A method and device for locating buffer overflow vulnerabilities

Abstract

The invention relates to a method and an apparatus for locating buffer overflow vulnerability. According to the method and the apparatus, outdated data information on a stack can be used to reestablish a function calling relation chain in the case that buffer overflow at the stack covers a stack frame address and a function return address, and an overflow function can be further directly located by virtue of the reestablished function calling relation chain. The method comprises the following steps: when the buffer overflow occurs, allowing a current program to be interrupted by an error so as to avoid the execution of a malicious code; taking an address indicated by a current ESP register as a starting point, and successively finding and determining an outdated stack frame pointer and an outdated return address from outdated data on the stack, wherein a value of the outdated return address is the return address of a last sub-function called by the overflow function, and a function corresponding to the return address is the overflow function. According to the method and the apparatus, a novel way of directly locating the overflow function rather than the way of adopting a stack calling function for successively backtrackeing is used, a vulnerability function is located by using the outdated data on the stack, different situations are classified to be processed, so that the outdated data can be reused, and the overflow function and the overflow address can be rapidly located.

Description

technical field [0001] The invention relates to a method and device for locating a buffer overflow vulnerability, belonging to the technical field of information security. Background technique [0002] In the field of information security, software vulnerability analysis is a very important part. Among the many types of vulnerabilities, buffer overflow vulnerabilities are the most common type of vulnerabilities. Buffer overflow, according to the location of the buffer, is divided into stack overflow and heap overflow. Stack buffer overflow refers to the overflow of the buffer by writing the content exceeding its length to the buffer of the program, thereby destroying the stack of the program, making the program execute the data constructed by the attacker instead, so as to achieve the purpose of executing malicious code . [0003] When analyzing the cause of the vulnerability, it is very necessary to quickly locate the point where the vulnerability occurs. If the function...

AI Technical Summary

Problems solved by technology

This method can overcome the above-mentioned problem of loss of function call relationship caused by buffer overflow overwriting the stack frame, but this method has two shortcomings, one is relying on the ability of the decompiler tool, and the other is when the program When the execution paths are different, it will cause false positives

Images