SGX-ROP: Practical Enclave Malware with Intel SGX

This repository contains the implementations of the paper "Practical Enclave Malware with Intel SGX". The repository consists of three parts: tap_claw, demo, and egghunter.

TAP + CLAW

Contains the Intel TSX-based primitives to check whether a page is mapped and writable without using syscalls.

Demo

Uses TAP + CLAW inside a (malicious) SGX enclave to break ASLR of the host application, create a ROP payload and mount a simple PoC attack (i.e., create a file in the current directory).

Egg Hunter

Shows how to use TAP as egg hunter for classical exploits.

License

All code is licensed under the MIT license.