ReARM: Protecting ARM Binaries via Load-time Reduction and Run-time Read-Protection
Wed 08.23.17
ReARM: Protecting ARM Binaries via Load-time Reduction and Run-time Read-Protection
Wed 08.23.17
Wed 08.23.17
Wed 08.23.17
Wed 08.23.17
Wed 08.23.17
This project aims to discover and develop new techniques in software de-bloating, i.e. removing unusable code from software. This unusable code increases the attack surface of the software and removing it from the software is a promising countermeasure against exploitation. There are limitations to current software de-bloating technology, such as the fact that existing work only removes a small amount of unusable code, leaving remaining useable code vulnerable to attack, and the fact that such programs generally target x86 platforms, rather than Advanced RISC Machines or ARM.
In order to combat these issues, the project team is designing and implementing ReARM, a framework able to perform load-time reduction of ARM binaries, such as on-demand and learning-based loading of code, as well as enforce run-time read-protection of loaded code, such as transforming and mapping code to hidden, execute-only memory pages. ReARM will not require any assistance from developers or end users because it will work on commercial off the shelf (COTS) binaries. ReARM will have the ability to learn and pre-load heavily used code-pages. During program execution, ReARM will compare code transfers with code pages in order to make sure that the absent page is compliant. REARM dynamically transforms code being loaded; it maps code into executable-only memory pages, relocates embedded data in such pages, and updates data references and symbol information accordingly. This transformation, without breaking program executions or permanently changing executable files, protects loaded code (i.e., permanent code) against exploitations.
This project aims to discover and develop new techniques in software de-bloating, i.e. removing unusable code from software. This unusable code increases the attack surface of the software and removing it from the software is a promising countermeasure against exploitation. There are limitations to current software de-bloating technology, such as the fact that existing work only removes a small amount of unusable code, leaving remaining useable code vulnerable to attack, and the fact that such programs generally target x86 platforms, rather than Advanced RISC Machines or ARM.
In order to combat these issues, the project team is designing and implementing ReARM, a framework able to perform load-time reduction of ARM binaries, such as on-demand and learning-based loading of code, as well as enforce run-time read-protection of loaded code, such as transforming and mapping code to hidden, execute-only memory pages. ReARM will not require any assistance from developers or end users because it will work on commercial off the shelf (COTS) binaries. ReARM will have the ability to learn and pre-load heavily used code-pages. During program execution, ReARM will compare code transfers with code pages in order to make sure that the absent page is compliant. REARM dynamically transforms code being loaded; it maps code into executable-only memory pages, relocates embedded data in such pages, and updates data references and symbol information accordingly. This transformation, without breaking program executions or permanently changing executable files, protects loaded code (i.e., permanent code) against exploitations.