arXiv subjects

Kai Lehniger

Publications and source records attributed to Kai Lehniger.

2 recordsLinked to original sources

arXiv2024

Comments on: RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices with Binary Analysis

This is a comment on "RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices with Binary Analysis". RIO prevents finding gadgets for Return-Oriented Programming attacks by encrypting return instructions. This paper shows flaws in the design of RIO that allow for the easy retrieval of the plaintext return instructions without decrypting them. Additionally, changes are proposed to improve upon the original idea.

cs.CR↗

arXiv2022

Challenges of Return-Oriented-Programming on the Xtensa Hardware Architecture

This paper shows how the Xtensa architecture can be attacked with Return-Oriented-Programming (ROP). The presented techniques include possibilities for both supported Application Binary Interfaces (ABIs). Especially for the windowed ABI a powerful mechanism is presented that not only allows to jump to gadgets but also to manipulate registers without relying on specific gadgets. This paper purely focuses on how the properties of the architecture itself can be exploited to chain gadgets and not on specific attacks or a gadget catalog.

cs.CR↗