Fault-tolerant method of software stack buffer overflow

Abstract

The invention provides a fault-tolerant method of software stack buffer overflow, which comprises the following steps of: obtaining a fault-tolerant-protection target program; parsing a binary executable file of the target program so as to identify functions in the target program and information of the stack buffer in the functions; attaching a dynamic instrumentation tool to all threads of the target program; using the dynamic instrumentation tool to intercept function call and function return; determining whether the intercept results are the function call of the target program or not, if so, using the dynamic instrumentation tool to intercept the initialization operation of the stack buffer, allocating a heap buffer in the heap space of the target program, so that the heap buffer is mapped with the stack buffer; saving a mapping relationship between the stack buffer and the heap buffer in a mapping table, and the mapping relationship comprising stack buffer information and heap buffer information; and using the dynamic instrumentation tool to intercept all memory access operations in order to obtain the virtual effective addresses of the memory access operation. The method realizes the fault tolerance of the stack buffer overflow.

Description

technical field [0001] The invention belongs to the field of computer safety, and in particular relates to a fault-tolerant method for software stack buffer overflow. Background technique [0002] Currently, there are some solutions to the problem of stack buffer overflow to prevent the execution of unauthorized code by using stack buffer overflow, which are mainly divided into two types: static detection and dynamic protection. Static detection methods mainly include static detection based on source code and detection based on object code. ITS, Splint and MOPS are three representative tools of static analysis methods. This class of methods identifies partial buffer overflows, format string overflows, and race condition vulnerabilities in filesystems related to vulnerable library functions. Dynamic protection refers to the dynamic defense during the running of the program to prevent the attacker from modifying the function return address into malicious code and running it ...

AI Technical Summary

Problems solved by technology

[0003] However, the above method still has major deficiencies when solving stack buffer overflow

Static detection methods suffer from high false positive and high false negative rates

The dynamic protection scheme can only prevent the use of stack buffer overflow to execute unauthorized code, only guarantees security, but cannot fault tolerance to stack buffer overflow, and cannot guarantee the correctness and reliability of program execution

In addition, in terms of implementation, the above method requires strong conditions, and the source code of the program needs to be obtained, and the source code of the program needs to be recompiled with a modified compiler.

Images