A stack space layout method, device, storage medium and equipment
By converting and parsing the source code, identifying and randomizing the processing points of external input acquisition functions in the program, the problem of high cost of protecting stack space in existing technologies is solved, and security and efficiency are improved.
Patent Information
- Application Number
- CN202211376190.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-04
- Publication Date
- 2026-02-24
- Estimated Expiration
- 2042-11-04
AI Technical Summary
Existing technologies are costly to protect program stack space, require additional runtime environment support, and result in complex processing procedures.
Intermediate code is generated by transforming the source code, parsing functions to identify external input functions, determining randomization points, and adding memory blocks corresponding to random values at these points to randomize the stack space layout.
This reduces the cost of protecting the stack space, and the program itself performs randomized operations without requiring additional runtime environment support, thus improving program security.
Smart Images
Figure CN115640050B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of stack space layout, and more particularly to a stack space layout method, apparatus, storage medium and device. Background Technology
[0002] Stack space, as an important component of program memory space, is one of the most common attack points in network attacks.
[0003] Currently, the method of protecting the program's stack space by dynamic stack space randomization changes the stack space layout during program execution to achieve the purpose of protecting the program's stack space. However, this method requires relatively complex processing of the program itself and requires additional runtime environment support, resulting in a high cost for protecting the stack space.
[0004] Therefore, how to reduce the cost of protecting stack space has become an urgent problem to be solved in this field. Summary of the Invention
[0005] This application provides a stack space layout method, apparatus, storage medium, and device, with the aim of reducing the cost of protecting stack space.
[0006] To achieve the above objectives, this application provides the following technical solution:
[0007] A stack space layout method, comprising:
[0008] The source code is converted to obtain intermediate code; the intermediate code includes various functions.
[0009] For each of the functions, the function is parsed to obtain the parsing result;
[0010] Based on the analysis results, determine whether the function is an external input acquisition function;
[0011] If the function is the external input acquisition function, then the function is identified to obtain the function's parameters and return value;
[0012] The randomization point is determined based on the parameters and return value of the function.
[0013] The randomization points are randomized to randomize the stack space layout.
[0014] Optionally, the parsing result includes at least the function name of the function;
[0015] The step of determining whether the function is an external input acquisition function based on the parsing result includes:
[0016] Based on the function name, determine whether the function is an external input acquisition function.
[0017] Optionally, after determining whether the function is an external input acquisition function based on the parsing result, the method further includes:
[0018] If the function is not the external input acquisition function, then a preset step is performed on the new function; the preset step is: parsing the new function to obtain the function name of the new function; determining whether the new function is the external input acquisition function based on the function name of the new function; if the new function is the external input function, then parsing the new function to obtain the parameters and return value of the new function; determining the external input variable based on the parameters and return value of the new function; obtaining the stack space allocation instruction corresponding to the external input variable from a preset record; and marking the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0019] Optionally, determining the randomization point based on the parameters and return value of the function includes:
[0020] Determine the external input variables based on the parameters and return value of the function;
[0021] Obtain the stack space allocation instruction corresponding to the external input variable from the preset record;
[0022] The stack space allocation instruction corresponding to the external input variable is marked as a randomization processing point.
[0023] Optionally, the randomization process of the randomization points to randomize the stack space layout includes:
[0024] For each randomization point, a random number generation function is called to generate a random value;
[0025] Generate a memory block corresponding to the random value;
[0026] Add the memory block corresponding to the random value before the randomization point to randomize the stack space layout.
[0027] Optionally, after determining the randomization point based on the parameters and return value of the function, the method further includes:
[0028] Based on each of the randomized processing points, a set of processing points is constructed.
[0029] A stack space layout device, comprising:
[0030] The conversion unit converts the source code to obtain intermediate code; the intermediate code includes various functions.
[0031] The parsing unit is used to parse each of the functions and obtain the parsing result.
[0032] The judgment unit is used to determine whether the function is an external input acquisition function based on the parsing result;
[0033] The identification unit is used to identify the function if the function is the external input acquisition function, and to obtain the parameters of the function and the return value of the function.
[0034] The determining unit is used to determine the randomization processing point based on the parameters of the function and the return value of the function;
[0035] The processing unit is used to randomize the randomization processing points so as to randomize the stack space layout.
[0036] Optionally, the parsing result includes at least the function name of the function;
[0037] The judgment unit is specifically used for:
[0038] Based on the function name, determine whether the function is an external input acquisition function.
[0039] A computer-readable storage medium includes a stored program, wherein the program is executed by a processor to perform the stack space layout method.
[0040] A stack space layout device includes: a processor, a memory, and a bus; the processor and the memory are connected via the bus.
[0041] The memory is used to store programs, and the processor is used to run programs, wherein the program is executed by the processor to perform the stack space layout method.
[0042] The technical solution provided in this application involves converting the source code to obtain intermediate code; parsing each function to obtain the parsing result; determining whether the function is an external input acquisition function based on the parsing result; if the function is an external input acquisition function, identifying the function to obtain its parameters and return value; determining the randomization point based on the function's parameters and return value; and performing randomization processing on the randomization point to randomize the stack space layout. Compared with existing technologies, the randomization operation of the program is executed by the program itself without the need for additional runtime environment support, thus reducing the cost of protecting the stack space. Attached Figure Description
[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0044] Figure 1 A flowchart illustrating a stack space layout method provided in an embodiment of this application;
[0045] Figure 2 A flowchart illustrating another stack space layout method provided in an embodiment of this application;
[0046] Figure 3 A schematic diagram of the architecture of a stack space layout device provided in an embodiment of this application;
[0047] Figure 4 This is a schematic diagram of the architecture of a stack space layout device provided in an embodiment of this application. Detailed Implementation
[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0049] like Figure 1 The diagram shown is a flowchart of a stack space layout method provided in an embodiment of this application, including:
[0050] S101: Convert the source code to obtain intermediate code.
[0051] The source code indicates the input to the compilation system, the intermediate code includes various functions, and the intermediate code indicates different representations of the source code. The forms of the intermediate code include, but are not limited to: Reverse Polish Notation, quadruples, triples, and tree representation.
[0052] Optionally, the source code can be converted via the compiler front-end (i.e., the source code can be translated into intermediate code using the compiler).
[0053] It should be noted that the specific implementation method of converting source code through the front end is common knowledge among those in the field, and will not be elaborated here.
[0054] It is important to emphasize that mapping the source code to intermediate code representation and then to target code is done in several stages, which makes the compilation algorithm clearer.
[0055] S102: For each function, parse the function to obtain the function name.
[0056] Optionally, functions can be parsed using the Instruction and Function interfaces provided by the LLVM compilation framework.
[0057] It should be noted that the specific implementation of parsing functions through the instruction and function interfaces provided by the LLVM compilation framework is common knowledge in the field and will not be elaborated here.
[0058] S103: Determine whether a function is an external input acquisition function based on its function name.
[0059] If the function is an external input acquisition function, then execute S104; otherwise, execute S108.
[0060] The external input acquisition function refers to the function that acquires external data.
[0061] It should be noted that since the program relies on the underlying C / C++ code to obtain external input, and the underlying code is fixed, the function name can be used to determine whether a function is an external input acquisition function.
[0062] S104: Identify the function and obtain its parameters and return value.
[0063] Optionally, the function can be identified using the instruction and function interfaces provided by the LLVM compilation framework.
[0064] S105: Determine the external input variables based on the function's parameters and return value.
[0065] Among them, external input variables indicate variables that store external inputs.
[0066] It should be emphasized that determining the specific implementation method of external input variables based on the function's parameters and return value is common knowledge among those in the field, and will not be elaborated here.
[0067] It should be noted that the program must obtain input by calling the external input acquisition function. The main forms of input entering the program are the function parameters and the function return value (i.e., the parameters for obtaining external input and the return value of the function receiving external input). Therefore, when the function parameters and the function return value are obtained, the external input variables can be determined.
[0068] S106: Retrieve the stack space allocation instruction corresponding to the external input variable from the preset record.
[0069] Among them, stack space allocation instructions include, but are not limited to, the alloca instruction.
[0070] It should be noted that all alloca instructions are first recorded in the preset record. External input variables are allocated space through alloca instructions. Before external input variables are used in the program, they are allocated space through alloca instructions. Therefore, when an external input variable is used, the alloca instruction (i.e., stack space allocation instruction) corresponding to the external input variable can be obtained from the preset record.
[0071] S107: Mark the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0072] S108: Perform preset steps on the new function.
[0073] The preset steps are as follows: parse the new function to obtain its name; determine whether the new function is an external input acquisition function based on its name; if it is an external input function, parse it to obtain its parameters and return value; determine the external input variable based on its parameters and return value; retrieve the stack space allocation instruction corresponding to the external input variable from a preset record; and mark the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0074] S109: Construct a set of processing points based on each randomized processing point.
[0075] Specifically, suppose there are five randomization processing points: the first randomization processing point, the second randomization processing point, the third randomization processing point, the fourth randomization processing point, and the fifth randomization processing point. Based on the first randomization processing point, the second randomization processing point, the third randomization processing point, the fourth randomization processing point, and the fifth randomization processing point, a set of processing points is constructed.
[0076] S110: For each randomization point, call the random number generation function to generate a random value.
[0077] The specific implementation of calling the random number generation function to generate random values is common knowledge to those in the field and will not be elaborated here.
[0078] It should be noted that calling the random number generation function to generate random values lays the foundation for the subsequent randomization of the stack space layout.
[0079] S111: Generate a memory block corresponding to a random value.
[0080] Among them, the memory block is a meaningless memory block.
[0081] Specifically, assuming the random value is 128, a memory block of 128 bytes will be generated corresponding to the random value.
[0082] It should be noted that a memory block corresponding to the random value is generated so that it can be used directly later without having to search for it again.
[0083] S112: Add a memory block corresponding to the random value before the randomization point to randomize the stack space layout.
[0084] It's important to note that adding a memory block corresponding to the randomized value before the randomization point achieves randomization of the dynamic stack space layout. Taking a common ROP attack based on a stack overflow vulnerability as an example, to exploit the stack overflow vulnerability, the attacker needs to steal sufficient stack space information. Due to the randomization of the dynamic stack space layout, as the program's stack space layout changes, the stack space information already obtained by the attacker becomes invalid. The attacker cannot steal enough stack space information and therefore cannot exploit the stack overflow vulnerability to perform the attack. Therefore, randomization of the dynamic stack space layout can effectively improve program security.
[0085] In summary, for each randomization point, a random number generation function is called to generate a random value, and a memory block corresponding to the random value is generated. The memory block corresponding to the random value is added before the randomization point to randomize the stack space layout. Compared with existing technologies, the randomization operation of the program is executed by the program itself without the support of an additional runtime environment, thus reducing the cost of protecting the stack space.
[0086] like Figure 2 The flowchart shown is another stack space layout method provided in an embodiment of this application, including:
[0087] S201: Convert the source code to obtain intermediate code.
[0088] The intermediate code includes various functions.
[0089] S202: For each function, parse the function to obtain the parsing result.
[0090] S203: Based on the parsing results, determine whether the function is an external input acquisition function.
[0091] S204: If the function is an external input acquisition function, then the function is identified to obtain the function's parameters and return value.
[0092] S205: Determine the randomization point based on the function's parameters and return value.
[0093] S206: Randomize the randomization points to randomize the stack space layout.
[0094] In summary, for each randomization point, a random number generation function is called to generate a random value, and a memory block corresponding to the random value is generated. The memory block corresponding to the random value is added before the randomization point to randomize the stack space layout. Compared with existing technologies, the randomization operation of the program is executed by the program itself without the support of an additional runtime environment, thus reducing the cost of protecting the stack space.
[0095] like Figure 3 The diagram shown is an architectural schematic of a stack space layout device provided in an embodiment of this application, including:
[0096] The conversion unit 100 is used to convert the source code to obtain intermediate code; the intermediate code includes various functions.
[0097] Parsing unit 200 is used to parse each function and obtain the parsing result.
[0098] Judgment unit 300 is used to determine whether a function is an external input acquisition function based on the parsing result.
[0099] The judgment unit is specifically used to: determine whether a function is an external input acquisition function based on its function name; the parsing result must include at least the function name.
[0100] The judgment unit 300 is also used to perform preset steps on the new function if the function is not an external input acquisition function. The preset steps are: parsing the new function to obtain its function name; determining whether the new function is an external input acquisition function based on its function name; if the new function is an external input function, parsing the new function to obtain its parameters and return value; determining the external input variable based on its parameters and return value; retrieving the stack space allocation instruction corresponding to the external input variable from a preset record; and marking the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0101] The identification unit 400 is used to identify the function if it is an external input function, and to obtain the function's parameters and return value.
[0102] Unit 500 is used to determine the randomization point based on the function's parameters and return value.
[0103] The determination unit 500 is specifically used to: determine the external input variable based on the function's parameters and return value; obtain the stack space allocation instruction corresponding to the external input variable from the preset record; and mark the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0104] The determination unit 500 is also used to construct a set of processing points based on each randomized processing point.
[0105] The processing unit 600 is used to randomize the randomization points so as to randomize the stack space layout.
[0106] The processing unit 600 is specifically used for: for each randomization processing point, calling a random number generation function to generate a random value; generating a memory block corresponding to the random value; and adding a memory block corresponding to the random value before the randomization processing point to randomize the stack space layout.
[0107] In summary, for each randomization point, a random number generation function is called to generate a random value, and a memory block corresponding to the random value is generated. The memory block corresponding to the random value is added before the randomization point to randomize the stack space layout. Compared with existing technologies, the randomization operation of the program is executed by the program itself without the support of an additional runtime environment, thus reducing the cost of protecting the stack space.
[0108] This application also provides a computer-readable storage medium including a stored program, wherein the program executes the stack space layout method provided in this application.
[0109] like Figure 4 As shown, this application also provides a stack space layout device, including: a processor 401, a memory 402, and a bus 403. The processor 401 and the memory 402 are connected via the bus 403. The memory 402 is used to store programs, and the processor 401 is used to run programs. When the program runs, it executes the stack space layout method provided in this application, including the following steps:
[0110] The source code is converted to obtain intermediate code; the intermediate code includes various functions.
[0111] For each of the functions, the function is parsed to obtain the parsing result;
[0112] Based on the analysis results, determine whether the function is an external input acquisition function;
[0113] If the function is the external input acquisition function, then the function is identified to obtain the function's parameters and return value;
[0114] The randomization point is determined based on the parameters and return value of the function.
[0115] The randomization points are randomized to randomize the stack space layout.
[0116] Optionally, the parsing result includes at least the function name of the function;
[0117] The step of determining whether the function is an external input acquisition function based on the parsing result includes:
[0118] Based on the function name, determine whether the function is an external input acquisition function.
[0119] Optionally, after determining whether the function is an external input acquisition function based on the parsing result, the method further includes:
[0120] If the function is not the external input acquisition function, then a preset step is performed on the new function; the preset step is: parsing the new function to obtain the function name of the new function; determining whether the new function is the external input acquisition function based on the function name of the new function; if the new function is the external input function, then parsing the new function to obtain the parameters and return value of the new function; determining the external input variable based on the parameters and return value of the new function; obtaining the stack space allocation instruction corresponding to the external input variable from a preset record; and marking the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
[0121] Optionally, determining the randomization point based on the parameters and return value of the function includes:
[0122] Determine the external input variables based on the parameters and return value of the function;
[0123] Obtain the stack space allocation instruction corresponding to the external input variable from the preset record;
[0124] The stack space allocation instruction corresponding to the external input variable is marked as a randomization processing point.
[0125] Optionally, the randomization process of the randomization points to randomize the stack space layout includes:
[0126] For each randomization point, a random number generation function is called to generate a random value;
[0127] Generate a memory block corresponding to the random value;
[0128] Add the memory block corresponding to the random value before the randomization point to randomize the stack space layout.
[0129] Optionally, after determining the randomization point based on the parameters and return value of the function, the method further includes:
[0130] Based on each of the randomized processing points, a set of processing points is constructed.
[0131] If the functions described in the embodiments of this application are implemented as software functional units and sold or used as independent products, they can be stored in a computing device readable storage medium. Based on this understanding, the parts of the embodiments of this application that contribute to the prior art or the technical solutions can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computer, server, mobile computing device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.
[0132] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0133] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for arranging stack space, characterized in that, include: The source code is converted to obtain intermediate code; The intermediate code includes various functions; For each function, the function is parsed to obtain a parsing result; the parsing result includes at least the function name of the function; Based on the analysis results, determine whether the function is an external input acquisition function; If the function is the external input acquisition function, then the function is identified to obtain the function's parameters and return value; The randomization point is determined based on the parameters and return value of the function. The randomization points are randomized to randomize the stack space layout. The step of determining the randomization point based on the parameters and return value of the function includes: Determine the external input variables based on the parameters and return value of the function; Obtain the stack space allocation instruction corresponding to the external input variable from the preset record; The stack space allocation instruction corresponding to the external input variable is marked as a randomization processing point.
2. The method according to claim 1, characterized in that, The parsing result includes at least the function name of the function; The step of determining whether the function is an external input acquisition function based on the parsing result includes: Based on the function name, determine whether the function is an external input acquisition function.
3. The method according to claim 1, characterized in that, After determining whether the function is an external input acquisition function based on the parsing result, the process further includes: If the function is not the external input acquisition function, then a preset step is performed on the new function; the preset step is: parsing the new function to obtain the function name of the new function; determining whether the new function is the external input acquisition function based on the function name of the new function; if the new function is the external input function, then parsing the new function to obtain the parameters and return value of the new function; determining the external input variable based on the parameters and return value of the new function; obtaining the stack space allocation instruction corresponding to the external input variable from a preset record; and marking the stack space allocation instruction corresponding to the external input variable as a randomization processing point.
4. The method according to claim 1, characterized in that, The randomization process of the randomization points to randomize the stack space layout includes: For each randomization point, a random number generation function is called to generate a random value; Generate a memory block corresponding to the random value; Add the memory block corresponding to the random value before the randomization point to randomize the stack space layout.
5. The method according to claim 1, characterized in that, After determining the randomization point based on the parameters and return value of the function, the process further includes: Based on each of the randomized processing points, a set of processing points is constructed.
6. A stack space layout device, characterized in that, include: The conversion unit converts the source code to obtain intermediate code; The intermediate code includes various functions; A parsing unit is configured to parse each of the functions to obtain a parsing result; the parsing result includes at least the function name of the function. The judgment unit is used to determine whether the function is an external input acquisition function based on the parsing result; The identification unit is used to identify the function if the function is the external input acquisition function, and to obtain the parameters of the function and the return value of the function. The determining unit is used to determine the randomization processing point based on the parameters of the function and the return value of the function; A processing unit is used to randomize the randomization processing points so as to randomize the stack space layout. Specifically, the determining unit is used for: Determine the external input variables based on the parameters and return value of the function; Obtain the stack space allocation instruction corresponding to the external input variable from the preset record; The stack space allocation instruction corresponding to the external input variable is marked as a randomization processing point.
7. The apparatus according to claim 6, characterized in that, The parsing result includes at least the function name of the function; The judgment unit is specifically used for: Based on the function name, determine whether the function is an external input acquisition function.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed by a processor, performs the stack space layout method according to any one of claims 1-5.
9. A stack space layout device, characterized in that, include: Processor, memory, and bus; The processor and the memory are connected via the bus; The memory is used to store a program, and the processor is used to run the program, wherein the program is executed by the processor to perform the stack space layout method according to any one of claims 1-5.
Citation Information
Patent Citations
System and method for resisting control flow hijack based on LLVM
CN107545174A