Return Oriented Programming

[Nytro]

Return Oriented Programming

CSCI 6621: Network Security

Week 11, Lecture 21: Tuesday, 04/04/2011

Daniel Bilar

University of New Orleans

Department of Computer Science

Spring 2011

Goals today

• Review: Buffer overflow, format string

• Return Oriented Programming

– Chain together sequences (‘gadgets’) ending in RET

– Can use good code chunks as ‘alphabet’, string

together to get for bad code

• Some similarities to an antigram (form of anagram)

Within earshot ‡ I won't hear this

– Build “gadgets” for load?store, arithmetic,

logic, control flow, system calls

– Attack can perform arbitrary computation

using no injected code at all

Some slides gratefully adapted from Shacham BH 08 presentation

(UCSD)

Download:

http://shell-storm.org/papers/files/779.pdf