DROP: Detecting Return-Oriented Programming Malicious Code

  • Authors:

  • Ping Chen;Hai Xiao;Xiaobin Shen;Xinchun Yin;Bing Mao;Li Xie

  • Affiliations:

  • State Key Laboratory for Novel Software Technology, Department of Computer Science and Technology, Nanjing University, Nanjing 210093;State Key Laboratory for Novel Software Technology, Department of Computer Science and Technology, Nanjing University, Nanjing 210093;College of Information Engineering, Yangzhou University, Yangzhou Jiangsu, China 225009;College of Information Engineering, Yangzhou University, Yangzhou Jiangsu, China 225009;State Key Laboratory for Novel Software Technology, Department of Computer Science and Technology, Nanjing University, Nanjing 210093;State Key Laboratory for Novel Software Technology, Department of Computer Science and Technology, Nanjing University, Nanjing 210093

  • Venue:
  • ICISS '09 Proceedings of the 5th International Conference on Information Systems Security
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Return-Oriented Programming (ROP) is a new technique that helps the attacker construct malicious code mounted on x86/SPARC executables without any function call at all. Such technique makes the ROP malicious code contain no instruction, which is different from existing attacks. Moreover, it hides the malicious code in benign code. Thus, it circumvents the approaches that prevent control flow diversion outside legitimate regions (such as W *** X ) and most malicious code scanning techniques (such as anti-virus scanners). However, ROP has its own intrinsic feature which is different from normal program design: (1) uses short instruction sequence ending in "ret", which is called gadget, and (2) executes the gadgets contiguously in specific memory space, such as standard GNU libc. Based on the features of the ROP malicious code, in this paper, we present a tool DROP, which is focused on dynamically detecting ROP malicious code. Preliminary experimental results show that DROP can efficiently detect ROP malicious code, and have no false positives and negatives.