Insert random noops to increase security against ROP attacks (clang)
A pass that adds random noops to X86 binaries to introduce diversity with the goal of increasing security against most return-oriented programming attacks. Command line options: -noop-insertion // Enable noop insertion. -noop-insertion-percentage=X // X% of assembly instructions will have a noop prepended (default: 50%, requires -noop-insertion) -max-noops-per-instruction=X // Randomly generate X noops per instruction. ie. roll the dice X times with probability set above (default: 1). This doesn't guarantee X noop instructions. In addition, the following 'quick switch' in clang enables basic diversity using default settings (currently: noop insertion and schedule randomization; it is intended to be extended in the future). -fdiversify This is the clang part of the patch. llvm part: D3392 http://reviews.llvm.org/D3393 Patch by Stephen Crane (@rinon) llvm-svn: 225910
This commit is contained in:
parent
934361a4b8
commit
4cb557039d
|
@ -194,6 +194,8 @@ def relaxed_aliasing : Flag<["-"], "relaxed-aliasing">,
|
|||
HelpText<"Turn off Type Based Alias Analysis">;
|
||||
def no_struct_path_tbaa : Flag<["-"], "no-struct-path-tbaa">,
|
||||
HelpText<"Turn off struct-path aware Type Based Alias Analysis">;
|
||||
def noop_insertion : Flag<["-"], "noop-insertion">,
|
||||
HelpText<"Randomly insert NOOPs">;
|
||||
def masm_verbose : Flag<["-"], "masm-verbose">,
|
||||
HelpText<"Generate verbose assembly output">;
|
||||
def mcode_model : Separate<["-"], "mcode-model">,
|
||||
|
|
|
@ -469,6 +469,7 @@ def fdiagnostics_show_category_EQ : Joined<["-"], "fdiagnostics-show-category=">
|
|||
def fdiagnostics_show_template_tree : Flag<["-"], "fdiagnostics-show-template-tree">,
|
||||
Group<f_Group>, Flags<[CC1Option]>,
|
||||
HelpText<"Print a template comparison tree for differing templates">;
|
||||
def fdiversify : Flag<["-"], "fdiversify">, Group<f_clang_Group>;
|
||||
def fdollars_in_identifiers : Flag<["-"], "fdollars-in-identifiers">, Group<f_Group>,
|
||||
HelpText<"Allow '$' in identifiers">, Flags<[CC1Option]>;
|
||||
def fdwarf2_cfi_asm : Flag<["-"], "fdwarf2-cfi-asm">, Group<clang_ignored_f_Group>;
|
||||
|
@ -857,7 +858,7 @@ def fprofile_arcs : Flag<["-"], "fprofile-arcs">, Group<f_Group>;
|
|||
def fno_profile_arcs : Flag<["-"], "fno-profile-arcs">, Group<f_Group>;
|
||||
def fprofile_generate : Flag<["-"], "fprofile-generate">, Group<f_Group>;
|
||||
def framework : Separate<["-"], "framework">, Flags<[LinkerInput]>;
|
||||
def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group<clang_ignored_f_Group>;
|
||||
def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group<f_Group>, Flags<[CC1Option]>;
|
||||
def freg_struct_return : Flag<["-"], "freg-struct-return">, Group<f_Group>, Flags<[CC1Option]>,
|
||||
HelpText<"Override the default ABI to return small structs in registers">;
|
||||
def frtti : Flag<["-"], "frtti">, Group<f_Group>;
|
||||
|
|
|
@ -160,6 +160,8 @@ ENUM_CODEGENOPT(Inlining, InliningMethod, 2, NoInlining)
|
|||
/// The default TLS model to use.
|
||||
ENUM_CODEGENOPT(DefaultTLSModel, TLSModel, 2, GeneralDynamicTLSModel)
|
||||
|
||||
CODEGENOPT(NoopInsertion, 1, 0) ///< Randomly add NOPs
|
||||
|
||||
#undef CODEGENOPT
|
||||
#undef ENUM_CODEGENOPT
|
||||
#undef VALUE_CODEGENOPT
|
||||
|
|
|
@ -519,6 +519,7 @@ TargetMachine *EmitAssemblyHelper::CreateTargetMachine(bool MustCreateTM) {
|
|||
Options.PositionIndependentExecutable = LangOpts.PIELevel != 0;
|
||||
Options.FunctionSections = CodeGenOpts.FunctionSections;
|
||||
Options.DataSections = CodeGenOpts.DataSections;
|
||||
Options.NoopInsertion = CodeGenOpts.NoopInsertion;
|
||||
|
||||
Options.MCOptions.MCRelaxAll = CodeGenOpts.RelaxAll;
|
||||
Options.MCOptions.MCSaveTempLabels = CodeGenOpts.SaveTempLabels;
|
||||
|
|
|
@ -3737,6 +3737,17 @@ void Clang::ConstructJob(Compilation &C, const JobAction &JA,
|
|||
getToolChain().getTriple().getArch() == llvm::Triple::aarch64_be)
|
||||
CmdArgs.push_back("-fallow-half-arguments-and-returns");
|
||||
|
||||
// Translate -frandom-seed to seed the LLVM RNG
|
||||
if (Args.hasArg(options::OPT_frandom_seed_EQ)) {
|
||||
StringRef seed = Args.getLastArgValue(options::OPT_frandom_seed_EQ);
|
||||
CmdArgs.push_back("-backend-option");
|
||||
CmdArgs.push_back(Args.MakeArgString("-rng-seed=" + seed));
|
||||
}
|
||||
|
||||
if (Args.hasArg(options::OPT_fdiversify)) {
|
||||
CmdArgs.push_back("-noop-insertion");
|
||||
}
|
||||
|
||||
if (Arg *A = Args.getLastArg(options::OPT_mrestrict_it,
|
||||
options::OPT_mno_restrict_it)) {
|
||||
if (A->getOption().matches(options::OPT_mrestrict_it)) {
|
||||
|
|
|
@ -516,6 +516,7 @@ static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK,
|
|||
Opts.SSPBufferSize =
|
||||
getLastArgIntValue(Args, OPT_stack_protector_buffer_size, 8, Diags);
|
||||
Opts.StackRealignment = Args.hasArg(OPT_mstackrealign);
|
||||
Opts.NoopInsertion = Args.hasArg(OPT_noop_insertion);
|
||||
if (Arg *A = Args.getLastArg(OPT_mstack_alignment)) {
|
||||
StringRef Val = A->getValue();
|
||||
unsigned StackAlignment = Opts.StackAlignment;
|
||||
|
|
Loading…
Reference in New Issue