Sound and Efficient Generation of Data-Oriented Exploits via Programming Language Synthesis
No ratings
Presented at USENIX Security 2025 by
Data-oriented programming (DOP) is a methodology for embedding malicious programs into fixed executable vulnerable binaries. DOP is effective for implementing code reuse attacks that exploit memory corruptions without violating many defence techniques, such as non-execute, address space layer randomisation, control flow and code point integrity. Existing approaches for automated exploit generation for DOP follow the program synthesis approach: given a description of an attack phrased as a program, they perform extensive constraint-based search to identify the required payload for the corrupted memory. The program synthesis-inspired approaches come with three major shortcomings regarding (a) efficiency: attack generation often takes prohibitively large amount of time, (b) soundness: they provide no formal guarantees whatsoever that a particular user-described attack is feasible in a particular vulnerable program with suitable payloads, and (c) capability visibility: they do not make clear to users what attack capabilities are admitted by the vulnerable program.