Jump oriented programming on windows platform (on the x86)

Authors:
Jae-Won Min;Sung-Min Jung;Dong-Young Lee;Tai-Myoung Chung
Affiliations:
Dept. of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea;Dept. of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea;Dept. of Information and Communication, Myong-ji College, Seoul, Korea;Dept. of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea
Venue:
ICCSA'12 Proceedings of the 12th international conference on Computational Science and Its Applications - Volume Part III
Year:
2012

Citing 7
Cited 0

StackGhost: Hardware facilitated stack protection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

Proceedings of the 14th ACM conference on Computer and communications security
Dynamic integrity measurement and attestation: towards defense against return-oriented programming attacks

Proceedings of the 2009 ACM workshop on Scalable trusted computing
DROP: Detecting Return-Oriented Programming Malicious Code

ICISS '09 Proceedings of the 5th International Conference on Information Systems Security
Return-oriented programming without returns

Proceedings of the 17th ACM conference on Computer and communications security
Jump-oriented programming: a new class of code-reuse attack

Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security
Mitigating code-reuse attacks with control-flow locking

Proceedings of the 27th Annual Computer Security Applications Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

Non-executable memory pages were deployed in operating systems in order to defend against code injection attacks. However, it was bypassed by reusing codes that already exist in the process memory which have the execute permission. The Return-Oriented Programming (ROP), of the most well-known code reuse attack, has been developed and widely used to exploit systems. ROP hijacks the control flow and returns to the middle of instruction sequences that end with a return instruction. These instruction sequences are called gadgets. Researchers proposed many ROP defense mechanisms which mostly relied on the fact that ROP executes many return instructions. Proposed defenses however, are not fundamental defenses. Researches found that the concept of ROP can be implemented in Linux using jump instructions instead of return instructions, therefore successfully bypassing ROP defenses. However, no research was done on implementing the attack on non-Linux systems. In this paper, we show the possibility of implementing JOP (Jump Oriented Programming) attack model on Windows platform by presenting example gadgets and propose an algorithm for searching JOP gadgets in Dynamic Link Libraries.