5

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal:

-mmitigate-rop
    Try to avoid generating code sequences that contain unintended return
    opcodes, to mitigate against certain forms of attack. At the moment, this
    option is limited in what it can do and should not be relied on to provide
    serious protection.

I am trying to figure out exactly how it works in order to assess how effective it actually is against ROP. I read through the source code but it is difficult to understand without knowing GCC internals. My hunch is that it is rather useless and trivial to bypass, but as I don't even know the theory behind it (it clearly isn't true CFI like clang's ROP mitigations), I can't even begin to assess it. Perhaps it ensures that opcodes which, if read with a different offset, could not decode to a ret? I would like to know how this feature works and what its implications are for realistic ROP chains.

The functions that seem relevant to this feature are copied below (in no particular order).

/* Return true if T is one of the bytes we should avoid with
   -mmitigate-rop.  */

static bool
ix86_rop_should_change_byte_p (int t)
{
  return t == 0xc2 || t == 0xc3 || t == 0xca || t == 0xcb;
}

/* Given an insn INSN with NOPERANDS OPERANDS, return the modr/m byte used
   in its encoding if it could be relevant for ROP mitigation, otherwise
   return -1.  If POPNO0 and POPNO1 are nonnull, store the operand numbers
   used for calculating it into them.  */

static int
ix86_get_modrm_for_rop (rtx_insn *insn, rtx *operands, int noperands,
            int *popno0 = 0, int *popno1 = 0)
{
  if (asm_noperands (PATTERN (insn)) >= 0)
    return -1;
  int has_modrm = get_attr_modrm (insn);
  if (!has_modrm)
    return -1;
  enum attr_modrm_class cls = get_attr_modrm_class (insn);
  rtx op0, op1;
  switch (cls)
    {
    case MODRM_CLASS_OP02:
      gcc_assert (noperands >= 3);
      if (popno0)
    {
      *popno0 = 0;
      *popno1 = 2;
    }
      op0 = operands[0];
      op1 = operands[2];
      break;
    case MODRM_CLASS_OP01:
      gcc_assert (noperands >= 2);
      if (popno0)
    {
      *popno0 = 0;
      *popno1 = 1;
    }
      op0 = operands[0];
      op1 = operands[1];
      break;
    default:
      return -1;
    }
  if (REG_P (op0) && REG_P (op1))
    {
      int enc0 = reg_encoded_number (op0);
      int enc1 = reg_encoded_number (op1);
      return 0xc0 + (enc1 << 3) + enc0;
    }
  return -1;
}

/* Given a register number BASE, the lowest of a group of registers, update
   regsets IN and OUT with the registers that should be avoided in input
   and output operands respectively when trying to avoid generating a modr/m
   byte for -mmitigate-rop.  */

static void
set_rop_modrm_reg_bits (int base, HARD_REG_SET &in, HARD_REG_SET &out)
{
  SET_HARD_REG_BIT (out, base);
  SET_HARD_REG_BIT (out, base + 1);
  SET_HARD_REG_BIT (in, base + 2);
  SET_HARD_REG_BIT (in, base + 3);
}

/* Called if -mmitigate-rop is in effect.  Try to rewrite instructions so
   that certain encodings of modr/m bytes do not occur.  */
static void
ix86_mitigate_rop (void)
{
  HARD_REG_SET input_risky;
  HARD_REG_SET output_risky;
  HARD_REG_SET inout_risky;

  CLEAR_HARD_REG_SET (output_risky);
  CLEAR_HARD_REG_SET (input_risky);
  SET_HARD_REG_BIT (output_risky, AX_REG);
  SET_HARD_REG_BIT (output_risky, CX_REG);
  SET_HARD_REG_BIT (input_risky, BX_REG);
  SET_HARD_REG_BIT (input_risky, DX_REG);
  set_rop_modrm_reg_bits (FIRST_SSE_REG, input_risky, output_risky);
  set_rop_modrm_reg_bits (FIRST_REX_INT_REG, input_risky, output_risky);
  set_rop_modrm_reg_bits (FIRST_REX_SSE_REG, input_risky, output_risky);
  set_rop_modrm_reg_bits (FIRST_EXT_REX_SSE_REG, input_risky, output_risky);
  set_rop_modrm_reg_bits (FIRST_MASK_REG, input_risky, output_risky);
  set_rop_modrm_reg_bits (FIRST_BND_REG, input_risky, output_risky);
  COPY_HARD_REG_SET (inout_risky, input_risky);
  IOR_HARD_REG_SET (inout_risky, output_risky);

  df_note_add_problem ();
  /* Fix up what stack-regs did.  */
  df_insn_rescan_all ();
  df_analyze ();

  regrename_init (true);
  regrename_analyze (NULL);

  auto_vec cands;

  for (rtx_insn *insn = get_insns (); insn; insn = NEXT_INSN (insn))
    {
      if (!NONDEBUG_INSN_P (insn))
    continue;

      if (GET_CODE (PATTERN (insn)) == USE
      || GET_CODE (PATTERN (insn)) == CLOBBER)
    continue;

      extract_insn (insn);

      int opno0, opno1;
      int modrm = ix86_get_modrm_for_rop (insn, recog_data.operand,
                      recog_data.n_operands, &opno0,
                      &opno1);

      if (!ix86_rop_should_change_byte_p (modrm))
    continue;

      insn_rr_info *info = &insn_rr[INSN_UID (insn)];

      /* This happens when regrename has to fail a block.  */
      if (!info->op_info)
    continue;

      if (info->op_info[opno0].n_chains != 0)
    {
      gcc_assert (info->op_info[opno0].n_chains == 1);
      du_head_p op0c;
      op0c = regrename_chain_from_id (info->op_info[opno0].heads[0]->id);
      if (op0c->target_data_1 + op0c->target_data_2 == 0
          && !op0c->cannot_rename)
        cands.safe_push (op0c);

      op0c->target_data_1++;
    }
      if (info->op_info[opno1].n_chains != 0)
    {
      gcc_assert (info->op_info[opno1].n_chains == 1);
      du_head_p op1c;
      op1c = regrename_chain_from_id (info->op_info[opno1].heads[0]->id);
      if (op1c->target_data_1 + op1c->target_data_2 == 0
          && !op1c->cannot_rename)
        cands.safe_push (op1c);

      op1c->target_data_2++;
    }
    }

  int i;
  du_head_p head;
  FOR_EACH_VEC_ELT (cands, i, head)
    {
      int old_reg, best_reg;
      HARD_REG_SET unavailable;

      CLEAR_HARD_REG_SET (unavailable);
      if (head->target_data_1)
    IOR_HARD_REG_SET (unavailable, output_risky);
      if (head->target_data_2)
    IOR_HARD_REG_SET (unavailable, input_risky);

      int n_uses;
      reg_class superclass = regrename_find_superclass (head, &n_uses,
                            &unavailable);
      old_reg = head->regno;
      best_reg = find_rename_reg (head, superclass, &unavailable,
                  old_reg, false);
      bool ok = regrename_do_replace (head, best_reg);
      gcc_assert (ok);
      if (dump_file)
    fprintf (dump_file, "Chain %d renamed as %s in %s\n", head->id,
         reg_names[best_reg], reg_class_names[superclass]);

    }

  regrename_finish ();

  df_analyze ();

  basic_block bb;
  regset_head live;

  INIT_REG_SET (&live);

  FOR_EACH_BB_FN (bb, cfun)
    {
      rtx_insn *insn;

      COPY_REG_SET (&live, DF_LR_OUT (bb));
      df_simulate_initialize_backwards (bb, &live);

      FOR_BB_INSNS_REVERSE (bb, insn)
    {
      if (!NONDEBUG_INSN_P (insn))
        continue;

      df_simulate_one_insn_backwards (bb, insn, &live);

      if (GET_CODE (PATTERN (insn)) == USE
          || GET_CODE (PATTERN (insn)) == CLOBBER)
        continue;

      extract_insn (insn);
      constrain_operands_cached (insn, reload_completed);
      int opno0, opno1;
      int modrm = ix86_get_modrm_for_rop (insn, recog_data.operand,
                          recog_data.n_operands, &opno0,
                          &opno1);
      if (modrm  %d\n", i);
      rtx newreg = gen_rtx_REG (recog_data.operand_mode[opno1], i);
      validate_change (insn, recog_data.operand_loc[opno1], newreg, false);
      insn = emit_insn_before (gen_move_insn (newreg, oldreg), insn);
    }
    }
}
1

Looks like it was added: https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html

I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted as a return.

  • That does indeed sound very limited. I do hope the feature is extended to actually reduce gadgets. – forest Mar 11 '18 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.