ROP Obfuscation via Synthetic Code Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming (ROP) attacks are difficult to prevent as they exploit existing executable code within a program, making it challenging to distinguish between intended and unintended execution flows, and existing solutions only discourage such attacks without fully preventing them.
Innovation Solution
The method involves determining a first set of instructions for a target operation and a second set of instructions that contain gadgets to perform the same function, creating a code library with these instructions, and modifying the stack to execute instructions in an order that achieves the target operation, thereby obfuscating the functionality and making ROP-based attacks more difficult to execute.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the program limits execution to marked executable addresses only, then code execution from data addresses is prevented, but ROP attacks can still execute code by reusing existing executable code sequences
Solution Approach 1:
The patent segments the program's executable code into multiple versions: an original version and a synthetic version. The synthetic version is created by combining code sequences (gadgets) from the original version in specific patterns. This segmentation allows the system to maintain the original executable code for normal operation while creating a separate synthetic version for security validation, preventing ROP attacks by verifying that control flow transfers match expected synthetic patterns
Solution Approach 2:
The patent creates a synthetic version of the executable code by copying and recombining code sequences from the original version. This synthetic copy serves as a security layer that validates control flow transfers. By copying existing gadgets and arranging them in predetermined sequences, the system can detect when attackers attempt to execute unintended code paths without modifying the original executable code
2Ease of operation
If the program uses existing code sequences (gadgets) for ROP operations, then the attack code is guaranteed to be in executable memory, but the program's functionality can be completely changed by controlling execution flow
Solution Approach 1:
The patent implements a feedback mechanism where the synthetic version of the code is generated based on the original code's structure and control flow. This synthetic version then serves as a reference for validating actual execution paths. When the program executes, the control flow transfers are checked against the predetermined synthetic patterns, providing continuous feedback to detect and prevent unauthorized ROP attacks while allowing legitimate code execution
Solution Approach 2:
The patent performs preliminary action by pre-generating the synthetic version of the executable code before the program runs. This synthetic version contains all expected control flow transfer patterns between gadgets. By preparing this security validation layer in advance, the system can quickly detect ROP attacks during execution without needing to analyze code patterns in real-time, improving both security and performance
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A method for obfuscating functionality of computer software is disclosed. In an embodiment, the method involves determining a first set of instructions needed to perform a target operation and a second set of instructions for at least one or more additional operations. The second set of instructions is tuned to contain instructions such that, by executing the second set of instructions, the function of the first set of instructions can be performed. Once the first and second sets of instruction are determined and tuned, a code library is created and code fragments in the library correspond to code needed to perform the function of the first set of instructions when executed. Instructions are then added to the second set of instructions such that, when executed, will cause the functionality of the first set of instructions to be achieved.