UC San Diego UC San Diego Electronic Theses and Dissertations Title JIT Spraying Threats on ARM and Defense by Diversification Permalink https://escholarship.org/uc/item/0dw3f9k1 Author Lian, Wing-Soon Wilson Publication Date 2016 Peer reviewed|Thesis/dissertation eScholarship.org Powered by the California Digital Library University of California UNIVERSITY OF CALIFORNIA, SAN DIEGO JIT Spraying Threats on ARM and Defense by Diversification A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science by Wing-Soon Wilson Lian Committee in charge: Professor Stefan Savage, Co-Chair Professor Hovav Shacham, Co-Chair Professor Ranjit Jhala Professor Gert Lanckriet Professor Geoffrey M. Voelker 2016 Copyright Wing-Soon Wilson Lian, 2016 All rights reserved. The Dissertation of Wing-Soon Wilson Lian is approved and is acceptable in quality and form for publication on microfilm and electronically: Co-Chair Co-Chair University of California, San Diego 2016 iii TABLE OF CONTENTS Signature Page . iii Table of Contents . iv List of Figures . vii List of Tables . ix Acknowledgements . x Vita................................................................. xii Abstract of the Dissertation . xiii Introduction . 1 Chapter 1 Background . 6 Chapter 2 Assumptions and Threat model . 11 Chapter 3 ARM Architecture . 13 3.1 Instruction sets . 13 3.2 Core registers . 15 3.3 Endianness . 17 3.4 Conditional execution . 17 Chapter 4 JIT Spraying Payloads on ARM. 19 4.1 Introduction . 19 4.2 Controlling JIT compiler output. 21 4.2.1 Attacker-controlled bits . 21 4.2.2 Immediate bits . 22 4.2.3 Register fields . 24 4.2.4 Arithmetic woes . 26 4.3 Same-instruction set self-sustaining payloads on ARM . 27 4.4 Cross-instruction set self-sustaining payloads . 30 4.4.1 Thumb-to-ARM self-sustaining payloads . 30 4.4.2 ARM-to-Thumb self-sustaining payloads . 38 4.5 Gadget chaining payloads . 44 Chapter 5 Thumb gadget chaining against JavaScriptCore . 51 5.1 The JavaScriptCore JavaScript Engine . 51 5.1.1 Low Level Interpreter . 52 iv 5.1.2 Baseline JIT . 52 5.1.3 Data Flow Graph (DFG) JIT . 53 5.1.4 Fourth Tier LLVM (FTL) JIT . 53 5.1.5 JavaScript value representation . 53 5.1.6 JavaScript call stack and calling convention . 54 5.2 Proof of concept gadget chaining attack . 55 5.2.1 Gadget generation . 57 5.2.2 Pinpointing gadgets in memory . 58 5.2.3 Preparing registers and branching to gadgets from JavaScript . 62 5.2.4 Returning from gadgets without crashing . 62 5.2.5 Analysis of the proof of concept attack . 64 Chapter 6 ARM Gadget Chaining against V8 . 67 6.1 The V8 JavaScript Engine . 67 6.2 Proof of concept gadget chaining attack . 68 6.2.1 Gadget layout and creation . 70 6.2.2 Artificial control flow vulnerability . 71 6.2.3 Failure-tolerant invocation. 72 6.2.4 Analysis . 76 Chapter 7 ARM-to-Thumb Self-sustaining JIT Spraying against SpiderMonkey 77 7.1 SpiderMonkey JavaScript Engine . 77 7.1.1 Bytecode Interpreter. 77 7.1.2 Baseline JIT . 78 7.1.3 IonMonkey JIT . 79 7.2 Proof of concept Turing-complete self-sustaining payload . 79 7.2.1 Implementing an SBNZ One Instruction Computer . 79 7.2.2 Encoding challenges . 80 7.2.3 Encoding a NOP sled . 86 7.2.4 System calls . 87 7.2.5 Design shortcomings . 88 Chapter 8 Defensive Just-In-Time Code Emission on ARM . 90 8.1 Introduction . 90 8.2 Survey of Proposed JIT Spraying Mitigations . 91 8.2.1 Capability confinement . 91 8.2.2 Memory protection . 98 8.2.3 Diversification mechanisms . 106 8.2.4 Concrete diversification proposals . 111 8.3 State of Mitigation Deployment . 121 8.3.1 JavaScriptCore . 121 8.3.2 V8 . 125 v 8.3.3 SpiderMonkey . 127 8.3.4 Chakra . 128 8.4 Understanding the costs and benefits of diversification mitigations . 130 8.4.1 Implementations . 131 8.4.2 Evaluation . 146 Chapter 9 Conclusion . 157 Bibliography . 160 vi LIST OF FIGURES Figure 1.1. Illustration of a NOP sled encoded in the bytes implementing the statement x = 0x3c909090 ^0x3c909090 ^0x3c909090; . 9 Figure 4.1. Example of two possible Thumb-mode decodings of a sequence of halfwords. 29 Figure 4.2. Example decoding of four consecutive bytes of little endian instruc- tion memory into two Thumb halfwords and an ARM instruction with both a condition flag and an ALU destination register. 32 Figure 4.3. Illustrations of the three classes of halfwords from which un- intended ARM instructions can draw their most significant half. 33 Figure 4.4. Diagram of the second halfword encoding found in many Thumb ALU instructions with an immediate operand. 34 Figure 4.5. Diagram illustrating the use of 16-bit Thumb branch instructions as the most significant half of unintended ARM instructions.. 37 Figure 4.6. Illustration of ARM-to-Thumb payloads. 40 Figure 4.7. Illustration of how the immediate-operand bitwise AND instruction from the ARM instruction set (top row) can be decoded as two 16-bit Thumb-2 instructions (bottom row). 41 Figure 4.8. Illustration of using a virtual PC (in this case R6) to more efficiently utilize the space skipped over by branches.. 43 Figure 4.9. Diagram of the invocation of the read gadget with arrows showing control flow. ..