# An In-Depth Survey of Bypassing Buffer Overflow Mitigation Techniques
## 3 Hardware-Based Mitigation Techniques  
Buffer overflow attacks are launched by altering the saved return address in the FSF of the called function that redirects the execution to an arbitrary code injected by the attacker. Different hardware-based approaches for protecting the saved return address on the stack have been proposed, which are summarized in Table 4. Ref. [15] introduced Smashguard, a hardware stack implemented in the CPU to protect the return address, and was first implemented in Alpha architecture. Each time a function is called, the return address is pushed on the process stack in memory as well as saved in the hardware stack. When a function returns, both the saved return addresses are popped and compared. If both addresses are not the same, the CPU throws an exception, and the process is terminated. [PERSON]. [16] introduced a similar approach called Secure return address stack (SRAS), and was first implemented in Alpha 21264 processor. When a function is called, the return address is pushed on SRAS, and the program counter (PC) is set to the target of the call instruction. When a function returns, processor compares the return address from the stack memory with the SRAS return address. If addresses are not identical, the process is terminated. [PERSON]. [17] introduced another hardware-based protection mechanism, that is, the idea of building an untrusted software named on a trusted hardware architecture called XOM (eXecute Only Memory). XOM architecture assign cryptographic keys to each compartment/logical container of a process. XOM key table is used to store the hashes of encrypted data along with their cryptographic keys and later used to protect/verify the actual information. [PERSON]. [18] introduced another architectural approach called Secure Bit, to protect control data such as return address. If secure bit is set for a particular data, it will not be used as control data and mark as untrustworthy [19]. An additional mode named sbit_write mode is introduced to manage the Secure bit. Ref. [20] introduced HSDefender (Hardware/Software Defender) to protect against buffer overflow attacks, and was first implemented in ARM processor. It was mainly designed to protect embedded systems by designing a secure call instruction. HSDefender comes with both protection and checking together, which makes this method more secure. No-Execute (NX) bit is another hardware-based technique that was first implemented in in AMD64 processors (Athlon64, Opteron) as their protection policy [21]. Later the authors focused on using NX bit to avoid/protect stack-based buffer overflow and different exploitation mechanisms that can be used to perform a BOF attack with NX bit in place.  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Mitigation Technique**} & **Architecture (First** & \multirow{2}{*}{**Strategy**} \\  & **Implemented** & \\ \hline Smashguard & Alpha & Return Address Protection \\ \hline SRAS & Alpha 21264 & Return Address Protection \\ \hline XOMOS & SimOS simulator & Encrypt Memory Values \\ \hline Secure Bit & BOCHS emulator & Marked control data \\  & & untrustworthy \\ \hline HSDefender & StrongARM-110 & Secure call instructions \\ \hline NX bit & AMD64 & Marked Memory Regions \\  & & Non-executable \\ \hline \hline \end{tabular}
\end{table}
Table 4: Summary of Hardware Mitigation.