ROP chain detection method and device and medium

Abstract

The ROP chain detection method and device and the medium provided by the invention are suitable for the field of flow detection. Based on a composition rule of an ROP chain, the problem that to-be-detected flow data of a data packet needs to be detected and judged for multiple times in existing research is optimized, the number of times of detection and judgment is set according to a specific operating system digit, and the to-be-detected flow data is simplified to obtain first generation data; correspondingly dividing the plurality of pieces of first generation data into a plurality of pieces of second generation data according to a byte address division principle and a Gadget address space; and according to the sliding window, judging the plurality of pieces of second generation data to obtain corresponding sliding data. And when the sliding data meets the preset condition, the position of the target sequence which appears for the first time is output to correspond to the position of the first generation data so as to position the ROP chain position, so that the time cost is further saved, the detection process is simplified, and convenience can be provided for subsequent flow analysis work according to the positioned ROP chain position.

Description

technical field [0001] The invention relates to the field of flow detection, in particular to a detection method, device and medium of a ROP chain. Background technique [0002] For the operating system mitigation mechanism, there is a technology that uses code fragments in the program to control the execution flow of the program, which is called Return Oriented Programming (ROP). The attacker implements the ROP attack by calling the code in the program memory space multiple times, thereby successfully bypassing the protection mechanism and implementing arbitrary instruction execution. Using the instruction fragment (Gadget) ending with the ret instruction to construct a ROP chain is an important feature of the gadget in the ROP attack. Gadget is the basic unit of building a ROP chain. Depending on the code fragment, it can be combined to complete various tasks, such as loading values ​​into registers, storing, arithmetic and logic operations, etc. [0003] Since the ROP c...

AI Technical Summary

Problems solved by technology

In the existing ROP chain detection process, data packets need to be detected multiple times, and the data to be detected is long. The entire detection process is cumbersome, and the detection time and cost it takes is relatively long.

At the same time, the detection of the ROP chain can only know the presence of the ROP chain in the data packet, and cannot locate the location of the data packet, so that the detection work stays at detecting the occurrence of ROP attacks and cannot provide guarantee for follow-up work

Images