论文标题
RISC-V中的面向返回的编程
Return-Oriented Programming in RISC-V
论文作者
论文摘要
RISC-V是基于RISC设计原理的开源硬件ISA，由于其开源性质，它一直是一些新颖的ROP缓解技术建议的主题。但是，很少有工作实际上评估了假设典型的RISC-V实施，这种攻击是否可行。我们证明，RISC-V ROP可用于通过利用GNU LIBC库中的小工具来执行完整的计算和任意功能调用。使用诸如自我修改的ROP链和算法ROP链的生成之类的技术，我们通过创建一个编译器来证明RISC-V ROP的力量，该编译器将用流行的Turing-Complete语言编写的任意复杂性代码转换为RISC-Complete语言中的RISC-C-V ROP链。
RISC-V is an open-source hardware ISA based on the RISC design principles, and has been the subject of some novel ROP mitigation technique proposals due to its open-source nature. However, very little work has actually evaluated whether such an attack is feasible assuming a typical RISC-V implementation. We show that RISC-V ROP can be used to perform Turing complete calculation and arbitrary function calls by leveraging gadgets found in a version of the GNU libc library. Using techniques such as self-modifying ROP chains and algorithmic ROP chain generation, we demonstrate the power of RISC-V ROP by creating a compiler that converts code of arbitrary complexity written in a popular Turing-complete language into RISC-V ROP chains.
