From 4cb557039dbc6d764fa2b16f811f37e5accf2f0d Mon Sep 17 00:00:00 2001 From: JF Bastien Date: Wed, 14 Jan 2015 01:07:51 +0000 Subject: [PATCH] Insert random noops to increase security against ROP attacks (clang) A pass that adds random noops to X86 binaries to introduce diversity with the goal of increasing security against most return-oriented programming attacks. Command line options: -noop-insertion // Enable noop insertion. -noop-insertion-percentage=X // X% of assembly instructions will have a noop prepended (default: 50%, requires -noop-insertion) -max-noops-per-instruction=X // Randomly generate X noops per instruction. ie. roll the dice X times with probability set above (default: 1). This doesn't guarantee X noop instructions. In addition, the following 'quick switch' in clang enables basic diversity using default settings (currently: noop insertion and schedule randomization; it is intended to be extended in the future). -fdiversify This is the clang part of the patch. llvm part: D3392 http://reviews.llvm.org/D3393 Patch by Stephen Crane (@rinon) llvm-svn: 225910 --- clang/include/clang/Driver/CC1Options.td | 2 ++ clang/include/clang/Driver/Options.td | 3 ++- clang/include/clang/Frontend/CodeGenOptions.def | 2 ++ clang/lib/CodeGen/BackendUtil.cpp | 1 + clang/lib/Driver/Tools.cpp | 11 +++++++++++ clang/lib/Frontend/CompilerInvocation.cpp | 1 + 6 files changed, 19 insertions(+), 1 deletion(-) diff --git a/clang/include/clang/Driver/CC1Options.td b/clang/include/clang/Driver/CC1Options.td index e043001..fafd149 100644 --- a/clang/include/clang/Driver/CC1Options.td +++ b/clang/include/clang/Driver/CC1Options.td @@ -194,6 +194,8 @@ def relaxed_aliasing : Flag<["-"], "relaxed-aliasing">, HelpText<"Turn off Type Based Alias Analysis">; def no_struct_path_tbaa : Flag<["-"], "no-struct-path-tbaa">, HelpText<"Turn off struct-path aware Type Based Alias Analysis">; +def noop_insertion : Flag<["-"], "noop-insertion">, + HelpText<"Randomly insert NOOPs">; def masm_verbose : Flag<["-"], "masm-verbose">, HelpText<"Generate verbose assembly output">; def mcode_model : Separate<["-"], "mcode-model">, diff --git a/clang/include/clang/Driver/Options.td b/clang/include/clang/Driver/Options.td index 4daddba..9a76d2a 100644 --- a/clang/include/clang/Driver/Options.td +++ b/clang/include/clang/Driver/Options.td @@ -469,6 +469,7 @@ def fdiagnostics_show_category_EQ : Joined<["-"], "fdiagnostics-show-category="> def fdiagnostics_show_template_tree : Flag<["-"], "fdiagnostics-show-template-tree">, Group, Flags<[CC1Option]>, HelpText<"Print a template comparison tree for differing templates">; +def fdiversify : Flag<["-"], "fdiversify">, Group; def fdollars_in_identifiers : Flag<["-"], "fdollars-in-identifiers">, Group, HelpText<"Allow '$' in identifiers">, Flags<[CC1Option]>; def fdwarf2_cfi_asm : Flag<["-"], "fdwarf2-cfi-asm">, Group; @@ -857,7 +858,7 @@ def fprofile_arcs : Flag<["-"], "fprofile-arcs">, Group; def fno_profile_arcs : Flag<["-"], "fno-profile-arcs">, Group; def fprofile_generate : Flag<["-"], "fprofile-generate">, Group; def framework : Separate<["-"], "framework">, Flags<[LinkerInput]>; -def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group; +def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group, Flags<[CC1Option]>; def freg_struct_return : Flag<["-"], "freg-struct-return">, Group, Flags<[CC1Option]>, HelpText<"Override the default ABI to return small structs in registers">; def frtti : Flag<["-"], "frtti">, Group; diff --git a/clang/include/clang/Frontend/CodeGenOptions.def b/clang/include/clang/Frontend/CodeGenOptions.def index b44672d..5a9bfc4 100644 --- a/clang/include/clang/Frontend/CodeGenOptions.def +++ b/clang/include/clang/Frontend/CodeGenOptions.def @@ -160,6 +160,8 @@ ENUM_CODEGENOPT(Inlining, InliningMethod, 2, NoInlining) /// The default TLS model to use. ENUM_CODEGENOPT(DefaultTLSModel, TLSModel, 2, GeneralDynamicTLSModel) +CODEGENOPT(NoopInsertion, 1, 0) ///< Randomly add NOPs + #undef CODEGENOPT #undef ENUM_CODEGENOPT #undef VALUE_CODEGENOPT diff --git a/clang/lib/CodeGen/BackendUtil.cpp b/clang/lib/CodeGen/BackendUtil.cpp index 25ecec5..ef857ce 100644 --- a/clang/lib/CodeGen/BackendUtil.cpp +++ b/clang/lib/CodeGen/BackendUtil.cpp @@ -519,6 +519,7 @@ TargetMachine *EmitAssemblyHelper::CreateTargetMachine(bool MustCreateTM) { Options.PositionIndependentExecutable = LangOpts.PIELevel != 0; Options.FunctionSections = CodeGenOpts.FunctionSections; Options.DataSections = CodeGenOpts.DataSections; + Options.NoopInsertion = CodeGenOpts.NoopInsertion; Options.MCOptions.MCRelaxAll = CodeGenOpts.RelaxAll; Options.MCOptions.MCSaveTempLabels = CodeGenOpts.SaveTempLabels; diff --git a/clang/lib/Driver/Tools.cpp b/clang/lib/Driver/Tools.cpp index d625c0e..4aecf22 100644 --- a/clang/lib/Driver/Tools.cpp +++ b/clang/lib/Driver/Tools.cpp @@ -3737,6 +3737,17 @@ void Clang::ConstructJob(Compilation &C, const JobAction &JA, getToolChain().getTriple().getArch() == llvm::Triple::aarch64_be) CmdArgs.push_back("-fallow-half-arguments-and-returns"); + // Translate -frandom-seed to seed the LLVM RNG + if (Args.hasArg(options::OPT_frandom_seed_EQ)) { + StringRef seed = Args.getLastArgValue(options::OPT_frandom_seed_EQ); + CmdArgs.push_back("-backend-option"); + CmdArgs.push_back(Args.MakeArgString("-rng-seed=" + seed)); + } + + if (Args.hasArg(options::OPT_fdiversify)) { + CmdArgs.push_back("-noop-insertion"); + } + if (Arg *A = Args.getLastArg(options::OPT_mrestrict_it, options::OPT_mno_restrict_it)) { if (A->getOption().matches(options::OPT_mrestrict_it)) { diff --git a/clang/lib/Frontend/CompilerInvocation.cpp b/clang/lib/Frontend/CompilerInvocation.cpp index 0f6f01d..ef8b76f 100644 --- a/clang/lib/Frontend/CompilerInvocation.cpp +++ b/clang/lib/Frontend/CompilerInvocation.cpp @@ -516,6 +516,7 @@ static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK, Opts.SSPBufferSize = getLastArgIntValue(Args, OPT_stack_protector_buffer_size, 8, Diags); Opts.StackRealignment = Args.hasArg(OPT_mstackrealign); + Opts.NoopInsertion = Args.hasArg(OPT_noop_insertion); if (Arg *A = Args.getLastArg(OPT_mstack_alignment)) { StringRef Val = A->getValue(); unsigned StackAlignment = Opts.StackAlignment; -- 2.7.4