Shaping vulnerability detection method based on dynamic and static analysis

Abstract

The invention provides a shaping vulnerability detection method based on dynamic and static analysis. Static and dynamic program analysis technologies are combined. Points to be protected include thefollowing contents that in a static analysis stage, the tool decompiles the binary program and creates a suspicious instruction set; in a dynamic analysis stage, the tool dynamically scans instructions in the suspicious instruction set, and whether the instructions are vulnerabilities or not is judged in combination with input capable of triggering the vulnerabilities. At present, vulnerability mining is either static analysis or dynamic analysis. The vulnerability detection technology can well overcome the defects of existing vulnerability mining, accurate and sufficient type information is provided, and through static analysis based on the decompiler, the number of instructions needing to be detected during dynamic operation is reduced.

Description

technical field [0001] The invention relates to a detection method for shaping loopholes, in particular to a dynamic and static analysis-based detection method for plastic loopholes. Background technique [0002] In the past few years, several methods for detecting shaping vulnerabilities have been proposed. But the shaping loopholes still haven't disappeared. There are three main reasons: (1) There are quite a few methods, such as BLIP, RICH, SafeInt, IntSafe, etc., which require program source code, but for most commercial software, the source code is not necessary for ordinary Users are generally not available. (2) The extraction of type information is incomplete. Shaping vulnerability detection tools for binary code (BRICK, IntScope, SmartFuzz) do not consider control flow dependencies when extracting type information, and part of the type information is lost, which affects the detection of shaping vulnerabilities. (3) Detection limitations, some tools can only detect...

AI Technical Summary

Problems solved by technology

But the shaping loopholes still haven't disappeared. There are three main reasons: (1) There are quite a few methods, such as BLIP, RICH, SafeInt, IntSafe, etc., which require program source code, but for most commercial software, the source code is not necessary for ordinary Users are generally not available

(2) Incomplete type information extraction

Shaping vulnerability detection tools for binary code (BRICK, IntScope, SmartFuzz) do not consider control flow dependencies when extracting type information, and part of the type information is lost, which affects the detection of shaping vulnerabilities

(3) Detection limitations, some tools can only detect integer overflow, such as IntScope, UQBTng

However, some tools lack dynamic detection tools specifically for shaping vulnerabilities, which may result in false negatives. SmartFuzz generates test cases that may trigger shaping vulnerabilities, and reports test cases that cause memory errors through the detection tool Memcheck

However, the shaping vulnerability that causes non-control flow attacks cannot be detected by Memcheck, the test cases of this vulnerability will not be reported, and SmartFuzz will generate false negatives

Images