Detecting return-oriented programming payloads by evaluating data for a gadget address space address and determining whether operations associated with instructions beginning at the address indicate a return-oriented programming payload
First Claim
1. A system for detecting the presence of a return-oriented programming (ROP) payload in data, comprising:
- a hardware processor that;
identifies a potential gadget address space;
determines if a piece of the data corresponds to an address of the potential gadget address space; and
in response to determining that the piece of the data corresponds to an address of the potential gadget address space;
for each instruction of a plurality of instructions beginning at the address;
attempts to execute the instruction;
determines whether at least one of;
that the instruction has an invalid execution address;
that the instruction is invalid; and
that the instruction is privileged;
counts the instruction as part of an instruction count; and
determines whether the instruction count meets at least one threshold;
in response to determining that the instruction count meets the at least one threshold, increases a gadget count; and
indicates that an ROP payload is present in the data in response to the gadget count meeting a threshold greater than one.
0 Assignments
0 Petitions
Accused Products
Abstract
Systems, methods, and media for detecting the presence of return-oriented programming (ROP) payloads are provided, comprising: identifying a potential gadget address space; determining if a piece of the data corresponds to an address of the potential gadget address space; and in response to determining that the piece of the data corresponds to an address of the potential gadget address space: determining whether a plurality of operations, each associated one of a plurality instructions beginning at the address, indicates that an ROP payload is present in the data, and indicating that an ROP payload is present in the data in response to making a determination that a plurality of operations indicates that an ROP payload is present in the data a given number of times.
-
Citations
27 Claims
-
1. A system for detecting the presence of a return-oriented programming (ROP) payload in data, comprising:
a hardware processor that; identifies a potential gadget address space; determines if a piece of the data corresponds to an address of the potential gadget address space; and in response to determining that the piece of the data corresponds to an address of the potential gadget address space; for each instruction of a plurality of instructions beginning at the address; attempts to execute the instruction; determines whether at least one of;
that the instruction has an invalid execution address;
that the instruction is invalid; and
that the instruction is privileged;counts the instruction as part of an instruction count; and determines whether the instruction count meets at least one threshold; in response to determining that the instruction count meets the at least one threshold, increases a gadget count; and indicates that an ROP payload is present in the data in response to the gadget count meeting a threshold greater than one. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
10. A method for detecting the presence of a return-oriented programming (ROP) payload in data, comprising:
-
identifying a potential gadget address space using a hardware processor; determining if a piece of the data corresponds to an address of the potential gadget address space using the hardware processor; and in response to determining that the piece of the data corresponds to an address of the potential gadget address space; for each instruction of a plurality of instructions beginning at the address, using the hardware processor to; attempt to execute the instruction; determine whether at least one of;
that the instruction has an invalid execution address;
that the instruction is invalid; and
that the instruction is privileged;count the instruction as part of an instruction count; and determine whether the instruction count meets at least one threshold; in response to determining that the instruction count meets the at least one threshold, using the hardware processor to increase a gadget count; and indicating, using the hardware processor, that an ROP payload is present in the data in response to the gadget count meeting a threshold greater than one. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting the presence of a return-oriented programming (ROP) payload in data, the method comprising:
-
identifying a potential gadget address space; determining if a piece of the data corresponds to an address of the potential gadget address space; and in response to determining that the piece of the data corresponds to an address of the potential gadget address space; for each instruction of a plurality of instructions beginning at the address; attempting to execute the instruction; determining whether at least one of;
that the instruction has an invalid execution address;
that the instruction is invalid; and
that the instruction is privileged;counting the instruction as part of an instruction count; and determining whether the instruction count meets at least one threshold; in response to determining that the instruction count meets the at least one threshold, increasing a gadget count; and indicating that an ROP payload is present in the data in response to the gadget count meeting a threshold greater than one. - View Dependent Claims (20, 21, 22, 23, 24, 25, 26, 27)
-
Specification