You Can Run but You Can't Read: Preventing Disclosure Exploits in Executable Code

No abstract is available for this paper.

• Publication year

  2014

• Venue

  Conference on Computer and Communications Security

• Publication date

  2014-11-03

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1145/2660267.2660378
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Hacking Blind

  2014cited by this paper
• ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks

  2014cited by this paper
• Out of Control: Overcoming Control-Flow Integrity

  2014cited by this paper
• Size Does Matter: Why Using Gadget-Chain Length to Prevent Code-Reuse Attacks is Hard

  2014cited by this paper
• ROP is Still Dangerous: Breaking Modern Defenses

  2014cited by this paper
• Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection

  2014cited by this paper
• Moving Target Defense II

  2013cited by this paper
• Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization

  2013cited by this paper
• Practical Control Flow Integrity and Randomization for Binary Executables

  2013cited by this paper
• Gadge me if you can: secure and efficient ad-hoc instruction-level randomization for x86 and ARM

  2013influential reference
• Transparent ROP Exploit Mitigation Using Indirect Branch Tracing

  2013cited by this paper
• Control Flow Integrity for COTS Binaries

  2013cited by this paper
• Memory Errors: The Past, the Present, and the Future

  2012cited by this paper
• Return-Oriented Programming: Systems, Languages, and Applications

  2012cited by this paper
• Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization

  2012cited by this paper
• Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization

  2012cited by this paper
• MoCFI: A Framework to Mitigate Control-Flow Attacks on Smartphones

  2012cited by this paper
• Binary stirring: self-randomizing instruction addresses of legacy x86 binary code

  2012influential reference
• ILR: Where'd My Gadgets Go?

  2012cited by this paper
• Moving Target Defense II: Application of Game Theory and Adversarial Modeling

  2012cited by this paper
• Jump-oriented programming: a new class of code-reuse attack

  2011cited by this paper
• On the Expressiveness of Return-into-libc Attacks

  2011cited by this paper
• Adapting Software Fault Isolation to Contemporary CPU Architectures

  2010cited by this paper
• G-Free: defeating return-oriented programming through gadget-less binaries

  2010cited by this paper
• Return-oriented programming without returns

  2010cited by this paper
• Address-space layout randomization using code islands

  2009cited by this paper
• Microsoft Research Silicon Valley

  2009cited by this paper
• Native Client: A Sandbox for Portable, Untrusted x86 Native Code

  2009cited by this paper
• When good instructions go bad: generalizing return-oriented programming to RISC

  2008cited by this paper
• Preventing Memory Error Exploits with WIT

  2008cited by this paper
• The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

  2007cited by this paper
• Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software

  2006cited by this paper
• Efficient Techniques for Comprehensive Protection from Memory Error Exploits

  2005cited by this paper
• On the effectiveness of address-space randomization

  2004cited by this paper
• Smashing the stack for fun and prot

  1996cited by this paper
• Smashing The Stack For Fun And Profit

  1996cited by this paper

• Oreo: Protecting ASLR Against Microarchitectural Attacks

  2025cites this paper
• Timing and Speculative Execution Attacks: Defeating State-of-the-Art Code-Reuse Defenses

  2025cites this paper
• PortPrint: Identifying Inaccessible Code with Port Contention

  2025cites this paper
• Lixom: Protecting Encryption Keys with Execute-Only Memory

  2025cites this paper
• War on JITs: Software-Based Attacks and Hybrid Defenses for JIT Compilers - A Comprehensive Survey

  2025cites this paper
• PtrProxy: Efficient code re-randomization on AArch64 platform

  2025cites this paper
• Overview of the Code-Reuse Attacks Mitigations, and Evaluation using SMAA-2 Approach

  2025cites this paper
• Retrofitting XoM for Stripped Binaries without Embedded Data Relocation

  2024influential citation
• sMVX: Multi-Variant Execution on Selected Code Paths

  2024cites this paper
• What you can read is what you can't execute

  2023cites this paper
• Teacher Efforts in Increasing Student Interest in Reading the Quran

  2022cites this paper
• AppBastion: Protection from Untrusted Apps and OSes on ARM

  2022cites this paper
• Pagoda: Towards Binary Code Privacy Protection with SGX-based Execute-Only Memory

  2022cites this paper
• MProbe: Make the code probing meaningless

  2022cites this paper
• ExOShim: preventing memory disclosure using execute-only kernel code

  2022cites this paper
• SeBROP: blind ROP attacks without returns

  2022cites this paper
• Exploitation Techniques for Data-oriented Attacks with Existing and Potential Defense Approaches

  2021cites this paper
• Tutorial: Investigating Advanced Exploits for System Security Assurance

  2021cites this paper
• Obfuscation-Resilient Executable Payload Extraction From Packed Malware

  2021cites this paper
• Mitigating Memory-Safety Bugs with Efficient Out-of-Process Integrity Checking

  2021cites this paper
• Securely Sharing Randomized Code That Flies

  2021cites this paper
• Experience Paper: sgx-dl: dynamic loading and hot-patching for secure applications

  2021cites this paper
• Software-driven Security Attacks: From Vulnerability Sources to Durable Hardware Defenses

  2021cites this paper
• Fine-Grained Isolation to Protect Data against In-Process Attacks on AArch64

  2020cites this paper
• xMP: Selective Memory Protection for Kernel and User Space

  2020cites this paper
• Enhancing Randomization Entropy of x86-64 Code while Preserving Semantic Consistency

  2020cites this paper
• De-randomizing the Code Segment with Timing Function Attack

  2020influential citation
• IskiOS: Intra-kernel Isolation and Security using Memory Protection Keys.

  2020cites this paper
• Quantitative Assessment on the Limitations of Code Randomization for Legacy Binaries

  2020cites this paper
• CoDaRR: Continuous Data Space Randomization against Data-Only Attacks

  2020cites this paper
• Speculative Probing: Hacking Blind in the Spectre Era

  2020cites this paper
• Poster: Methodologies for Quantifying (Re-) Randomization Security and Timing under JIT-ROP

  2020cites this paper
• Instruction Set Randomization: An Updated Implementation

  2020cites this paper
• Fast Execute-Only Memory for Embedded Systems

  2020cites this paper
• Secure and efficient in-process monitor (and library) protection with Intel MPK

  2020cites this paper
• Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

  2020cites this paper
• MPTEE: bringing flexible and efficient memory protection to Intel SGX

  2020cites this paper
• Preventing Code Reuse Attacks On Modern Operating Systems

  2020influential citation
• A Survey of Exploitation Techniques and Defenses for Program Data Attacks

  2020cites this paper
• NoJITsu: Locking Down JavaScript Engines

  2020influential citation
• Methodologies for Quantifying (Re-)randomization Security and Timing under JIT-ROP

  2019influential citation
• Kernel Protection Against Just-In-Time Code Reuse

  2019cites this paper
• SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)

  2019cites this paper
• Measuring Attack Surface Reduction in the Presence of Code (Re-)Randomization

  2019influential citation
• uXOM: Efficient eXecute-Only Memory on ARM Cortex-M

  2019cites this paper
• The Leakage-Resilience Dilemma

  2019cites this paper
• An Approach of Code Pointer Hiding Based on a Resilient Area

  2019cites this paper
• Making Code Re-randomization Practical with MARDU

  2019cites this paper
• Exploitation Techniques and Defenses for Data-Oriented Attacks

  2019cites this paper
• Revisiting the Arm Debug Facility for OS Kernel Security

  2019cites this paper
• User centric privacy policy modelling

  2019cites this paper
• A Survey of Research on Runtime Rerandomization Under Memory Disclosure

  2019cites this paper
• Fast Intra-kernel Isolation and Security with IskiOS

  2019cites this paper
• Repurposing Software Defenses with Specialized Hardware

  2019cites this paper
• STEROIDS for DOPed Applications: A Compiler for Automated Data-Oriented Programming

  2019cites this paper
• ProbeGuard: Mitigating Probing Attacks Through Reactive Program Transformations

  2019cites this paper
• IskiOS: Lightweight Defense Against Kernel-Level Code-Reuse Attacks

  2019cites this paper
• High-performance and Secure Just-in-time Compiler Protection (preliminary version)

  2018cites this paper
• Safe and secure model-driven design for embedded systems

  2018cites this paper
• Diversity and information leaks

  2018cites this paper
• Multi-variant execution environments

  2018cites this paper
• Attacking dynamic code

  2018cites this paper
• How memory safety violations enable exploitation of programs

  2018cites this paper
• Preface

  2018cites this paper
• Shredder: Breaking Exploits through API Specialization

  2018cites this paper
• Compiler-Assisted Code Randomization

  2018cites this paper
• Position-Independent Code Reuse: On the Effectiveness of ASLR in the Absence of Information Disclosure

  2018cites this paper
• IMIX: In-Process Memory Isolation EXtension

  2018cites this paper
• Protecting Instruction Set Randomization from Code Reuse Attacks

  2018cites this paper
• An Exploratory Analysis of Microcode as a Building Block for System Defenses

  2018cites this paper
• Safe and secure model-driven design for embedded systems. (Approche orientée modèles pour la sûreté et la sécurité des systèmes embarqués)

  2018cites this paper
• Bytecode Corruption Attacks Are Real - And How to Defend Against Them

  2018cites this paper
• On the Weaknesses of Function Table Randomization

  2018cites this paper
• Record-Replay Architecture as a General Security Framework

  2018cites this paper
• BoundShield: Comprehensive Mitigation for Memory Disclosure Attacks via Secret Region Isolation

  2018cites this paper
• ROPNN: Detection of ROP Payloads Using Deep Neural Networks

  2018cites this paper
• EPTI: Efficient Defence against Meltdown Attack for Unpatched VMs

  2018cites this paper
• Protecting dynamic code

  2018cites this paper
• SoK: Make JIT-Spray Great Again

  2018cites this paper
• Function Risk Assessment Under Memory Leakage

  2018cites this paper
• Hardware control flow integrity

  2018cites this paper
• Reviving instruction set randomization

  2017cites this paper
• Breaking and Fixing Destructive Code Read Defenses

  2017cites this paper
• kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse

  2017influential citation
• CodeArmor: Virtualizing the Code Space to Counter Disclosure Attacks

  2017influential citation
• Protecting COTS Binaries from Disclosure-guided Code Reuse Attacks

  2017influential citation
• The Dynamics of Innocent Flesh on the Bone: Code Reuse Ten Years Later

  2017cites this paper
• Hardware-Assisted Dependable Systems

  2017cites this paper
• Composite Software Diversification

  2017cites this paper
• Revisiting Browser Security in the Modern Era: New Data-Only Attacks and Defenses

  2017cites this paper
• Pinpointing Vulnerabilities

  2017cites this paper
• An Evil Copy: How the Loader Betrays You

  2017cites this paper
• Execution Integrity with In-Place Encryption

  2017cites this paper
• SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs

  2017cites this paper
• Secure In-Cache Execution

  2017cites this paper
• Securing software systems by preventing information leaks

  2017cites this paper
• Large-Scale Automated Software Diversity—Program Evolution Redux

  2017cites this paper
• Address Oblivious Code Reuse: On the Effectiveness of Leakage Resilient Diversity

  2017influential citation
• SGXBOUNDS: Memory Safety for Shielded Execution

  2017cites this paper
• Defeating Zombie Gadgets by Re-randomizing Code upon Disclosure

  2017cites this paper