Buffer overflow attack protection method, device and system

Abstract

The embodiment of the invention discloses a protection method, a device and a system of buffer overflow attacks; the method comprises the following steps that: a randomizing management drive is loaded in a memory in the mode of a Windows core; the randomizing management drive is linked with an application program interface API function which is arranged in the Windows core and related to the memory allocation, and parameters of the API function are modified to randomize a base address allocated by the memory. Therefore the range of the attacks caused by the overflow of a protection buffer area is further expanded, and the effect is better.

Description

technical field [0001] The invention relates to the communication field, in particular to a buffer overflow attack protection method, device and system. Background technique [0002] Microsoft's next-generation operating system, Windows Vista, is most proud of security in that it uses Address Space Layout Randomization (ASLR, Address Space Layout Randomization) technology to allocate memory, such as Dynamic-link Library (DLL, Dynamic-link Library). ) and executables to ensure that two concurrent instances of the operating system (eg, two identical executables) are loaded at different memory addresses each time. [0003] Windows Vista's ASLR loads system DLLs and executable files in different locations each time the system starts, making it impossible for malware to know the location of the application programming interface (API, Application Programming Interface). Early in the boot process, the memory manager will randomly select one of the 256 64KB addresses in the top 16M...

AI Technical Summary

Problems solved by technology

[0005] However, the existing ASLR technology only randomizes part of the memory allocation (such as DLL and executable programs), so the existing technology has a narrow range of protection against buffer overflow attacks and poor effect

Images