Forest Global Training Partners

Cyber Risks · Cisco Talos

Prototyping Mitigations with DBI Frameworks

Summary: A Cisco Talos researcher described prototyping mitigations for return oriented programming and just-in-time shellcode using dynamic binary instrumentation frameworks such as PIN, DynamoRIO, and Valgrind, which he treats as in-process debuggers that hook functions, basic blocks, and instructions. He presented two ROP defenses - a shadow stack that pushes the next instruction address at each CALL and validates it on RET, and branch monitoring that checks whether a return address is in a block list - plus a JIT heuristic that disassembles the buffer passed to VirtualProtect and flags long chains of MOV_REG_IMM32 instructions, with both ROP mitigations implemented in under 200 lines of source.

Why it matters: Nearly all released mitigations come from the vendor, and the author notes that in some cases the vendor decides the performance or stability cost is not worth building them at all - leaving no option but to develop the mitigation yourself. He also notes these two ROP defenses cover Dan Rosenberg's technique for defeating the ROP mitigation Microsoft shipped in Windows 8, which relies on observing the stack pointer value rather than the integrity of the stack itself.

Read the original at Cisco Talos ↗

Topics
Malware
Related