{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,5]],"date-time":"2024-09-05T21:12:38Z","timestamp":1725570758079},"publisher-location":"Berlin, Heidelberg","reference-count":31,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642177132"},{"type":"electronic","value":"9783642177149"}],"license":[{"start":{"date-parts":[[2010,1,1]],"date-time":"2010-01-01T00:00:00Z","timestamp":1262304000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010]]},"DOI":"10.1007\/978-3-642-17714-9_11","type":"book-chapter","created":{"date-parts":[[2010,12,7]],"date-time":"2010-12-07T13:27:24Z","timestamp":1291728444000},"page":"140-155","source":"Crossref","is-referenced-by-count":16,"title":["Efficient Detection of the Return-Oriented Programming Malicious Code"],"prefix":"10.1007","author":[{"given":"Ping","family":"Chen","sequence":"first","affiliation":[]},{"given":"Xiao","family":"Xing","sequence":"additional","affiliation":[]},{"given":"Hao","family":"Han","sequence":"additional","affiliation":[]},{"given":"Bing","family":"Mao","sequence":"additional","affiliation":[]},{"given":"Li","family":"Xie","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"key":"11_CR1","unstructured":"The pax project (2004), http:\/\/pax.grsecurity.net\/"},{"key":"11_CR2","first-page":"340","volume-title":"Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS)","author":"M. Abadi","year":"2005","unstructured":"Abadi, M., Budiu, M., Ligatti, J.: Control-flow integrity. In: Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS), pp. 340\u2013353. ACM, New York (2005)"},{"key":"11_CR3","unstructured":"Bhatkar, E., Duvarney, D.C., Sekar, R.: Address obfuscation: an efficient approach to combat a broad range of memory error exploits. In: Proceedings of the 12th USENIX Security Symposium, pp. 105\u2013120 (2003)"},{"key":"11_CR4","unstructured":"Blazakis, D.: Interpreter exploitation: pointer inference and jit spraying. BHDC (2010), http:\/\/www.semantiscope.com\/research\/BHDC2010\/BHDC-2010-Paper.pdf"},{"key":"11_CR5","doi-asserted-by":"crossref","unstructured":"Buchanan, E., Roemer, R., Shacham, H., Savage, S.: When good instructions go bad: generalizing return-oriented programming to risc. In: Proceedings of the 15th ACM Conference on Computer and Communications Security (CCS), pp. 27\u201338 (2008)","DOI":"10.1145\/1455770.1455776"},{"key":"11_CR6","doi-asserted-by":"crossref","unstructured":"Caballero, J., Johnson, N.M., McCamant, S., Song, D.: Binary code extraction and interface identification for security applications. In: Proceedings of the 17th Annual Network and Distributed System Security Symposium (2010)","DOI":"10.21236\/ADA538737"},{"key":"11_CR7","doi-asserted-by":"crossref","unstructured":"Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.R., Shacham, H., Winandy, M.: Return-oriented programming without returns. In: Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS (2010)","DOI":"10.1145\/1866307.1866370"},{"key":"11_CR8","doi-asserted-by":"crossref","unstructured":"Checkoway, S., Feldman, A.J., Kantor, B., Halderman, J.A., Felten, E.W., Shacham, H.: Can dres provide long-lasting security? the case of return-oriented programming and the avc advantage. In: Proceedings of EVT\/WOTE 2009. USENIX\/ACCURATE\/IAVoSS (2009)","DOI":"10.1145\/1866307.1866370"},{"key":"11_CR9","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"163","DOI":"10.1007\/978-3-642-10772-6_13","volume-title":"Information Systems Security","author":"P. Chen","year":"2009","unstructured":"Chen, P., Xiao, H., Shen, X., Yin, X., Mao, B., Xie, L.: Drop: Detecting return-oriented programming malicious code. In: Prakash, A., Sen Gupta, I. (eds.) ICISS 2009. LNCS, vol.\u00a05905, pp. 163\u2013177. Springer, Heidelberg (2009)"},{"key":"11_CR10","unstructured":"Datarescue: Interactive disassembler (ida) pro (2008), http:\/\/www.datarescue.com"},{"key":"11_CR11","doi-asserted-by":"crossref","unstructured":"Davi, L., Sadeghi, A.R., Winandy, M.: Dynamic integrity measurement and attestation: towards defense against return-oriented programming attacks. In: Proceedings of the 2009 ACM Workshop on Scalable Trusted Computing, pp. 49\u201354 (2009)","DOI":"10.1145\/1655108.1655117"},{"key":"11_CR12","doi-asserted-by":"crossref","unstructured":"Davi, L., Sadeghi, A.R., Winandy, M.: Ropdefender: A detection tool to defend against return-oriented programming attacks. Technical Report HGI-TR-2010-001 (2010), http:\/\/www.trust.rub.de\/home\/_publications\/LuSaWi10\/","DOI":"10.1145\/1966913.1966920"},{"key":"11_CR13","unstructured":"Durden, T.: Bypassing pax aslr protection. Phrack Magazine (2002)"},{"key":"11_CR14","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1145\/1655077.1655083","volume-title":"Proceedings of the First ACM Workshop on Secure Execution of Untrusted Code, SecuCode 2009","author":"A. Francillon","year":"2009","unstructured":"Francillon, A., Perito, D., Castelluccia, C.: Defending embedded systems against control flow attacks. In: Proceedings of the First ACM Workshop on Secure Execution of Untrusted Code, SecuCode 2009, pp. 19\u201326. ACM, New York (2009)"},{"key":"11_CR15","doi-asserted-by":"crossref","unstructured":"Francillon, A., Castelluccia., C.: Code injection attacks on harvard-architecture devices. In: Syverson, P., Jha, S. (eds.) Proceedings of CCS 2008 (2008)","DOI":"10.1145\/1455770.1455775"},{"key":"11_CR16","doi-asserted-by":"crossref","unstructured":"Kolbitsch, C., Holz, T., Kruegel, C., Kirda, E.: Inspector gadget: Automated extraction of proprietary gadgets from malware binaries. In: Proceedings of the 30th IEEE Symposium on Security and Privacy (2010)","DOI":"10.1109\/SP.2010.10"},{"key":"11_CR17","unstructured":"Kornau, T.: Return oriented programming for the arm architecture. Master\u2019s thesis, Ruhr-Universitat Bochum (2010)"},{"key":"11_CR18","first-page":"195","volume-title":"Proceedings of the 5th European Conference on Computer Systems, EuroSys 2010","author":"J. Li","year":"2010","unstructured":"Li, J., Wang, Z., Jiang, X., Grace, M., Bahram, S.: Defeating return-oriented rootkits with \u201creturn-less\u201d kernels. In: Proceedings of the 5th European Conference on Computer Systems, EuroSys 2010, pp. 195\u2013208. ACM, New York (2010)"},{"key":"11_CR19","unstructured":"Lidner, F.F.: Developments in cisco ios forensics. CONFidence 2.0, http:\/\/www.recurity-labs.com\/content\/pub\/FX_Router_Exploitation.pdf"},{"key":"11_CR20","doi-asserted-by":"crossref","unstructured":"Lin, Z., Zhang, X., Xu, D.: Reuse-oriented camouflaging trojan: Vulnerability detection and attack construction. In: Proceedings of the 40th DSN-DCCS (2010)","DOI":"10.1109\/DSN.2010.5544305"},{"key":"11_CR21","doi-asserted-by":"publisher","first-page":"190","DOI":"10.1145\/1065010.1065034","volume-title":"Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation","author":"C.K. Luk","year":"2005","unstructured":"Luk, C.K., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V.J., Hazelwood, K.: Pin: building customized program analysis tools with dynamic instrumentation. In: Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 190\u2013200. ACM, New York (2005)"},{"key":"11_CR22","unstructured":"milw0rm, http:\/\/www.milw0rm.com\/shellcode\/linux\/x86"},{"key":"11_CR23","unstructured":"Nergal: The advanced return-into-lib(c) exploits (pax case study). Phrack Magazine (2001), http:\/\/www.phrack.com\/issues.html?issue=58&id=4"},{"key":"11_CR24","doi-asserted-by":"crossref","unstructured":"Nethercote, N., Seward, J.: Valgrind: a framework for heavyweight dynamic binary instrumentation. In: Proceedings of the 2007 PLDI Conference, vol.\u00a042(6), pp. 89\u2013100 (2007)","DOI":"10.1145\/1250734.1250746"},{"key":"11_CR25","unstructured":"Readelf, http:\/\/sourceware.org\/binutils\/docs\/binutils\/readelf.html"},{"key":"11_CR26","first-page":"229","volume-title":"Proceedings of the 13th USENIX Conference on System Administration","author":"M. Roesch","year":"1999","unstructured":"Roesch, M.: Snort - lightweight intrusion detection for networks. In: Proceedings of the 13th USENIX Conference on System Administration, pp. 229\u2013238. USENIX Association, Berkeley (1999)"},{"key":"11_CR27","first-page":"552","volume-title":"Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS)","author":"H. Shacham","year":"2007","unstructured":"Shacham, H.: The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86). In: Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS), pp. 552\u2013561. ACM, New York (2007)"},{"key":"11_CR28","unstructured":"Symantec: Dynamic linking in linux and windows, part one (2006), http:\/\/www.symantec.com\/connect\/articles\/dynamic-linking-linux-and-windows-part-one"},{"key":"11_CR29","unstructured":"Team, P.: What the future holds for pax (2003), http:\/\/pax.grsecurity.net\/docs\/pax-future.txt"},{"key":"11_CR30","doi-asserted-by":"crossref","unstructured":"Bletsch, T., Jiang, X., Freeh, V.: Jump-oriented programming: A new class of code-reuse attack. Technical Report TR-2010-8 (2010)","DOI":"10.1145\/1966913.1966919"},{"key":"11_CR31","unstructured":"Wang, X., Pan, C.C., Liu, P., Zhu, S.: Sigfree: A signature-free buffer overflow attack blocker. IEEE Transactions on Dependable and Secure Computing\u00a099(2) (2006)"}],"container-title":["Lecture Notes in Computer Science","Information Systems Security"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-17714-9_11","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,6,4]],"date-time":"2023-06-04T11:51:22Z","timestamp":1685879482000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-17714-9_11"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010]]},"ISBN":["9783642177132","9783642177149"],"references-count":31,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-17714-9_11","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2010]]}}}