ROP Chain Execution Detection Using Intel PT

No ratings

Presented at ekopartySecurityConference 2018 by

Diego Provinciani

About Intel PTThe Intel Core iX processors incorporate a new technology called Intel Processor Trace. Intel PT allows low-level monitoring of a running process. The information provided by Intel PT is related to the instructions that are being executed by the processor. This information is delivered in different kind of data packets with a specific format. Everything is achieved through dedicated hardware, which is inside the processor package and ensures a low impact on performance.The IdeaTaking the information generated by Intel PT, especially the one related to the execution flow of a traced process, it is possible to apply some heuristics derived from the mitigation technique called Control Flow Integrity (CFI). The CFI mitigation suggests the use of tags in the prologues and epilogues of each function, as well as the use of shadow stacks. Then, by comparing the tags (origin and destination) in the call instructions and the values in the shadow stack with the return addresses in the return instructions, it is possible to confirm if a process is following a valid execution path or not.Our ImplementationThe point is… if we are using Intel PT. Why use shadow stacks? Considering the implementation of Intel PT, it is possible to avoid a software implemented shadow stack and use just the packets generated when a failure occurs because of a mismatch between the information stored in the LBR table and the trace information. So, having some specific sequences of packets, it is possible to confirm that a ROP chain is being executed.