Dynamic measuring method of buffer overflow on the basis of logic isolation

Abstract

The invention discloses a dynamic measuring method of buffer overflow on the basis of logic isolation, comprising the steps of logic isolation of buffer data and buffer dynamic measurement on the basis of the logic isolation in an operation process so as to detect the buffer overflow. Different data types are stored in continuous linear physical spaces without modifying the current structure of acomputer system. The dynamic measuring method comprises the following steps: by inserting an isolation mark, storing the buffer data in the low address direction of the isolation mark, and storing pointer data in the high address direction of the isolation mark to form a state space subset ranging from the low address to the high address of a memory, wherein a buffer comprises a plurality of continuous state space subsets; and based on the logic isolation, checking the completeness of the isolation mark by the dynamic measuring method to judge whether the buffer overflow occurs in or not. Thedynamic measuring method of buffer overflow on the basis of logic isolation can be applied to buffers with different applications, in particular to stacks. The method is optimized in measuring time and measuring range to overcome the defects of the traditional method.

Description

technical field [0001] The invention relates to the field of information security, in particular to a dynamic measurement method for buffer overflow based on logic isolation. Background technique [0002] Buffer overflow refers to when more data than the buffer's processing capacity is copied into a buffer that has allocated a certain storage space, a buffer overflow will occur. Overflow destroys the integrity of the data space. Overflow includes heap overflow and stack overflow. [0003] The buffer overflow attack is to overwrite the pointer to the execution code by overflowing, so that the pointer points to the injected malicious code, thereby changing the control flow of the program and running the program injected by the outside world. Therefore, the key point of the attack is to destroy the integrity of the pointer data space. [0004] There are currently two main modes of buffer overflow attack. First, the data written to the buffer contains shellcode (executable b...

AI Technical Summary

Problems solved by technology

In addition, when the stack frame is popped, only the buffer in the stack frame is checked, which cannot resist the overflow attack of attack example 4

Therefore, the security check of the current stack frame is only performed when the function returns, and overflow attacks on other data that the function depends on during execution cannot be found.

Images