MAO &amp;#x2014; An extensible micro-architectural optimizer

Hundt,; Raman, Aaswath; Thuresson,; Vachharajani,

doi:10.1109/cgo.2011.5764669

Cited by 25 publications

(17 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some works focus on the structural analysis of the whole program graph to identify common patterns [5,10] or some other ways to simplify the structure of the graph [14,5,9] or even discover non-trivial equivalence in it [10,13]. These methods focus on the control flow nature of the machine code, on the basic block level, they do not attempt to modify the code using the data flow information.…”

Section: Related Workmentioning

confidence: 99%

“…Future work will include evaluation of other code transformation methods used together with instruction reordering, such as pattern based instruction substitution [14,4,17] and also exploiting the basic principles of the split-stream compression. The data types used in this work can be also refined using much more sophisticated analysis on memory access, especially on the stack.…”

Section: Future Workmentioning

confidence: 99%

See 1 more Smart Citation

x86 Instruction Reordering for Code Compression

Paroczi¹

2013

Acta Cybern

View full text Add to dashboard Cite

Runtime executable code compression is a method which uses standard data compression methods and binary machine code transformations to achieve smaller file size, yet maintaining the ability to execute the compressed file as a regular executable. With a disassembler, an almost perfect instructional and functional level disassembly can be generated. Using the structural information of the compiled machine code each function can be split into so called basic blocks.In this work we show that reordering instructions within basic blocks using data flow constraints can improve code compression without changing the behavior of the code. We use two kinds of data affection (read, write) and 20 data types including registers: 8 basic x86 registers, 11 eflags, and memory data. Due to the complexity of the reordering, some simplification is required. Our solution is to search local optimum of the compression on the function level and then combine the results to get a suboptimal global result.Using the reordering method better results can be achieved, namely the compression size gain for gzip can be as high as 1.24%, for lzma 0.68% on the tested executables.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Future Workmentioning

confidence: 99%

x86 Instruction Reordering for Code Compression

Paroczi¹

2013

Acta Cybern

View full text Add to dashboard Cite

show abstract

“…Therefore our current prototype does not handle inline assembly; this is not a fundamental limitation of our approach however. To make sure that every load is properly masked in the presence of assembly code, we could extend the LLVM code emitter or an assemblyrewriting framework such as MAO [26] with load-masking and code pointer hiding passes. Since the code is not in SSA form at this stage we can not apply our optimizations.…”

Section: B Assembly Codementioning

confidence: 99%

Leakage-Resilient Layout Randomization for Mobile Devices

Braden¹,

Crane

Davi

et al. 2016

Proceedings 2016 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Attack techniques based on code reuse continue to enable real-world exploits bypassing all current mitigations. Code randomization defenses greatly improve resilience against code reuse. Unfortunately, sophisticated modern attacks such as JIT-ROP can circumvent randomization by discovering the actual code layout on the target and relocating the attack payload on the fly. Hence, effective code randomization additionally requires that the code layout cannot be leaked to adversaries.Previous approaches to leakage-resilient diversity have either relied on hardware features that are not available in all processors, particularly resource-limited processors commonly found in mobile devices, or they have had high memory overheads. We introduce a code randomization technique that avoids these limitations and scales down to mobile and embedded devices: Leakage-Resilient Layout Randomization (LR 2 ).Whereas previous solutions have relied on virtualization, x86 segmentation, or virtual memory support, LR 2 merely requires the underlying processor to enforce a W⊕X policy-a feature that is virtually ubiquitous in modern processors, including mobile and embedded variants. Our evaluation shows that LR 2 provides the same security as existing virtualization-based solutions while avoiding design decisions that would prevent deployment on less capable yet equally vulnerable systems. Although we enforce execute-only permissions in software, LR 2 is as efficient as the best-in-class virtualization-based solution. I. MOTIVATIONThe recent "Stagefright" vulnerability exposed an estimated 950 million Android systems to remote exploitation [21]. Similarly, the "One Class to Rule them All" [40] zero-day vulnerability affected 55% of all Android devices. These are just the most recent incidents in a long series of vulnerabilities that enable attackers to mount code-reuse attacks [37,43] against mobile devices. Moreover, because these devices run scripting capable web browsers, they are also exposed to sophisticated code-reuse attacks that can bypass ASLR and even finegrained code randomization by exploiting information-leakage vulnerabilities [11,20,48,50]. Just-in-time attacks (JIT-ROP) [50] are particularly challenging because they misuse run-time scripting to analyze the target memory layout after randomization and relocate a return-oriented programming (ROP) payload accordingly.There are several alternatives to code randomization aimed to defend against code-reuse attacks, including control-flow integrity (CFI) [1] and code-pointer integrity (CPI) [28]. However, these defenses come with their own set of challenges and tend to have high worst-case performance overheads. We focus on code randomization techniques since they are known to be efficient [18,25] and scalable to complex, real-world applications such as web browsers, language runtimes, and operating system kernels without the need to perform elaborate static program analysis during compilation.Recent code randomization defenses offer varying degrees of resilience to JIT...

show abstract

“…Compilers insert NOPs in programs for various purposes: (i) to enforce aligment of basic blocks, functions or other code blocks (for performance and security); (ii) to add timing delays to code fragments (for contention mitigation) [35]; (iii) to compensate for microarchitectural limitations, such as those in the branch predictor [15].…”

Section: Our Approachmentioning

confidence: 99%

Profile-guided automated software diversity

Homescu

Neisius

Larsen

et al. 2013

Proceedings of the 2013 IEEE/ACM International Symposium on Code Generation and Optimization (CGO)

View full text Add to dashboard Cite

Code-reuse attacks are notoriously hard to defeat, and most current solutions to the problem focus on automated software diversity. This is a promising area of research, as diversity attacks the common denominator enabling code-reuse attacks-the software monoculture. Recent research in this area provides security, but at an unfortunate price: performance overhead.Leveraging previously collected profiling information, compilers can substantially improve subsequent code generation. Traditionally, profile-guided optimization focuses on hot program code, where a program spends most of its execution time. Optimizing rarely executed code does not significantly impact performance, so few optimizations focus on this code.We use profile-guided optimization to reduce the performance overhead of software diversity. The primary insight is that we are free to diversify cold code, but restrict our diversification efforts in hot code.Our work investigates the impact of profiling on an expensive diversification technique: NOP insertion. By differentiating between hot cold and cold code, we optimize NOP insertion overheads from a maximum of 25% down to a negligible 1%, while preserving the security properties of the original defense. Consequently, using our profile-guided diversification technique, even randomization techniques having a high performance overhead become practical.

show abstract

MAO — An extensible micro-architectural optimizer

Cited by 25 publications

References 10 publications

x86 Instruction Reordering for Code Compression

x86 Instruction Reordering for Code Compression

Leakage-Resilient Layout Randomization for Mobile Devices

Profile-guided automated software diversity

Contact Info

Product

Resources

About