# Constraint-based Diversification of JOP Gadgets

arXiv: https://arxiv.org/abs/2111.09934 · HTML: https://mlsanity.com/paper/2111.09934/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 52 references that are in the map.
- First posted on arXiv 18 Nov 2021.

## Builds on (most cited first, 6 of 6)

- [A Survey on Compiler Autotuning using Machine Learning](https://mlsanity.com/paper/1801.04405/) (2018)
- [Combinatorial Register Allocation and Instruction Scheduling](https://mlsanity.com/paper/1804.02452/) (2018)
- [The Multiple Facets of Software Diversity: Recent Developments in Year 2000 and Beyond](https://mlsanity.com/paper/1409.7324/) (2014)
- [Constraint-Based Software Diversification for Efficient Mitigation of Code-Reuse Attacks](https://mlsanity.com/paper/2007.08955/) (2020)
- [CROW: Code Diversification for WebAssembly](https://mlsanity.com/paper/2008.07185/) (2020)
- [Tailored Source Code Transformations to Synthesize Computationally Diverse Program Variants](https://mlsanity.com/paper/1401.7635/) (2014)

## Built on by (most cited first, 1 of 1)

- [Securing Optimized Code Against Power Side Channels](https://mlsanity.com/paper/2207.02614/) (2022)

## Abstract (arXiv)

Modern software deployment process produces software that is uniform and hence vulnerable to large-scale code-reuse attacks, such as Jump-Oriented Programming (JOP) attacks. Compiler-based diversification improves the resilience of software systems by automatically generating different assembly code versions of a given program. Existing techniques are efficient but do not have a precise control over the quality of the generated variants. This paper introduces Diversity by Construction (DivCon), a constraint-based approach to software diversification. Unlike previous approaches, DivCon allows users to control and adjust the conflicting goals of diversity and code quality. A key enabler is the use of Large Neighborhood Search (LNS) to generate highly diverse code efficiently. For larger problems, we propose a combination of LNS with a structural decomposition of the problem. To further improve the diversification efficiency of DivCon against JOP attacks, we propose an application-specific distance measure tailored to the characteristics of JOP attacks. We evaluate DivCon with 20 functions from a popular benchmark suite for embedded systems. These experiments show that the combination of LNS and our application-specific distance measure generates binary programs that are highly resilient against JOP attacks. Our results confirm that there is a trade-off between the quality of each assembly code version and the diversity of the entire pool of versions. In particular, the experiments show that DivCon generates near-optimal binary programs that share a small number of gadgets. For constraint programming researchers and practitioners, this paper demonstrates that LNS is a valuable technique for finding diverse solutions. For security researchers and software engineers, DivCon extends the scope of compiler-based diversification to performance-critical and resource-constrained applications.