ROP Obfuscation via Synthetic Code Segmentation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Return-oriented programming (ROP) attacks are difficult to prevent as they exploit existing executable code within a program, making it challenging to distinguish between intended and unintended execution flows, and existing solutions only discourage such attacks without fully preventing them.

Innovation Solution

The method involves determining a first set of instructions for a target operation and a second set of instructions that contain gadgets to perform the same function, creating a code library with these instructions, and modifying the stack to execute instructions in an order that achieves the target operation, thereby obfuscating the functionality and making ROP-based attacks more difficult to execute.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the program limits execution to marked executable addresses only, then code execution from data addresses is prevented, but ROP attacks can still execute code by reusing existing executable code sequences

Engineering Contradiction:
Improveprotection against code execution from data addressesVSAvoidvulnerability to ROP-based hijacking attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the program's executable code into multiple versions: an original version and a synthetic version. The synthetic version is created by combining code sequences (gadgets) from the original version in specific patterns. This segmentation allows the system to maintain the original executable code for normal operation while creating a separate synthetic version for security validation, preventing ROP attacks by verifying that control flow transfers match expected synthetic patterns

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent creates a synthetic version of the executable code by copying and recombining code sequences from the original version. This synthetic copy serves as a security layer that validates control flow transfers. By copying existing gadgets and arranging them in predetermined sequences, the system can detect when attackers attempt to execute unintended code paths without modifying the original executable code

Inventive Principle:
Principle #26Copying

2Ease of operation

If the program uses existing code sequences (gadgets) for ROP operations, then the attack code is guaranteed to be in executable memory, but the program's functionality can be completely changed by controlling execution flow

Engineering Contradiction:
Improveability to execute code from valid executable addressesVSAvoidarbitrary execution flow manipulation
Core Design Contradiction:
Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The patent implements a feedback mechanism where the synthetic version of the code is generated based on the original code's structure and control flow. This synthetic version then serves as a reference for validating actual execution paths. When the program executes, the control flow transfers are checked against the predetermined synthetic patterns, providing continuous feedback to detect and prevent unauthorized ROP attacks while allowing legitimate code execution

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent performs preliminary action by pre-generating the synthetic version of the executable code before the program runs. This synthetic version contains all expected control flow transfer patterns between gadgets. By preparing this security validation layer in advance, the system can quickly detect ROP attacks during execution without needing to analyze code patterns in real-time, improving both security and performance

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2942727B1Return-oriented programming as an obfuscation technique
Publication Date: 2019.06.12 NXP BV
  • EP2942727B1 patent drawingFigure 1A
  • EP2942727B1 patent drawingFigure 1B
  • EP2942727B1 patent drawingFigure 2

AI summary

A method for obfuscating functionality of computer software is disclosed. In an embodiment, the method involves determining a first set of instructions needed to perform a target operation and a second set of instructions for at least one or more additional operations. The second set of instructions is tuned to contain instructions such that, by executing the second set of instructions, the function of the first set of instructions can be performed. Once the first and second sets of instruction are determined and tuned, a code library is created and code fragments in the library correspond to code needed to perform the function of the first set of instructions when executed. Instructions are then added to the second set of instructions such that, when executed, will cause the functionality of the first set of instructions to be achieved.