Binary stirring: Self-randomizing instruction addresses of legacy x86 binary code

DMCA

Binary stirring: Self-randomizing instruction addresses of legacy x86 binary code (2012)

Cached

Download Links

by Richard Wartell , Vishwath Mohan , Kevin W. Hamlen , Zhiqiang Lin

Venue:	In Proc. ACM Conf. Computer and Communications Security
Citations:	60 - 4 self

BibTeX

@INPROCEEDINGS{Wartell12binarystirring:,
    author = {Richard Wartell and Vishwath Mohan and Kevin W. Hamlen and Zhiqiang Lin},
    title = {Binary stirring: Self-randomizing instruction addresses of legacy x86 binary code},
    booktitle = {In Proc. ACM Conf. Computer and Communications Security},
    year = {2012}
}

OpenURL

Abstract

Unlike library code, whose instruction addresses can be randomized by address space layout randomization (ASLR), application binary code often has static instruction addresses. Attackers can exploit this limitation to craft robust shell codes for such applications, as demonstrated by a recent attack that reuses instruction gadgets from the static binary code of victim applications. This paper introduces binary stirring, a new technique that imbues x86 native code with the ability to self-randomize its instruction addresses each time it is launched. The input to STIR is only the application binary code without any source code, debug symbols, or relocation information. The output is a new binary whose basic block addresses are dynamically determined at load-time. Therefore, even if an attacker can find code gadgets in one instance of the binary, the instruction addresses in other instances are unpredictable. An array of binary transformation techniques enable STIR to transparently protect large, realistic applications that cannot be perfectly disassembled due to computed jumps, code-data interleaving, OS callbacks, dynamic linking and a variety of other difficult binary features. Evaluation of STIR for both Windows and Linux platforms shows that stirring introduces about 1.6 % overhead on average to application runtimes.

Keyphrases

binary stirring self-randomizing instruction address legacy x86 binary code application binary code instruction address source code o callback code-data interleaving computed jump debug symbol basic block address realistic application linux platform recent attack new technique dynamic linking binary transformation technique enable stir relocation information x86 native code victim application address space layout randomization static instruction address instruction gadget difficult binary feature library code application runtimes static binary code code gadget robust shell code

DMCA