Recent years have witnessed code reuse techniques being employed to craft entire programs such as Jekyll apps, malware droppers, and persistent data-only rootkits. The increased complexity observed in such payloads calls for specific techniques and tools that can help in their analysis. In this paper we propose novel ideas for static analysis of ROP code and apply them to study prominent payloads targeting the Windows platform. Unlike state-of-the-art approaches, we do not require the ROP activation context be reproduced for the analysis. We then propose a guessing mechanism to identify gadget sources for payloads found in documents or over the network.

Static analysis of ROP code / D'Elia, D. C.; Coppa, Emilio; Salvati, A.; Demetrescu, C.. - EuroSec '19 Proceedings of the 12th European Workshop on Systems Security, (2019), pp. 1-6. (EuroSys '19: Fourteenth EuroSys Conference 2019, Dresden, Germany, 25 Marzo 2019). [10.1145/3301417.3312494].

Static analysis of ROP code

Coppa E.;
2019

Abstract

Recent years have witnessed code reuse techniques being employed to craft entire programs such as Jekyll apps, malware droppers, and persistent data-only rootkits. The increased complexity observed in such payloads calls for specific techniques and tools that can help in their analysis. In this paper we propose novel ideas for static analysis of ROP code and apply them to study prominent payloads targeting the Windows platform. Unlike state-of-the-art approaches, we do not require the ROP activation context be reproduced for the analysis. We then propose a guessing mechanism to identify gadget sources for payloads found in documents or over the network.
2019
9781450362740
Code reuse, Exploits, Return oriented programming, Static analysis
File in questo prodotto:
File Dimensione Formato  
DElia_Static-Analysis_2019.pdf

Solo gestori archivio

Tipologia: Versione dell'editore
Licenza: Tutti i diritti riservati
Dimensione 575.59 kB
Formato Adobe PDF
575.59 kB Adobe PDF   Visualizza/Apri
Pubblicazioni consigliate

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11385/236279
Citazioni
  • Scopus 8
  • ???jsp.display-item.citation.isi??? 5
  • OpenAlex ND
social impact