ROP (return-oriented programming) on basis of Pin tools and method for dynamically detecting variant attack of ROP

Abstract

The invention belongs to the field of attack detection, and discloses ROP (return-oriented programming) on the basis of Pin tools and a method for dynamically detecting variant attack of the ROP. The method includes steps of 1, enabling target programs by the aid of binary Pin instrumentation tools; 2, tracking the target programs and matching ret instructions, call instructions and jmp instructions with one another; 3, detecting the variant attack by the aid of detection modules on the basis of the ret instructions if the ret instructions are available, detecting the variant attack by the aid of detection modules on the basis of the call instructions if the call instructions are available and detecting the variant attack by the aid of detection modules on the basis of the jmp instructions if the jmp instructions are available; 4, raising attack alarm if exception of the target programs is detected by the detection modules or skipping to the step 2. The ROP and the method have the advantages that the ROP and the variant attack of the ROP can be dynamically detected, and the ROP and the method are extremely high in practicality and universality.

Description

Technical field [0001] The invention relates to a detection technology for ROP attacks, in particular to a dynamic detection method for ROP and its variant attacks based on a Pin tool, which is used for detecting ROP and its variant attacks. Background technique [0002] There are many types of network security, such as: network physical security, network topology security, network system security, application system security, and network management security. However, the present invention relates to application system security. All kinds of software running on the computer are manually written. Due to human limitations, the written software has more or less loopholes. Buffer overflow vulnerabilities, heap overflow vulnerabilities, and local privilege escalation vulnerabilities are still common. Once these vulnerabilities are discovered and used by people with ulterior motives, the harm they bring cannot be underestimated. In order to deal with the harm caused by loopholes, expe...

AI Technical Summary

Problems solved by technology

[0007] Based on the above technical problems, the present invention provides a dynamic detection method for ROP and its variant attacks based on the Pin tool. ROP attack detection, while detecting low-efficiency technical problems

Images