Skip to Main Content
 

Global Search Box

 
 
 
 

Files

File List


sisco-zachary-thesis.pdf (347.41 KB)

ETD Abstract Container

Abstract Header

Verifying Data-Oriented Gadgets in Binary Programs to Build Data-Only Exploits

Sisco, Zachary David
http://orcid.org/0000-0002-6553-712X
http://rave.ohiolink.edu/etdc/view?acc_num=wright1533308865314126

Abstract Details

2018, Master of Science (MS), Wright State University, Computer Science.
Data-Oriented Programming (DOP) is a data-only code-reuse exploit technique that “stitches” together sequences of instructions to alter a program’s data flow to cause harm. DOP attacks are difficult to mitigate because they respect the legitimate control flow of a program and by-pass memory protection schemes such as Address Space Layout Randomization, Data Execution Prevention, and Control Flow Integrity. Techniques that describe how to build DOP payloads rely on a program’s source code. This research explores the feasibility of constructing DOP exploits without source code—that is, using only binary representations of programs. The lack of semantic and type information introduces difficulties in identifying data-oriented gadgets and their properties. This research uses binary program analysis techniques and formal methods to identify and verify data-oriented gadgets, and determine if they are reachable and executable from a given memory corruption vulnerability. This information guides the construction of DOP attacks without the need for source code, showing that common-off-the-shelf programs are also vulnerable to this class of exploit.
Adam Bryant, Ph.D. (Committee Co-Chair)
John Emmert, Ph.D. (Committee Co-Chair)
Meilin Liu, Ph.D. (Committee Member)
Krishnaprasad Thirunarayan, Ph.D. (Committee Member)
70 p.
Computer Science
Data-oriented programming; data-oriented exploits; binary program analysis; data flow analysis; program verification; formal methods

Recommended Citations

Citations

  • Sisco, Z. D. (2018). Verifying Data-Oriented Gadgets in Binary Programs to Build Data-Only Exploits [Master's thesis, Wright State University]. OhioLINK Electronic Theses and Dissertations Center. http://rave.ohiolink.edu/etdc/view?acc_num=wright1533308865314126

    APA Style (7th edition)

  • Sisco, Zachary. Verifying Data-Oriented Gadgets in Binary Programs to Build Data-Only Exploits. 2018. Wright State University, Master's thesis. OhioLINK Electronic Theses and Dissertations Center, http://rave.ohiolink.edu/etdc/view?acc_num=wright1533308865314126.

    MLA Style (8th edition)

  • Sisco, Zachary. "Verifying Data-Oriented Gadgets in Binary Programs to Build Data-Only Exploits." Master's thesis, Wright State University, 2018. http://rave.ohiolink.edu/etdc/view?acc_num=wright1533308865314126

    Chicago Manual of Style (17th edition)

wright1533308865314126
624
© 2018, some rights reserved.Creative Commons License Verifying Data-Oriented Gadgets in Binary Programs to Build Data-Only Exploits by Zachary David Sisco is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License. Based on a work at etd.ohiolink.edu.
This open access ETD is published by Wright State University and OhioLINK.