Q: exploit hardening made easy

Prior work has shown that return oriented programming (ROP) can be used to bypass W⊕X, a software defense that stops shellcode, by reusing instructions from large libraries such as libc. Modern operating systems have since enabled address randomization (ASLR), which ran-domizes the location of libc, making these techniques unusable in practice. However, modern ASLR implemen-tations leave smaller amounts of executable code unran-domized and it has been unclear whether an attacker can use these small code fragments to construct payloads in the general case. In this paper, we show defenses as currently deployed can be bypassed with new techniques for automatically creating ROP payloads from small amounts of unran-domized code. We propose using semantic program ver-ification techniques for identifying the functionality of gadgets, and design a ROP compiler that is resistant to missing gadget types. To demonstrate our techniques, we build Q, an end-to-end system that automatically gener-ates ROP payloads for a given binary. Q can produce payloads for 80 % of Linux /usr/bin programs larger than 20KB. We also show that Q can automatically per-form exploit hardening: given an exploit that crashes with defenses on, Q outputs an exploit that bypasses both W⊕X and ASLR. We show that Q can harden nine real-world Linux and Windows exploits, enabling an attacker to automatically bypass defenses as deployed by industry for those programs.