ARM Binary Instruction Randomization for ROP Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ROP mitigation strategies are ineffective for mobile computer systems running on ARM architectures, as existing methods like Address Space Layout Randomization and instruction randomization are not applicable or sufficient for these platforms.
Innovation Solution
A novel instruction randomization technique that substitutes instruction pairs in binary files with equivalent pairs, including PUSH and POP instructions, to prevent ROP attacks by modifying the registers used, without altering the instruction length or control flow, thereby protecting ARM-based systems from ROP-based attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Address Space Layout Randomization (ASLR) and instruction randomization are applied, then security against ROP attacks is improved, but these methods are not applicable or sufficient for ARM architectures
Solution Approach 1:
The patent applies parameter changes by modifying instruction pairs in the binary code - specifically replacing PUSH and POP instruction pairs with equivalent pairs that operate on different registers. This transforms the original instruction sequences into randomized versions that maintain functional equivalence but break the predictable patterns required for ROP attacks on ARM architectures.
2Reliability
If instruction substitution with additional registers is performed, then ROP attack prevention is improved, but instruction sequences become more complex
Solution Approach 1:
The patent uses copying by creating equivalent instruction pairs that replicate the functional behavior of original PUSH-POP pairs. Instead of fundamentally changing the instruction structure, it copies the pattern and modifies the register operands, thereby maintaining simplicity while achieving security goals.
3Reliability
If binary files are modified with equivalent instruction pairs, then security is improved, but file processing time increases
Solution Approach 1:
The patent applies preliminary action by performing the instruction substitution during the binary file processing stage, before the program is executed. This preprocessing approach ensures that security modifications are already in place when the program runs, avoiding any runtime overhead while providing continuous protection.
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3C
AI summary
Embodiments of the invention provide method and system for defense against ROP attacks. The method comprises: identifying a substitutable instruction pair in a binary file, which includes a first instruction for pushing a first group of registers into a stack memory, and a second instruction for popping the first group of registers off the stack memory, generating an equivalent instruction pair for the substitutable instruction pair, which includes a first equivalent instruction for pushing a second group of registers onto the stack memory, and a second equivalent instruction for popping the second group of registers off the stack memory, wherein the second group of registers includes the first group of registers and at least one additional register which is not used by the substitutable instruction pair, and overwriting the first instruction and the second instruction with the first equivalent instruction and the second equivalent instruction respectively.