Detecting Return Oriented Programming by Examining Positions of Saved Return Addresses

Abstract

In the recent years, return-oriented programming (ROP) has become the most widely used exploitation technique, achieving arbitrary code execution without injecting any code at all. This is possible by executing small sequences of assembly instructions found in binaries, also known as gadgets. Gadgets cannot do complex operations by themselves but when chained together, they can do any arbitrary operations theoretically. There were many mitigations proposed in the past but they either introduced large overhead or were too complex. In this paper, we propose a simple method of detecting ROP attacks by calculating distance between saved return addresses in the runtime stack. Examined ROP exploits which were published on the Internet resulted short distances between return addresses, which are gadget addresses, compared to that of normal control flow of the program. Our method can be used as a stand-alone tool or part of sequential checks in existing tools.