面向块的编程：自动化仅数据攻击
Block Oriented Programming: Automating Data-Only Attacks
摘要：
随着控制流完整性（CFI）的广泛部署，控制流劫持攻击以及代码重用攻击变得更加困难。CFI将控制流限制在已知位置，从而严格限制任意代码的执行。在高级控制流劫持防御（如CFI和影子堆栈）下评估应用程序的剩余攻击面仍然是一个悬而未决的问题。我们引入BOPC，一种自动评估攻击者是否可以在使用CFI/影子堆栈防御加固的二进制文件上执行任意代码的机制。BOPC根据以图灵完备的高级语言SPL编写的有效载荷规范计算目标程序的漏洞利用，SPL抽象了体系结构和程序特定的细节。SPL有效负载被编译成在目标二进制文件上执行所需行为的程序跟踪。BOPC的输入是SPL有效载荷、起始点（例如，来自模糊器崩溃）和允许应用程序状态损坏的任意存储器写入原语。为了将SPL有效载荷映射到程序跟踪，BOPC引入了面向块编程（BOP），这是一种新的代码重用技术，它利用整个基本块作为程序中有效执行路径上的小工具，即，而不违反CFI或影子堆栈策略。我们发现有效负载到程序轨迹的映射问题是NP难的，所以BOPC首先通过修剪不可行路径来减少搜索空间，然后使用启发式算法来引导搜索到可能的路径。BOPC将BOP有效负载编码为一组内存写入。我们执行13 SPL有效载荷应用于10个流行的应用程序。BOPC成功地发现了有效载荷和复杂的执行跟踪-这可能不会通过手动分析发现-同时在81%的情况下，在理想的CFI策略下遵循目标的控制流图。
英文摘要：
With the widespread deployment of Control-Flow Integrity (CFI), control-flow hijacking attacks, and consequently code reuse attacks, are significantly more difficult. CFI limits control flow to well-known locations, severely restricting arbitrary code execution. Assessing the remaining attack surface of an application under advanced control-flow hijack defenses such as CFI and shadow stacks remains an open problem. We introduce BOPC, a mechanism to automatically assess whether an attacker can execute arbitrary code on a binary hardened with CFI/shadow stack defenses. BOPC computes exploits for a target program from payload specifications written in a Turing-complete, high-level language called SPL that abstracts away architecture and program-specific details. SPL payloads are compiled into a program trace that executes the desired behavior on top of the target binary. The input for BOPC is an SPL payload, a starting point (e.g., from a fuzzer crash) and an arbitrary memory write primitive that allows application state corruption. To map SPL payloads to a program trace, BOPC introduces Block Oriented Programming (BOP), a new code reuse technique that utilizes entire basic blocks as gadgets along valid execution paths in the program, i.e., without violating CFI or shadow stack policies. We find that the problem of mapping payloads to program traces is NP-hard, so BOPC first reduces the search space by pruning infeasible paths and then uses heuristics to guide the search to probable paths. BOPC encodes the BOP payload as a set of memory writes. We execute 13 SPL payloads applied to 10 popular applications. BOPC successfully finds payloads and complex execution traces -- which would likely not have been found through manual analysis -- while following the target's Control-Flow Graph under an ideal CFI policy in 81% of the cases.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
