Binary program-oriented heap overflow detection method

Abstract

The invention provides a binary program-oriented heap overflow detection method. The method comprises the following steps: recording relevant heap management operation information according to the calling situation of a heap management operation function in a program running process; generating taint information according to the heap management operation information, and associating the taint information with the heap management operation information; dynamically monitoring all operations related to the taint information in the program running process by means of dynamic transmission of the taint information; if the taint data is found to be used in a command, taking the command as a heap overflow judgment command; determining the actual access memory address of the command according to the taint data, and judging whether the memory address has heap overflow or not. By dynamically monitoring the heap allocation and heap pointers in the program running process, the out-of-bounds behaviors in all heap access operation processes are identified, so that heap overflow detection is completed.

Description

Technical field [0001] The invention belongs to the technical field of network security, and specifically relates to a binary program-oriented heap overflow detection method. Background technique [0002] There are many types of existing software vulnerabilities, and program buffer overflow vulnerabilities are currently the most common and most exploitable type of vulnerabilities. They can be divided into stack overflow vulnerabilities and heap overflow vulnerabilities according to different buffer memory. Among them, stack overflow vulnerabilities are the oldest type of overflow vulnerabilities. There have been quite a wealth of research results on the mining, defense, and exploitability analysis of this type of vulnerabilities. For heap overflow vulnerabilities, due to the complexity of the heap's own structure The dynamic characteristics of performance and heap allocation are currently hot and difficult issues in the field of software vulnerability research for related vulnera...

AI Technical Summary

Problems solved by technology

[0008] In view of the unsatisfactory efficiency of existing heap overflow detection methods and the lack of dependence on source code, the purpose of the present invention is to propose a heap overflow detection method for binary programs, through dynamic monitoring of heap allocation during program operation and Heap pointer, identifying out-of-bounds behavior during all heap access operations, so as to complete the detection of heap overflow

Images