# US 2019/0318094 A1 · Mitigation of return-oriented programming exploits > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318094 A1 - Document ID: US20190318094A1 - Status: Published application - Kind: A1 - Application number: 16/453,716 - Filed: 2019-06-26 - Published: 2019-10-17 - Earliest claimed: 2019-06-26 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Ke Sun; Rodrigo Branco; Kekai Hu - Web page: https://patentgrep.com/patent/US20190318094A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/561: {Virus type analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computing apparatus, including: a processor; a memory; and encoded logic to instruct the processor to: identify within the memory a payload that is suspected to be a return-oriented programming (ROP) chain; execute the suspected ROP chain in a speculative execution path within the processor; force a missed prediction of the speculative execution path; determine that the suspected ROP chain executed through; and take a security action responsive to the determining. ## Claims ### Claim 1 A computing apparatus, comprising: a processor; a memory; and encoded logic to instruct the processor to: identify within the memory a payload that is suspected to be a return-oriented programming (ROP) chain; execute the suspected ROP chain in a speculative execution path within the processor; force a missed prediction of the speculative execution path; determine that the suspected ROP chain executed through; and take a security action responsive to the determining. ### Claim 2 (depends on 1) The computing apparatus of claim 1, wherein executing the suspected ROP chain the speculative execution path comprises populating a stack return register with a pointer to the suspected ROP chain. ### Claim 3 (depends on 1) The computing apparatus of claim 1, wherein determining that the suspected ROP chain executed through comprises appending a canary instruction to the end of the suspected ROP chain, and determining that the canary instruction was executed. ### Claim 4 (depends on 3) The computing apparatus of claim 3, wherein the canary instruction comprises a dummy label. ### Claim 5 (depends on 3) The computing apparatus of claim 3, wherein the canary instruction comprises a load from a memory address. ### Claim 6 (depends on 5) The computing apparatus of claim 5, wherein determining that the suspected ROP chain executed through comprises determining that the memory address of the canary instruction is located in cache. ### Claim 7 (depends on 5) The computing apparatus of claim 5, wherein determining that the suspected ROP chain executed through comprises loading the address of the canary instruction, and measuring the time for loading the address to complete. ### Claim 8 (depends on 5) The computing apparatus of claim 5, wherein determining that the suspected ROP malware is malicious comprises determining that the label was loaded to cache. ### Claim 9 (depends on 6) The computing apparatus of claim 6, wherein determining that the label was loaded to cache comprises determining a latency to fetch the label. ### Claim 10 (depends on 7) The computing apparatus of claim 7, wherein the logic is further to perform a cache flash before executing the suspected ROP chain. ### Claim 11 (depends on 1) The computing apparatus of claim 1, further comprising encoded logic to force an increased latency on a speculative execution window. ### Claim 12 (depends on 11) The computing apparatus of claim 11, wherein forcing the increased latency comprises adding memory access latency. ### Claim 13 One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to: dynamically scan a binary object to identify a potential return-oriented programming (ROP) chain; append a canary instruction to the end of the potential ROP chain; execute the potential ROP chain; determine that the canary instruction was executed; and based at least in part on the determining, designate the potential ROP chain as an ROP chain. ### Claim 14 (depends on 13) The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the instructions are further to take a security action based on the designating. ### Claim 15 (depends on 13) The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein executing the potential ROP chain comprises executing the potential ROP chain in a speculative execution path. ### Claim 16 (depends on 15) The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein executing the potential ROP chain comprises forcing a missed prediction. ### Claim 17 (depends on 13) The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the canary instruction comprises a dummy label. ### Claim 18 A computer-implemented method of detecting a return-oriented programming (ROP) exploit, comprising: appending a dummy instruction to the end of a suspected ROP chain; executing the suspected ROP chain; determining that the dummy instruction was executed; and designating the suspected ROP chain as an ROP chain. ### Claim 19 (depends on 18) The method of claim 18, further comprising taking a security action based on the designating. ### Claim 20 (depends on 18) The method of claim 18, wherein executing the suspected ROP chain comprises executing within a speculative execution path that does not affect an architectural state on a missed prediction.