# SGXDump: A Repeatable Code-Reuse Attack for Extracting SGX Enclave Memory
## 1 Introduction  
Intel's SGX is a widely-used technology to solve more fundamental security problems [1, 2, 3, 4] security by using hardware as the root of trust. It encrypts data and executables and stores them in a safe space: the enclave. It also prevents extraneous access to the enclave [5] by generating illegal memory access signals. In addition, SGX provides an advanced security model in that it protects the enclave even when the operating system is compromised. However, SGX was not designed to defend against code-reuse attack, so its effectiveness depends on the security implemented by SGX application developers [6]. As a result, various studies have successfully demonstrated a code-reuse attack. ROP can be used at the stage of injecting the attack code in both micro-architectural timing attacks and controlled-channel attacks, which are two representative methods of attacking SGX. Micro-architectural timing attacks first record the access speed of hardware components such as the buffer, cache, input and output ports, as well as encryption engines. Then, they analyze any access time differences to infer protected data [7, 8]. This attack often suffers from noise-related inaccuracies due to unpredictable system events and/or access speed variations. A controlled-channel attack is analyzing memory access patterns or memory contents through channels that an attacker can control such as page faults [9, 10, 11, 12, 13, 14]. A typical code-reuse attack is a return oriented programming (ROP) attack. The ROP attack uses instruction sets called gadgets that are a series of instructions ending with _ret_ instruction. Since all the gadgets are already contained in the victim binary, attackers do not need to inject new executable codes [15]. Furthermore, refs. [16, 17] demonstrated that _BLX_, a branch instruction of ARM CPU, and _jmp_ can be ending instructions to constitutea gadget. In addition, ref. [18] proposed Sigreturn Oriented Programming (SROP) using the _restore_sigcontext()_ function that is used to process signals in kernel mode for restoring stacks after a context switch. Ref. [19] proposed Blind ROP (BROP) that performs ROP attacks by analyzing binary's memory space features without direct access to the source code or binaries. Refs. [14; 20; 21; 22; 23] took the control flow of the process within enclaves by using the ROP. However, the methods proposed in previous studies require detailed analysis of the enclave software because it is essential to know how the software processes the protected data. This makes it very hard to carry out ROP attacks when the source code is not available. In addition, when the ROP payload is injected, a number of gadgets runs sequentially, making it difficult to perform complex tasks such as communication with the outside of the enclave. In this paper, we propose an ROP payload that implements iterative and conditional statements without _cmp_ instruction. By using this method, we constructed a communication channel to outside of the enclave. We developed the SGXDump ROP attack and the Probe Array Monitor (PAM) kernel module to prove that our implementation is working well. First, SGXDump in the form of an ROP payload is injected into the enclave software and reads the entire enclave memory. At each byte value, SGXDump accesses its corresponding page in the probe array to set the access bit of its page table entry to one. When the Probe Array Monitor detects this change, it translates the access bit's location to the value that SGXDump reads from the enclave's memory. We summarize the main contributions of this study as follows:  
* We present an ROP attack that implements loops inside the attack payload to leak enclave data. Our ROP attack utilizes page table entries' access bits so that the PAM can retrieve the enclave's memory. * We give a real example of ROP code for attacking SGX. Unlike the usual ROP codes that simply call a specific function with designated parameters, SGXDump walks through the entire memory while accessing the probe array.