Methods, systems, and computer readable media for preventing code reuse attacks
Methods, systems, and computer readable media for preventing code reuse attacks are disclosed. According to one method, the method includes executing, on a processor, code in a memory page related to an application, wherein the memory page is protected. The method also includes detecting a read request associated with the code. The method further includes after detecting the read request, modifying, without using a hypervisor, at least one memory permission associated with the memory page such that the code is no longer executable after the code is read.
1. A method for preventing code reuse attacks, the method comprising:
executing, on a processor, code in a memory page related to an application, wherein the memory page is protected by a memory protection unit (MPU);
detecting a read request associated with the code; and
after detecting the read request, modifying, by the MPU and without using a hypervisor, at least one memory permission associated with the memory page such that the code is no longer executable after the code is read.
2. The method of claim 1 comprising:
performing the read request; and
after performing the read request, modifying read code by changing at least one opcode in the read code.
3. The method of claim 1 wherein modifying the at least one memory permission includes modifying one or more bits of a memory register or a memory protection.
4. The method of claim 1 wherein the at least one memory permission includes a memory permission primitive of execute-no-read.
5. The method of claim 1 wherein detecting the read request associated with the code includes triggering a read exception or a fault for every memory page read.
6. The method of claim 1 comprising:
prior to executing an executable binary, separating at least one data portion from an executable binary containing mixed executable code and data portions.
7. The method of claim 6 wherein separating the at least one data portion from the executable binary includes identifying and relocating function exports, function imports, jump tables, or local function variables.
8. The method of claim 7 wherein identifying the local function variables includes identifying gaps between known function code, after identifying the gaps, identifying references to data within these gaps, and performing a backwards disassembly to a first control-flow instruction.
9. The method of claim 7 wherein identifying the jump tables includes scanning a code section for clusters of two or more consecutive pointers in the code section and, for each cluster, scanning the code section for a jmp instruction referencing a pointer associated with the cluster.
10. A system for preventing code reuse attacks, the system comprising:
at least one processor for executing code in a memory page related to an application, wherein the memory page is protected by a memory protection unit (MPU); and
a MPU configured to detect a read request associated with the code and, after detecting the read request, to modify, by the MPU and without using a hypervisor, at least one memory permission associated with the memory page such that the code is no longer executable after the code is read.
11. The system of claim 10 wherein the MPU is configured to modify read code by changing at least one opcode in the read code after a read request is performed.
12. The system of claim 10 wherein the MPU is configured to modify the at least one memory permission by modifying one or more bits of a memory register or a memory protection key.
13. The system of claim 10 wherein the at least one memory permission includes a memory permission primitive of execute-no-read.
14. The system of claim 10 wherein the MPU is configured to trigger a read exception or a fault for every memory page read.
15. The system of claim 10 wherein the MPU is configured to separate at least one data portion from an executable binary containing mixed executable code and data portions prior to the executable binary being executed.
16. The system of claim 15 wherein the MPU is configured to identify and relocate function exports, function imports, jump tables, or local function variables contained in the executable binary.
17. The system of claim 16 wherein the MPU is configured to identify the local function variables by identifying gaps between known function code, after identifying the gaps, identifying references to data within these gaps, and performing a backwards disassembly to a first control-flow instruction.
18. The system of claim 16 wherein the MPU is configured to identify the jump tables by scanning a code section for clusters of two or more consecutive pointers in the code section and, for each cluster, scanning the code section for a jmp instruction referencing a pointer associated with the cluster.
19. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer cause the computer to perform steps comprising:
executing, on a processor, code in a memory page related to an application, wherein the memory page is protected by a memory protection unit (MPU);
detecting a read request associated with the code; and
after detecting the read request, modifying, by the MPU and without using a hypervisor, at least one memory permission associated with the memory page such that the code is no longer executable after the code is read.
20. The non-transitory computer readable medium of claim 19 having stored thereon executable instructions that when executed by the processor of the computer cause the computer to perform the read request and, after performing the read request, modifying read code by changing at least one opcode in the read code.