  Just-in-time return-oriented programming (JIT-ROP) allows one to dynamically
discover instruction pages and launch code reuse attacks, effectively bypassing
most fine-grained address space layout randomization (ASLR) protection.
However, in-depth questions regarding the impact of code (re-)randomization on
code reuse attacks have not been studied. For example, how would one compute
the re-randomization interval effectively by considering the speed of gadget
convergence to defeat JIT-ROP attacks?; how do starting pointers in JIT-ROP
impact gadget availability and gadget convergence time?; what impact do
fine-grained code randomizations have on the Turing-complete expressive power
of JIT-ROP payloads? We conduct a comprehensive measurement study on the
effectiveness of fine-grained code randomization schemes, with 5 tools, 20
applications including 6 browsers, 1 browser engine, and 25 dynamic libraries.
We provide methodologies to measure JIT-ROP gadget availability, quality, and
their Turing-complete expressiveness, as well as to empirically determine the
upper bound of re-randomization intervals in re-randomization schemes using the
Turing-complete (TC), priority, MOV TC, and payload gadget sets. Experiments
show that the upper bound ranges from 1.5 to 3.5 seconds in our tested
applications. Besides, our results show that locations of leaked pointers used
in JIT-ROP attacks have no impacts on gadget availability, but have an impact
on how fast attackers find gadgets. Our results also show that
instruction-level single-round randomization thwarts current gadget finding
techniques under the JIT-ROP threat model.
