Defending method based on virtual function table hijacking

Abstract

The invention provides a defense method based on virtual function table hijacking, which can determine the utilization and further attack of potential use-after-free type loopholes in binary executable files. Step 1. Use the static instruction fragmentation and extraction framework to disassemble an executable file as input and generate a control flow graph and assembly language; Step 2. Compress and simplify the assembly language obtained in Step 1; Step 3. vEXTRACTOR in Step 2 Execute backward program slicing on the obtained intermediate language; step 4, extract all low-level semantics satisfying virtual function scheduling from the first three steps, and take out the virtual function scheduling part; step 5, rewrite and configure ID; All reference parameters of the function table are changed to new addresses of vtables, and VRewriter equips each virtual function with a security check to verify the integrity of the target virtual table; step 7, put the execution code equipped with security check into a new The code segment, to ensure that most of the original code department intact.

Description

technical field [0001] The invention belongs to the technical field of memory safety and relates to a defense method based on virtual function table hijacking. Background technique [0002] The memory safety technology can protect the system from various memory damage attacks, and the complete memory safety technology can prevent the occurrence of various memory errors without missing a report. Type-safe languages ​​ensure that memory errors do not occur by checking object boundaries and using automatic garbage collection. Memory safety technology is an attempt to add protection to the program to simulate the nature of type-safe languages. In recent years, researchers have proposed a large number of memory security technologies to protect system security, but due to compatibility, performance overhead and other reasons, they have not been widely used. CCured and Cyclone use "fat pointers" to store additional pointer information, including pointer range and other data, to pr...

AI Technical Summary

Problems solved by technology

[0008] Although the automatic reverse analysis is fast and convenient in speed and does not require manual intervention, the subsequent security scheme to protect the binary files causes a large system overhead; while the protected binary files generated by the VTint defense method have a small system overhead, but the entire analysis process Manual intervention is not required

Images