{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T15:10:22Z","timestamp":1773155422237,"version":"3.50.1"},"publisher-location":"Cham","reference-count":39,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319465975","type":"print"},{"value":"9783319465982","type":"electronic"}],"license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016]]},"DOI":"10.1007\/978-3-319-46598-2_15","type":"book-chapter","created":{"date-parts":[[2016,9,15]],"date-time":"2016-09-15T18:31:00Z","timestamp":1473964260000},"page":"212-228","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["PSHAPE: Automatically Combining Gadgets for Arbitrary Method Execution"],"prefix":"10.1007","author":[{"given":"Andreas","family":"Follner","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alexandre","family":"Bartel","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hui","family":"Peng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu-Chen","family":"Chang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kyriakos","family":"Ispoglou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mathias","family":"Payer","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Eric","family":"Bodden","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,9,17]]},"reference":[{"key":"15_CR1","unstructured":"Andersen, S., Abella, V.: Memory protection technologies. \n                    https:\/\/technet.microsoft.com\/en-us\/library\/bb457155.aspx\n                    \n                  , August 2004"},{"key":"15_CR2","unstructured":"Athanasakis, M., Athanasopoulos, E., Polychronakis, M., Portokalidis, G., Ioannidis, S.: The devil is in the constants: Bypassing defenses in browser JIT engines. In: 22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, February 8\u201311, 2014 (2015)"},{"key":"15_CR3","doi-asserted-by":"crossref","unstructured":"Bittau, A., Belay, A., Mashtizadeh, A., Mazi\u00e8res, D., Boneh, D.: Hacking blind. In: Proceedings of the IEEE Symposium on Security and Privacy, SP 2014, pp. 227\u2013242. IEEE Computer Society, Washington, DC (2014)","DOI":"10.1109\/SP.2014.22"},{"key":"15_CR4","doi-asserted-by":"crossref","unstructured":"Bletsch, T., Jiang, X., Freeh, V.W., Liang, Z.: Jump-oriented programming: a new class of code-reuse attack. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2011, pp. 30\u201340. ACM, New York (2011)","DOI":"10.1145\/1966913.1966919"},{"key":"15_CR5","unstructured":"Bray, B.: Compiler security checks in depth, February 2002. \n                    http:\/\/msdn.microsoft.com\/en-us\/library\/aa290051(v=vs.71).aspx"},{"key":"15_CR6","unstructured":"Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-R., Shacham, H., Winandy, M.: Return-oriented programming without returns. In: Proceedings of the 17th ACM Conference on Computer and Communications Security (USA, 2010), CCS 2010, pp. 559\u2013572. ACM, New York, NY (2010)"},{"key":"15_CR7","unstructured":"Chen, X.: Aslr bypass apocalypse in recent zero-day exploits. \n                    https:\/\/www.fireeye.com\/blog\/threat-research\/2013\/10\/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html"},{"key":"15_CR8","doi-asserted-by":"crossref","unstructured":"Cheng, Y., Zhou, Z., Yu, M., Ding, X., Deng, R.H.: Ropecker: A generic and practical approach for defending against ROP attacks. In: NDSS (2014)","DOI":"10.14722\/ndss.2014.23156"},{"key":"15_CR9","doi-asserted-by":"crossref","unstructured":"Davi, L., Sadeghi, A.-R., Winandy, M.: Ropdefender: a detection tool to defend against return-oriented programming attacks. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2011, pp. 40\u201351. ACM, New York (2011)","DOI":"10.1145\/1966913.1966920"},{"key":"15_CR10","unstructured":"Dinh, L.L.: Ropeme - rop exploit made easy. \n                    https:\/\/github.com\/packz\/ropeme"},{"key":"15_CR11","unstructured":"Eeckhoutte, P. V. mona.py. \n                    https:\/\/github.com\/corelan\/mona"},{"key":"15_CR12","unstructured":"Federico, A.D., Cama, A., Shoshitaishvili, Y., Kruegel, C., Vigna, G.: How the elf ruined christmas. In 24th USENIX Security Symposium (USENIX Security 15), pp. 643\u2013658. USENIX Association, Washington, D.C. (2015)"},{"key":"15_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"155","DOI":"10.1007\/978-3-319-30806-7_10","volume-title":"Engineering Secure Software and Systems","author":"A Follner","year":"2016","unstructured":"Follner, A., Bartel, A., Bodden, E.: Analyzing the gadgets. In: Caballero, J., et al. (eds.) ESSoS 2016. LNCS, vol. 9639, pp. 155\u2013172. Springer, Heidelberg (2016). doi:\n                    10.1007\/978-3-319-30806-7_10"},{"key":"15_CR14","first-page":"3","volume":"82","author":"A Follner","year":"2016","unstructured":"Follner, A., Bodden, E.: Ropocop - dynamic mitigation of code-reuse attacks. J. Inf. Secur. Appl. 82, 3\u201322 (2016)","journal-title":"J. Inf. Secur. Appl."},{"key":"15_CR15","unstructured":"Fraser, L.: Roper. \n                    https:\/\/github.com\/oblivia-simplex\/roper"},{"key":"15_CR16","unstructured":"Gallo, M.: Agafi. \n                    https:\/\/github.com\/CoreSecurity\/Agafi"},{"key":"15_CR17","doi-asserted-by":"crossref","unstructured":"G\u00f6ktas, E., Athanasopoulos, E., Bos, H., Portokalidis, G.: Out of control: Overcoming control-flow integrity. In: Proceedings of the IEEE Symposium on Security and Privacy SP 2014, pp. 575\u2013589. IEEE Computer Society, Washington, DC (2014)","DOI":"10.1109\/SP.2014.43"},{"key":"15_CR18","unstructured":"Howard, M., Miller, M., Lambert, J., Thomlinson, M.: Windows isv software security defenses, December 2010. \n                    http:\/\/msdn.microsoft.com\/en-us\/library\/bb430720.aspx"},{"key":"15_CR19","doi-asserted-by":"crossref","unstructured":"Hund, R., Willems, C., Holz, T.: Practical timing side channel attacks against kernel space aslr. In: Proceeding of the IEEE Symposium on Security and Privacy SP 2013, pp. 191\u2013205. IEEE Computer Society, Washington, DC (2013)","DOI":"10.1109\/SP.2013.23"},{"key":"15_CR20","unstructured":"Metasploit. Msfrop. \n                    http:\/\/www.offensive-security.com\/metasploit-unleashed\/msfrop"},{"key":"15_CR21","doi-asserted-by":"crossref","unstructured":"Nethercote, N., Seward, J.: Valgrind: a framework for heavyweight dynamic binary instrumentation. In: ACM Sigplan notices, ACM (2007)","DOI":"10.1145\/1250734.1250746"},{"key":"15_CR22","unstructured":"Nguyen, A.Q.: Capstone: Next generation disassembly framework. \n                    http:\/\/www.capstone-engine.org\/BHUSA2014-capstone.pdf"},{"key":"15_CR23","unstructured":"Nguyen, A.Q.: Optirop. \n                    https:\/\/media.blackhat.com\/us-13\/US-13-Quynh-OptiROP-Hunting-for-ROP-Gadgets-in-Style-WP.pdf"},{"key":"15_CR24","unstructured":"Pakt. Ropc. \n                    https:\/\/github.com\/pakt\/ropc"},{"key":"15_CR25","unstructured":"Pappas, V., Polychronakis, M., Keromytis, A.D.: Transparent rop exploit mitigation using indirect branch tracing. In: Proceedings of the 22Nd USENIX Conference on Security, SEC 2013, pp. 447\u2013462. USENIX, Berkeley (2013)"},{"issue":"1","key":"15_CR26","doi-asserted-by":"publisher","first-page":"2:1","DOI":"10.1145\/2133375.2133377","volume":"15","author":"R Roemer","year":"2012","unstructured":"Roemer, R., Buchanan, E., Shacham, H., Savage, S.: Return-oriented programming: Systems, languages, and applications. ACM Trans. Inf. Syst. Secur. 15(1), 2:1\u20132:34 (2012)","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"15_CR27","unstructured":"Salwan, J.: Ropgadget. \n                    https:\/\/github.com\/JonathanSalwan\/ROPgadget"},{"key":"15_CR28","unstructured":"Schirra, S.: Ropper - rop gadget finder and binary information tool. \n                    https:\/\/scoding.de\/ropper\/"},{"key":"15_CR29","doi-asserted-by":"crossref","unstructured":"Schuster, F., Tendyck, T., Liebchen, C., Davi, L., Sadeghi, A.-R., Holz, T.: Counterfeit object-oriented programming: on the difficulty of preventing code reuse attacks in C++ applications. In: 36th IEEE Symposium on Security and Privacy (Oakland) (2015)","DOI":"10.1109\/SP.2015.51"},{"key":"15_CR30","unstructured":"Schwartz, E.J., Avgerinos, T., Brumley, D.: Q: Exploit hardening made easy. In: Proceedings of the 20th USENIX Conference on Security, SEC 2011, p. 25. USENIX Association, Berkeley (2011)"},{"key":"15_CR31","unstructured":"Serna, F.J.: The info leak era of software exploitation (2012). \n                    http:\/\/media.blackhat.com\/bh-us-12\/Briefings\/Serna\/BH_US_12_Serna_Leak_Era_Slides.pdf"},{"key":"15_CR32","doi-asserted-by":"crossref","unstructured":"Shacham, H.: The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86). In: Proceedings of the 14th ACM Conference on Computer and communications security, CCS 2007. ACM, New York, NY (2007)","DOI":"10.1145\/1315245.1315313"},{"key":"15_CR33","doi-asserted-by":"crossref","unstructured":"Shacham, H., Page, M., Pfaff, B., Goh, E.-J., Modadugu, N., Boneh, D.: On the effectiveness of address-space randomization. In: Proceedings of the 11th ACM Conference on Computer and communications security, CCS 2004, ACM (2004)","DOI":"10.1145\/1030083.1030124"},{"key":"15_CR34","doi-asserted-by":"crossref","unstructured":"Shoshitaishvili, Y., Wang, R., Hauser, C., Kruegel, C., Vigna, G.: Firmalice - automatic detection of authentication bypass vulnerabilities in binary firmware. In: NDSS (2015)","DOI":"10.14722\/ndss.2015.23294"},{"key":"15_CR35","unstructured":"Sol, P.: Deplib. \n                    https:\/\/www.immunitysec.com\/downloads\/DEPLIB.pdf"},{"key":"15_CR36","unstructured":"Souchet, A.: rp++. \n                    https:\/\/github.com\/0vercl0k\/rp"},{"key":"15_CR37","unstructured":"STIC, P.: Barfgadgets. \n                    https:\/\/github.com\/programa-stic\/barf-project"},{"key":"15_CR38","unstructured":"Wailly, A.: nrop. \n                    https:\/\/github.com\/awailly\/nrop"},{"key":"15_CR39","unstructured":"Zhang, C., Wei, T., Chen, Z., Duan, L., Szekeres, L., McCamant, S., Song, D., Zou, W.: Practical control flow integrity and randomization for binary executables. In: Proceedings of the IEEE Symposium on Security and Privacy, SP 2013, pp. 559\u2013573. IEEE Computer Society, Washington, DC (2013)"}],"container-title":["Lecture Notes in Computer Science","Security and Trust Management"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-46598-2_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,20]],"date-time":"2019-05-20T01:18:06Z","timestamp":1558315086000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-46598-2_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"ISBN":["9783319465975","9783319465982"],"references-count":39,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-46598-2_15","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]},"assertion":[{"value":"17 September 2016","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"STM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Workshop on Security and Trust Management","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Heraklion","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Greece","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2016","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2016","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 September 2016","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"stm2016","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}