Polymorphing Software by Randomizing Data Structure Layout

Abstract. This paper introduces a new software polymorphism technique that randomizes program data structure layout. This technique will generate different data structure layouts for a program and thus diversify the binary code compiled from the same program source code. This technique can mitigate attacks (e.g., kernel rootkit attacks) that require knowledge about data structure definitions. It is also able to disrupt the generation of data structure-based program signatures. We have implemented our data structure layout randomization technique in the open source compiler collection gcc-4.2.4 and applied it to a number of programs. Our evaluation results show that our technique is able to achieve software binary diversity. We also apply the technique to one operating system data structure in order to foil a number of kernel rootkit attacks. Meanwhile, programs produced by the technique were analyzed by a state-of-the-art data structure inference system and it was demonstrated that rel...

• Type: Conference
• Year: 2009
• Where: DIMVA
• Authors: Zhiqiang Lin, Ryan Riley, Dongyan Xu
• Keywords: Data Structure, Data Structure Layout, DIMVA 2007, DIMVA 2009, Kernel Rootkit Attacks