Abstract
In this paper, we explore instruction scheduling approaches to reducing the susceptibility of code-reuse attacks. We design several instruction scheduling strategies for x86 and AArch64 and implement them in the LLVM open-source compiler. Using a collection of open-source programs written in Rust, we find that employing a disassembler during scheduling effectively reduces gadget count and quality across return-oriented programming and call-oriented programming categories on the x86 architecture, but does not work effectively on jump-oriented programming gadgets. Our scheduling methods for AArch64 appear largely ineffective at reducing gadget count and quality. Our instruction scheduling methods seem to either lack accuracy in approximating the gadget’s value destination register to estimate instruction score, or require more foresight when searching for similar block endings to reduce the total number of unique gadgets present in a binary.