Method for checking stack frame destruction

Abstract

The present invention provides a method of detecting stack frame damage, when function enters pile, back-up the return address LR, when function exits pile, judging present LR in stack frame whether is identical to the back-up LR, if not identical, the damaged stack frame is detected. The method of the invention can detect damage of stack frame is the first site, and detect program to be or already overflow in the first site.

Description

technical field [0001] The present invention relates to methods for detecting stack frame corruption and stack overflow. Background technique [0002] In the process of program development, due to problems such as local variable out-of-bounds (buffer overflow) and wild pointers, the stack frame is destroyed. When the function returns, it jumps to the wrong return address, which makes the error spread further. It was not the first scene when it crashed, which brought great difficulty to locating program bugs. [0003] Attacking programs with buffer overflow flaws is one of the most common methods used by viruses. The attacker writes code for this defect, modifies the stack frame through overflow, constructs the attack code, and makes the return address point to the attack code, and runs the attack code when the function returns, so as to gain control over the system, etc. Stack overflow will also lead to memory overwriting or access to illegal memory, causing the program to...

AI Technical Summary

Problems solved by technology

These methods realized by means of software can also realize the attack on buffer overflow, but there are certain loopholes or too complicated in the implementation. For example, the patent No. CN1564098 can rewrite a long section of overflow memory to point to virus Code, possibly passing through the random pad space and rewriting the return address, thus breaking the isolation protection of the random pad space

Images