Program exception analysis method based on dynamic stain propagation

Abstract

The invention provides a program exception analysis method based on dynamic stain propagation, which comprises the following steps of: dynamically running a target program in a virtualization environment, monitoring a target process of the target program and recording execution sequence information; Marking the input data causing the abnormity of the target program as a stain source, and performing stain propagation analysis according to the instruction semantics of the instruction executed by the target process to obtain stain state information of a memory; Identifying a memory access exception in the running process of the target program, extracting an exception position of an exception instruction, and detecting an operand of the exception position and a stain state of a register according to stain state information of the memory; If the operands and the registers are polluted, positioning error points through stain backtracking; And otherwise, carrying out reverse slice analysis onthe register, finding out a related data link, carrying out heap overflow detection and UAF detection on each node on the data link, and positioning an error point through comparative analysis.

Description

technical field [0001] The invention belongs to the technical field of network security, and specifically relates to a method for analyzing abnormalities or loopholes of binary programs and locating error points on a virtualization platform based on data flow analysis of dynamic stain propagation. Background technique [0002] With the continuous improvement of program functions, scale, and complexity and the intensification of update iteration speed, as well as the lack of security awareness of software developers, software vulnerabilities have seriously threatened the security of cyberspace, and the damage caused by them has become increasingly serious. The harm of the vulnerability is initially manifested in the crash and exception of the program, and most of these crashes and exceptions are caused by memory access exceptions. Currently, memory access exceptions include memory read exceptions, write exceptions, and execution exceptions. Common causes include null pointer ...

AI Technical Summary

Problems solved by technology

[0012] To sum up, the main drawbacks of the current program exception analysis method are: relying on debuggers and a large number of analysts, unable to deal with target software with packer obfuscation and anti-debugging capabilities, the depth of analysis is not enough, it stays at the surface, and cannot effectively analyze the abnormality caused by it deeply. root cause, has certain dependencies on the source code

Images