Automated in-pile memory pool analysis assisted vulnerability mining method and device

Abstract

This invention provides an automated heap memory pool analysis-assisted vulnerability discovery method, apparatus, and electronic device, belonging to the field of data security technology. The method includes: analyzing the memory call behavior of a target application to determine whether the memory region requested by the target application during memory pool management contains multiple memory pages; if so, further analyzing the memory pool management library used by the target application; when the memory pool management library is a general-purpose memory management library, executing a pre-made patch replacement program; when the memory management library is a customized memory management library, employing a heuristic automatic patching program. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code using heuristic rules, and generates the interception code required by LLVM's compile-rt. This solution can effectively discover memory-corruption vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to an automated method, apparatus, and electronic device for assisting in the analysis of heap memory pools for vulnerability discovery. Background Technology

[0002] Fuzzing is an effective method for discovering security vulnerabilities. The method of utilizing coverage path feedback—that is, instrumenting the target program through the compiler and then running the target program to collect execution path information to guide sample mutation—is particularly effective. Meanwhile, ASAN (address sanitizer) is often used to discover memory corruption vulnerabilities, such as UAF (use-after-free), double free, and OOB (out-of-bounds).

[0003] Currently, ASAN primarily intercepts heap memory allocation / deallocation (malloc / free) during program execution, performing corresponding memory poisoning and unpoisoning operations. In this way, when the program accesses the poisoned memory, it can promptly throw an exception and report call traceback information, thereby helping to locate the location of the vulnerability.

[0004] However, some programs, in order to improve efficiency, employ memory pooling on top of standard heap memory management. This involves allocating a large memory region (usually an integer multiple of memory pages) each time, and then allocating it to smaller objects. The `free` function is only called when the memory pool is destroyed. Therefore, during memory pool management, the compiler does not perform instrumentation, making it virtually impossible to detect memory corruption.

[0005] Although LLVM provides an interface for manual memory poisoning, in practice, code supplementation is required for each target program, which results in a lot of repetitive work. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide an automated heap memory pool analysis-assisted vulnerability discovery method, apparatus, and electronic device, which at least partially solves the problems existing in the prior art.

[0007] In a first aspect, embodiments of the present invention provide an automated heap memory pool analysis-assisted vulnerability discovery method, comprising:

[0008] Analyze the memory usage of the target application to determine whether the memory region requested by the target application during memory pool management contains multiple memory pages;

[0009] If so, the memory pool management library used by the target application will be further analyzed to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library.

[0010] When the memory pool management library is a general-purpose memory management library, a pre-made patch replacement program is executed. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features, and adds the interception code corresponding to the target function of the library in LLVM's compile-rt.

[0011] When the memory management library is a custom memory management library, a heuristic automatic patching program is used. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt.

[0012] According to a specific implementation of this disclosure, before executing the pre-made patch replacement procedure, the method further includes:

[0013] Pre-made patches are prepared in advance so that a pre-made patch replacement procedure can be performed based on the pre-made patches.

[0014] According to a specific implementation of an embodiment of this disclosure, the step of pre-making a pre-made patch includes:

[0015] Analyze the memory pool management library API to identify key memory allocation and deallocation interfaces;

[0016] By analyzing the internal implementation principles of the target function's source code, the location of the code in the target application that requests memory from the operating system kernel can be determined.

[0017] The source code of the target function is modified so that the target application can use the modified function to circumvent the memory poisoning operation in the original ASAN when requesting large blocks of memory.

[0018] Locate the code that releases memory to the operating system kernel;

[0019] Modify the source code of the target function to maintain the data structure of the patch code added in ASAN while the target application releases memory;

[0020] Modify LLVM's compile-rt to add interception code for the memory pool management API and maintain data structures related to poisoned memory;

[0021] Use the diff tool to create patch files and record version information for use when applying patches later.

[0022] According to a specific implementation of an embodiment of this disclosure, the step of executing the pre-made patch replacement program further includes:

[0023] Analyze whether the source code of the target application corresponding to the vulnerability discovery uses a memory pool management library with pre-installed patches;

[0024] If so, determine the name and version of the memory pool management library of the existing pre-made patch, and obtain the corresponding patch file from the memory pool management library of the existing pre-made patch;

[0025] Use the patch program to patch the memory pool management library and the LLVM compile-rt library;

[0026] To ensure that the patch has been successfully applied, and to prevent the patch from failing due to third-party customization;

[0027] After confirming that the patch has been successfully applied, compile the source code of the library that applied the patch to generate a static link library file;

[0028] The target application's code is compiled and statically linked into library files, after which it enters the fuzzing process.

[0029] According to a specific implementation of an embodiment of this disclosure, before employing a heuristic automatic patching procedure, the method further includes:

[0030] The heuristic automatic patching program consists of an engine and rules. The engine encapsulates the syntax tree analysis, dynamic execution tracing, and heuristic rule parsing functions of the programming language. The heuristic rules consist of built-in and external rules. The built-in rules are implemented using a programming language, while the external rules are described using an ML-like language.

[0031] Provides an auxiliary information input interface, allowing data or constraints to be provided for auxiliary analysis before initiating the analysis, in order to speed up the analysis process;

[0032] Output patch files for subsequent patching and fuzzing processes.

[0033] According to a specific implementation of an embodiment of this disclosure, the heuristic automatic patching procedure further includes:

[0034] Manually collect auxiliary information and configure heuristic patches;

[0035] Specify the directory where the code is located, and the location of the executable program;

[0036] Execute the heuristic patching program to generate patch files;

[0037] If the patch is generated successfully, proceed with the regular patching and fuzz testing process.

[0038] If patch generation fails, selectively add auxiliary information or adjust the heuristic rules and try again;

[0039] If multiple attempts fail, it is recommended to start the regular fuzz testing process directly, or to manually intervene in patch development.

[0040] According to a specific implementation of an embodiment of this disclosure, the method further includes:

[0041] Automatically identify memory pool management libraries by scanning the source code of the target application, and find the name and version of the memory pool management library by matching Yara rules;

[0042] If the name and version of the library are returned, then the name and version are used to confirm whether a pre-made patch already exists in the patch library. The name is matched using regular expression fuzzy matching, and the version is matched using range matching.

[0043] If a pre-made patch exists, proceed with the normal patching process and then proceed with the regular fuzz testing process.

[0044] If no pre-made patch exists, the subsequent process of generating a patch heuristically will proceed depending on whether the configuration option for heuristic patching is enabled.

[0045] Secondly, embodiments of the present invention provide an automated heap memory pool analysis-assisted vulnerability discovery device, comprising:

[0046] The judgment module is used to analyze the memory call behavior of the target application and determine whether the memory region requested by the target application during the memory pool management process contains multiple memory pages.

[0047] The analysis module is used to further analyze the memory pool management library used by the target application to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library.

[0048] The first execution module is used to execute a pre-made patch replacement program when the memory pool management library is a general memory management library. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features and adds the interception code corresponding to the target function in the library to LLVM's compile-rt.

[0049] The second execution module is used to employ a heuristic automatic patching program when the memory management library is a custom memory management library. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt.

[0050] Thirdly, embodiments of the present invention also provide an electronic device, the electronic device comprising:

[0051] At least one processor; and,

[0052] The memory is communicatively connected to the at least one processor; wherein,

[0053] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the automated heap memory pool analysis-assisted vulnerability discovery method in any of the first aspects or any implementations thereof.

[0054] Fourthly, embodiments of the present invention also provide a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the automated heap memory pool analysis-assisted vulnerability discovery method in the first aspect or any implementation thereof.

[0055] Fifthly, embodiments of the present invention also provide a computer program product, the computer program product including a computing program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to execute the automated heap memory pool analysis-assisted vulnerability mining method in the first aspect or any implementation thereof.

[0056] The automated heap memory pool analysis-assisted vulnerability discovery scheme in this embodiment of the invention includes: analyzing the memory call behavior of the target application to determine whether the memory region requested by the target application during memory pool management contains multiple memory pages; if so, further analyzing the memory pool management library used by the target application to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library; when the memory pool management library is a general-purpose memory management library, executing a pre-made patch replacement program, which extracts features from the target functions contained in the memory management library to replace the target functions based on the extracted features, and adds the corresponding interception code of the target function in LLVM's compile-rt; when the memory management library is a customized memory management library, using a heuristic automatic patching program, which selectively receives a set of function names from the target functions, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt. This scheme can effectively discover memory-corruption vulnerabilities. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A schematic diagram of an automated heap memory pool analysis-assisted vulnerability discovery method provided in this embodiment of the invention;

[0059] Figure 2 A schematic diagram of another automated heap memory pool analysis-assisted vulnerability discovery method provided in this embodiment of the invention;

[0060] Figure 3 A schematic diagram of another automated heap memory pool analysis-assisted vulnerability discovery method provided in this embodiment of the invention;

[0061] Figure 4 A schematic diagram of another automated heap memory pool analysis-assisted vulnerability discovery method provided in this embodiment of the invention;

[0062] Figure 5 A schematic diagram of the structure of the automated heap memory pool analysis-assisted vulnerability discovery device provided in this embodiment of the invention;

[0063] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0064] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0065] The following specific examples illustrate the implementation of this disclosure. Those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0066] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0067] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0068] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0069] This disclosure provides an automated heap memory pool analysis-assisted vulnerability discovery method. The automated heap memory pool analysis-assisted vulnerability discovery method provided in this embodiment can be executed by a computing device, which can be implemented as software or a combination of software and hardware. This computing device can be integrated into a server, terminal device, or the like.

[0070] See Figure 1 , Figure 2 , Figure 3 and Figure 4 This disclosure provides an automated heap memory pool analysis-assisted vulnerability discovery method, including:

[0071] S101, Analyze the memory usage of the target application to determine whether the memory region requested by the target application during the memory pool management process contains multiple memory pages.

[0072] During the execution of the target application, some programs, in order to improve efficiency, employ memory pooling technology on top of standard heap memory management. This involves requesting (mallocate) a large memory region each time, typically an integer multiple of memory pages, and then allocating it to smaller objects. The `free` function is only called when the memory pool is destroyed. In this case, the compiler does not perform instrumentation during memory pool management, making it virtually impossible to detect memory corruption.

[0073] Therefore, the memory call behavior of the target application that needs to be detected for vulnerabilities is analyzed to determine whether the memory region requested by the target application during memory pool management contains multiple memory pages, so as to facilitate vulnerability detection and handling for cases containing multiple memory pages.

[0074] S102, if so, further analyze the memory pool management library used by the target application to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library.

[0075] When the target application accesses memory across multiple memory pages, further analysis can be performed on the memory pool management library used by the target application. Specifically, this can be done by scanning the target application's source code and using Yara rules to find the memory pool management library name and version. The name and version of the memory pool management library can then be used to determine whether it is a general-purpose or custom-designed memory management library. General-purpose memory management libraries are common and can be used by multiple applications, while custom-designed memory management libraries are specifically developed for particular applications and are primarily used within those applications.

[0076] S103, when the memory pool management library is a general memory management library, a pre-made patch replacement program is executed. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features, and adds the interception code corresponding to the target function of the library in LLVM's compile-rt.

[0077] For common memory pool management libraries, key functions are pre-organized, features are extracted, and corresponding patches are developed. Patches include: (I) replacing malloc / free calls in key library functions, for example, replacing them with __libc__malloc to avoid poisoning the entire memory region; (II) adding interception code corresponding to key library functions in LLVM's compile-rt, which calls asan_malloc. When the target program uses a common memory pool management library, the library name and version can be automatically identified, code patching operations are performed, and then the subsequent compilation and fuzzing process begins.

[0078] The development of pre-made patches mainly includes the following steps:

[0079] Analyze the memory pool management library API to identify key memory allocation and deallocation interfaces;

[0080] By analyzing the internal implementation principles of the target function's source code, the location of the code in the target application that requests memory from the operating system kernel can be determined.

[0081] The source code of the target function is modified so that the target application can use the modified function to circumvent the memory poisoning operation in the original ASAN when requesting large blocks of memory.

[0082] Locate the code that releases memory to the operating system kernel;

[0083] Modify the source code of the target function to maintain the data structure of the patch code added in ASAN while the target application releases memory;

[0084] Modify LLVM's compile-rt to add interception code for the memory pool management API and maintain data structures related to poisoned memory;

[0085] Use the diff tool to create patch files and record version information for use when applying patches later.

[0086] Using pre-made patches to discover vulnerabilities in the memory pool management library mainly includes the following steps:

[0087] (1) Analyze the source code of the target application for vulnerability discovery to confirm whether it uses a memory pool management library with pre-installed patches;

[0088] (2) If so, determine the name and version of the library and obtain the corresponding patch file from the patch library;

[0089] (3) Use the patch program to patch the memory pool management library and the LLVM compile-rt library.

[0090] (4) Verify that the patch has been successfully applied to avoid patch failure due to third-party customization.

[0091] (5) Compile the library source code for the application patch to generate a static link library file.

[0092] (6) Compile the target application code and statically link the library files, and then proceed with the regular fuzzing process.

[0093] S104, when the memory management library is a custom memory management library, a heuristic automatic patching program is used. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt.

[0094] For a self-developed memory pool management library, there is a lack of pre-made patches. However, since it is generally not universal, manually developing patches is not very valuable. In this case, a heuristic automatic patching program can be used. This program can optionally receive a set of function names, match and replace them in the target program code through heuristic rules, and generate the interception code required by compile-rt.

[0095] Heuristic patch development mainly includes the following steps:

[0096] (1) Heuristic patching mainly consists of an engine and rules;

[0097] (2) The engine mainly encapsulates general functions, such as syntax tree analysis and dynamic execution tracing of conventional programming languages, as well as heuristic rule parsing functions;

[0098] (3) Heuristic rules consist of built-in and external rules. Built-in rules are implemented using programming languages ​​and are suitable for rules with complex logic or high performance requirements. External rules are described using ML-like languages ​​and are suitable for rules with simple logic or low performance requirements.

[0099] (4) Provide an auxiliary information input interface, allowing auxiliary analysis data or constraints to be given before the analysis is initiated, so as to speed up the analysis process;

[0100] (5) The output is a patch file, and then the regular patching and fuzzing process begins.

[0101] Using heuristic patching to discover vulnerabilities in memory management libraries mainly includes the following steps:

[0102] (1) Manually collect auxiliary information and configure heuristic patching programs;

[0103] (2) Specify the directory where the code is located, and the location of the executable program;

[0104] (3) Execute the heuristic patching program to generate patch files;

[0105] (4) If the patch is successfully generated, proceed with the subsequent regular patching and fuzz testing process;

[0106] (5) If the patch generation fails, you can selectively add auxiliary information or adjust the heuristic rules and try again, returning to step (3);

[0107] (6) If multiple attempts fail, it is recommended to start the regular fuzz testing process directly, or to manually intervene in patch development.

[0108] In gray-box fuzzing, the automatic identification of memory pool management libraries and patching steps includes:

[0109] (1) By scanning the source code of the target application, the name and version of the memory pool management library are found by matching yara rules;

[0110] (2) If the name and version of the memory pool management library are returned, then check whether a pre-made patch already exists in the patch library by using the name and version. The name is matched using regular expression fuzzy matching, and the version is matched using range matching.

[0111] (3) If there is a pre-made patch, then proceed with the normal fuzzing process after patching.

[0112] (4) If no pre-made patch exists or step (1) does not return a matching result, proceed with the subsequent process of generating a patch heuristically, depending on whether the configuration option for heuristic patching is enabled.

[0113] According to a specific implementation of this disclosure, before executing the pre-made patch replacement procedure, the method further includes:

[0114] Pre-made patches are prepared in advance so that a pre-made patch replacement procedure can be performed based on the pre-made patches.

[0115] See Figure 2 According to a specific implementation of this disclosure, the step of pre-making the pre-made patch includes:

[0116] S201, Analyze the memory pool management library API to identify key memory allocation and release interfaces;

[0117] S202, by analyzing the internal implementation principle of the target function's source code, the location of the code in the target application that requests memory from the operating system kernel is determined;

[0118] S203, Modify the source code of the target function so that the target application can use the modified function to circumvent the memory poisoning operation in the original ASAN when requesting a large block of memory.

[0119] S204, locate the code that releases memory to the operating system kernel;

[0120] S205, Modify the source code of the target function so as to maintain the data structure of the patch code added in ASAN while the target application releases memory;

[0121] S206, Modify LLVM's compile-rt, add interception code for the memory pool management API, and maintain data structures related to poisoned memory;

[0122] S207 uses the diff tool to create patch files and records version information for use when applying patches later.

[0123] See Figure 3 According to a specific implementation of this disclosure, the step of executing the pre-made patch replacement procedure further includes:

[0124] S301, Analyze whether the source code of the target application corresponding to the vulnerability discovery uses a memory pool management library with pre-installed patches;

[0125] S302, If yes, determine the name and version of the memory pool management library of the existing pre-made patch, and obtain the corresponding patch file from the memory pool management library of the existing pre-made patch;

[0126] S303, use the patch program to patch the memory pool management library and the LLVM compile-rt library;

[0127] S304, confirms whether the patch has been successfully applied, to avoid patch failure due to third-party customization;

[0128] S305: After confirming that the patch has been successfully applied, compile the source code of the library that applied the patch and generate a static link library file.

[0129] S306: Compile the target application's code and statically link the library files, then proceed to the fuzzing process.

[0130] See Figure 4 According to a specific implementation of this disclosure, before employing a heuristic automatic patching procedure, the method further includes:

[0131] S401 consists of an engine and rules for a heuristic automatic patching program. The engine encapsulates the syntax tree analysis, dynamic execution tracing, and heuristic rule parsing functions of the programming language. The heuristic rules consist of built-in and external rules. The built-in rules are implemented using a programming language, while the external rules are described using an ML-like language.

[0132] S402 provides an auxiliary information input interface, allowing auxiliary analysis data or constraints to be given before the analysis is initiated, in order to speed up the analysis process;

[0133] S403 outputs patch files for subsequent patching and fuzzing processes.

[0134] According to a specific implementation of an embodiment of this disclosure, the heuristic automatic patching procedure further includes:

[0135] Manually collect auxiliary information and configure heuristic patches;

[0136] Specify the directory where the code is located, and the location of the executable program;

[0137] Execute the heuristic patching program to generate patch files;

[0138] If the patch is generated successfully, proceed with the regular patching and fuzz testing process.

[0139] If patch generation fails, selectively add auxiliary information or adjust the heuristic rules and try again;

[0140] If multiple attempts fail, it is recommended to start the regular fuzz testing process directly, or to manually intervene in patch development.

[0141] According to a specific implementation of an embodiment of this disclosure, the method further includes:

[0142] Automatically identify memory pool management libraries by scanning the source code of the target application, and find the name and version of the memory pool management library by matching Yara rules;

[0143] If the name and version of the library are returned, then the name and version are used to confirm whether a pre-made patch already exists in the patch library. The name is matched using regular expression fuzzy matching, and the version is matched using range matching.

[0144] If a pre-made patch exists, proceed with the normal patching process and then proceed with the regular fuzz testing process.

[0145] If no pre-made patch exists, the subsequent process of generating a patch heuristically will proceed depending on whether the configuration option for heuristic patching is enabled.

[0146] See Figure 5This invention also discloses an automated heap memory pool analysis-assisted vulnerability discovery device 50, comprising:

[0147] The judgment module 501 is used to analyze the memory call situation of the target application and determine whether the memory region requested by the target application during the memory pool management process contains multiple memory pages.

[0148] Analysis module 502 is used to further analyze the memory pool management library used by the target application to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library.

[0149] The first execution module 503 is used to execute a pre-made patch replacement program when the memory pool management library is a general memory management library. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features and adds the interception code corresponding to the target function in the library to LLVM's compile-rt.

[0150] The second execution module 504 is used to employ a heuristic automatic patching program when the memory management library is a custom memory management library. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt.

[0151] See Figure 6 This invention also provides an electronic device 60, which includes:

[0152] At least one processor; and,

[0153] The memory is communicatively connected to the at least one processor; wherein,

[0154] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the automated heap memory pool analysis-assisted vulnerability discovery method in the foregoing method embodiments.

[0155] This invention also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to perform the aforementioned method embodiments.

[0156] This invention also provides a computer program product, which includes a computing program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions that, when executed by a computer, cause the computer to perform the automated heap memory pool analysis-assisted vulnerability discovery method described in the foregoing method embodiments.

[0157] Figure 6 The device shown can perform Figure 1-4 For the methods shown in the embodiments, the parts not described in detail in this embodiment can be referred to the following: Figure 1-4 The relevant descriptions of the illustrated embodiments are not repeated here.

[0158] The following is for reference. Figure 6 The diagram illustrates a structural schematic of an electronic device 60 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0159] like Figure 6 As shown, electronic device 60 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of electronic device 60. The processing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. An input / output (I / O) interface 605 is also connected to bus 604.

[0160] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 60 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 60 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0161] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0162] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0163] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0164] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: acquire at least two Internet Protocol (IP) addresses; send a node evaluation request including the at least two IP addresses to a node evaluation device, wherein the node evaluation device selects an IP address from the at least two IP addresses and returns it; and receive the IP address returned by the node evaluation device; wherein the acquired IP address indicates an edge node in a content delivery network.

[0165] Alternatively, the aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: receive a node evaluation request including at least two Internet Protocol (IP) addresses; select an IP address from the at least two IP addresses; and return the selected IP address; wherein the received IP address indicates an edge node in the content delivery network.

[0166] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses".

[0169] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof.

[0170] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A vulnerability discovery method assisted by automated heap memory pool analysis, characterized in that, include: Analyze the memory usage of the target application to determine whether the memory region requested by the target application during memory pool management contains multiple memory pages; If so, the memory pool management library used by the target application will be further analyzed to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library. When the memory pool management library is a general-purpose memory management library, a pre-made patch replacement program is executed. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features, and adds the interception code corresponding to the target function in LLVM's compile-rt. When the memory management library is a custom memory management library, a heuristic automatic patching program is used. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt. Before executing the pre-made patch replacement procedure, the method further includes: pre-creating a pre-made patch so that the pre-made patch replacement procedure can be executed based on the pre-made patch; The aforementioned pre-made pre-made patches include: Analyze the memory pool management library API to identify key memory allocation and deallocation interfaces; By analyzing the internal implementation principles of the target function's source code, the location of the code in the target application that requests memory from the operating system kernel can be determined. The source code of the target function is modified so that the target application can use the modified function to circumvent the memory poisoning operation in the original ASAN when requesting large blocks of memory. Locate the code that releases memory to the operating system kernel; Modify the source code of the target function to maintain the data structure of the patch code added in ASAN while the target application releases memory; Modify LLVM's compile-rt to add interception code for the memory pool management API and maintain data structures related to poisoned memory; Use the diff tool to create patch files and record version information for use when applying patches later.

2. The method according to claim 1, characterized in that, The process of performing the pre-made patch replacement also includes: Analyze whether the source code of the target application corresponding to the vulnerability discovery uses a memory pool management library with pre-installed patches; If so, determine the name and version of the memory pool management library of the existing pre-made patch, and obtain the corresponding patch file from the memory pool management library of the existing pre-made patch; Use the patch program to patch the memory pool management library and the LLVM compile-rt library; To ensure that the patch has been successfully applied, and to prevent the patch from failing due to third-party customization; After confirming that the patch has been successfully applied, compile the source code of the library that applied the patch to generate a static link library file; The target application's code is compiled and statically linked into library files, after which it enters the fuzzing process.

3. The method according to claim 2, characterized in that, Prior to employing a heuristic automatic patching procedure, the method further includes: The heuristic automatic patching program consists of an engine and rules. The engine encapsulates the syntax tree analysis, dynamic execution tracing, and heuristic rule parsing functions of the programming language. The heuristic rules consist of built-in and external rules. The built-in rules are implemented using a programming language, while the external rules are described using an ML-like language. Provides an auxiliary information input interface, allowing data or constraints to be provided for auxiliary analysis before initiating the analysis, in order to speed up the analysis process; Output patch files for subsequent patching and fuzzing processes.

4. The method according to claim 3, characterized in that, The heuristic automatic patching process also includes: Manually collect auxiliary information and configure heuristic patches; Specify the directory where the code is located, and the location of the executable program; Execute the heuristic patching program to generate patch files; If the patch is generated successfully, proceed with the regular patching and fuzz testing process. If patch generation fails, selectively add auxiliary information or adjust the heuristic rules and try again; If multiple attempts fail, it is recommended to start the regular fuzz testing process directly, or to manually intervene in patch development.

5. The method according to claim 4, characterized in that, The method further includes: Automatically identify memory pool management libraries by scanning the source code of the target application, and find the name and version of the memory pool management library by matching Yara rules; If the name and version of the library are returned, then the name and version are used to confirm whether a pre-made patch already exists in the patch library. The name is matched using regular expression fuzzy matching, and the version is matched using range matching. If a pre-made patch exists, proceed with the normal patching process and then proceed with the regular fuzz testing process. If no pre-made patch exists, the subsequent process of generating a patch heuristically will proceed depending on whether the configuration option for heuristic patching is enabled.

6. An automated vulnerability discovery device assisted by heap memory pool analysis, characterized in that, include: The judgment module is used to analyze the memory call behavior of the target application and determine whether the memory region requested by the target application during the memory pool management process contains multiple memory pages. The analysis module is used to further analyze the memory pool management library used by the target application to determine whether the memory pool management library is a general-purpose memory management library or a customized memory management library. The first execution module is used to execute a pre-made patch replacement program when the memory pool management library is a general memory management library. The pre-made patch replacement program extracts features from the target functions contained in the memory management library so as to replace the target functions based on the extracted features and adds the interception code corresponding to the target function in LLVM's compile-rt. The second execution module is used to employ a heuristic automatic patching program when the memory management library is a custom memory management library. The automatic patching program selectively receives a set of function names from the target function, performs matching and replacement in the target program code according to heuristic rules, and generates the interception code required by LLVM's compile-rt. Before executing the pre-made patch replacement procedure, the device is further configured to: prepare a pre-made patch in advance so as to perform the pre-made patch replacement procedure based on the pre-made patch; The aforementioned pre-made pre-made patches include: Analyze the memory pool management library API to identify key memory allocation and deallocation interfaces; By analyzing the internal implementation principles of the target function's source code, the location of the code in the target application that requests memory from the operating system kernel can be determined. The source code of the target function is modified so that the target application can use the modified function to circumvent the memory poisoning operation in the original ASAN when requesting large blocks of memory. Locate the code that releases memory to the operating system kernel; Modify the source code of the target function to maintain the data structure of the patch code added in ASAN while the target application releases memory; Modify LLVM's compile-rt to add interception code for the memory pool management API and maintain data structures related to poisoned memory; Use the diff tool to create patch files and record version information for use when applying patches later.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the automated heap memory pool analysis-assisted vulnerability discovery method according to any one of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the automated heap memory pool analysis-assisted vulnerability discovery method according to any one of claims 1-5.

Images