Recent years have witnessed code reuse techniques being employed to craft entire programs such as Jekyll apps, malware droppers, and persistent data-only rootkits. The increased complexity observed in such payloads calls for specific techniques and tools that can help in their analysis. In this paper we propose novel ideas for static analysis of ROP code and apply them to study prominent payloads targeting the Windows platform. Unlike state-of-the-art approaches, we do not require the ROP activation context be reproduced for the analysis. We then propose a guessing mechanism to identify gadget sources for payloads found in documents or over the network.
Static analysis of ROP code / D'Elia, D. C.; Coppa, Emilio; Salvati, A.; Demetrescu, C.. - EuroSec '19 Proceedings of the 12th European Workshop on Systems Security, (2019), pp. 1-6. (EuroSys '19: Fourteenth EuroSys Conference 2019, Dresden, Germany, 25 Marzo 2019). [10.1145/3301417.3312494].
Static analysis of ROP code
Coppa E.;
2019
Abstract
Recent years have witnessed code reuse techniques being employed to craft entire programs such as Jekyll apps, malware droppers, and persistent data-only rootkits. The increased complexity observed in such payloads calls for specific techniques and tools that can help in their analysis. In this paper we propose novel ideas for static analysis of ROP code and apply them to study prominent payloads targeting the Windows platform. Unlike state-of-the-art approaches, we do not require the ROP activation context be reproduced for the analysis. We then propose a guessing mechanism to identify gadget sources for payloads found in documents or over the network.File | Dimensione | Formato | |
---|---|---|---|
DElia_Static-Analysis_2019.pdf
Solo gestori archivio
Tipologia:
Versione dell'editore
Licenza:
Tutti i diritti riservati
Dimensione
575.59 kB
Formato
Adobe PDF
|
575.59 kB | Adobe PDF | Visualizza/Apri |
Pubblicazioni consigliate
I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.