# SGXDump: A Repeatable Code-Reuse Attack for Extracting SGX Enclave Memory
## 2 Background  
**Intel SGX.** Intel Software Guard Extensions (SGX) is a set of instructions that allows a user process to create a secure area called an enclave inside its address space. An enclave has separate code and data sections including a stack and heap; SGX safeguards this enclave against external access [5; 6]. However, as many previous studies presented, enclave's memory is still vulnerable to various attacks and the code-reuse attack such as ROP is demonstrated to be effective in leaking the enclave's memory [14; 20]. In our study, we build the ROP payload that has a loop format by using gadgets inside the enclave. It should be noted that, SGX SDK libraries are statically linked to an enclave's code at build-time so that the enclave becomes a self-contained binary. This property may hamper an attacker's ROP composition because the target enclave binary should be available to the attacker beforehand. However, this is not necessarily true because SGX is designed to secure enclaves under a compromised OS and the OS has the privilege of looking into the enclave binaries [5; 6].  
**Enclave ASLR.** Address space layout randomization (ASLR) is a technique that randomly selects the loading address of executables including libraries, the heap, and stack in the address space [26]. This is an effective countermeasure against memory corruption vulnerabilities (e.g., from buffer overflow) because injected code usually needs the target library function's address.  
Although ASLR should be an effective defense against normal ROP attacks, our attack works well even if ASLR is used. In this study, an attacker with root privilege is able to find the base address of the enclave binary at each execution. Additionally, ASLR does not randomize the section address inside of the enclave. Therefore, once an attacker knows the base address of the loaded enclave, he can calculate all the addresses of the necessary ROP gadgets. SGX-Shield [27] addresses this limitation of enclave ASLR, but this approach is yet to be deployed in the official SGX library.  
**Virtual Address Translation.** As a computer operates, virtual addresses need to be translated into physical addresses. For this purpose, the OS uses a per-process page table to manage its memory at the page level. The page table is an array of page table entries (PTE). A PTE contains the physical address of a virtual page and additional information including status bits such as accessed, present, rw, user, and dirty, among others. From these status bits, we make use of the access bit. When an instruction accesses a page, its access bit is set to one. Later, the access bit is used by the page replacement algorithm to select which page will be swapped out to the secondary disk [28; 29].  
When an attacker has root privilege, this access bit can be useful as a covert channel in the following way. First, a process allocates 256*4096-bytes for called a probe array (_pa[]_), which needs 256 consecutive pages for a page size of 4 KB. Let us assume that the process acquires one byte of secret information, \(s\). The unsigned integer value of \(s\) ranges from 0 to 255. Then, the process uses \(s\) for accessing _pa[s*4096]_. This memory reads or writes operation sets the _s_th page's access bit to one. When the attacker residing in the kernel monitors _pal[]_'s access bit, he can obtain \(s\) easily. In this paper, we will demonstrate how to develop the SGXDump ROP payload and the kernel module, both of which collaboratively leak the contents of the target enclave application's memory.