PSHAPE: Automatically Combining Gadgets for Arbitrary Method Execution

  • Andreas Follner
  • Alexandre Bartel
  • Hui Peng
  • Yu-Chen Chang
  • Kyriakos Ispoglou
  • Mathias Payer
  • Eric Bodden
Conference paper

DOI: 10.1007/978-3-319-46598-2_15

Part of the Lecture Notes in Computer Science book series (LNCS, volume 9871)
Cite this paper as:
Follner A. et al. (2016) PSHAPE: Automatically Combining Gadgets for Arbitrary Method Execution. In: Barthe G., Markatos E., Samarati P. (eds) Security and Trust Management. STM 2016. Lecture Notes in Computer Science, vol 9871. Springer, Cham

Abstract

Return-Oriented Programming (ROP) is the cornerstone of today’s exploits. Yet, building ROP chains is predominantly a manual task, enjoying limited tool support. Many of the available tools contain bugs, are not tailored to the needs of exploit development in the real world and do not offer practical support to analysts, which is why they are seldom used for any tasks beyond gadget discovery. We present PSHAPE (Practical Support for Half-Automated Program Exploitation), a tool which assists analysts in exploit development. It discovers gadgets, chains gadgets together, and ensures that side effects such as register dereferences do not crash the program. Furthermore, we introduce the notion of gadget summaries, a compact representation of the effects a gadget or a chain of gadgets has on memory and registers. These semantic summaries enable analysts to quickly determine the usefulness of long, complex gadgets that use a lot of aliasing or involve memory accesses. Case studies on nine real binaries representing 147 MiB of code show PSHAPE’s usefulness: it automatically builds usable ROP chains for nine out of eleven scenarios.

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  • Andreas Follner
    • 1
  • Alexandre Bartel
    • 1
  • Hui Peng
    • 2
  • Yu-Chen Chang
    • 2
  • Kyriakos Ispoglou
    • 2
  • Mathias Payer
    • 2
  • Eric Bodden
    • 3
  1. 1.Technische Universität DarmstadtDarmstadtGermany
  2. 2.Purdue UniversityWest LafayetteUSA
  3. 3.Paderborn University & Fraunhofer IEMPaderbornGermany

Personalised recommendations