Challenges of Return-Oriented-Programming on the Xtensa Hardware Architecture

TL;DR

This paper explores how the unique properties of the Xtensa architecture can be exploited to perform Return-Oriented Programming attacks, highlighting new techniques for gadget chaining and register manipulation.

Contribution

It introduces novel ROP techniques tailored to Xtensa's architecture, especially for the windowed ABI, without relying on specific gadgets or attack scenarios.

Findings

Xtensa architecture can be effectively exploited with ROP techniques

A new mechanism for register manipulation in ROP on Xtensa is presented

The paper demonstrates architecture-specific vulnerabilities for ROP attacks

Abstract

This paper shows how the Xtensa architecture can be attacked with Return-Oriented-Programming (ROP). The presented techniques include possibilities for both supported Application Binary Interfaces (ABIs). Especially for the windowed ABI a powerful mechanism is presented that not only allows to jump to gadgets but also to manipulate registers without relying on specific gadgets. This paper purely focuses on how the properties of the architecture itself can be exploited to chain gadgets and not on specific attacks or a gadget catalog.