# SGXDump: A Repeatable Code-Reuse Attack for Extracting SGX Enclave Memory
## 8 Conclusions  
In this paper, we proposed an ROP payload that can loop inside the payload by using gadgets in the enclave. To demonstrate the effectiveness of our method, we implemented a SGXDump that can extract an enclave's entire memory. Once a memory corruption vulnerability is found in a target SGX application, an SGXDump ROP payload can be injected. Its main role is to read bytes from enclave memory and access pages of a probe array in which we use those bytes' values as indexes. Meanwhile, a previously installed kernel module, the PAM (Probe Array Monitor), keeps monitoring the change of access bits of the probe array's page table. When a change occurs, the PAM determines an index of the page and easily converts the index into the value stored in enclave memory. The attacker can easily retrieve leaked data from the kernel module through network, file, or proc file systems, as demonstrated in our study.  
The important conclusions from this work are the following: First, this study demonstrated that enclave memory can be leaked rather easily when the SGX application has a memory corruption vulnerability. This contradicts the general belief that SGX's abilities to disallow illegal memory accesses and to prevent injected code from running cannot mitigate the SGX application's memory corruption vulnerability problem. Second, we devised an ROP attack that can loop inside the payload by using gadgets in the enclave. In most cases, once the ROP payload is injected, the gadget's control flow is executed sequentially. However, we successfully implemented the conditional statement by using gadgets of the enclave so that our attack payload can communicate with the outside or execute other attack payload.  
Finally, we presented a rather complicated return-oriented programming attack to retrieve the enclave's entire memory. Since it is considered to be hard to construct an ROP payload for complex tasks, people often use ROP attacks for simple but critical operations such as escalating privilege, disarming security mechanism, or calling a desired function. However, we used ROP as the main attack method; the synchronization, data extraction, and loops are implemented through ROP. This does not leave any system logs about security-related configuration changes and function calls, thus making the SGXDump attack more stealthy. We hope the detailed ROP code in this paper will be of great benefit to researchers who are interested in ROP attacks on SGX.  
We are trying to build other attack payloads that can utilize a different hardware resource as a communication medium. Since the kernel module can monitor any hardware, we believe that there will be better options than using the page table's access bit.  
**Author Contributions:** Formal analysis, H.Y.; Investigation, H.Y.; Software, H.Y.; Validation, H.Y. and M.L.; Writing--original draft, H.Y.; Writing--review & editing, M.L. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research was funded by National Research Foundation of Korea, grant number NRF-2021R1A4A2001810.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Acknowledgments:** This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (NRF-2021R1A4A2001810).  
**Conflicts of Interest:** The authors declare no conflict of interest.