Return-oriented programme evolution with ROPER
Olivia Lucca Fraser, Nur Zincir-Heywood, Malcolm Iain Heywood, J. T. Jacobs · Proceedings of the Genetic and Evolutionary Computation Conference Companion · 2017
Return-orientated programming (ROP) identifies code snippets ending in a return instruction (gadgets) and chains them together to construct exploits. Gadgets are already present in executable memory, thus avoiding the need to explicitly inject new code. As such ROP represents one of the most difficult exploit mechanisms to mitigate. ROP design is essentially driven by the skill of human hacker, limiting the ability of exploit mitigation to reacting to attacks. In this work we describe an evolutionary approach to ROP design, thus potentially pointing to the automatic detection of vulnerabilities before application code is released.