ROPdefender: A detection tool to defend against return-oriented programming attacks

Return-Oriented Programming (ROP) is a technique that enables an adversary to construct malicious programs with the desired behavior by combining short instruction sequences that already reside in the memory space of a program. ROP attacks have already been demonstrated on various processor architectures ranging from PCs to smartphones and special-purpose systems. In this paper we consider the following questions: (i) can any of the existing proposals against memory-based exploits provide an appropriate defense mechanism against ROP attacks? (ii) and if not, can we construct a general and efficient solution based on the extension and improvement of existing techniques? and (iii) if this solution is simple, would it then be of narrow scope and consequently question the relevance of ROP as a “crucial attack”? We give answers to the first two questions and leave the last question open, although we believe that ROP attacks are real threats and will increasingly be used in the near future and, hence, efficient countermeasures are strongly needed. We present ROPdefender, an immediate and practical solution against conventional ROP attacks based on return instructions. It protects arbitrary binary programs without the need to change or inspect their source code. ROPdefender consists of only 80 LOC an