# SGXDump: A Repeatable Code-Reuse Attack for Extracting SGX Enclave Memory
## 7 Discussion
presented the branch shadowing [40] technique that abuses the branch prediction unit by using the shadow code, which is aligned with the victim code in the enclave. After running the victim code, an attacker runs the shadow code and measures the elapsed clock cycles. Based on this measurement, the attacker infers whether the executed branch instruction in the victim enclave has been taken or not. Cache timing measurement attacks are traditional, but still useful side-channel attacks. With this approach, the main task of the attacker is to measure the elapsed latency when accessing the target memory. MemJam [36] exploits the false dependencies of memory read-after-write events in the same physical core. A CPU reads memory with a virtual address, but the L1 cache tags its contents with the physical address. Therefore, when several processes access the memory with the same virtual address in the same physical core, the L1 cache cannot determine if this access is a hit or a miss ahead of the address translation. MemJam measures this address translation latency in order to disclose the target memory contents. MicroScope [41], Stacco [42], and SGX-Step [13] were proposed as useful frameworks assisting side-channel attacks against enclaves. For example, CopyCat [9], Nemesis [43], and Single Trace [12] observe the single-stepping trace from a victim enclave on top of SGX-Step [13]. The overall structure of SGXDump is analogous to that of Foreshadow [10]. These have three similar components: a secret reference code, reference buffer, and PTE properties. In both approaches, the secret reference code dereferences the enclave memory and accesses an element in an array of 256 (4 KB) pages. The secret value is used to decide which element of the reference buffer is referenced. After access to the element, both detect changes in a PTE property (i.e., the access bit and the present bit). The key difference is how the secret reference code is created. In SGXDump, we create the secret reference code, i.e., the ROP payload using ROP gadgets that reside in the enclave, whereas Foreshadow uses small code snippets outside the enclave to execute transient instructions. \begin{table}
\begin{tabular}{c c c c c c c c} \hline  
Unlike the aforementioned side channel attacks used against Intel SGX, SGXDump leverages the PTE's access bit as a covert channel. This is because SGXDump requires a specific way (e.g., software vulnerabilities) to leak the enclave's memory via a covert channel. For example, SGXDump exploits a stack overflow vulnerability to inject its ROP payload and executes the ROP gadgets to disclose the enclave's contents through a PTE-based covert channel to prove our ROP payload is well working. Even though there is a limitation in that a target enclave must contain vulnerabilities to run the ROP gadgets, SGXDump has the advantage of being able to nullify side channel attack countermeasures [44]. Previous research into other attacks has [14; 45] also relied on software vulnerabilities. Intel SGX can effectively prevent illegal memory access and code injection attacks. Since it provides such secure execution environment even when an attacker has full control of the OS, it has become widely adopted [5]. Owing to this growing popularity, attackers are starting to pay more attention to compromising SGX enclaves via the code-reuse attack. Before constructing the payload for the ROP attack, it is generally necessary to statically analyze the binary to obtain the address of the gadget required for the payload. However, this method has the disadvantage that it is not possible to obtain the address of the gadget if the binary is encrypted or access to the binary is prohibited. In Dark-ROP [14], they proposed a method to find the gadget necessary for ROP attack by using the leaf function of SGX when the enclave is encrypted. In order to perform an ROP attack, a memory vulnerability is required to inject the attack payload because it could not overwrite the return address with an ROP payload.