A system and method for resisting memory leakage based on llvm

Abstract

The present invention provides a system and method for resisting memory leakage based on LLVM. The system includes a code honeypot device and a data honeypot device. The code honeypot device is used to resist memory leakage attacks based on code pointers, including compiling an LLVM source file as After the IR layer code, identify the cross-function transfer instruction in the code, insert the condition judgment instruction, the real end points to the jump instruction, and then create a copy of the function or code fragment pointed to by the jump instruction, and create a copy of the function or code fragment pointed to by the condition judgment false end. The honeypot jump instruction of the copy, and finally transfer the copy to the monitored or non-executable honeypot area; the data honeypot device is used to identify instructions that are likely to cause code location leakage, including program return address instructions, functions Pointer generation instructions, virtual function pointer generation instructions and exception handling pointer generation instructions are inserted into corresponding honeypot functions or code generation instructions. The invention can resist the memory leak attack based on code and data pointer leak.

Description

technical field [0001] The invention belongs to the field of computer software security, and relates to a LLVM-based technical solution for resisting memory leakage. Background technique [0002] The attack and defense of code reuse attack is one of the important research directions of software security. Code reuse attacks are accomplished by reusing code that already exists in the program, by hijacking the control flow to the target reuse code. The current randomization method increases the entropy of the target program, and the attacker cannot directly construct an attack based on the target fragment position obtained by offline analysis. Therefore, the attacker uses the memory leak to get the real code location after randomization, so as to correct the location of the fragment or directly search for the fragment in the memory. [0003] Some classical methods assist code reuse attacks by locating gadgets through memory leaks. JIT-ROP locates the code page by finding inf...

AI Technical Summary

Problems solved by technology

These two methods can mitigate execution-based memory leak attacks to a certain extent, but most of them cannot be used in actual industrialized scenarios due to problems such as high overhead and inconvenient deployment.

Images