Basic Block Randomization to Prevent ROP Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods to prevent return-oriented programming (ROP) attacks, such as Address Space Layout Randomization (ASLR) and compiler modifications, incur significant performance overhead or are vulnerable to information leakage attacks, and there is a need for more effective approaches that do not impose large performance penalties.
Innovation Solution
Randomizing the location of individual functional blocks within executable modules by identifying basic blocks, moving them to random memory locations, and replacing function call destinations with their new addresses, while maintaining performance efficiency by minimizing runtime overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Address Space Layout Randomization (ASLR) is used to randomize code locations, then attackers cannot accurately predict gadget locations, but the solution is vulnerable to information leakage attacks and incurs performance overhead
Solution Approach 1:
The patent segments the executable code into multiple basic blocks and randomizes their locations independently. Instead of randomizing the entire code segment as in traditional ASLR, each basic block (a sequence of instructions with a single entry and exit point) is treated as an independent unit that can be relocated. This segmentation allows for finer-grained randomization that maintains protection effectiveness while reducing the performance overhead associated with complete code segment randomization.
Solution Approach 2:
The patent performs preliminary randomization of basic block locations during the code loading or compilation phase, before execution begins. By pre-randomizing the locations of basic blocks and updating all corresponding function call destinations, the system establishes protection against ROP attacks without incurring runtime overhead. The randomization is done once in advance, and the randomized structure is then used during normal execution.
2Reliability
If compiler modifications are made to track return instructions, then gadget chaining is prevented, but heavy performance penalty is incurred
Solution Approach 1:
The patent performs the protective action in advance by randomizing basic block locations during code loading or compilation, before execution begins. This preliminary randomization prevents gadget chaining by ensuring that return instructions cannot reliably divert control flow to expected locations, without requiring runtime tracking or monitoring that would incur performance penalties.
3Reliability
If Intrusion Protection Systems invalidate memory pages except currently executed page, then control flow exceptions can be detected, but noticeable overhead is introduced
Solution Approach 1:
The patent performs protective randomization of basic block locations in advance, before execution begins. This preliminary action eliminates the need for runtime memory page validation and control flow monitoring, as the randomized structure itself prevents unauthorized control flow transfers. The protection is built into the code structure rather than requiring active monitoring during execution.
4Reliability
If randomization of entire executable block is performed, then gadget location prediction is complicated, but significant overhead is incurred in finding gadgets
Solution Approach 1:
The patent segments the executable code into multiple basic blocks and randomizes their locations independently. This segmentation allows legitimate processes to maintain efficient access to code through proper update of function call destinations, while attackers face the complexity of predicting randomized locations. The segmentation enables fine-grained randomization that protects against prediction without completely obscuring the code structure from legitimate software.
Solution Approach 2:
The patent applies randomization at the local level of individual basic blocks rather than uniformly randomizing the entire executable. This local approach allows different parts of the code to have different randomization characteristics, maintaining efficiency for frequently accessed code while providing protection where needed. The function call destination updates ensure that local randomization does not impede legitimate code execution.
Data Source
AI summary
Methods, systems, and media for protecting against return-oriented programming malware are provided. In some embodiments, the method comprises: retrieving an executable module; identifying a basic block in the executable module located at a first memory location, wherein the basic block has one entry point and one exit point; moving a portion of the executable module that corresponds to the basic block to a random memory location from the first memory location; and replacing a destination of a function call to the basic block within the executable module with a representation of the random memory location.