Lucca Fraser

Return-orientated programming (ROP) identifies pieces of a process’s executable memory ending in a return instruction (gadgets), and enlists them as an instruction set in which a new, “parasitic” program can be written, hijacking the process’s control flow. Since gadgets are already present in executable memory, there is no reliance upon memory being mapped as both writeable and executable, which lets the ROP program (or “chain”) bypass the shellcode attack mitigation known as w ⊕ x. As such ROP represents one of the most difficult exploit mechanisms to mitigate. This thesis explores ROP-chain generation as a domain for evolutionary computation. It describes a system called ROPER (Return-Oriented Program Evolution with ROPER), designed and implemented by the author, which orchestrates the evolution of ROP-chains towards declaratively specified objectives. The author goes on to study the behaviour and ecology of the ROP-chain populations generated by ROPER, and their responses to various environmental pressures. Issues of importance include: 1) establishing a robust environment for evolution to discover ROP solutions, 2) the design of variation operators, 3) emergent strategies for genomic resilience, and 4) the role of speciation through fitness sharing. Case studies are performed using four very different tasks representative of: 1) the functional objective of a bare bones exploit, 2) a supervised learning task, 3) policy discovery for an agent playing ‘Snake’, and 4) an “unwinnable” task in which fitness is gauged randomly, so that the effects of non-selective pressures in the environment can be studied. Taken together this work represents the first time that ROP evolution has been explicitly demonstrated (at least in the public domain), and studied across a range of tasks.

One of the central tasks of Badiou’s Being and Event is to elaborate a theory of the subject in the wake of an axiomatic identification of ontology with mathematics, or, to be precise, with classical Zermelo-Fraenkel set theory. The subject, for Badiou, is essentially a free project that originates in an event, and subtracts itself from both being qua being, as well as the linguistic and epistemic apparatuses that govern the situation. The subjective project is, itself, conceived as the temporal unfolding of a ‘truth’. Originating in an event and unfolding in time, the subject cannot, for Badiou, be adequately understood in strictly ontological, i.e. set-theoretical, terms, insofar as neither the event nor time have any place in classical set theory. Badiou nevertheless seeks to articulate the ontological infrastructure of the subject within set theory, and for this he fastens onto Cohen’s concepts of genericity and forcing: the former gives us the set-theoretic structure of the truth to which the subject aspires, the latter gives us the immanent logic of the subjective procedure, the ‘law of the subject’. Through the forcing operation, the subject is capable of deriving veridical statements from the local status of the truth that it pursues. Between these set-theoretic structures, and a doctrine of the event and temporality, Badiou envisions the subject as an irreducibly diachronic unfolding of a truth subtracted from language, a subject which expresses a logic quite distinct from that which governs the axiomatic deployment of his classical ontology. This vision of the subject is not unique to Badiou’s work. We find a strikingly similar conception in the thought of L.E.J. Brouwer, the founder of intuitionist mathematics. Brouwer, too, insists on the necessary subtraction of truth from language, and on its irreducibly temporal genesis. This genesis, in turn, is entirely concentrated in the autonomous activity of the subject. Moreover, this activity, through which the field of intuitionistic mathematics is generated, expresses a logical structure that, in 1963, Saul Kripke showed to be isomorphic with the forcing relation. In the following essay, I take up an enquiry into the structure of these two theories of the subject, and seek to elucidate both their points of divergence and their strange congruencies; the former, we will see, primarily concern the position of the subject, while the latter concern its form. The paper ends with an examination of the consequences that this study implies for Badiou’s resolutely classical approach to ontology, and his identification of ontology as a truth procedure.