The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

sion of an extended abstract published in Proceedings of ACM CCS 2007, ACM Press, 2007. We present new techniques that allow a return-into-libc attack to be mounted on x86 executables that calls no functions at all. Our attack combines a large number of short instruction sequences to build gadgets that allow arbitrary computation. We show how to discover such instruction sequences by means of static analysis. We make use, in an essential way, of the properties of the x86 instruction set.

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Hovav Shacham
• Keywords: ACM CCS, CCS 2007, Instruction Sequences, Security Privacy, Short Instruction Sequences