14 ms·
Say, if hardware checked that RET transfers control to a place that's immediately preceded by a CALL instruction, would that help?
by Joker_vD 3y ago
Say, if hardware checked that RET transfers control to a place that's immediately preceded by a CALL instruction, would that help?
- deadbeeves 3y agoThat would disable certain mechanisms that are occasionally useful. For example, to implement user-mode context switches and function hooking.
- saagarjha 3y agoIt would help but it wouldn’t solve ROP. I think it would probably be less useful than gadget reduction, honestly, since there are a lot of useful sequences after a call instruction.
- IshKebab 3y agoARM's Branch Target Identification does something similar to that (but for jumps & calls, not returns).
- cryptonector 3y agoA shadow stack of return addresses would help.
- hovav 3y agoIt would not help at all. See (all of, but especially) section 5.4 of N. Carlini, A. Barresi, M. Payer, D. Wagner, and T.R. Gross, "Control-Flow Bending: On the Effectiveness of Control-Flow Integrity," in proc. USENIX Security 2015, https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/carlini https://www.usenix.org/conference/usenixsecurity15/technical...