diff options
author | JF Bastien <jfb@google.com> | 2015-01-14 01:07:51 +0000 |
---|---|---|
committer | JF Bastien <jfb@google.com> | 2015-01-14 01:07:51 +0000 |
commit | b62cce9cec99b09ffd1a7c6ec7285b4b8b378cd8 (patch) | |
tree | ba2e731871672ee5af6a796a9ebe330e4523a241 /include | |
parent | 08dc5820ed14ce920c1e35b0e5946252af878fe8 (diff) |
Insert random noops to increase security against ROP attacks (clang)
A pass that adds random noops to X86 binaries to introduce diversity with the goal of increasing security against most return-oriented programming attacks.
Command line options:
-noop-insertion // Enable noop insertion.
-noop-insertion-percentage=X // X% of assembly instructions will have a noop prepended (default: 50%, requires -noop-insertion)
-max-noops-per-instruction=X // Randomly generate X noops per instruction. ie. roll the dice X times with probability set above (default: 1). This doesn't guarantee X noop instructions.
In addition, the following 'quick switch' in clang enables basic diversity using default settings (currently: noop insertion and schedule randomization; it is intended to be extended in the future).
-fdiversify
This is the clang part of the patch.
llvm part: D3392
http://reviews.llvm.org/D3393
Patch by Stephen Crane (@rinon)
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@225910 91177308-0d34-0410-b5e6-96231b3b80d8
Diffstat (limited to 'include')
-rw-r--r-- | include/clang/Driver/CC1Options.td | 2 | ||||
-rw-r--r-- | include/clang/Driver/Options.td | 3 | ||||
-rw-r--r-- | include/clang/Frontend/CodeGenOptions.def | 2 |
3 files changed, 6 insertions, 1 deletions
diff --git a/include/clang/Driver/CC1Options.td b/include/clang/Driver/CC1Options.td index e043001410..fafd149d47 100644 --- a/include/clang/Driver/CC1Options.td +++ b/include/clang/Driver/CC1Options.td @@ -194,6 +194,8 @@ def relaxed_aliasing : Flag<["-"], "relaxed-aliasing">, HelpText<"Turn off Type Based Alias Analysis">; def no_struct_path_tbaa : Flag<["-"], "no-struct-path-tbaa">, HelpText<"Turn off struct-path aware Type Based Alias Analysis">; +def noop_insertion : Flag<["-"], "noop-insertion">, + HelpText<"Randomly insert NOOPs">; def masm_verbose : Flag<["-"], "masm-verbose">, HelpText<"Generate verbose assembly output">; def mcode_model : Separate<["-"], "mcode-model">, diff --git a/include/clang/Driver/Options.td b/include/clang/Driver/Options.td index 4daddba332..9a76d2a7b9 100644 --- a/include/clang/Driver/Options.td +++ b/include/clang/Driver/Options.td @@ -469,6 +469,7 @@ def fdiagnostics_show_category_EQ : Joined<["-"], "fdiagnostics-show-category="> def fdiagnostics_show_template_tree : Flag<["-"], "fdiagnostics-show-template-tree">, Group<f_Group>, Flags<[CC1Option]>, HelpText<"Print a template comparison tree for differing templates">; +def fdiversify : Flag<["-"], "fdiversify">, Group<f_clang_Group>; def fdollars_in_identifiers : Flag<["-"], "fdollars-in-identifiers">, Group<f_Group>, HelpText<"Allow '$' in identifiers">, Flags<[CC1Option]>; def fdwarf2_cfi_asm : Flag<["-"], "fdwarf2-cfi-asm">, Group<clang_ignored_f_Group>; @@ -857,7 +858,7 @@ def fprofile_arcs : Flag<["-"], "fprofile-arcs">, Group<f_Group>; def fno_profile_arcs : Flag<["-"], "fno-profile-arcs">, Group<f_Group>; def fprofile_generate : Flag<["-"], "fprofile-generate">, Group<f_Group>; def framework : Separate<["-"], "framework">, Flags<[LinkerInput]>; -def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group<clang_ignored_f_Group>; +def frandom_seed_EQ : Joined<["-"], "frandom-seed=">, Group<f_Group>, Flags<[CC1Option]>; def freg_struct_return : Flag<["-"], "freg-struct-return">, Group<f_Group>, Flags<[CC1Option]>, HelpText<"Override the default ABI to return small structs in registers">; def frtti : Flag<["-"], "frtti">, Group<f_Group>; diff --git a/include/clang/Frontend/CodeGenOptions.def b/include/clang/Frontend/CodeGenOptions.def index b44672d0f5..5a9bfc4360 100644 --- a/include/clang/Frontend/CodeGenOptions.def +++ b/include/clang/Frontend/CodeGenOptions.def @@ -160,6 +160,8 @@ ENUM_CODEGENOPT(Inlining, InliningMethod, 2, NoInlining) /// The default TLS model to use. ENUM_CODEGENOPT(DefaultTLSModel, TLSModel, 2, GeneralDynamicTLSModel) +CODEGENOPT(NoopInsertion, 1, 0) ///< Randomly add NOPs + #undef CODEGENOPT #undef ENUM_CODEGENOPT #undef VALUE_CODEGENOPT |