ROP has become virtually synonymous with code-reuse attacks in exploit development, but the reality is there is another way: Jump-oriented Programming (JOP). Until recently, there were no dedicated tools to do JOP, unlike with ROP, which has many excellent tools, such as Mona and ROPgadget. In fact, there were even claims that JOP had never been done in the wild (not true). There is virtually no practical information on how to perform JOP, and it would have been a monumental effort to do pure JOP, without a dedicated tool. Thus, JOP was a phantom, lurking in the shadows, unknown.
Times have changed; JOP is now possible with the new JOP ROCKET, a reverse engineering and exploitation framework for JOP developed by Brizendine as part of his doctoral dissertation research. With the latest version of JOP ROCKET, the tool can now produce a pre-built JOP chain, which under ideal circumstances, can work with minimal user modification. With JOP ROCKET, you can develop a JOP exploit that, similar to ROP, allows for the bypass of Data Execution Prevention (DEP), or other mitigations such as ASLR; we show both in demo.
This talk serves to bring this previously arcane, esoteric knowledge of JOP to the people. It introduces the challenging, technical details of how to perform JOP exploits. The talk focuses heavily on giving examples and demos of JOP exploits, and explaining the many nuances. While JOP is similar to ROP, it is also extremely different, and there are many non-obvious gotcha's. JOP is a challenging, non-trivial code-reuse attack, seldom discussed, and this talk teaches people how to use it with the JOP ROCKET.
Our major update is the prebuilt JOP chain to bypass DEP with VirtualProtect() or VirtualAlloc(). While JOP exploit development can be challenging, this pre-built JOP chain simplifies the process.