LGadget: ROP Exploit based on Long Instruction Sequences

since ROP (Return Oriented Programming) has been put forward, it has broken the limit of protection strategy against malware. Finer granularity of control and complete expression make traditional defense against control flow attacks fail. In recent years, defense of ROP has made some progress. Some detection methods based on the short length of gadgets in ROP shellcode largely limit ROP. In this paper, we propose a new way of generating ROP shellcode by long instruction sequences called LGadget and design an algorithm to recognize the register dependency among instructions in LGadgets. Moreover, we build a Turing-complete instruction set based on LGadgets. By using our Turing-complete set, we construct a ROP exploit, which can break through the above-mentioned detection methods. Keywords—ROP, program security, LGadget, Turing-complete