ARM Binary Instruction Randomization for ROP Defense

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current ROP mitigation strategies are ineffective for mobile computer systems running on ARM architectures, as existing methods like Address Space Layout Randomization and instruction randomization are not applicable or sufficient for these platforms.

Innovation Solution

A novel instruction randomization technique that substitutes instruction pairs in binary files with equivalent pairs, including PUSH and POP instructions, to prevent ROP attacks by modifying the registers used, without altering the instruction length or control flow, thereby protecting ARM-based systems from ROP-based attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Address Space Layout Randomization (ASLR) and instruction randomization are applied, then security against ROP attacks is improved, but these methods are not applicable or sufficient for ARM architectures

Engineering Contradiction:
Improvesecurity against ROP attacksVSAvoidapplicability to ARM architectures
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies parameter changes by modifying instruction pairs in the binary code - specifically replacing PUSH and POP instruction pairs with equivalent pairs that operate on different registers. This transforms the original instruction sequences into randomized versions that maintain functional equivalence but break the predictable patterns required for ROP attacks on ARM architectures.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If instruction substitution with additional registers is performed, then ROP attack prevention is improved, but instruction sequences become more complex

Engineering Contradiction:
ImproveROP attack preventionVSAvoidinstruction sequences complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses copying by creating equivalent instruction pairs that replicate the functional behavior of original PUSH-POP pairs. Instead of fundamentally changing the instruction structure, it copies the pattern and modifies the register operands, thereby maintaining simplicity while achieving security goals.

Inventive Principle:
Principle #26Copying

3Reliability

If binary files are modified with equivalent instruction pairs, then security is improved, but file processing time increases

Engineering Contradiction:
ImprovesecurityVSAvoidfile processing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by performing the instruction substitution during the binary file processing stage, before the program is executed. This preprocessing approach ensures that security modifications are already in place when the program runs, avoiding any runtime overhead while providing continuous protection.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3289511B1Method and system for defense against return oriented programming (ROP) based attacks
Publication Date: 2019.12.04 HUAWEI INT PTE LTD
  • EP3289511B1 patent drawingFigure 1
  • EP3289511B1 patent drawingFigure 2A~2B
  • EP3289511B1 patent drawingFigure 3A~3C

AI summary

Embodiments of the invention provide method and system for defense against ROP attacks. The method comprises: identifying a substitutable instruction pair in a binary file, which includes a first instruction for pushing a first group of registers into a stack memory, and a second instruction for popping the first group of registers off the stack memory, generating an equivalent instruction pair for the substitutable instruction pair, which includes a first equivalent instruction for pushing a second group of registers onto the stack memory, and a second equivalent instruction for popping the second group of registers off the stack memory, wherein the second group of registers includes the first group of registers and at least one additional register which is not used by the substitutable instruction pair, and overwriting the first instruction and the second instruction with the first equivalent instruction and the second equivalent instruction respectively.