基于ARMv8架构gadget自动搜索框架  

AN AUTOMATED GADGET SEARCH FRAMEWORK BASED ON ARMv8 ARCHITECTURE

作　　者：赵利军 王震宇[1] 王奕森[1] 庄宽[1] 

机构地区：[1]信息工程大学数学工程与先进计算国家重点实验室,河南郑州450001

出　　处：《计算机应用与软件》2016年第5期307-311,316,共6页Computer Applications and Software

基　　金：国家高技术研究发展计划基金项目(2009AA012200)

摘　　要：为了在ARM公司最新发布的首款支持64位处理器的ARMv8架构上实现ROP(Return_Oriented Programmig)技术,设计了ARMv8架构上的ROP gadget的自动搜索工具。通过结合ARMv8架构指令系统的特点,首先在库文件搜索出所有的以RET指令结尾的短指令序列,并把这些指令序列存储在gadget库中,然后采用一些优化策略对该库进行优化,最后根据用户的输入在库中搜索到与用户输入功能相同的gadget链。通过对搜索工具搜索到的gadget的统计,结果表明gadget集具有图灵完整性,可以执行任意的操作。最后通过一个实例证明了ROP在ARMv8架构上的可行性。To implement ROP（ return-oriented programming） technology on the first ARMv8 architecture supporting 64 bits processor which is the latest release of ARM,we designed an automatic search tool for ROP gadget on ARMv8 architecture. By combining the features of instruction system of ARMv8 architecture,it first searches all the short instruction sequences ending with ＂RET＂instruction in library files,and stores these instruction sequences to gadget library,and then uses some optimisation strategy to optimise the library,finally,according to users＇ input it finds the gadget chains with same function of users＇ input. Through the statistics of gadgets searched by search tool,result showed that the gadget set had the Turing completeness,and could execute any operation. In end of the paper,through an example we proved the feasibility of ROP on ARMv8 architecture.

关 键 词：ROP 指令序列 自动搜索 ARMv8 图灵完整性 

分 类 号：TP309.1[自动化与计算机技术—计算机系统结构]