立即废弃地址-代码关联：一种防御高级代码重用攻击的新原理
Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack
摘要：
细粒度地址空间随机化被认为是一种有效的防止代码重用攻击的方法。然而，它仅采用一次性随机化，并且这种限制已被最近的即时ROP和侧通道ROP利用，其在运行中收集小工具并动态编译它们以用于恶意目的。为了击败这些先进的代码重用攻击，我们提出了一个新的防御原则：立即废弃的地址代码的关联。我们已经初始化这个原则与一个新的技术称为虚拟空间页表重映射和实现系统CHAMELEON的技术。CHAMELEON定期重新随机化代码页的位置。提出了一组技术来实现我们的目标，包括迭代仪器仪表，仪器要保护的二进制程序，以生成一个重新随机化兼容的二进制，运行时虚拟页洗牌，功能重新排序和指令重排优化。我们已经用一百多个二进制程序测试了CHAMELEON。我们的实验表明，CHAMELEON可以通过阻止漏洞收集足够的小工具和阻止小工具执行来击败我们所有的测试漏洞。关于我们重新随机化的间隔，它是一个参数，可以设置为100 ms，10 ms或1 ms。实验结果表明，CHAMELEON对这些参数的平均性能开销分别为11.1%、12.1%和12.9%。
英文摘要：
Fine-grained Address Space Randomization has been considered as an effective protection against code reuse attacks such as ROP/JOP. However, it only employs a one-time randomization, and such a limitation has been exploited by recent just-in-time ROP and side channel ROP, which collect gadgets on-the-fly and dynamically compile them for malicious purposes. To defeat these advanced code reuse attacks, we propose a new defense principle: instantly obsoleting the address-code associations. We have initialized this principle with a novel technique called virtual space page table remapping and implemented the technique in a system CHAMELEON. CHAMELEON periodically re-randomizes the locations of code pages on-the-fly. A set of techniques are proposed to achieve our goal, including iterative instrumentation that instruments a to-be-protected binary program to generate a re-randomization compatible binary, runtime virtual page shuffling, and function reordering and instruction rearranging optimizations. We have tested CHAMELEON with over a hundred binary programs. Our experiments show that CHAMELEON can defeat all of our tested exploits by both preventing the exploit from gathering sufficient gadgets, and blocking the gadgets execution. Regarding the interval of our re-randomization, it is a parameter and can be set as short as 100ms, 10ms or 1ms. The experiment results show that CHAMELEON introduces on average 11.1%, 12.1% and 12.9% performance overhead for these parameters, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
