@misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Comment on ''RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices''}, series = {IEEE Access}, volume = {13}, journal = {IEEE Access}, publisher = {IEEE}, address = {Piscataway, NJ}, issn = {2169-3536}, doi = {10.1109/ACCESS.2025.3568598}, pages = {90358 -- 90361}, abstract = {This is a comment on "RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices." RIO prevents finding gadgets for return-oriented programming attacks by encrypting return instructions. This paper shows flaws in the design of RIO that allow for the easy retrieval of the plaintext return instructions without decrypting them. Additionally, changes are proposed to improve upon the original idea.}, language = {en} } @misc{LehnigerLangendorfer, author = {Lehniger, Kai and Langendorfer, Peter}, title = {Elevating parallel shadow stack concepts for architectures with register windows}, series = {IEEE transactions on dependable and secure computing}, journal = {IEEE transactions on dependable and secure computing}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, issn = {1545-5971}, doi = {10.1109/TDSC.2025.3604556}, pages = {1 -- 18}, abstract = {Register windows are a processor feature that was originally developed to reduce the frequency for register spilling. This paper investigates how this mechanism can be used to implement a parallel shadow stack to protect return addresses from being corrupted. Furthermore, multiple improvements based on properties directly following the usage of register windows are proposed. Different configurations of parallel shadow stacks are evaluated based on prototype implementations on an ESP32 microcontroller and tested with different benchmarks. Performance overheads below 0.01\% for CoreMark, below 3\% for the worst case in MbedsTLS, and a worst case scenario of 22.153\% for a recursive function show that our concepts are able to be efficiently developed even for embedded devices like the ESP32.}, language = {en} }