Code reuse attack defense method based on dynamic function loading

Abstract

The invention belongs to the field of software vulnerability defense, and particularly relates to a code reuse attack defense method based on dynamic function loading, which comprises the following steps: S1, preprocessing a binary executable file, identifying the initial address and size of a function block, identifying segment information, and defining and identifying a compliance address; the binary executable file is preprocessed, the initial address and size of a function block are recognized, segment information is recognized, and a compliance address is defined and recognized; the executable file is classified according to the function of the gadget, and machine code features of the corresponding type of the gadget instruction are extracted, so that the gadget in the executable file can be searched; s2, a function dynamic loading scheme for local control flow integrity is introduced; and S3, a dynamic function uninstalling scheme of the gadget semantics is introduced. The method has the advantages that the required functions are dynamically loaded when the program runs, part of the functions are unloaded in time to reduce the number of available gadgets in the memory space during running, and the gadgets in the program are prevented from being utilized.

Description

technical field [0001] The present application belongs to the field of software vulnerability defense, and in particular relates to a code reuse attack defense method based on function dynamic loading. Background technique [0002] Software vulnerabilities are widely used in offensive and defensive games as a strategic resource due to their high threat, difficult to defend, and ubiquitous characteristics. Among them, the buffer overflow vulnerability is one of the representatives, and it has always been the hardest hit by attackers. Specifically, the attacker obtains the control of an instruction pointer through the buffer overflow vulnerability, hijacks the control flow by connecting the code fragment of the program itself (usually called gadget), and changes the register state to achieve the purpose of the code reuse attack of the system call . The existing methods mainly include control flow integrity (CFI), memory layout randomization and software debloat technology. ...

AI Technical Summary

Problems solved by technology

However, the randomization of memory only reaches the page level, and the data in the page is still stored sequentially, which is easy to be cracked by violence; at the same time, ASLR will face the threat of memory leak attacks

Images