RiscyROP: Automated Return-Oriented Programming Attacks on RISC-V and ARM64
Tobias Cloosters, David Paaßen, Jian‐qiang Wang, Oussama Draissi, Patrick Jauernig, Emmanuel Stapf, Lucas Davi, Ahmad‐Reza Sadeghi
Abstract
Return-oriented programming (ROP) is a powerful run-time exploitation technique to attack vulnerable software. Modern RISC architectures like RISC-V and ARM64 pose new challenges for ROP execution due to the lack of a stack-based return instruction and strict instruction alignment. Further, the large number of caller-saved argument registers significantly reduces the gadget space available to the attacker. Consequently, existing ROP gadget tools for other processor architectures cannot be applied to these RISC architectures. Previous work on RISC-V provides only manual construction of ROP attacks against specially crafted programs, and no analysis of ROP attacks has been conducted for ARM64 yet.