Block Oriented Programming - Automating Data-Only A Ttacks

Block Oriented Programming: Automating Data-Only Attacks
Kyriakos K. Ispoglou Bader AlBassam

ispo@purdue.edu balbassa@purdue.edu
Purdue University Purdue University
Trent Jaeger Mathias Payer

tjaeger@cse.psu.edu mathias.payer@nebelwelt.net
Pennsylvania State University Purdue University
ABSTRACT
arXiv:1805.04767v1 [cs.CR] 12 May 2018
canaries (GS) [22] to stop stack-based buffer overflows, and Ad-

With the wide deployment of Control-Flow Integrity (CFI), control- dress Space Layout Randomization (ASLR) [48] to probabilistically
flow hijacking attacks, and consequently code reuse attacks, are make code reuse attacks harder. These mitigations can be bypassed
significantly harder. CFI limits control flow to well-known loca- through, e.g., information leaks [28, 38, 42, 51] or code reuse at-
tions, severely restricting arbitrary code execution. Assessing the tacks [13, 37, 56, 57, 66].
remaining attack surface of an application under advanced control- Advanced control-flow hijacking defenses such as Control-Flow
flow hijack defenses such as CFI and shadow stacks remains an Integrity (CFI) [11, 14, 41, 61] or shadow stacks/safe stacks [40] limit
open problem. the set of allowed target addresses for indirect control-flow trans-
We introduce BOPC, a mechanism to assess whether an attacker fers. CFI mechanisms typically rely on static analysis to recover
can execute arbitrary code on a CFI/shadow stack hardened binary the Control-Flow Graph (CFG) of the application. These analyses
automatically. BOPC leverages SPL, a Turing-complete high-level over-approximate the allowed targets for each indirect dispatch
language that abstracts away architecture and program-specific location. At runtime, CFI checks determine if the observed target
details, such as register mappings, to express exploit payloads. SPL for each indirect dispatch location is within the allowed target set
payloads are compiled into a program trace that executes the de- for that dispatch location as identified by the CFG analysis. Mod-
sired behavior on top of the target binary. The input for BOPC is ern CFI mechanisms [41, 44, 45, 61] are deployed in, e.g., Google
an SPL payload, a starting point (e.g., from a fuzzer crash), and an Chrome [60] or Microsoft Windows 10 and Edge [59].
arbitrary read/write primitive that allows application state corrup- However, CFI still allows the attacker control over the execu-
tion. To map SPL payloads to a program trace, BOPC introduces tion along two dimensions: first, the imprecision in the analysis
Block Oriented Programming (BOP), a new code reuse technique that enables the attacker to choose any of the targets in the set for each
utilizes entire basic blocks as gadgets along valid execution paths dispatch; second, data-only attacks allow an attacker to influence
in the program, i.e., without violating CFI policies. We find that conditional branches arbitrarily. Existing attacks against CFI lever-
the problem of mapping payloads to program traces is NP-hard, so age manual analysis to construct exploits for specific applications
BOPC first reduces the search space by pruning infeasible paths and along these two dimensions [16, 24, 29, 31, 53]. With CFI, exploits
then uses heuristics to guide the search to probable paths. BOPC become highly program dependent as the set of gadgets is severely
encodes the BOP payload as a set of memory writes. limited (due to the restrictions for indirect control-flow), exploits
We execute 13 SPL payloads applied to 10 popular applications. must therefore follow valid paths in the CFG. Finding a path along
BOPC successfully finds payloads and complex execution traces – the CFG and satisfying its constraints is much more complex than
which would likely not have been found through manual analysis simply finding the locations of gadgets. Finding attacks against ad-
– while following the target’s Control-Flow Graph under an strict vanced control-flow hijacking defenses is therefore predominantly
CFI policy in 81% of the cases. a challenging manual process.
We present BOPC, an automatic framework to evaluate a pro-
ACM Reference format: gram’s remaining attack surface under strong control-flow hijack-
Kyriakos K. Ispoglou, Bader AlBassam, Trent Jaeger, and Mathias Payer. ing mitigations. BOPC automates the task of finding an execution
2018. Block Oriented Programming: Automating Data-Only Attacks. In
trace through a buggy program that executes arbitrary, attacker-
Proceedings of Technical Report, West Lafayette, USA, 9 May 2018, 16 pages.
DOI: 10.1145/nnnnnnn.nnnnnnn
specified behavior. BOPC compiles an “exploit” into a program
trace, executing on top of the original program’s Control-Flow
Graph (CFG). To flexibly express exploit payloads, BOPC leverages
1 INTRODUCTION a Turing-complete, high-level language: SPloit Language (SPL). To
interact with the environment, SPL provides a rich API to call OS
Control-flow hijacking and code reuse has been a challenging prob- functions, direct access to memory, and an abstraction for hardware
lem for applications written in C/C++ despite the development registers that allows a flexible mapping. BOPC takes as input an
and deployment of several defenses. Basic mitigations include SPL payload and a starting point (e.g., found through fuzzing or
Data Execution Prevention (DEP) [63] to stop code injection, stack manual analysis) and returns a trace through the program (encoded
as a set of memory writes) that encodes the SPL payload.
Technical Report, West Lafayette, USA The core component of BOPC is the mapping process through
2018. 978-x-xxxx-xxxx-x/YY/MM. . . $15.00
DOI: 10.1145/nnnnnnn.nnnnnnn a novel code reuse technique we call Block Oriented Programming
1
Block Oriented Programming: Automating Data-Only Attacks Kyriakos Ispoglou, Bader AlBassam, Trent Jaeger, Mathias Payer
(BOP). First, BOPC translates the SPL payload into constraints for number of code reuse variations followed [13, 19, 32], extending the
individual statements and, for each statement, searches for basic approach from return instructions to arbitrary indirect control-flow
blocks in the target binary that satisfy these constraints (called transfers.
candidate blocks). SPL keeps register assignments abstract from the Several tools [30, 46, 52, 54] seek to automate ROP payload gen-
underlying architecture. Second, BOPC infers a resource (register eration. However, the automation suffers from inherent limita-
and state) mapping for each SPL statement, iterating through the tions. Those tools fail to find gadgets in the target binary that do
set of candidate blocks and turning them into “functional blocks”. not follow the expected form “inst1; inst2; ... retn;”.
Functional blocks can be used to execute a concrete instantiation These tools search for a set of hard coded gadgets that form pre-
of the given SPL statement. Third, BOPC constructs a trace that determined gadget chains. Instead of abstracting the required com-
connects each functional block through dispatcher blocks. Since putation, the tools search for specific gadgets. If any gadget is not
the mapping process is NP-hard, to find a solution in reasonable found or if a more complex gadget chain is needed, these tools
time BOPC first prunes the set of functional blocks per statement degenerate to gadget dump tools, leaving the process of gadget
to constrain the search space and then uses a ranking based on chaining to the researcher who manually creates exploits from
the proximity of individual function blocks as a heuristic when discovered gadgets.
searching for dispatcher gadgets. The invention of code reuse attacks resulted in a plethora of new
We evaluate BOPC on 10 popular network daemons and setuid detection mechanisms based on execution anomalies and heuris-
programs, demonstrating that BOPC can generate traces from a set tics [20, 25, 35, 47, 50] such as frequency of return instructions.
of 13 test payloads. Our test payloads are both reasonable exploit Such heuristics can often be bypassed [17].
payloads (e.g., calling execve with attacker-controlled parame- While the aforementioned tools help to craft appropriate pay-
ters) as well as a demonstration of the computational capabilities of loads, finding the vulnerability is an orthogonal process. Automatic
SPL (e.g., loops, or conditionals). Applications of BOPC go beyond Exploit Generation (AEG) [12] was the first attempt to automati-
an attack framework. We envision BOPC as a tool for defenders cally find vulnerabilities and generate exploits for them. AEG is
and software developers to highlight the residual attack surface limited in that it does not assume any defenses (such as the now ba-
of a program. For example, a developer can test whether a bug at sic DEP or ASLR mitigations). The generated exploits are therefore
particular statement enables a practical code reuse attack in their buffer overflows followed by static shellcode.
program to focus further bug detection. Overall, we present the
following contributions:
2.1 Control Flow Integrity
• Abstraction: We introduce SPL, a C dialect that provides
Control Flow Integrity [11, 14, 41, 61] (CFI) prevents control flow
access to virtual registers and a rich API to call OS and
hijacking to arbitrary locations (and therefore code reuse attacks).
other library functions, suitable for writing exploit pay-
CFI restricts the set of potential targets that are reachable from
loads. SPL enables the necessary abstraction to scale to
an indirect branch. While CFI does not stop the initial memory
large applications.
corruption, it validates the code pointer before it is used. CFI infers
• Search: Development of a trace module that allows execu-
a CFG of the program to determine the allowed targets for each
tion of an arbitrary payload, written in SPL, using code
indirect control flow transfer. Before each indirect branch, the
of the target binary. The trace module considers strong
target address is checked to determine if it is a valid edge in the
defenses such as DEP, ASLR, shadow stack, and CFI alone
CFG, and if not an exception is thrown. This limits the freedom for
or in combination. The trace module enables the discovery
the attacker, as she can only target a small set of targets instead
of viable mappings through a search process.
of any executable byte in memory. For example, an attacker may
• Evaluation: Evaluation of our prototype demonstrates the
overwrite a function pointer through a buffer overflow, but the
generality of our mechanism and uncovers exploitable vul-
function pointer is checked before it is used. Note that CFI targets
nerabilities where manual exploitation may have been in-
the forward edge, i.e., virtual dispatch for C++ or indirect function
feasible. For 10 target programs, BOPC successfully gen-
calls for C. CFI is deployed in modern browsers (Google Chrome
erates exploit payloads and program traces to implement
and Microsoft Edge) due to its success in preventing control-flow
code reuse attacks for 13 SPL exploit payloads for 81% of
hijacking.
the cases.
With CFI, code reuse attacks become harder, but not impossi-
ble [16, 29, 31, 53]. Depending on the application and strength of
2 BACKGROUND AND RELATED WORK the CFI mechanism, CFI can be bypassed with Turing-complete
Initially, exploits relied on simple code injection to execute arbitrary payloads, which are often of high complexity to ensure compliance
code. The deployment of Data Execution Prevention (DEP) [63] with the CFG. So far, these code-reuse attacks rely on manually
mitigated code injection and attacks moved to reusing existing code. constructed payloads.
The first code reuse technique, return to libc [26], simply reused Deployed CFI implementations [41, 44, 45, 49, 61] use a static
existing libc functions. Return Oriented Programming (ROP) [56] over-approximation of the CFG – based on method prototypes and
extended code reuse to a Turing-complete technique. ROP locates class hierarchy. PittyPat [27] and PathArmor [64] introduce path
small sequences of code which end with a return instruction, called sensitivity that evaluates partial execution paths. Newton [65] in-
“gadgets”. Gadgets are connected by injecting the correct state, troduced a framework that reasons about the strength of defenses,
e.g., by preparing a set of invocation frames on the stack [56]. A including CFI. Newton exposes indirect pointers (along with their
2
allowed target set) that are reachable (i.e., controllable by an ad- ARPs have been completed. This can be an attacker-controlled code
versary) through given entry points. While Newton displays all pointer where the control flow is hijacked. Determining an entry
usable “gadgets”, it cannot stitch them together and effectively is a point is considered to be part of the vulnerability discovery process.
CFI-aware ROP gadget search tool that helps an analyst to manually Thus, finding this entry point is orthogonal to our work.
construct an attack. Note that these assumptions are in line with the threat model of
control-flow hijack mitigations that aim to prevent attackers from
2.2 Shadow Stacks exploiting arbitrary read and write capabilities. These assumptions
While CFI protects forward edges in the CFG (i.e., function pointers are also practical. Orthogonal bug finding tools such as fuzzing
or virtual dispatch), a shadow stack orthogonally protects backward often discover arbitrary memory accesses that can be abstracted
edges (i.e., return addresses) [23]. Shadow stacks keep a protected to the required arbitrary read and writes with an entry point right
copy (called shadow) of all return addresses on a separate, protected after the AWP. Furthermore, these assumptions map to real bugs.
stack. Function calls store the return address both on the regular Web servers, such as nginx, spawn threads to handle requests and a
stack and on the shadow stack. When returning from a function, bug in the request handler can be used to read or write an arbitrary
the mitigation checks for equivalence and reports an error if the memory address. Due to the request-based nature, the adversary
two return addresses do not match. The shadow stack itself is can repeat this process multiple times. After the completion of the
assumed to be at a protected memory location to keep the adversary state injection, the program follows an alternate and disjoint path
from tampering with it. Shadow stacks enforce stack integrity and to trigger the injected payload.
protect from any control-flow hijack attack against the backward These assumptions enable BOPC to inject the payload into the
edge. program, modifying its execution state and starting the payload
execution from the given entry point. BOPC assumes that the AWP
and ARP may be triggered multiple times to modify the execution
2.3 Data-only Attacks
state of the target binary. After the state modification completes, the
While CFI mitigates most code reuse attacks, CFI cannot stop data- SPL payload executes without further changes in execution state.
only attacks. Manipulating a program’s data can be enough for a This separates SPL execution into two phases: state modification
successful exploitation. Data-only attacks target the program’s data and execution. The AWP/ARP allow state modification, BOPC infers
rather than the execution flow. E.g., having full control over the the required state change to execute the SPL payload.
arguments to execve() suffices for arbitrary command execution.
Also, data in a program may be sensitive: consider overwriting
4 DESIGN
the uid or a variable like is admin. Data-only attacks were
generalized and defined formally as Data Oriented Programming Figure 1 shows how BOPC automates the analyst tasks necessary
(DOP) [34]. Existing DOP attacks rely on an analyst to identify to leverage AWPs and/or ARPs to produce a useful exploit in the
sensitive variables for manual construction. presence of strong defenses, including CFI. First, BOPC provides an
Similarly to CFI, it is possible to build the Data Flow Graph of the exploit programming language, called SPloit Language (SPL), that
program and apply Data Flow Integrity (DFI) [18] to it. However, to enables analysts to define exploits independent of the target pro-
the best of our knowledge, there are no practical DFI-based defenses gram or underlying architecture. Second, to automate how analysts
due to prohibitively high overhead of data-flow tracking. find gadgets that implement SPL statements that comply with CFI,
In comparison to existing data-only attacks, BOPC automatically BOPC finds basic blocks from the target program that implement
generates payloads based on a high-level programming language. individual SPL statements, called functional blocks. Third, to enable
The payloads follow the valid CFG of the program but not its Data analysts to chain basic blocks together in a manner that complies
Flow Graph. with CFI and shadow stacks, BOPC searches the target program
for sequences of basic blocks that connect pairs of neighboring
3 ASSUMPTIONS AND THREAT MODEL functional blocks, which we call dispatcher blocks. Fourth, BOPC
simulates the BOP chain to produce a payload that implements that
Our threat model consists of a binary with a known memory cor- SPL payload from a chosen AWP.
ruption vulnerability that is protected with the state-of-the-art The BOPC design builds on two key ideas: Block Oriented Pro-
control-flow hijack mitigations, such as Control Flow Integrity gramming and Block Constraint Summaries. First, defenses such as
(CFI) along with a Shadow Stack. Furthermore, the binary is also CFI, impose stringent restrictions on transitions between gadgets,
hardened with Data Execution Prevention (DEP), Address Space so we no longer have the flexibility of setting the instruction pointer
Layout Randomization (ASLR) and Stack Canaries (GS).
We assume that the target binary has an arbitrary memory write
vulnerability. That is, the attacker can write any value to any (2) Selecting
(writable) address. We call this an Arbitrary memory Write Primitive (1) SPL Payload
functional blocks
(AWP). To bypass probabilistic defenses such as ASLR, we assume
that the attacker has access to an information leak, i.e., a vulnera- (4) Stitching (3) Searching for
bility that allows her to read any value from any memory address. BOP gadgets dispatcher blocks
We call this an Arbitrary memory Read Primitive (ARP).
We also assume that there exists an entry point, i.e., a location
that the program reaches naturally and occurs after all AWPs and Figure 1: Overview of BOPC’s design.
3
Functional CFG for any chain of blocks, which motivates the need for tooling
Dispatcher support.
BOP
Gadget 4.1 Expressing Payloads
To start a search for exploits, analysts must identify what constitutes
a useful exploit. In the past, analysts likely have had a small number
of exploit types in mind to guide manual search from gadgets,
but the specific nature of the exploit depends on the low-level
details of the target program and processor architecture. Thus,
writing exploits has little benefit since they will differ depending
Figure 2: BOP gadget structure. The functional part consists on the gadgets available in the target program. Previous automated
of a single basic block that executes an SPL statement. Two approaches for exploit generation were designed with a specific
functional blocks are chained together through a series of type of exploit in mind, so they built the exploit specifications into
dispatcher blocks, without clobbering the execution of the their tools procedurally.
previous functional blocks. When searching for exploits against strong defenses automat-
ically, such ad hoc approaches will not suffice. Knowledge of the
gadgets necessary to perform an exploit cannot be built into the
to arbitrary values. Instead, BOPC implements Block Oriented Pro- exploit generation program because the way each exploit will be im-
gramming (BOP), which constructs exploit programs called BOP plemented by blocks and the way that such blocks may be chained
chains from basic block sequences in the valid CFG of a target pro- together varies from target program to target program. In addition,
gram. Note that our CFG encodes both forward edges (protected we want to enable analysts to generate exploit payloads for target
by CFI) and backward edges (protected through a shadow stack). programs built for different processor architectures without them
For BOP, gadgets are no longer arbitrary sequences of instructions having to be an expert in that processor architecture.
ending in an indirect control-flow transfer, but chains of entire To address this problem, BOPC provides a programming lan-
basic blocks (sequences of instructions that end with a direct or guage, called SPloit Language (SPL) that allows analysts to express
indirect control-flow transfer), as shown in Figure 2. A BOP chain exploit payloads in a compact high-level language that is indepen-
consists of a sequence of BOP gadgets where each BOP gadget is: dent of target programs or processor architectures. SPL is a dialect
one functional block that implements a statement in an SPL payload of C. Table 1 shows some sample payloads. Overall, SPL has the
and zero or more dispatcher blocks that connect the functional block following features:
to the next BOP gadget in a manner that complies with the CFG.
Second, BOPC abstracts each basic block from individual in- • It is Turing-complete;
structions operating on specific registers into Block Constraint Sum- • It is architecture independent;
maries, enabling blocks to be employed in a variety of different • It is close to a well known, high level language.
ways. That is, a single block may perform multiple functional
and/or dispatching operations by utilizing different sets of registers
for different operations, As an example, a basic block that modifies Compared to existing exploit development tools [30, 46, 52, 54],
register rdx unintentionally, is clobbering if rdx is part of the reg- the architecture independence of SPL has important advantages.
ister mapping, or a dispatcher block if it is not. In addition, BOPC First, the same payload can be executed under different ISAs or op-
leverages abstract block constraint summaries to apply blocks in erating systems. Second, SPL uses a set of virtual registers, accessed
multiple contexts. At each stage in the development of a BOP chain, through reserved volatile variables. Virtual registers increase flex-
the blocks that may be employed next in the CFG as dispatcher ibility, which in turn increases the chances of finding a solution.
blocks to connect two functional blocks depend on the block sum- That is, when payload uses a virtual register, any general purpose
mary constraints for each block. There are two cases: either the register (16 for x86-64) may be used.
candidate dispatcher block’s summary constraints indicate that it To interact with the environment, SPL defines a concise API
will modify the register state set by the functional blocks, called to access OS functionality. Finally, SPL supports conditional and
the SPL state, or it will not, enabling the computation to proceed unconditional jumps to enable control-flow transfers to arbitrary
without disturbing the effects of the functional blocks. A block locations. This feature makes SPL a Turing-complete language,
that modifies a current SPL state is said to be a clobbering block proven in Appendix C. The complete language specifications are
for that state. Block summary constraints enable identification of shown in Appendix A in Extended Backus–Naur form (EBNF).
clobbering blocks at each point in the search. The environment for SPL differs from that of conventional lan-
An important distinction between BOP and conventional ROP guages. Instead of running code directly on a CPU, our compiler
(and variants) is that the problem of computing BOP chains is NP- encodes the payload as a mapping of instructions to functional
hard, as proven in Appendix B. Conventional ROP assumes that blocks. That is, the underlying runtime environment is the target
indirect control-flows may target any executable byte (or a subset binary and its program state, where payloads are executed as side
thereof) in memory while BOP must follow a legal path through the effects of the underlying binary.
4
Simple loop Spawn a shell

void payload() { void payload() {
__r0 = 0; string prog = "/bin/sh\0";
int64 *argv = {&prog, 0x0};
LOOP:
__r0 += 1; __r0 = &prog;
if (__r0 != 128) __r1 = &argv;
goto LOOP; __r2 = 0;
(a) (b) (c)
returnto 0x446730; execve(__r0, __r1, __r2);
} }
Table 1: Examples of SPL payloads. Figure 3: Visualisation of BOP gadget volatility, rectangles:
SPL statements, dots: functional blocks (a). Connecting
any two statements through dispatcher blocks constrains re-
4.2 Selecting functional blocks maining gadgets (b), (c).
To generate a BOP chain for an SPL payload, BOPC must find a
sequence of blocks that implement each statement in the SPL pay- every possible control flow transfer in the SPL payload, is NP-
load, which we call functional blocks. The process of building BOP hard (as we prove in Appendix B), and we are not aware of an
chains starts by identifying functional blocks per SPL statement. approximative algorithm.
Conceptually, BOPC must compare each block to each SPL state- As the problem is not solvable in polynomial time, we propose
ment to determine if the block can implement the statement. How- several heuristics and optimizations to find solutions in reasonable
ever, blocks are in terms of machine code and SPL statements are amounts of time. BOPC leverages basic block proximity as a metric
high-level program statements. To provide flexibility for matching to “rank” dispatcher paths and organizes this information into a
blocks to SPL statements, BOPC computes block constraint sum- special data structure, called a delta graph that provides an efficient
maries, which define the possible impacts that the block would way to probe potential sequences of functional blocks.
have on SPL state. Block constraint summaries provide flexibility
in matching blocks to SPL statements because there are multiple 4.4 Searching for dispatcher blocks
possible mappings of SPL statements and their virtual registers to
While each functional block executes a statement, BOPC must
the block and its constraints on registers and state.
chain multiple functional blocks together to execute the SPL pay-
The constraint summaries of each basic block is obtained by
load. Functional blocks are connected through zero to L blocks
isolating and symbolically executing it. The effect of symbolically
that may not clobber the SPL state computed thusfar. Finding such
executing a basic block creates a set of constraints, mapping input
non-clobbering blocks that transfer control from one functional
to the resultant output. Such constraints may refer to registers,
statement to another is challenging as each additional block in-
memory locations, and external operations (e.g., library calls).
creases the constrains and path dependencies. We propose a graph
To find a match between a block and an SPL statement the block
data structure, the delta graph to represent the state of the search
must perform all the operations required for that SPL statement.
for dispatcher blocks. The delta graph stores, for each functional
More specifically, the constraints of the basic block must be a su-
block for each SPL, statement the shortest path to the next candi-
perset of the operations required to implement the SPL statement.
date block. Stitching arbitrary sequences of statements is NP-hard
as each selected path between two functional statements influences
4.3 Finding BOP gadgets the availability of further candidate blocks or paths, we therefore
BOPC computes a set of all potential functional blocks for each leverage the delta graph to try likely candidates first.
SPL statement or halts if any statement has no blocks. To stitch The intuition behind the proximity of functional blocks is that
functional blocks, BOPC must select one functional block and a shorter paths result in simpler and satisfiable constraints. Although
sequence of dispatcher blocks that reach the next functional block this metric is a heuristic (see Table 2 for a counter example), our
in the payload. The combination of a functional block and its dis- evaluation (Section 6) shows that it works well in practice.
patcher blocks is called a BOP gadget, as shown in Figure 2. To The delta graph enables quick elimination of sets of functional
build a BOP chain, BOPC must select exactly one functional block blocks that are highly unlikely to have dispatcher blocks and thus
from each set and find the appropriate dispatcher blocks to connect constitute a BOP gadget. For instance, if there is no valid path in the
all functional blocks together. CFG between two functional blocks (e.g., if execution has to traverse
However, dispatcher paths between two functional blocks may the CFG “backwards”), no dispatcher will exist and therefore, these
not exist. Either because there is no legal path in the CFG between two functional blocks cannot be part of the solution.
them, or the execution flow cannot naturally reach the next block The delta graph, is a multi-partite, directed graph which has a
due to un-satisfiable runtime constraints. This constraint imposes set of functional block nodes for every payload statement. An edge
limits on functional block selection, as the existence of a dispatcher between two functional blocks represents the minimum number
path depends on the previous BOP gadgets. of executed basic blocks to move from one functional block to
BOP gadgets are volatile: gadget feasibility changes based on the the other, while avoiding clobbering blocks. See Figure 7 for an
execution state (i.e., context) of the target binary. This concept is example.
illustrated in Figure 3. The problem of selecting a suitable sequence Indirect control-flow transfers pose an interesting challenge
of functional blocks, such that a dispatcher path exists between when calculating the shortest path between two basic blocks in
5
Function 1: most likely to give a solution, so the next step is to find the exact
<instructions> dispatcher blocks and create the BOP gadgets for the SPL payload.
...
call Function_2 Function 2:
4
<insn_after_call> <prologue> 4.5 Stitching BOP gadgets
... ... The minimum induced subgraph from the previous step determines
B:
<instructions> <instructions>
a set of functional blocks that may be stitched together into an SPL
A: 2 3 payload. This set of functional blocks is close to each other, making
<nop_sled> ... satisfiable dispatcher paths more likely.
call Function_2 retn To find a dispatcher path between two functional blocks, BOPC
1 <insn_after_call>
leverages concolic execution [55] (symbolic execution along a given
retn
path). Along the way, it collects the required constraints that are
needed to lead the execution to the next functional block. Sym-
Figure 4: Existing shortest path algorithms are unfit to mea-
bolic execution engines [15, 58] translate basic blocks into sets of
sure proximity in the CFG. Consider the shortest path from
constraints and use Satisfiability Modulo Theories (SMT) to find
A to B. A context-unaware shortest path algorithm will mark
satisfying assignments for these constraints; symbolic execution is
the red path as solution, instead of following the blue arrow
therefore NP-complete. Starting from the (context sensitive) short-
upon return from Function 2, it follows the red arrow (3).
est path between the functional blocks, BOPC guides the symbolic
execution engine, collecting the corresponding constraints.
Long path with simple constraints Short path with complex constraints To construct an SPL payload from a BOP chain, BOPC launches
a = input(); concolic execution from the first functional block in the BOP chain,
a, b, c, d, e = input();
// point A
X = sqrt(a); starting with an empty state. At each step BOPC tries the first K
if (a == 1) {
if (b == 2) {
Y = log(a*a*a - a) shortest dispatcher paths until it finds one that reaches the next
if (c == 3) { functional block (the edges in the minimum induced subgraph in-
// point A
if (d == 4) { dicate which is the “next” functional block). The corresponding
if (X == Y) {
if (e == 5) {
// point B constraints are added to the current state. The search therefore
// point B
...
... incrementally adds BOP gadgets to the execution state. When a
Table 2: A counterexample that demonstrates why proxim- functional block represents a conditional SPL statement, its node
ity between two functional blocks can be inaccurate. Left, in the induced subgraph contains two outgoing edges (i.e., the exe-
we can move from point A to point B even if they are 5 blocks cution can transfer control to two different statements). However
apart from each other. Right, it is much harder to satisfy the during the concolic execution, the algorithm does not know which
constrains and to move from A to B, despite the fact that A one will be followed, it clones the current state and independently
and B are only 1 block apart. follows both branches, exactly like symbolic execution [15].
Reaching the last functional block, BOPC checks whether the
constraints have a satisfying assignment and forms an exploit pay-
a CFG: while they statically allow multiple targets, at runtime
load. Otherwise, it falls back and tries the next possible set of
they are context sensitive and only have one concrete target. Our
functional blocks. To repeat that execution on top of the target
context sensitive shortest path algorithm is a recursive version
binary, these constraints are concretized and translated into a mem-
of Dijkstra’s [21] shortest path algorithm. We start with regular
ory layout that will be initialized through AWP in the target binary.
shortest path, assuming that every edge on the CFG has cost 1. Each
time we encounter a basic block that ends with a call instruction,
we recursively run a new shortest path algorithm, starting from the
5 IMPLEMENTATION
calling function. If the destination basic block is inside the caller Our open source prototype, BOPC, is implemented in Python and
function, then the shortest path is the addition of the two individual consists of approximately 14,000 lines of code. BOPC requires three
shortest paths (from the beginning to the function’s entry point and distinct inputs:
from there to the target block). Otherwise, we calculate the shortest • The exploit payload expressed in SPL,
path from the function’s entry point to the closest return and use • The vulnerable application on top of which the SPL payload
this value as an edge weight to the callee. Our algorithm uses a call runs,
stack to keep track of all visited functions to avoid infinite loops in • The entry point in the vulnerable application, which is a
case of recursive functions. Finally, our algorithm avoids any basic location that program reaches naturally and occurs after
block that are marked as clobbering. all memory writes have been completed.
After creation of the delta graph, our algorithm selects exactly The output of BOPC is a sequence of (address, value, size) tu-
one node (i.e., functional block) from each set (i.e., payload state- ples that describe how the memory should be modified during the
ment), to minimize the total weight of the resulting induced sub- state modification phase (Section 3) to execute the payload. Op-
graph 1 . This selection of functional blocks is considered to be the tionally, it may also require some additional (stream, value, size)
1 The
tuples that describe what input should be given on any potentially
induced subgraph of the delta graph is a subgraph of the delta graph with one
node (functional block) for each SPL statement and with edges that represent their open “streams” (file descriptors, sockets, stdin) that the attacker
shortest available dispatcher block chain. controls during the execution of the payload.
6
L P N K
Binary Binary CFG A RG FB

Frontend (addr, value)
Find VG Find Build δG Min. Hk Cw
Candidate Functional Delta Induced Simulation Output (addr, value)
Blocks CB Blocks M Ad j Graph Subgraphs ...
SPL SPL IR
(addr, value)
payload Frontend
Figure 5: High level overview of the BOPC implementation. The red arrows indicate the iterative process upon failure. CFG A :
CFG with basic block abstractions added, IR: Compiled SPL payload RG : Register mapping graph, VG : All variable mapping
graphs, C B : Set of candidate blocks, F B : Set of functional blocks, M Ad j : Adjacency matrix of SPL payload, δG: Delta graph,
Hk : Induced subgraph, Cw : Constraint set. L: Maximum length of continuous dispatcher blocks. P: Upper bound on payload
“shuffles”, N : Upper bound on minimum induced subgraphs, K: Upper bound on shortest paths for dispathers,
A high level overview of BOPC is shown in Figure 5. Our algo- possible ways to map the individual elements from the SPL envi-
rithm is iterative; that is, in case of a failure, the red arrows, indicate ronment to the ABI (though candidate blocks) and then iteratively
which module is executed next. selecting valid subsets from the ABI to “simulate” the environment
of the SPL payload.
Once the CFG A and the IR are generated, BOPC searches for
5.1 Binary Frontend and marks candidate basic blocks, as described in Section 4.2. For a
The Binary Frontend, lifts the target binary into an intermediate block to be candidate, it must “semantically match” with one (or
representation that exposes the application’s CFG. Operating di- more) payload statements. Table 3 shows the matching rules. Note
rectly on basic blocks is cumbersome and heavily dependent on that variable assignments, unconditional jumps, and returns do not
the Application Binary Interface (ABI). Instead, we translate each require a basic block and therefore are excluded from the search.
basic block into a block constraint summary. Abstraction leverages All statements that assign or modify registers require the ba-
symbolic execution [39] to “summarize” the basic block into a set sic block to apply the same operation on undetermined hardware
of constraints encoding changes in registers and memory, and any registers. For function calls, the requirement for the basic block is
potential system, library call, or conditional jump at the end of the to invoke the same call, either as a system call or as a library call.
block – generally any effect that this block has on the program’s Note that the calling convention exposes the register mapping.
state. BOPC executes each basic block in an isolated environment, Upon a successful matching, BOPC builds the following data
where every action (such as accesses to registers or memory) is structures:
monitored. Therefore, instead of working with the instructions of
each basic block, BOPC utilizes its abstraction for all operations. • RG , the Register Mapping Graph which is a bipartite undi-
The abstraction information for every basic block is added to the rected graph. The nodes in the two sets represent the
CFG, resulting in CFG A . virtual and hardware registers respectively. The edges rep-
resent potential associations between virtual and hardware
registers.
5.2 SPL Frontend • VG , the Variable Mapping Graph, which is very similar to
The SPL Frontend translates the exploit payload into a graph-based RG , but instead associates payload variables to underlying
Intermediate Representation (IR) for further processing. To increase memory addresses. VG is unique for every edge in RG i.e.:
the flexibility of the mapping process, statements in a sequence may
be executed out-of-order. For each statement sequence we build αγ
a dependence graph based on a customized version of Kahn’s [36] ∀( r α , reдγ ) ∈ RG ∃! VG (1)
topological sorting algorithm, to infer all groups of independent
statements. Independent statements in a subsequence are then • D M , the Memory Dereference Set, which has all memory
turned into a set of statements which can be executed out-of-order. addresses, that are dereferenced and their values are loaded
This results in a set of equivalent payloads that are essentially into registers. Those addresses can be symbolic expressions
permutations of the original. Our goal is to find a solution for any (e.g., [rbx + rdx*8]), and therefore we do not know
of them. the concrete address they point to, until execution reaches
them.
5.3 Locating candidate block sets After this step, each SPL statement has a list of candidate blocks.
SPL is an high level language that hides the underlying ABI. There- Note that a basic block can be candidate for multiple statements.
fore, BOPC looks for potential ways to “map” the SPL environment If for some statement there are no candidate blocks, the algorithm
to the underlying ABI. The key insight in this step, is to find all halts and reports that the program cannot be synthesized.
7
Statement Form Abstraction Actions Example

reдγ ← C – movzx rax, 7h
rα = C
reдγ ← ∗A D M ∪ {A} mov rax, ds:fd
Register Assignment
RG ∪ ( r α , reдγ )

reдγ ← C, C ∈ R ∧W αγ – lea rcx, [rsp+20h]
r α = &V VG ∪ (V , A)

reдγ ← ∗A D M ∪ {A} mov rdx, [rsi+18h]
rα = C reдγ ← reдγ C RG ∪ ( r α , reдγ )

Register Modification dec rsi
Memory Read rα = ∗ r β reдγ ← ∗reдδ mov rax, [rbx]
RG ∪ ( r α , reдγ ), ( r β , reдδ )

Memory Write ∗ rα = r β ∗reдγ ← reдδ mov [rax], [rbx]
call( r α , r β , ...) Ijk Call to call RG ∩ ( r α , %rdi), ( r β , %rsi), ...

Call call execve
i f ( r α = C) Ijk Boring ∧ test rax, rax
RG ∪ ( r α , reдγ )

Conditional Jump
дoto LOC condition = reдγ C jnz LOOP
Table 3: Semantic matching of SPL statements to basic blocks. Abstraction indicates the requirements that the basic block
abstraction needs to have to match the SPL statement in the Form. Upon a match, the appropriate Actions are taken. r α ,
r β : Virtual registers, reдγ , reдδ : Hardware registers, C: Constant value, V : SPL variable, A: Memory address, RG : Register
mapping graph, VG : Variable mapping graph, D M : Dereferenced Addresses Set, Ijk Call: A call to an address, Ijk Boring:
A normal jump to an address.
5.4 Identifying functional block sets and so on. As an exponential number of subgraphs may exist, this
After determining the set of candidate blocks, C B , BOPC iteratively step limits the search to the N minimum.
identifies, for each SPL statement, which candidate blocks can serve If the resulting delta graph does not lead to a solution, this
as functional blocks, i.e., the blocks that perform the operations. step “shuffles” out-of-order payload statements, see Section 5.2,
This step determines for each candidate block if there is a resource and builds a new delta graph. Note that the number of different
mapping that satisfies the block’s constraints. permutations may be exponential. Therefore, our algorithm sets an
BOPC identifies the concrete set of hardware registers and mem- upper bound P on the number of tried permutations.
ory addresses that execute the desired statement. A successful Each permutation results in a different yet semantically equiv-
mapping identifies candidate blocks that serve as functional blocks. alent SPL payload, so the CFG of the payload (i.e., the Adjacency
To find the hardware-to-virtual register association, BOPC searches Matrix, M Ad j needs to be recalculated.
for a maximum bipartite matching [21] in RG . If such a mapping
does not exists, the algorithm halts. The selected edges indicate
the set of VG graphs that are used to find the variable-to-address 5.6 Discovering dispatcher blocks
association (see Section 5.3, there can be a VG for every edge in The simulation phase takes the individual functional blocks (con-
RG ). Then for every VG the algorithm repeats the same process to tained in the minimum induced subgraph Hk ) and tries to find
find another maximum bipartite matching. the appropriate dispatcher blocks, to compose the BOP gadgets. It
This step determines, for each statement, which concrete regis- returns a set of memory assignments for the corresponding dis-
ters and memory addresses are reserved. Merging this information patcher blocks, or an error indicating un-satisfiable constraints for
with the set of candidate blocks removes clobbering blocks, i.e., any the dispatchers.
candidate blocks that are unsatisfiable. BOPC is called to find a dispatcher path for every edge in the
However, the previous mapping may not be unique (there may be minimum induced subgraph. That is, we need to simulate every
other sets of functional blocks). If the current mapping does not lead control flow transfer in the adjacency matrix, M Ad j of the SPL
to a solution, the algorithm revisits an alternate mapping iteratively. payload. However, dispatchers are built on the execution state, so
The algorithm enumerates all maximum bipartite matchings [62], BOP gadgets must be stitched with the respect to the execution
trying them one by one. If no matching leads to a solution, the flow which starts from the entry point.
algorithm halts. Finding dispatcher blocks relies on concolic execution. Our algo-
rithm utilizes functional block proximity as a metric for dispatcher
path quality. However, it cannot predict which constraints will take
5.5 Selecting functional blocks exponential time to solve (in practice we set a timeout). Therefore
Given the functional block set F B , this step searches for a set that concolic execution selects the K (context sensitive) shortest paths
executes all payload statements. The goal is to select exactly one as dispatcher blocks and tries them (starting from the shortest) until
functional block for every IR statement and find dispatcher blocks one leads to a set of satisfiable constraints. It turns that this metric
to chain them together. BOPC builds the delta graph δG, described works very well in practice even for small values of K (e.g., 8).
in Section 4.4. Thus, we find the shortest path between two functional blocks
Once the delta graph is generated, this step locates the minimum (i.e., the BOP dispatcher), and we instruct the symbolic execution
induced subgraph, which is the exact set of functional blocks that engine to follow it. Alternatively, the simulation tries the second
execute the payload. If the minimum induced subgraph does not shortest one and so on. This is similar to the k-shortest path [67]
result in a solution, the algorithm tries the second shortest subgraph, algorithm used for the delta graph.
8
When simulation starts it also initializes any SPL variables at the Finally, it is possible for registers or external symbolic variables
locations that are reserved during the variable mapping (Section 5.4). (e.g., data from stdin, sockets or file descriptors) to be part of the
These addresses are marked as immutable, so any unintended mod- constraints. BOPC executes a similar translation for the registers
ification raises an exception which stops this iteration. and any external input, as these are inputs to the program that are
In Table 3, we introduce the set of Dereferenced Addresses, D M , usually also controlled by the attacker.
which is the set of memory addresses whose contents are loaded
into registers. Simulation cannot obtain the exact location of a
symbolic address (e.g., [rax + 4]) until the block is executed 6 EVALUATION
and the register has a concrete value. Before simulation reaches a To evaluate BOPC, we leverage a set of 10 applications with known
functional block, it concretizes any symbolic addresses from D M memory corruption CVEs, listed in Table 4. These CVEs correspond
and initializes the memory cell accordingly. If that memory cell to arbitrary memory writes [16, 33, 34], fulfilling our AWP primitive
has already been set, any initialization prior to the entry point requirement. Table 4 contains the total number of all functional
cannot persist. That is, BOPC cannot leverage an AWP to initialize blocks for each application. Although there are many functional
this memory cell and the iteration fails. If a memory cell has been blocks, the difficulty of finding stitchable dispatcher blocks makes
used in the constraints, its concretization can make constraints a significant fraction of them unusable.
unsatisfiable and the iteration may fail. Basic block abstraction is a time consuming process – especially
Simulation traverses the minimum induced subgraph, and infor applications with large Control-Flow Graphs – whose results do
crementally extends the execution state from one BOP gadget to not change across iterations. As a performance optimization, BOPC
the next. Encountering a conditional statement (i.e., a functional caches the resulting abstractions of the Binary Frontend (Figure 5)
block has two outgoing edges), BOPC clones the current state and to a file and loads them for each search, thus avoiding the startup
continues building the trace for both paths independently, in the overhead listed in Table 4.
same way that a symbolic execution engine handles conditional To demonstrate the effectiveness of our algorithm, we chose
statements. When a path reaches a functional block that was al- a set of 13 representative SPL payloads, shown in Table 5. Our
ready visited, it gracefully terminates. At the end, we collect all goal is to “map and run” each of these payloads on top each of
those states and check whether the constraints of these paths are the vulnerable applications. Table 6 shows the results of running
satisfiable or not. If so, we have a solution. each payload on. BOPC successfully finds a mapping of memory
writes to encode an SPL payload as a set of side effects executed on
5.7 Synthesizing exploit from execution trace top of the applications for 105 out of 130 cases, approximately 81%.
In each case, the memory writes are sufficient to reconstruct the
If the simulation module returns a solution, the final step is to
payload execution by strictly following the CFG without violating
encode the execution trace as a set of memory writes in the target
a strict CFI policy or stack integrity.
binary. The constraint set Cw collected during simulation reveal a
Table 6 shows that applications with large CFGs result in higher
memory layout that leads to an execution flow across functional
success rates, as they encapsulate a “richer” set of BOP gadgets.
block according to the minimum induced subgraph.
Achieving truly infinite loops is hard in practice, as most of the
Concretizing the constraints for all participating conditional vari-
loops in our experiments involve some loop counter that is modified
ables at the end of the simulation can result in incorrect solutions,
in each iteration. This iterator serves as an index to dereference
as shown in the following example:
an array. By falsifying the exit condition through modifying loop
a = input();
if (a > 10 && a < 20) {
variables (i.e., the loop infinite), the program eventually terminates
a = 0; with a segmentation fault, as it tries to access memory outside
/* target block */ of the current segment. Therefore, even though the loop would
} run forever, an external factor (segmentation fault) causes it to
The symbolic execution engine concretizes the symbolic variable stop. BOPC aims to address this issue, by simulating the same loop
assigned to a, upon assignment. When execution reaches “target multiple times. However, finding a truly infinite loop, requires
block”, a is 0, which is contradicts the precondition to reach the BOPC to simulate it an infinite number of times, which is infeasible.
target block. Hence, BOPC needs to resolve the constraints on the For some cases, we managed to verify that the accessed memory
fly, rather than at the end of the simulation. inside the loop is bounded and therefore the solution truly is an
Therefore, this step is done alongside the simulation, carefully infinite loop. Otherwise the loop is arbitrarily bounded with the
monitoring all variables and concretizing them at the right moment. upper bound set by an external factor.
More specifically, memory locations that are accessed for first time, For some payloads, BOPC was unable to find an exploit trace.
are assigned a symbolic variable. Whenever a memory write occurs, This is is either due to imprecision of our algorithm, or because no
a check ensures that the initial symbolic variable persists in the solution exists for the written SPL payload. We can alleviate the
new symbolic expression. If not, BOPC concretizes it, adding the first failure by increasing the upper bounds and the timeouts in our
concretized value to the set of memory writes. configuration. Doing so, makes BOPC search more exhaustively at
There are also some symbolic variables that do not participate the cost of search time.
in the constraints, but are used as pointers. These variables are The non-existence of a solution is an interesting problem, as it
concretized to point to a writable location to avoid segmentation exposes the limitations of the vulnerable application. This type of
faults outside of the simulation environment. failure is due to the “structure” of the application’s CFG, which
9
Vulnerable Application CFG Time Total number of functional blocks

Program Vulnerability Prim. Nodes Edges (m:s) RegSet RegMod MemRd MemWr Call Cond Total
ProFTPd CVE-2006-5815 [5] AW 27,087 49,862 10:08 40,143 387 1,592 199 77 3,029 45,427
nginx CVE-2013-2028 [9] AW 24,169 44,645 12:36 31,497 1,168 1,522 279 35 3375 37,876
sudo CVE-2012-0809 [8] FMS 3,399 6,267 01:14 5,162 26 157 18 45 307 5715
orzhttpd BugtraqID 41956 [7] FMS 1,354 2,163 00:27 2,317 9 39 8 11 89 2473
wuftdp CVE-2000-0573 [1] FMS 8,899 17,092 03:22 14,101 62 274 11 94 921 15,463
nullhttpd CVE-2002-1496 [3] AW 1,488 2,701 00:27 2,327 77 54 7 19 125 2,609
opensshd CVE-2001-0144 [2] AW 6,688 12,487 01:53 8,800 98 214 19 63 558 9,752
wireshark CVE-2014-2299 [10] AW 74,186 162,111 29:41 12,4053 639 1,736 193 100 4555 131276
apache CVE-2006-3747 [4] AW 18,790 34,205 10:22 33,615 212 490 66 127 1,768 36,278
smbclient CVE-2009-1886 [6] FMS 166,081 351,309 82:25 265,980 1,481 6,791 951 119 28,705 304,027
Table 4: Vulnerable applications. The Prim. column indicates the primitive type (AW = Arbitrary Write, FMS = ForMat String).
Time is the amount of time needed to generate the abstractions for every basic block. Functional blocks show the total number
for each of the statements (RegSet = Register Assignments, RegMod = Register Modifications, MemRd = Memory Load, MemWr =
Memory Store, Call = system/library calls, Cond = Conditional Jumps). Note that the number of call statements is small because
we are targeting a predefined set of calls. Also note that MemRd statements are a subset of RegSet statements.
Payload Description |S | flat?

and modify the memory on the fly, as we reach the given entry
regset4 Initialize 4 registers with arbitrary values 4 3
regref4 Initialize 4 registers with pointers to arbitrary memory 8 3 point. We ensure as we step through our trace that we maintain the
regset5 Initialize 5 registers with arbitrary values 5 3 properties of the SPL payload expressed. That is, blocks between
regref5 Initialize 5 registers with pointers to arbitrary memory 10 3 the statements are non-clobbering in terms of register allocation
regmod Initialize a register with an arbitrary value and modify it 3 3
memrd Read from arbitrary memory 4 3 and memory assignment.
memwr Write to arbitrary memory 5 3
print Display a message to stdout using write 6 3
execve Spawn a shell through execve 6 3
abloop Perform an arbitrarily long bounded loop utilizing regmod 2 7
infloop Perform an infinite loop that sets a register in its body 2 7 7 CASE STUDY: NGINX
ifelse An if-else condition based on a register comparison 7 7 We utilize a version of the nginx web server with a known memory
loop Conditional loop with register modification 4 7
corruption vulnerability [9] that has been exploited in the wild to
Table 5: SPL payloads. Each payload consists of |S | state-
further study BOPC. When an HTTP header contains the “Transfer-
ments. Payloads with flat delta graphs (i.e., have no jump
Encoding: chunked” attribute, nginx fails to properly length check
statements), are marked with 3.
for the received packet chunks, resulting in stack buffer overflow.
This buffer overflow [16] results in an arbitrary memory write,
prevents BOPC from finding a trace for an SPL payload. A solution fulfilling the AWP requirement. For our case study we select three
may not exist due to one the following: of the most interesting payloads: spawning a shell, an infinite loop,
and a conditional branch. Table 7 shows metrics collected during
(1) There are not enough candidate blocks.
the BOPC execution for these cases.
(2) There are no valid register / variable mappings.
(3) There are not enough functional blocks or no valid paths
between functional blocks.
(4) The constraints between blocks are un-satisfiable or sym-
7.1 Spawning a shell
bolic execution raised aa timeout.
Function ngx execute proc is invoked through a function
In Section 3 we mention that the determination of the entry
pointer, with the second argument (passed to rsi, according to
point is part of the vulnerability discovery process. Therefore,
x64 calling convention), being a void pointer that is interpreted as
BOPC assumes that the entry point is given. Without having access
a struct to initialize all arguments of execve:
to actual exploits (or crashes), inference of entry points (and bugs)
mov rbx, rsi
is undetermined. Hence, we have selected arbitrary locations as the mov rdx, QWORD PTR [rsi+0x18]
entry points. This allows BOPC to find payloads for the evaluation mov rsi, QWORD PTR [rsi+0x10]
without having access to concrete exploits. In practice, BOPC would mov rdi, QWORD PTR [rbx]
leverage the given entry points as starting points. We demonstrate call 0x402500 <execve@plt>
several test cases where the entry points are precisely at the start BOPC leverages this function to successfully synthesize the
of functions, deep in the Call Graph, to show the power of our execve payload (shown on the right side of Table 1) and gen-
approach. Orthogonally, we allow for vulnerabilities to exist in the erate a PoC exploit in less than a minute as shown in Table 7.
middle of a function. In such situations, BOPC would set our entry Assuming that rsi points to some writable address x, BOPC pro-
point to the location after the return of the function. duces the following (address, value, size) tuples: ($y, $x, 8), ($y +
The lack of the exact entry point complicates the verification 8h, 0, 8), ($x, /bin/sh, 8), ($x + 10h, $y, 8), ($x + 18h, 0, 8), were $y
of our solutions. We leverage a debugger to “simulate” the AWP is a concrete writable addresses set by BOPC.
10
SPL payload
Program
regset4 regref4 regset5 regref5 regmod memrd memwr print execve abloop infloop ifelse loop
ProFTPd 3 3 3 3 3 3 3 3 32 71 3 128+ 3 ∞ 3 3 3
nginx 3 3 3 3 3 3 3 74 3 3 128+ 3 ∞ 3 3 128
sudo 3 3 3 3 3 3 3 3 3 74 3 128+ 74 74
orzhttpd 3 3 3 3 3 3 3 74 71 74 3 128+ 74 73
wuftdp 3 3 3 3 3 3 3 3 71 3 128+ 3 128+ 74 73
nullhttpd 3 3 3 3 3 3 73 73 3 3 30 3 ∞ 74 73
opensshd 3 3 3 3 3 3 74 74 74 3 512 3 128+ 3 3 99
wireshark 3 3 3 3 3 3 3 3 4 71 3 128+ 3 7 3 3 8
apache 3 3 3 3 3 3 3 74 74 3 ∞ 3 128+ 3 74
smbclient 3 3 3 3 3 3 3 3 1 71 3 1057 3 128+ 3 3 256
Table 6: Feasibility of executing various SPL payloads for each of the vulnerable applications. An 3 means that the SPL payload
was successfully executed on the target binary while a 7 indicates a failure, with the subscript denoting the type of failure
(71 = Not enough candidate blocks, 72 = No valid register/variable mappings, 73 = No valid paths between functional blocks
and 74 = Un-satisfiable constraints or solver timeout). Note that in the first two cases (71 and 72 ), we know that there is no
solution while, in the last two (73 and 74 ), a solution might exists, but BOPC cannot find it, either due to over-approximation
or timeouts. The numbers next to the 3 in abloop, infloop, and loop columns indicate the maximum number of iterations. The
number next to the print column indicates the number of character successfully printed to the stdout.
Payload Time |C B | Mappings |δG | |Hk | this function. In order to do so BOPC sets ngx time lock a
execve 0m:55s 10,407 142,355 1 1 non-zero value, thus causing this function to return quickly. BOPC
infloop 4m:45s 9,909 14 1 1 successfully synthesizes this payload in less than 5 minutes.
ifelse 1m:47s 10,782 182 4 2
Table 7: Performance metrics for BOPC on nginx. Time = 7.3 Conditional statements
time to synthesize exploit, |C B | = # candidate blocks, Map- This case study shows an SPL if-else condition that implements
pings = # concrete register and variable mappings, |δG | = # a logical NOT. That is, if register r0 is zero, the payload sets
delta graphs created, |Hk | = # of induced subgraphs tried. r1 to one, otherwise r1 becomes zero. The execution trace
starts at the beginning of ngx cache manager process -
7.2 Infinite loop cycle. This function is called through a function pointer. A part
Here we present a payload that generates a trace that executes an of the CFG starting from this function is shown in Appendix D.
infinite loop. The infloop payload, is an simple infinite loop that After trying 4 mappings, r0 and r1 map to rsi and r15
consists of only two statements: respectively. The resulting delta graph is the shown in Figure 7.
As we mentioned in Section 5.6, when BOPC encounters a func-
void payload() {
LOOP:
tional block for a conditional statement, it clones the current state of
__r1 = 0; the symbolic execution and the two clones independently continue
goto LOOP; the execution. The constraints up to the conditional jump are the
} following:
We set the entry point at the beginning of ngx signal - 0x41eb23 :
$rdi = ngx_cycle_t* cycle
handler function which is a signal handler that is invoked through 0x40f709 :
*(ngx_event_flags + 1) == 0x2
0x41dfe3 :
__r0 = rsi = 0x0
a function pointer. Hence, this point is reachable through control-
0x403cdb :
$r15 = 0x1
flow hijacking. The solution synthesized by BOPC is shown in ngx_module_t ngx_core_module.index = 0
Figure 6. The box on the top-left corner demonstrates how the $alloca_1 = *cycle
memory is initialized to satisfy the constraints. ngx_core_conf_t* conf_ctx =
Virtual register r0 was mapped to hardware register r14, so *$alloca_1 + ngx_core_module.index * 8
0x403d06 : test rsi, rsi (__r0 != 0)
ngx signal handler contains three candidate blocks, marked 0x403d09 : jne 0x403d1b <ngx_set_environment+64>
as octagons. Exactly one of them is selected to be the functional
block while the others are avoided by the dispatcher blocks. The If the condition is false and the jump is not taken, the following
dispatcher finds a path from the entry point to the first functional constraints are also added to the state.
block and then, finds a loop to return back to the same functional 0x403d0b : conf_ctx->environment != 0
block (highlighted with blue arrows). Note that the size of the 0x403fd9 : __r1 = *($stack - 0x178) = 1;
dispatcher block exceeds 20 basic blocks, while the functional block When the condition is true, the execution trace will follow the
consists of a single basic block. “taken” branch of the trace. In this case the shortest path to the next
The oval nodes in Figure 6 indicate basic blocks that are outside functional block is 403d1b → 403d3d → 403d4b → 403d54 →
of the current function. At basic block 0x41C79F, function ngx - 403d5a → 403f b4 with a total length 6. Unfortunately, this cannot
time sigsafe update is invoked. Due to the shortest path be used as a dispatcher block, due to an exception that is raised
heuristic, BOPC, tries to execute as few basic blocks as possible from at 403d4b. The register rsi, is 1 and therefore when we attempt
11
41c750 Statement #0
41C765: signals.signo == 0
40E10F: ngx_time_lock != 0 41eb23
41C7B1: ngx_process 3 > 1 402220
41C9AC: ngx_cycle = $alloc_1
$alloc_1>log = $alloc_2 8 10 13 36 40 4 11
1000038
$alloc_2>log_level <= 5
41CA18: signo == 17 Statement #2
41CA4B: waitpid() return value != {0, 1} 41c765
41cA50: ngx_last_process == 0 403d4b 403d6c 404d5a 407887 407a1c 41dfe3 41e02a
41CB50: *($stack 0x03C) & 0x7F != 0
41CB5B: $alloc_2>log_level <= 1 41c778
41CBE6: *($stack 0x03C + 1) != 2 INF INF INF INF INF 1 INF
41CC48: ngx_accept_mutex_ptr == 0
Statement #4
41CC5F: ngx_cycle>shared_memory.part.elts = 0 41c77c 41c793
__r0 = r14 = 0
41CC79: ngx_cycle>shared_memory.part.nelts <= 0 403cdb
41c787 41c79a
41CC7F: ngx_cycle>shared_memory.part.next == 0
10 2 10 19 6 2
41c783 41c791
Statement #6 Statement #12
41c79f
403e4e 403fd9 403e4e 403ebb 403fb4 403fd9
41cb6c 40e10f
0 0 0 0 0 0
Statement #16
41cbaa 40e223
-1
41cbe6 41c7a4
41cbed 41c7c4 41c7b1
41cbfe 41c7cd 41c97a 41c7bf

Figure 7: A delta graph instance for an ifelse payload for ng-
inx. The first node is the entry point. Blue nodes and edges
form the minimum induced subgraph, Hk . Statement #4 is con-
41cc0f 41c910 41c8f2 41c96d
41cc39 41c9a1 41c91e 41c93f 41c994 41c956 41c8f7 41c900

ditional, execution branches into two statements. Note that
41cc48 41c9ac BOPC created this graph.
41cc52 41c9bd
41cc5f 41c9e5
41cc79 41c9ea 0x403d1b : conf_ctx->env.elts = &elt (ngx_array_t*)

conf_ctx->env.nelts == 0
41cc7f 41c9fb
0x4050ba : conf_ctx->env.nelts != $alloca_2->env.nalloc
41ca27 41cc8c 41ca18 0x40511c : conf_ctx->env.nelts += 1
0x40513a : $ret = conf_ctx->env.elts +
41ca2c 41cc95
conf_ctx->env.nelts*conf_ctx->env.size
4027d0 41ccad 41ca22 0x403d9c : $ret != 0
0x403da5 : conf_ctx->env.nelts != 0
1000308 41ccb2
0x403fb4 : __r1 = r15 = 0
41ca40 41ccc3
41ca4b 41cce7
8 DISCUSSION AND FUTURE WORK

41ca50 41ca7c
41cb46 41ca60 41ca84
Our prototype demonstrates the feasibility and scalability of auto-

41cb36 41ca77 41ca8f
matic construction of BOP chains through a high level language.
41cb3f 41caff 41ca97
However, we note some potential optimizations that we consider
41cb09 41cb0b 41cacd 41ca9b for future versions of BOPC.
In function
41cb10 41cae2 41cab0
BOPC is limited by the granularity of basic blocks. That is, a

Out of function combination of basic blocks could potentially lead to the execution
41cb50 41cafa 41cac8
of a desired SPL statement, while individual blocks might not. Take
Functional block
41cb5b 41cbac 41cced
for instance an instruction that sets a virtual register to 1. Assume
Dispatcher path
41cbbd that a basic block initializes rcx to 0, while the following block
increments it by 1; a pattern commonly encountered in loops. Al-
Figure 6: CFG of nginx’s ngx signal handler and pay- though there is no functional block that directly sets rcx to 1, the
load for an infinite loop (blue arrow dispatcher blocks, oc- combination of the previous two has the desired effect. BOPC can
tagons functional blocks) with the entry point at the func- be expanded to address this issue if the basic blocks are coalesced
tion start. The top box shows the memory layout initializa- into larger blocks that result in a new CFG.
tion for this loop. This graph was created by BOPC. BOPC sets several upper bounds defined by user inputs. These
configurable bounds include the upper limit of (i) SPL payload per-
to execute the following instruction: cmp BYTE PTR [rsi], mutations (P), (ii) length of continuous blocks (L), (iii) of minimum
54h, we essentially try to dereference address 1. BOPC is aware induced subgraphs extracted from the delta graph (N ), and (iv) dis-
of this exception, so it discards the current path and tries with the patcher paths between a pair of functional blocks (K). These upper
second shortest path. The second shortest path has length 7 and bounds along with the timeout for symbolic execution, reduce the
avoids the problematic block: 403d1b → 403d8b → 4050ba → search space, but prune some potentially valid solutions. The eval-
40511c → 40513a → 403d9c → 403da5 → 403f b4. This results in uation of higher limits may result to alternate or more solutions
a new set of constraints as shown below: being found by BOPC.
12
9 CONCLUSION [22] Cowan, C., Pu, C., Maier, D., Walpole, J., Bakke, P., Beattie, S., Grier, A.,
Wagle, P., Zhang, Q., and Hinton, H. Stackguard: automatic adaptive detection
Despite the deployment of strong control-flow hijack defenses such and prevention of buffer-overflow attacks. In Usenix Security (1998).
as CFI or shadow stacks, data-only code reuse attacks remain pos- [23] Dang, T. H., Maniatis, P., and Wagner, D. The performance cost of shadow
stacks and stack canaries. In Proceedings of the 10th ACM Symposium on Infor-
sible. So far, configuring these attacks relies on complex manual mation, Computer and Communications Security (2015), ACM, pp. 555–566.
analysis to satisfy restrictive constraints for execution paths. [24] Davi, L., Sadeghi, A.-R., Lehmann, D., and Monrose, F. Stitching the gadgets:
Our BOPC mechanism automates the analysis of the remain- On the ineffectiveness of coarse-grained control-flow integrity protection. In
USENIX Security (2014).
ing attack surface and synthesis of exploit payloads. To abstract [25] Davi, L., Sadeghi, A.-R., and Winandy, M. ROPdefender: A detection tool to
complexity from target programs and architectures, the payload is defend against return-oriented programming attacks. In Proceedings of the 6th
expressed in a high-level language. Our novel code reuse technique, ACM Symposium on Information, Computer and Communications Security (2011).
[26] Designer, S. return-to-libc attack. Bugtraq, Aug (1997).
Block Oriented Programming, maps statements of the payload to [27] Ding, R., Qian, C., Song, C., Harris, B., Kim, T., and Lee, W. Efficient protection
functional basic blocks. Functional blocks are stitched together of path-sensitive control security.
[28] Durden, T. Bypassing PaX ASLR protection. Phrack magazine #59 (2002).
through dispatcher blocks that satisfy the program CFG and avoid [29] Evans, I., Long, F., Otgonbaatar, U., Shrobe, H., Rinard, M., Okhravi, H., and
clobbering functional blocks. To find a solution for this NP-hard Sidiroglou-Douskos, S. Control jujutsu: On the weaknesses of fine-grained
problem, we develop heuristics to prune the search space and to control flow integrity. In Proceedings of the 22nd ACM SIGSAC Conference on
Computer and Communications Security (2015).
evaluate the most probable paths first. [30] Follner, A., Bartel, A., Peng, H., Chang, Y.-C., Ispoglou, K., Payer, M., and
The evaluation demonstrates that the majority of 13 payloads, Bodden, E. PSHAPE: Automatically combining gadgets for arbitrary method
ranging from typical exploit payloads to loops and conditionals are execution. In International Workshop on Security and Trust Management (2016).
[31] Göktas, E., Athanasopoulos, E., Bos, H., and Portokalidis, G. Out of control:
successfully mapped 81% of the time across 10 programs. Upon Overcoming control-flow integrity. In Security and Privacy (SP), 2014 IEEE
acceptance, we will release the source code of our proof of concept Symposium on (2014).
[32] Homescu, A., Stewart, M., Larsen, P., Brunthaler, S., and Franz, M. Mi-
prototype along with all of our evaluation results. crogadgets: size does matter in turing-complete return-oriented programming.
In Proceedings of the 6th USENIX conference on Offensive Technologies (2012),
USENIX Association, pp. 7–7.
REFERENCES [33] Hu, H., Chua, Z. L., Adrian, S., Saxena, P., and Liang, Z. Automatic generation
[1] CVE-2000-0573: Format string vulnerability in wu-ftpd 2.6.0. https://cve.mitre. of data-oriented exploits. In USENIX Security (2015).
org/cgi-bin/cvename.cgi?name=CVE-2000-0573, 2001. [34] Hu, H., Shinde, S., Adrian, S., Chua, Z. L., Saxena, P., and Liang, Z. Data-
[2] CVE-2001-0144: Integer overflow in openssh 1.2.27. https://cve.mitre.org/cgi-bin/ oriented programming: On the expressiveness of non-control data attacks. In
cvename.cgi?name=CVE-2001-0144, 2001. Security and Privacy (SP), 2016 IEEE Symposium on (2016).
[3] CVE-2002-1496: Heap-based buffer overflow in null http server 0.5.0. https: [35] Jacobson, E. R., Bernat, A. R., Williams, W. R., and Miller, B. P. Detecting code
//cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1496, 2004. reuse attacks with a model of conformant program execution. In International
[4] CVE-2006-3747: Off-by-one error in apache 1.3.34. Available from MITRE, CVE- Symposium on Engineering Secure Software and Systems (2014).
ID CVE-2006-3747, 2006. [36] Kahn, A. B. Topological sorting of large networks. Communications of the ACM
[5] CVE-2006-5815: Stack buffer overflow in proftpd 1.3.0. https://cve.mitre.org/ (1962).
cgi-bin/cvename.cgi?name=CVE-2006-5815, 2006. [37] Katoch, V. Whitepaper on bypassing aslr/dep. Tech. rep., Secfence, Tech. Rep.,
[6] CVE-2009-1886: Format string vulnerability in smbclient 3.2.12. https://cve.mitre. September 2011.[Online]. Available: http://www.exploit-db.com/wp-content/
org/cgi-bin/cvename.cgi?name=CVE-2009-1886, 2009. themes/exploit/docs/17914.pdf.
[7] Orzhttpd - format string. https://www.exploit-db.com/exploits/10282/, 2009. [38] Kil3r, and Bulba. Bypassing stackguard and stackshield. Phrack magazine #53
[8] CVE-2012-0809: Format string vulnerability in sudo 1.8.3. https://cve.mitre.org/ (2000).
cgi-bin/cvename.cgi?name=CVE-2012-0809, 2012. [39] King, J. C. Symbolic execution and program testing. Communications of the
[9] CVE-2013-2028: Nginx http server chunked encoding buffer overflow 1.4.0. ACM (1976).
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028, 2013. [40] Kuznetsov, V., Szekeres, L., Payer, M., Candea, G., Sekar, R., and Song, D.
[10] CVE-2014-2299: Buffer overflow in wireshark 1.8.0. https://cve.mitre.org/cgi-bin/ Code-pointer integrity. In OSDI (2014), vol. 14, p. 00000.
cvename.cgi?name=CVE-2014-2299, 2014. [41] Microsoft. Visual studio 2015 — compiler options — enable control flow guard,
[11] Abadi, M., Budiu, M., Erlingsson, U., ´ and Ligatti, J. Control-flow integrity 2015. https://msdn.microsoft.com/en-us/library/dn919635.aspx.
principles, implementations, and applications. ACM Transactions on Information [42] Müller, T. ASLR smack & laugh reference. Seminar on Advanced Exploitation
and System Security (TISSEC) (2009). Techniques (2008).
[12] Avgerinos, T., Cha, S. K., Rebert, A., Schwartz, E. J., Woo, M., and Brumley, [43] Müller, U. Brainfuck–an eight-instruction turing-complete programming lan-
D. Automatic exploit generation. Communications of the ACM 57, 2 (2014), 74–84. guage. Available at the Internet address http://en. wikipedia. org/wiki/Brainfuck
[13] Bletsch, T., Jiang, X., Freeh, V. W., and Liang, Z. Jump-oriented programming: (1993).
a new class of code-reuse attack. In Proceedings of the 6th ACM Symposium on [44] Niu, B., and Tan, G. Modular control-flow integrity. ACM SIGPLAN Notices 49
Information, Computer and Communications Security (2011). (2014).
[14] Burow, N., Carr, S. A., Brunthaler, S., Payer, M., Nash, J., Larsen, P., and [45] Niu, B., and Tan, G. Per-input control-flow integrity. In Proceedings of the 22nd
Franz, M. Control-flow integrity: Precision, security, and performance. ACM ACM SIGSAC Conference on Computer and Communications Security (2015).
Computing Surveys (CSUR) (2018). [46] Pakt. ropc: A turing complete rop compiler. https://github.com/pakt/ropc, 2013.
[15] Cadar, C., Dunbar, D., Engler, D. R., et al. Klee: Unassisted and automatic [47] Pappas, V. kBouncer: Efficient and transparent rop mitigation. tech. rep. Citeseer
generation of high-coverage tests for complex systems programs. In OSDI (2008). (2012).
[16] Carlini, N., Barresi, A., Payer, M., Wagner, D., and Gross, T. R. Control-flow [48] PAX-TEAM. Pax aslr (address space layout randomization). http://pax.grsecurity.
bending: On the effectiveness of control-flow integrity. In USENIX Security net/docs/aslr.txt, 2003.
(2015). [49] Payer, M., Barresi, A., and Gross, T. R. Fine-grained control-flow integrity
[17] Carlini, N., and Wagner, D. ROP is still dangerous: Breaking modern defenses. through binary hardening. In International Conference on Detection of Intrusions
In USENIX Security (2014). and Malware, and Vulnerability Assessment (2015).
[18] Castro, M., Costa, M., and Harris, T. Securing software by enforcing data-flow [50] Polychronakis, M., and Keromytis, A. D. ROP payload detection using specu-
integrity. In Proceedings of the 7th symposium on Operating systems design and lative code execution. In Malicious and Unwanted Software (MALWARE), 2011
implementation (2006). 6th International Conference on (2011).
[19] Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A., Shacham, H., and [51] Richarte, G., et al. Four different tricks to bypass stackshield and stackguard
Winandy, M. Return-oriented programming without returns. In Proceedings of protection. World Wide Web (2002).
the 17th ACM conference on Computer and communications security (2010). [52] Salwan, J., and Wirth, A. ROPGadget. https://github.com/JonathanSalwan/
[20] Cheng, Y., Zhou, Z., Miao, Y., Ding, X., DENG, H., et al. ROPecker: A generic ROPgadget, 2012.
and practical approach for defending against ROP attack. [53] Schuster, F., Tendyck, T., Liebchen, C., Davi, L., Sadeghi, A.-R., and Holz,
[21] Cormen, T. H., Stein, C., Rivest, R. L., and Leiserson, C. E. Introduction to T. Counterfeit object-oriented programming: On the difficulty of preventing
Algorithms. The MIT press, 2009. code reuse attacks in c++ applications. In Security and Privacy (SP), 2015 IEEE
13
Symposium on (2015). A EXTENDED BACKUS-NAUR FORM OF SPL

[54] Schwartz, E. J., Avgerinos, T., and Brumley, D. Q: Exploit hardening made
easy. In USENIX Security Symposium (2011).
[55] Sen, K., Marinov, D., and Agha, G. Cute: a concolic unit testing engine for c. hSPLi ::= void payload( ) { hstmtsi }
In ACM SIGSOFT Software Engineering Notes (2005), vol. 30, ACM, pp. 263–272. hstmtsi ::= (hstmti | hlabeli)* hreturni?
[56] Shacham, H. The Geometry of Innocent Flesh on the Bone: Return-into-libc
without Function Calls (on the x86). In Proceedings of CCS 2007 (Oct. 2007), hstmti ::= hvarseti | hregseti | hregmodi | hcalli
S. De Capitani di Vimercati and P. Syverson, Eds., ACM Press, pp. 552–61. | hmemwri | hmemrdi | hcondi | hjumpi
[57] Shacham, H., Page, M., Pfaff, B., Goh, E.-J., Modadugu, N., and Boneh, D.
On the effectiveness of address-space randomization. In Proceedings of the 11th
ACM conference on Computer and communications security (2004). hvarseti ::= int64 hvari = hrvaluei;
[58] Shoshitaishvili, Y., Wang, R., Salls, C., Stephens, N., Polino, M., Dutcher, | int64* hvari = {hrvaluei (, hrvaluei)*};
A., Grosen, J., Feng, S., Hauser, C., Kruegel, C., et al. SOK:(State of) The Art
of War: Offensive Techniques in Binary Analysis. In Security and Privacy (SP),
| string hvari = hstri;
2016 IEEE Symposium on (2016). hregseti ::= hregi = hrvaluei;
[59] Tang, J., and Team, T. M. T. S. Exploring control flow guard in windows
10. Available at ”http:// blog.trendmicro.com/ trendlabs-security-intelligence/
hregmodi ::= hregi hopi= hnumberi;
exploring-control-flow-guard-in-windows-10” (2015). hmemwri ::= *hregi = hregi;
[60] The Chromium Projects. Control Flow Integrity The Chromium Projects.
”https://www.chromium.org/developers/testing/control-flow-integrity”.
hmemrdi ::= hregi = *hregi;
[61] Tice, C., Roeder, T., Collingbourne, P., Checkoway, S., Erlingsson, U., ´ hcalli ::= hvari ( ( ϵ | hregi (, hregi)* );
Lozano, L., and Pike, G. Enforcing forward-edge control-flow integrity in hlabeli ::= hvari:
GCC & LLVM. In USENIX Security (2014).
[62] Uno, T. Algorithms for enumerating all perfect, maximum and maximal match- hcondi ::= if (hregi hcmpopi hnumberi) goto hvari;
ings in bipartite graphs. Algorithms and Computation (1997). hjumpi ::= goto hvari;
[63] van de Ven, A., and Molnar, I. Exec shield. https://www.redhat.com/f/pdf/
rhel/WHP0006US Execshield.pdf, 2004. hreturni ::= returnto hnumberi;
[64] van der Veen, V., Andriesse, D., Göktaş, E., Gras, B., Sambuc, L., Slowinska,
A., Bos, H., and Giuffrida, C. Practical Context-Sensitive CFI. In Proceedings of
the 22nd Conference on Computer and Communications Security (CCS’15) (October hregi := ‘__r’hregidi
2015). hregidi := [0-7]
[65] van der Veen, V., Andriesse, D., Stamatogiannakis, M., Chen, X., Bos, H.,
and Giuffrida, C. The dynamics of innocent flesh on the bone: Code reuse ten
hvari := [a-zA-Z ][a-zA-Z 0-9]*
years later. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and hnumberi := (‘+’ | ‘-’) [0-9]+ | ‘0x’[0-9a-fA-F]+
Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03,
2017 (2017), pp. 1675–1689.
hrvaluei := hnumberi | ‘&’ hvari
[66] Wojtczuk, R. The advanced return-into-lib (c) exploits: Pax case study. Phrack hstri := [.]*
Magazine, Volume 0x0b, Issue 0x3a, Phile# 0x04 of 0x0e (2001).
[67] Yen, J. Y. Finding the k shortest loopless paths in a network. management Science
hopi := ‘+’ | ‘-’ | ‘*’ | ‘/’ | ‘&’ | ‘|’ | ‘˜’ | ‘<<’ | ‘<<’
17, 11 (1971), 712–716. hcmpopi := ‘==’ | ‘!=’ | ‘>’ | ‘>=’ | ‘<’ | ‘<=’
B STITCHING BOP GADGETS IS NP-HARD

We present the NP-hardness proof for the BOP Gadget stitching
problem. This problem reduces to the problem of finding the mini-
mum induced subgraph Hk in a delta graph. Furthermore, we show
that this problem cannot even be approximated.
Let δG be a multipartite directed weighted delta graph with k
sets. Our goal is to select exactly one node (i.e., functional block)
from each set and form the induced subgraph Hk , such that the total
weight of all of edges is minimized:
Õ
min distance(e) (2)
H k ⊂δ G
e ∈H k
A δG is flat, when all edges from i th set are towards (i + 1)th set.
The nodes and the black edges in Figure 8 are such an example. In
this case, the minimum induced subgraph, is the minimum among
all shortest paths that start from some node in the first set and end
in any node in the last set. However, if the δG is not flat (i.e., the
SPL payload contains jump statements, so edges from i th set can
go anywhere), the shortest path approach does not work any more.
Going back in Figure 8, if we make some loops (add the blue edges),
the previous approach does not give the correct solution.
It turns out that the problem is NP-hard if the δG is not flat . To
prove this, we will use a reduction from K-Clique: First we apply
some equivalent transformations to the problem. Instead of having
K independent sets, we add an edge with ∞ weight between every
14
∞ This completes the proof that finding the minimum induced

A1 ∞ A2 ∞ A3 subgraph in δG is NP-hard. However, no (multiplicative) approxi-
mation algorithm does exists, as it would also solve the K-Clique
8 12 2 4
problem (it must return 0 if there is a K-Clique).
B1 ∞ B2
50 11 11 13 10 C SPL IS TURING-COMPLETE
We present a constructive proof of Turing-completeness through
C1 17
building an interpreter for Brainfuck [43], a Turing-complete lan-
7 17 guage in the following listing. This interpreter is written using SPL
with a Brainfuck program provided as input in the SPL payload.
D1 ∞ D2 ∞ D3
∞
1 int64 *tape = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
Figure 8: An delta graph instance. The nodes along the black 2 string input = ".+[.+]";
3 __r0 = &tape; // Data pointer
edges form a flat delta graph. In this case, the minimum in- 4 __r2 = &input; // Instruction pointer
duced subgraph, Hk is A3 , B 1 , C 1 , D 1 , with a total weight of 20, 5 __r6 = 0; // STDIN
which is also the shortest path from A3 to D 1 . When delta 6 __r7 = 1; // STDOUT
graph is not flat (assume that we add the blue edges), the 7 __r8 = 1; // Count arg for write/read
8 NEXT: __r1 = *__r2;
shortest path nodes constitute an induced subgraph with a
9 if (__r1 != 0x3e) goto LESS; // '>'
total weight of 70. However Hk has total weight 34 and con- 10 __r0 += 1;
tains A3 , B 2 , C 1 , D 2 . Finally, the problem of finding the min- 11 LESS: if (__r1 != 0x3c) goto PLUS; // '<'
imum induced subgraph becomes equivalent to finding a k- 12 __r0 -= 1;
clique if we add the red edges with ∞ cost between all nodes 13 PLUS: if (__r1 != 0x2b) goto MINUS; // '+'
14 *__r0 += 1;
in the same set. 15 MINUS: if (__r1 != 0x2d) goto DOT; // '-'
16 *__r0 -= 1;
17 DOT: if (__r1 != 0x2e) goto COMMA; // '.'
18 write(__r7, __r0, __r8);
pair on the same set, as shown in Figure 8 (red edges). Then, the 19 COMMA: if (__r1 != 0x2c) goto OPEN; // ','
minimum weight K-induced subgraph Hk , cannot have two nodes 20 read(__r6, *__r0, __r8);
21 OPEN: if (__r1 != 0x5b) goto CLOSE; // '['
from the same layer, as this would imply that Hk contains an edge 22 if (__r0 != 0) goto CLOSE;
with ∞ weight. 23 __r3 = 1; // Loop depth counter
Let R be an undirected un-weighted graph that we want to 24 FIND_C: if (__r3 <= 0) goto CLOSE;
check whether it has a k-clique. That is, we want to check whether 25 __r2 += 1;
clique(R, k) is True or not. Thus, we create a new directed graph 26 __r1 = *__r2;
27 if (__r1 != 0x5b) goto CHECK_C; // '['
R 0 as follows: 28 __r3 += 1;
• R 0 contains all the nodes from R 29 CHECK_C: if (__r1 != 0x5d) goto FIND_C; // ']'
30 __r3 -= 1;
• ∀ edge (u, v) ∈ R, we add the edges (u, v) and (v, u) in R 0 31 goto FIND_C;
with weiдht = 0 32 CLOSE: if (__r1 != 0x5d) goto END; // ']'
• ∀ edge (u, v) < R, we add the edges (u, v) and (v, u) in R 0 33 if (__r0 != 0) goto END;
with weiдht = ∞ 34 __r3 = 1; // Loop depth counter
35 FIND_O: if (__r3 <= 0) goto END;
Then we try to find the minimum weight k-induced subgraph Hk 36 __r2 -= 1;
in R 0 . It is true that: 37 __r1 = *__r2;
38 if (__r1 != 0x5b) goto CHECK_O; // '['
Õ 39 __r3 -= 1;
weiдht(e) < ∞ ⇔ clique(R, k) = True 40 CHECK_O: if (__r1 != 0x5d) goto FIND_O; // ']'
e ∈H k 41 __r3 += 1;
42 goto FIND_O;
:⇒ If the total edge weight of Hk is not ∞, this implies that for 43 END: __r2 += 1;
every pair of nodes in Hk , there is an edge with weight 1 in R 0 and 44 goto NEXT;
thus an edge in R. This by definition means that the nodes of Hk
form a k-clique in R. Otherwise (the total edge weight of Hk is ∞)
it means that it does not exist a set of k nodes in R 0 that has all edge
weights < ∞.
:⇐ If R has a k-clique, then there will be a set of k nodes that are D CFG OF NGINX AFTER PRUNING
fully connected. This set of nodes will have no edge with ∞ weight The following graph, is a portion of nginx’s CFG that includes func-
in R 0 . Thus, these nodes will form an induced subgraph of R 0 and tion calls starting from the function ngx cache manager -
the total weight will be smaller than ∞. process cycle. The graph only displays functions which are
15
up to 3 function calls deep to simplify visualization. Note the reduc-

tion in search space–which is a result of BOPC’s pruning–as this
portion of the CFG reduces to the small delta graph in Figure 7.
40c6a3
40c6ac 40c6b1
40c6ba
40c6e6
40c6fb 40c6f5
40c6ff 40c6bf
40c70e
40c748 40c743
40c752 40c758
40c75c 40c704
40c765
40c769
40c772
40c776
40ca53
40c79e 40ca58
40ca62 40c7a0
41ebde 40c90c 40c7b1
41ebe3 40c912 40c7bb
40c3e6 40c937 40c7e0
40c419 40c93b 40c7e4
40c41f 40c948 40c94d 40c7f1 40c7f6
40c5f8 40c95d 40c957 40c800 40c806
40c601 40c3fc 40c961 40c80a
40c424 40c60f 40c971 40c81a
40c435 40c51b 40c613 40c824 40c97b 40c83b
40c43f 40c460 40c542 40c521 41ebf7 40c82e 40c992 40c985 40c846
40c469 40c54b 41ebfc 40c9af 40c863
40c47a 40c55c 41ec05 40c9b3 40c867
40c47e 40c560 41ec13 40c9c5 40c9c0 40c874 40c879
40c492 40c48c 40c574 41ec1e 40c9d5 40c9cf 40c883 40c889
40c4a2 40c49c 40c584 40c57e 40c56e 41ec28 40c9d9 40c88d
40c4a6 40c588 40429e 40c9e9 40c89d
40c4b1 40c593 4042cc 40ca1e 40c8d2
40c4e2 40c5c4 40430c 40ca22 40c8d6
40c4e6 40c5c8 40431c 40ca2f 40ca34 40c8e3 40c8e8
40c4fa 40c4f4 40c5dc 404337 40ca3e 40ca44 40c8f8 40c8f2
40c50a 40c504 40c5d6 40c5ec 40c5e6 40436c 40ca48 40c8fc
40c50e 40c5f0 40438d
404399
4043b3
4043b6
404407
40440f
40441f
404422
40442c
404435 4044c8
404448
40444b
404475
40447f
404485
40448e
4044b3
4044c6
4044ef
41ec41 40f7fa 41ec81
40f804 411441
40f80e 41146c
40f817 411473
40f827 411481 4117af
40f82c 41eb23 41148a 4117be
40f836 40f709 4117c8 41149d
40f83b 40f716 4117cd 4114a6
40f857 40f74c 4117d7 4114af
40f756 40f873 4117dc 4114c7
40f766 40f889 4117f5 4114cf 411505
40f770 41eb42 41ec8b 411510 4114de
40f78c 40f77c 41dfe3 4189db 411523 4114e3
40f791 41e000 403cdb 4189ff 411528 411500
41e00f 40f7a3 40f7a1 40f78a 403d1b 418a04 411537
41e023 40f7b3 403d0b 403d8b 418a0a 41153c
41e02a 40f7bb 4050ba 418a14 41155b
41e039 40f7c2 40511c 418a2d 411563
41e03e 40f7ca 40513a 418a35 411568
41e04a 40f7cf 403d9c 418a3f 411577
41e04f 40f7d9 403fa6 403da5 418a4f 41157c
41e06c 40f7de 403fd9 403fb4 418a55 41159b
41e076 418a20 418a5e 418a49 4115a9
41e08c 418a65 4115b9
41e091 418a7b 4115be
41e09d 418a8c 4115cd
41e0a2 418a99 4115d2
41e0bf 418aa3 4115f6
41e0c9 418aad 4115fe
41e0df 418ab2 411603
41e0e4 418ab7 411612
41e0f0 418ac1 411617
41e0f5 418acb 411636
41e112 418ad3 418ad5 41164c
41e11c 418ae2 41165f
41e132 41ec93 411664
41e137 41ec15 41eca0 411673
41e143 41ec4b 411678
41e148 41ec54 411697
41e165 41ec68 41169f
41e16a 4116a4
41e172 4116b3
41e17a 4116b8
41e17f 41e1b7 4116d7
41e18b 41e1c3 4116ee
41e190 41e1c8 4116f3 411762
41e1ad 41e1d4 411702 41176a
41e1d9 411707 41176f
41e1fa 411726 41177e
41e202 41172e 411783
41e23f 41e207 411733 4117a2
41e244 41e213 41173e
41e24c 41e218 411743
41e251 41e235 411760
41e25e 4117a6
41e282 41e005
41e287
41e293
41e298
41e2b1
41e2b8
41e2c1
41e2c6 41e2fe
41e2d2 41e308
41e2d7 41e31c
41e2f4 41e321
41e32c
41e331
41e34a
41e357
41e35c
41e379
41e385
41e38a
41e393
41e398
41e3a8
41e39e 41e3b9
41e3c3
41e3cd
41e3d2
41e3db
41e3e3
41e3e8
41e3ed
41e3f9
41e3fe
41e417
41e428
41e442
41e447
41e452
41e457
41e470
41e488
41e48e 41e498
402880 41eb5c
41eb69
41eb6c
41d8a7
41d8d1
41d8e6
41d8f2
41d902
41eba7
41ebbc
41ebcf
40c684
40c691 40c69a
40c6b7
16

Block Oriented Programming - Automating Data-Only A Ttacks

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Block Oriented Programming - Automating Data-Only A Ttacks

Transféré par

Droits d'auteur :

Formats disponibles

Block Oriented Programming: Automating Data-Only Attacks

Kyriakos K. Ispoglou Bader AlBassam

Trent Jaeger Mathias Payer

canaries (GS) [22] to stop stack-based buffer overflows, and Ad-

Simple loop Spawn a shell

Binary Binary CFG A RG FB

Statement Form Abstraction Actions Example

Vulnerable Application CFG Time Total number of functional blocks

Payload Description |S | flat?

41cbed 41c7c4 41c7b1

41cbfe 41c7cd 41c97a 41c7bf

41cc39 41c9a1 41c91e 41c93f 41c994 41c956 41c8f7 41c900

41cc79 41c9ea 0x403d1b : conf_ctx->env.elts = &elt (ngx_array_t*)

8 DISCUSSION AND FUTURE WORK

41cb46 41ca60 41ca84

Our prototype demonstrates the feasibility and scalability of auto-

Symposium on (2015). A EXTENDED BACKUS-NAUR FORM OF SPL

B STITCHING BOP GADGETS IS NP-HARD

∞ This completes the proof that finding the minimum induced

up to 3 function calls deep to simplify visualization. Note the reduc-

41ebde 40c90c 40c7b1

41ebe3 40c912 40c7bb

40c3e6 40c937 40c7e0

40c419 40c93b 40c7e4

40c41f 40c948 40c94d 40c7f1 40c7f6

40c5f8 40c95d 40c957 40c800 40c806

40c601 40c3fc 40c961 40c80a

40c424 40c60f 40c971 40c81a

40c435 40c51b 40c613 40c824 40c97b 40c83b

40c43f 40c460 40c542 40c521 41ebf7 40c82e 40c992 40c985 40c846

40c469 40c54b 41ebfc 40c9af 40c863

40c47a 40c55c 41ec05 40c9b3 40c867

40c47e 40c560 41ec13 40c9c5 40c9c0 40c874 40c879

40c492 40c48c 40c574 41ec1e 40c9d5 40c9cf 40c883 40c889

40c4a2 40c49c 40c584 40c57e 40c56e 41ec28 40c9d9 40c88d

40c4a6 40c588 40429e 40c9e9 40c89d

40c4b1 40c593 4042cc 40ca1e 40c8d2

40c4e2 40c5c4 40430c 40ca22 40c8d6

40c4e6 40c5c8 40431c 40ca2f 40ca34 40c8e3 40c8e8

40c4fa 40c4f4 40c5dc 404337 40ca3e 40ca44 40c8f8 40c8f2

40c50a 40c504 40c5d6 40c5ec 40c5e6 40436c 40ca48 40c8fc

40c50e 40c5f0 40438d

41ec41 40f7fa 41ec81

40f827 411481 4117af

40f82c 41eb23 41148a 4117be

40f836 40f709 4117c8 41149d

40f83b 40f716 4117cd 4114a6

40f857 40f74c 4117d7 4114af

40f756 40f873 4117dc 4114c7

40f766 40f889 4117f5 4114cf 411505

40f770 41eb42 41ec8b 411510 4114de

40f78c 40f77c 41dfe3 4189db 411523 4114e3

40f791 41e000 403cdb 4189ff 411528 411500

41e00f 40f7a3 40f7a1 40f78a 403d1b 418a04 411537

41e023 40f7b3 403d0b 403d8b 418a0a 41153c

41e02a 40f7bb 4050ba 418a14 41155b

41e039 40f7c2 40511c 418a2d 411563

41e03e 40f7ca 40513a 418a35 411568

41e04a 40f7cf 403d9c 418a3f 411577

41e04f 40f7d9 403fa6 403da5 418a4f 41157c

41e06c 40f7de 403fd9 403fb4 418a55 41159b

41e076 418a20 418a5e 418a49 4115a9

41e08c 418a65 4115b9