Return-Oriented Programming

摘要: We introduce return-oriented programming, a technique by which an attacker can induce arbitrary behavior in program whose control flow he has diverted, without injecting any code. A chains together short instruction sequences already present program’s address space, each of ends “return” instruction.Return-oriented programming defeats the W⊕X protections recently deployed Microsoft, Intel, and AMD; this context, it be seen as generalization traditional return-into-libc attacks. But threat is more general. Return-oriented readily exploitable on multiple architectures systems. It also bypasses entire category security measures---those that seek to prevent malicious computation preventing execution code.To demonstrate wide applicability we construct Turing-complete set building blocks called gadgets using standard C libraries two very different architectures: Linux/x86 Solaris/SPARC. To power high-level, general-purpose language for describing exploits compiler translates gadgets.