A Binary-Oriented Function-Level Software Randomization Method

Abstract

The present invention discloses a binary-oriented function-level software randomization method, comprising the following steps: identifying the function boundary of the original binary software; performing function-level redundant disassembly on the binary software; and performing randomized rewriting on the disassembled code, thereby reconstructing an executable file. The technical effect of the present invention is that, through the binary code function-level rewriting, the original function function is randomly moved to a new position, and the instructions of the function area in the original binary software are reset, so that the code instruction fragments used to construct the ROP attack can be disrupted, thereby effectively blocking the ROP attack. The binary-oriented function-level software randomization method provided by the present invention, through function boundary identification, function-level redundant disassembly and randomized code generation, only needs to change the static form of the binary software, without the need to perform highly complex operations at runtime, and will not introduce additional runtime overhead, thereby providing an efficient ROP defense means.

Description

Technical Field

[0001] The present invention relates to the field of software security, and in particular to a binary-oriented function-level software randomization method. Background Art

[0002] With the development of information technology, software has penetrated into every aspect of people's lives and work. However, software development is constrained by both technical and economic factors, and there is the possibility of artificially reserved backdoors, which leads to the fact that software vulnerabilities cannot be fundamentally eliminated and will inevitably exist for a long time. Many vulnerability exploitation methods have emerged to target software vulnerabilities, which may capture and control the information systems that people rely on, causing huge economic losses. Among the many software vulnerability exploitation methods, return-oriented programming (ROP) attack is a new type of attack based on code reuse technology. The attacker extracts instruction fragments from existing libraries or executable files and constructs malicious code to achieve vulnerability exploitation and network attacks. ROP attack is different from buffer overflow attack and formatted string vulnerability attack. It is an attack method that uses code reuse technology, uses the existing instruction sequence in the program to attack, avoids code injection, and has good attack effect and is difficult to defend.

[0003] See also Figure 1 Although there are some defense solutions for ROP attacks, these solutions are based on runtime reconstruction of program control flow or dynamic instrumentation monitoring. The target binary program is loaded through the dynamic instrumentation framework, and the instruction execution process and control flow are dynamically analyzed to implement defense instrumentation against ROP attacks, ensuring that the original functions of the software are normal and not attacked by ROP. However, these solutions all need to save additional control flow change information at runtime, and use this information to restore the correct execution control flow when an attack is detected, resulting in large resource consumption in these solutions. Therefore, such solutions have great obstacles in practical applications.

[0004] Since it is difficult to directly achieve equivalent rewriting of binary software, existing solutions are mainly based on dynamic insertion. Since these solutions consume a lot of resources, there are great obstacles in practical application of such solutions. There are also some technical solutions based on direct rewriting, but their technical maturity and effectiveness need to be further verified and have not yet been widely used. Summary of the invention

[0005] In order to solve the technical problems that the current defense schemes against ROP attacks have excessive resource consumption and are not mature and effective enough, the present invention provides a binary-oriented function-level software randomization method that can disrupt the reusable code fragments necessary for ROP attacks, making it impossible to construct attack programs using existing instruction fragments, thereby blocking ROP-based software vulnerability attacks from the source.

[0006] In order to achieve the above technical purpose, the technical solution of the present invention is:

[0007] A binary-oriented function-level software randomization method comprises the following steps:

[0008] First, the function boundaries of the original binary software are identified; then, based on the identified function boundaries, the binary software is redundantly disassembled at the function level; finally, the disassembled code is randomly rewritten to reconstruct the executable file.

[0009] The method of identifying the function boundary of the original binary software comprises:

[0010] Step 1: Collect existing public source code containing various functions, and then extract the boundary information of different functions in binary code during the compilation process to construct a training set for binary software function boundary recognition. Then, train the deep neural network based on the training set to obtain a function boundary recognition model.

[0011] Step 2: For the original binary software that needs to identify function boundaries, extract data fragments by byte-by-byte offset, vectorize the data fragments, and use the recognition model to identify function boundaries, thereby marking the boundary positions of different functions.

[0012] In the method, in the second step, extracting data segments by byte-by-byte offset and performing vectorized processing on the data segments include:

[0013] First, the binary software is regarded as a finite-length binary sequence, and then fixed-length data is extracted byte by byte to serve as the input vector of the recognition model.

[0014] The method of performing function-level redundant disassembly on binary software comprises:

[0015] Phase 1: Based on the function boundary identification, the binary fragment data of the function is intercepted, and the fragment data is scanned and disassembled byte by byte. Then, randomized reconstruction is performed to generate new code, and the length of the generated new code is calculated to determine the global offset of the new code. Then, an address mapping table is constructed with the global offset of the original fragment data and the newly generated code.

[0016] The second stage: disassemble the entire function byte by byte, use the address mapping table to update the address reference relationship of the generated code, splice the newly generated code in sequence as the new function content, and then reset the data in the original binary fragment area as an interrupt instruction to block the ROP attack chain, and then update the instruction starting from the first byte position of the original function to a long jump instruction, so that when the function is called, it will directly jump to the location of the new function to continue execution. Finally, select a random code starting address to insert the new function code into the executable file to generate a security-enhanced binary software, and perform necessary repairs on the executable file format according to the binary software format specification, including relocation table repair and exception handling table repair, so that the security-enhanced binary software can run normally.

[0017] In the method, in the first stage, the randomized reconstruction includes:

[0018] Randomly insert junk instructions or attack detection logic to achieve randomized reconstruction.

[0019] In the method, in the second stage, resetting the data in the original binary fragment area means changing the original data to random data or setting all to 0.

[0020] The method described, in the second stage, updates the instruction starting from the first byte position of the original function to a long jump instruction, that is, hard-coding the original instruction to a jmp 0xaddr instruction, so that when the original function is called, it directly jumps to the new function code for execution.

[0021] An electronic device, comprising:

[0022] one or more processors;

[0023] a storage device for storing one or more programs,

[0024] When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0025] A computer readable medium stores a computer program, which implements the above method when executed by a processor.

[0026] The technical effect of the present invention is that, through binary code function-level rewriting, the original function is randomly moved to a new location, and the instructions of the function area in the original binary software are reset, so that the code instruction fragments used to construct ROP attacks can be disrupted, thereby effectively blocking ROP attacks. The binary-oriented function-level software randomization method provided by the present invention, through function boundary identification, function-level redundant disassembly and randomized code generation, only needs to change the static form of the binary software, without the need to perform highly complex operations at runtime, and will not introduce additional runtime overhead, thereby providing an efficient ROP defense method. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a structural diagram of the existing ROP attack defense solution;

[0028] Figure 2 It is a schematic diagram of the process of the present invention;

[0029] Figure 3 A schematic diagram of the process of identifying function boundaries of the present invention;

[0030] Figure 4 It is a schematic diagram of the flow of function-level redundant disassembly of the present invention;

[0031] Figure 5 This is a schematic diagram showing the byte-by-byte disassembly of the present invention. DETAILED DESCRIPTION

[0032] The method provided in this embodiment includes inputting original binary software and identifying function boundaries; performing function-level redundant disassembly on the binary software; performing randomized rewriting on the disassembled code, reconstructing the executable file, and generating security-enhanced binary software.

[0033] 1. Function boundary identification

[0034] Executable files generally store code and data in the form of segments and sections. After the source code is compiled into binary software, all function codes are generally stored in .text. To restore the boundaries of different functions from .text, we can use the additional information generated by the compiler. However, when this information is not available, it is difficult to accurately restore the function boundary information. To solve this problem, this embodiment uses a deep neural network method to identify function boundaries. The method flow is as follows: Figure 3 shown.

[0035] Step 1: Collect public source code, then extract the boundary information of different functions in the binary code during the compilation process, further construct a binary software function boundary recognition training set, and train the deep neural network to output the function boundary recognition model. The neural network here can use various neural networks including LSTM, Bi-LSTM, TextCNN, etc.

[0036] Step 2: For the target binary software, first preprocess it: treat the binary software as a finite-length binary sequence Bin = (B1, B2, ... B n ), and then extract the data fragment by byte offset, that is, the first data fragment extracted is Vec1 = (B1, B2, ... B 1+k ), then the second data segment is Vec2=(B2,B3,…B 2+k ), and after vectorizing the data fragments, the trained recognition model is used to identify function boundaries, and finally the boundary positions of different functions are accurately marked, providing support for randomized rewriting at the function level.

[0037] 2. Function-level redundant disassembly

[0038] Due to the characteristics of mixed storage of binary software code and data, it is theoretically impossible to achieve 100% accurate disassembly. Therefore, this embodiment proposes to solve this problem through two-stage redundant disassembly. The specific method flow is as follows: Figure 4 shown.

[0039] Phase 1: Based on the identification of function boundaries, directly intercept the binary fragment data of the function, scan and disassemble the data byte by byte, and use the randomized reconstruction method to generate new code. The randomized reconstruction here can be processed differently according to the different instructions disassembled byte by byte, such as simply inserting some redundant instructions, and inserting additional attack detection logic for instructions that need special processing, so as to achieve randomized rewriting of the target code. Among them, the attack detection logic can be defined by itself. For example, a typical attack detection logic in this embodiment is: allocate a data verification stack in the memory, and when processing the function call instruction call, push the next instruction address of the call instruction into the stack, and then when processing the ret instruction, verify whether the return address is in the data verification stack. If it exists, it is considered safe and the data pop operation is performed. If the return address does not exist, it can be considered that a ROP attack is detected, and further an alarm event is output or the program execution is directly terminated.

[0040] Next, the length of the generated code is calculated to determine the global relative offset position of the generated code so that the correct jump target can be found when the jump instruction is generated later. Then an address mapping table is constructed with the current disassembled address and the global offset of the newly generated code.

[0041] The second stage: disassemble the entire function byte by byte again, and use the constructed address mapping table to update the address reference relationship of the generated code. This is because the code length is determined in the first stage, but the jump address of some jump instructions is not completely determined, so these jump addresses are determined through the second stage of processing, that is, the address reference relationship of the code is updated. The specific method is to use the mapping table to accurately calculate the relative address and generate the final assembly code. Then the newly generated code is sequentially spliced ​​as the new function content, and the data in the original binary fragment area is reset to an interrupt instruction to block the ROP attack chain. The reset here is to change the original data to random data or set it to all 0.

[0042] Then update the instruction starting from the first byte position of the original function to a long jump instruction, so that when the function is called, it will directly jump to the location of the new function to continue execution. Since the location of the generated code is already known, a jmp 0xaddr instruction is hard-coded here to achieve direct jump to the newly generated code for execution when the original function is called. Finally, apply for a random code starting address. Specifically, through the API function of the executable file operation, determine where to start storing the generated new function code, insert the new function code into the executable file in the form of a new section, generate the binary software with security enhancement, and perform necessary repairs on the executable file format, including relocation table repair, exception handling table repair, etc., so that the binary software with security enhancement can run normally. The repair here is because the binary software has been modified, and the binary software has a format specification. Therefore, after the modification, the final generated software needs to be repaired according to the format specification of the binary software. The specific method of repair is to parse and update the relevant data structure through the executable file operation library, and finally save it as an output file.

[0043] At the same time, this embodiment also provides an electronic device and a computer-readable medium.

[0044] Electronic equipment includes:

[0045] one or more processors;

[0046] a storage device for storing one or more programs,

[0047] When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0048] In specific use, users can interact with servers, which are also electronic devices, through electronic devices as terminal devices and based on the network to achieve functions such as receiving or sending messages. Terminal devices are generally various electronic devices equipped with display devices and used based on human-computer interfaces, including but not limited to smart phones, tablet computers, laptops and desktop computers. Various specific application software can be installed on the terminal devices as needed, including but not limited to web browser software, instant messaging software, social platform software, shopping software, etc.

[0049] The server is a network service end for providing various services. The method provided in this embodiment is generally executed by the server. In actual use, under the necessary conditions, the terminal device can also directly execute this method.

[0050] Similarly, the computer-readable medium provided in this embodiment stores a computer program, which implements the method of the embodiment of the present invention when executed by a processor.

Claims

1. A binary-oriented function-level software randomization method, characterized in that: The following steps are involved: First, the function boundaries of the original binary software are identified; then, based on the identified function boundaries, the binary software is redundantly disassembled at the function level; finally, the disassembled code is randomly rewritten to reconstruct the executable file; Function-level redundant disassembly of binary software includes: Phase 1: Based on the function boundary identification, the binary fragment data of the function is intercepted, and the fragment data is scanned and disassembled byte by byte. Then, randomized reconstruction is performed to generate new code, and the length of the generated new code is calculated to determine the global offset of the new code. Then, an address mapping table is constructed with the global offset of the original fragment data and the newly generated code. The second stage: disassemble the entire function byte by byte, use the address mapping table to update the address reference relationship of the generated code, splice the newly generated code in sequence as the new function content, and then reset the data in the original binary fragment area as an interrupt instruction to block the ROP attack chain, and then update the instruction starting from the first byte position of the original function to a long jump instruction, so that when the function is called, it will directly jump to the location of the new function to continue execution. Finally, select a random code starting address to insert the new function code into the executable file to generate a security-enhanced binary software, and perform necessary repairs on the executable file format according to the binary software format specification, including relocation table repair and exception handling table repair, so that the security-enhanced binary software can run normally.

2. The method according to claim 1, characterized in that Identifying function boundaries of raw binary software involves: Step 1: Collect existing public source code containing various functions, and then extract the boundary information of different functions in binary code during the compilation process to construct a training set for binary software function boundary recognition. Then, train the deep neural network based on the training set to obtain a function boundary recognition model. Step 2: For the original binary software that needs to identify function boundaries, extract data fragments by byte-by-byte offset, vectorize the data fragments, and use the recognition model to identify function boundaries, thereby marking the boundary positions of different functions.

3. The method according to claim 2, characterized in that In the second step, extracting data segments by byte-by-byte offset and performing vectorized processing on the data segments include: First, the binary software is regarded as a binary sequence of finite length, and then fixed-length data is extracted byte by byte. That is, each fixed-length data extracted is shifted back one byte at the beginning and end of the sequence, so as to serve as the input vector of the recognition model.

4. The method according to claim 1, characterized in that: In the first stage, randomized reconstruction includes: Randomly insert junk instructions or attack detection logic to achieve randomized reconstruction.

5. The method according to claim 1, characterized in that In the second stage, resetting the data in the original binary fragment area means changing the original data to random data or setting all to zero.

6. The method according to claim 1, characterized in that In the second stage, the instruction starting from the first byte position of the original function is updated to a long jump instruction, that is, the original instruction is hard-coded as a jmp 0xaddr instruction, so that when the original function is called, it directly jumps to the new function code for execution.

7. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

8. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images