一种基于关键地址动态保护的栈溢出自动防御方法
By dynamically instrumenting function return addresses and utilizing a memory manager to detect and set memory attributes, this approach solves the problems of low efficiency and incomplete defense against stack overflows in existing technologies, achieving efficient defense against return2shellcode and return2libc attacks.
CN116150739BActive Publication Date: 2026-07-17RUAN AN TECH CO LTD
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- RUAN AN TECH CO LTD
- Filing Date
- 2023-03-01
- Publication Date
- 2026-07-17
AI Technical Summary
Technical Problem
Existing stack overflow defense technologies suffer from low efficiency, consume additional stack space, and cannot completely defend against return2shellcode and return2libc attacks.
Method used
By dynamically instrumenting function return addresses during function calls, utilizing the memory manager to detect and prevent tampering, and combining memory properties to be set to read-only or writable, instrumentation can be automated, and instrumentation can be performed using eBPF, kprobe, uprobe, or frida frameworks.
Benefits of technology
It effectively prevents the function return address from being tampered with, defends against return2shellcode and return2libc attacks, improves defense efficiency, and reduces stack space waste.
✦ Generated by Eureka AI based on patent content.
Smart Images
Figure CN116150739B_ABST
Abstract
本发明涉及一种基于关键地址动态保护的栈溢出自动防御方法，包括：callee函数执行完毕后，执行第一指令使得在callee函数内部将原caller的ebp寄存器植入栈保护，再执行第二指令让callee的ebp寄存器值指向栈底，在第二指令的下一条指令处插桩并通过内存管理器进行检测；执行第三指令恢复caller函数的栈空间，然后在返回指令处插桩，将存放返回地址的栈内存属性改为第二状态后，再执行返回指令跳转回caller函数继续执行。本发明限制了函数返回地址的栈内存属性为只读，任何攻击方法都无法篡改函数返回地址，成功防御return2shellcode的攻击方式。
Need to check novelty before this filing date? Find Prior Art