Preventing return-oriented programming exploits
View Patent ↗Preventing return-oriented programming exploits by identifying a set of contiguous computer software instructions extending from a first location within a computer memory to a second location within the computer memory, where the set of computer software instructions includes a return-oriented programming gadget, copying the set of computer software instructions to extend from a third location within the computer memory to a fourth location within the computer memory, placing a branching instruction at the first memory location, where the branching instruction branches to the third location, appending a return branching instruction to the copy of the set of computer software instructions, where the return branching instruction branches to a fifth location within the computer memory that immediately follows the second location, and overwriting at least a portion of the return-oriented programming gadget between the first location and the second location.
1. A computer security method comprising:
identifying a set of contiguous computer software instructions extending from a first location within a computer memory to a second location within the computer memory, wherein the set of contiguous computer software instructions includes a return-oriented programming gadget;
copying the set of contiguous computer software instructions to extend from a third location within the computer memory to a fourth location within the computer memory;
placing a branching instruction at the first location, wherein the branching instruction branches to the third location;
appending a return branching instruction to the copy of the set of contiguous computer software instructions, wherein the return branching instruction branches to a fifth location within the computer memory that immediately follows the second location;
overwriting at least a portion of the return-oriented programming gadget between the first location and the second location, wherein overwriting comprises overwriting with at least one trap instruction; and
configuring a trap handler for the trap instruction to perform a computer-security-related action.
2. The method of claim 1 wherein the identifying comprises identifying wherein each computer software instruction in the set of contiguous computer software instructions includes at least a portion of the return-oriented programming gadget.
3. The method of claim 1 further comprising configuring the trap handler to:
identify an execution path to the trap instruction;
determine that the execution path is consistent with unauthorized execution; and
perform the computer-security-related action responsive to determining that the execution path is consistent with unauthorized execution.
4. The method of claim 1 further comprising replacing any branching instruction that branches to any of a location between the first location and the second location with a replacement branching instruction that branches to a corresponding location between the third location and the fourth location.
5. The method of claim 1 wherein the identifying, copying, placing, appending, and overwriting are implemented in any of:
a) computer hardware; and
b) computer software embodied in a computer readable storage medium.
6. A computer security system comprising:
one or more computer processors;
one or more computer readable storage media;
program instructions stored on the computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
identify a set of contiguous computer software instructions extending from a first location within a computer memory to a second location within the computer memory, wherein the set of contiguous computer software instructions includes a return-oriented programming gadget;
copy the set of contiguous computer software instructions to extend from a third location within the computer memory to a fourth location within the computer memory;
place a branching instruction at the first location, wherein the branching instruction branches to the third location; and
append a return branching instruction to the copy of the set of contiguous computer software instructions, wherein the return branching instruction branches to a fifth location within the computer memory that immediately follows the second location;
overwrite at least a portion of the return-oriented programming gadget between the first location and the second location, wherein overwriting comprises overwriting with at least one trap instruction; and
configuring a trap handler for the trap instruction to perform a computer-security-related action.
7. The system of claim 6 wherein each computer software instruction in the set of contiguous computer software instructions includes at least a portion of the return-oriented programming gadget.
8. The system of claim 6 wherein the trap handler is configured to
identify an execution path to the trap instruction;
determine that the execution path is consistent with unauthorized execution; and
perform the computer-security-related action responsive to determining that the execution path is consistent with unauthorized execution.
9. The system of claim 6 wherein a branch manager is configured to replace any branching instruction that branches to any of a location between the first location and the second location with a replacement branching instruction that branches to a corresponding location between third location and the fourth location.
10. The system of claim 6 wherein a gadget mover, a branch manager, and a gadget remover are implemented in any of:
a) computer hardware; and
b) computer software embodied in a computer readable storage medium.
11. A computer program product for computer security, the computer program product comprising:
a computer readable storage medium; and
computer readable program code embodied in the computer readable storage medium, wherein the computer readable program code is configured to:
identify a set of contiguous computer software instructions extending from a first location within a computer memory to a second location within the computer memory, wherein the set of contiguous computer software instructions includes a return-oriented programming gadget;
copy the set of contiguous computer software instructions to extend from a third location within the computer memory to a fourth location within the computer memory;
place a branching instruction at the first location, wherein the branching instruction branches to the third location;
append a return branching instruction to the copy of the set of contiguous computer software instructions, wherein the return branching instruction branches to a fifth location within the computer memory that immediately follows the second location;
overwrite at least a portion of the return-oriented programming gadget between the first location and the second location, wherein overwriting comprises overwriting with at least one trap instruction; and
configuring a trap handler for the trap instruction to perform a computer-security related action.
12. The computer program product of claim 11 wherein each computer software instruction in the set of contiguous computer software instructions includes at least a portion of the return-oriented programming gadget.
13. The computer program product of claim 11 wherein the trap handler is configured to
identify an execution path to the trap instruction;
determine that the execution path is consistent with unauthorized execution; and
perform the computer-security-related action responsive to determining that the execution path is consistent with unauthorized execution.
14. The computer program product of claim 11 wherein the computer readable program code is configured to replace any branching instruction that branches to any of a location between the first location and the second location with a replacement branching instruction that branches to a corresponding location between third location and the fourth location.