# AEMB: An Automated Exploit Mitigation Bypassing Solution
## 3 Exploit Mitigations Bypassing
### Bypassing Payload Generation
#### 3.2.2 DEP Bypassing Payload Generation  
The DEP security mechanism primarily limits execution permission in the data segment, preventing the program's control flow from being hijacked to the data segment. As a result, for exploit, Return-oriented Programming (ROP) technology is required, which does not directly execute code on the data segment but instead deploys function pointers on the data region and calls the lawful code in the code segment through the function call and return mechanism. The DEP bypassing payload generation aims to create a sequence of ROP gadgets that can be combined to fulfill the exploit's goal. The feature of ROP gadgets is a series of register operations, system calls, etc. with an end of ret instructions. The ret instructions allow gadgets to be linked and then combined to perform the required function, as shown in Figure 5a. These gadgets are not limited to the assembly code that exists in the program, but the machine code that exists in the process memory. In the binary's assembly code, for example, there are call QWORD PTR [rax+0x4855c35d] instructions that cannot be utilized as ROP gadgets. The intercept portion of the machine code, on the other hand, may turn it into a gadget, as shown in Figure 5b. According to the aforementioned ROP gadget features, _AEMB_ can rapidly scan the effective memory space of the application and get the anticipated ROP gadget address. Following that, _AEMB_ decides which ROP must be built based on the target program running environment. Figure 4: The process of obtaining memory affected by external input. Figure 3: Identification of exploit mitigations. Mainly includes the identification of DEP and GS mitigations. (**a**) Identification of DEP exploit mitigation, mainly based on the permissions of the data segment. (**b**) Identification of GS exploit mitigation, mainly based on the storing and checking instructions of the security cookie. The main factors affecting the ROP structure are as follows:  
* **Expected functionality**. This mainly refers to the expected function, which mainly refers to getshell, to be completed via ROP. Under Linux, the most straightforward way is to call the system function and pass in the /bin/sh parameter. Some functions and their corresponding ROPs are present in the _AEMB_. However, often due to other exploit mitigations, especially ASLR, the construction of ROP will not be as ssmooth. * **Available ROP gadgets**. This mainly refers to gadgets, which are stored in the memory with a known address and can be used in ROP. If it does not exist, its needs to be replaced with one or some similar gadgets. The gadget with an unknown address should be replaced by one or more alternative gadgets that perform the same purpose. For example, add rsp,8;ret can be replaced by push reg;ret, and leave;ret can be replaced by mov rsp,rbp;ret and textttpop rsp.ret. _AEMB_ sets many basic replacement rules such as as the above-mentioned rules. Furthermore, the _AEMB_ employs the \"shadow process\", which is a simulated process that focuses on the memory of the source application in order to determine if the alternative gadget can replace the source gadget. The _AEMB_ will simulate the execution of the source gadget and alternate gadget via the \"shadow process\", and record the content of the registers and stack memory. These data are used to ensure the immutability of the normal function of the gadgets (for example, if the RAX register is expected to be executed minus one by source instruction, the alternate instruction should also complete this operation), as well as the immutability of the memory layout, particularly the stack memory layout, as shown in Figure 6.
* **Size of the buffer**. Its primary purpose is to define the maximum length of the built ROP, which cannot be longer than the data buffer. Taking into account the aforementioned contributing variables, the _AEMB_ will first utilize the predefined gadgets to build the ROP in accordance with the anticipated purpose. Figure 5: The concept of ROP gadget.