WindowGuardian: Return Address Integrity for ESP32 Microcontrollers with Xtensa Processors using AES and Register Windows

The integrity of return addresses in C and C++ applications plays a central role as it has been a prime target for memory corruption attacks. While many different methods exist to protect the return address from memory corruption attacks, many of them are not applicable to embedded devices. In this paper we are investigating the ESP32 microcontroller series and the register window feature of its’ Xtensa processor. Due to this feature, return addresses are mostly kept in registers, making the need for protection a much rarer occasion. As a result, we explore the possibility of using AES encryption to provide integrity to return addresses, an approach that would typically be discarded as too costly to be efficient. We present two different approaches and evaluate them with the BEEBS benchmark, showing that the execution overhead is negligible (< 0.1%) in many cases. The benchmark and its results are publicly available.