System and method for resisting memory leak based on LLVM

Abstract

The invention provides a system and a method for resisting memory leak based on an LLVM. The system comprises a code honeypot device and a data honeypot device, the code honeypot device is used for resisting a memory leak attack based on a code pointer; the method comprises the following steps: compiling an LLVM source file into IR layer codes; identifying a cross-function transfer instruction, aninsertion condition judgment instruction and a real end pointing to the jump instruction in the code, then creating a copy of a function or code fragment pointed by the jump instruction, creating a honeypot jump instruction pointing to the copy at a condition judgment false end, and finally transferring the copy to a monitored or non-executable honeypot area; the data honeypot device is used foridentifying instructions easy to cause code position leakage, including a return address instruction of a program, a function pointer generation instruction, a virtual function pointer generation instruction and an exception handling pointer generation instruction, and inserting a corresponding honeypot function or code generation instruction. According to the system, the memory leakage attack ofpointer leakage based on codes and data can be resisted.

Description

technical field [0001] The invention belongs to the field of computer software security, and relates to a technical solution for resisting memory leaks based on LLVM. Background technique [0002] The attack and defense of code reuse attacks is one of the important research directions of software security. The code reuse attack completes the attack by reusing the code already in the program and hijacking the control flow to the target reusing code. The current randomization method increases the entropy value of the target program, and the attacker cannot directly construct an attack based on the target fragment position obtained by offline analysis. Therefore, the attacker uses memory leaks to obtain the real code location after randomization, so as to correct the location of the fragment or directly search for the fragment in memory. [0003] Some classic methods use memory leaks to locate gadgets to assist code reuse attacks. JIT-ROP uses the memory information leakage ...

AI Technical Summary

Problems solved by technology

These two methods can mitigate execution-based memory leak attacks to a certain extent, but most of them cannot be used in actual industrialized scenarios due to problems such as high overhead and inconvenient deployment.

Images