Universal Availability of ROP-Based Turing-Complete Computation
Author:
Affiliation:

Clc Number:

Fund Project:

National Natural Science Foundation of China (61772266, 61572248, 61431008, 61321491); National Key Technology R&D Program of China (2012BAK26B01)

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    Return-Oriented programming (ROP) is widely applied in modern software vulnerability exploitations.This work demonstrates that Turing-complete ROP code is universally available in everyday software.A big challenge for applying ROP is to construct the functionality of conditional jumps.Because conditional branch instructions are abandoned as they are deemed no use for achieving this functionality, existing works resort to some awkward methods which suffer from high risk of failure.By analyzing the execution context of conditional branch instructions, this study finds that the traditional viewpoint on these instructions only partially reveals the truth.In fact, there are some conditional branch instructions in which two branches each starts a reusable gadget, and these two gadgets fetch the next gadget from different memory cells.Hence, the code snippets beginning at these conditional instructions can implement the conditional jumps for ROP code.Such a code snippet is named if-gadget.Experimental results show that if-gadgets are widely available in executables of Linux and Windows platforms.Evaluations on programs of Binutils demonstrate that, Turing complete ROP code can be achieved with the help of if-gadgets while existing techniques even fail to gather Turing complete gadgets.On platforms such as Ubuntu, because the executables running on them do not support ASLR by default, attackers can construct Turing-complete ROP code on these executables and then mount an attack.Therefore, ROP-based attacks pose a great threat to modern platforms, which is far more serious than originally thought.

    Reference
    Related
    Cited by
Get Citation

袁平海,曾庆凯. ROP图灵完备的普遍可实现性.软件学报,2017,28(10):2583-2598

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:January 20,2017
  • Revised:June 07,2017
  • Adopted:
  • Online: September 30,2017
  • Published:
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063