A C / C++ post-release reference dynamic detection method based on pointer dereference instrumentation

Abstract

The application discloses a C / C++ post-release re-reference dynamic detection method based on pointer dereference insertion, and when software testing is performed, a traditional Address Sanitizer cannot detect logical errors of address legality; the application realizes dynamic detection of pointer reuse memory errors through data flow analysis and insertion of GetElementPtr instructions.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a C / C++ post-release re-reference dynamic detection method based on pointer dereference instrumentation. Background Art

[0002] In 2011, Google engineers first proposed Address Sanitizer (Asan) for rapid memory error detection. It works by inserting additional code segments during compilation to track memory allocation and access, thereby detecting a variety of memory errors. Compared to previous tools, Asan boasts high efficiency, a wide detection range, and ease of use. In terms of error detection, Asan can precisely locate anomalies and provide detailed error reports. After more than a decade of development, Asan's capabilities have been continuously enhanced, and it has now become a commonly used tool for memory debugging and code defect detection.

[0003] However, Asan's design is not comprehensive and may miss detections for the following situations: non-contiguous buffer out-of-bounds access, i.e., accessing another buffer across the redzone; and repeated allocations of the same address, resulting in the use-after-free pointer pointing to a valid address, making it impossible to detect the error. Furthermore, while the industry's existing improved FuZZan achieves these missed detections, it incurs an O(log n) access overhead.

[0004] Therefore, designing and implementing a memory detection mechanism to solve the two problems of missed detection while retaining the efficiency of Asan (O(1) access overhead) can improve the ability of software testing to discover vulnerabilities and is of great significance to security research. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the prior art and provide a C / C++ post-release dynamic detection method based on pointer dereference instrumentation.

[0006] The object of the present invention is achieved through the following technical solution: a C / C++ post-release re-reference dynamic detection method based on pointer dereference instrumentation, comprising the following steps:

[0007] (1) Collect all memory allocation and release, pointer dereference instruction information during the compilation phase, and record all memory allocation call points as set C m , record all memory release call points as set C f , all pointer dereference instruction points are recorded as set C d ;

[0008] (2) During the compilation phase, the set C collected in the previous step m, Set C f and set C d The parameters and return values ​​of the pointer analysis are analyzed, and the pointer analysis includes dependency analysis and value transfer chain analysis, and the set C is extracted. f and set C d The parameter dependency set V d and V f , and extract the set C m The memory allocation returns the passed set of values ​​V m ;

[0009] (3) In the intermediate code stage, the set C m , Set C f and set C d Perform instrumentation, verify and update the corresponding V f and V m The shadow memory mapped by the address is made available, and the temporary variable is released from the unavailable state when the function returns.

[0010] Furthermore, in step (2), the extraction obtains a set C f and set C d The parameter dependency set V d and V f , specifically including the following sub-steps:

[0011] (a.1) Extracting set C under the LLVM framework f Parameters of each call point in the get parameter set in, Represents the set C f Any call point in Parameters, i=1,…,i,…,N, N represents the parameter set There are a total of N parameters in the LLVM framework and extract the set C d Each instruction point Parameters, get the parameter set in, Represents the set C d The parameters of any instruction point in , j=1,…,j,…,M, where M represents the parameter set There are a total of M parameters in ;

[0012] (a.2) For parameter set Any parameter in The type is checked:

[0013] a) If the parameter If the type is LoadInst type, update the parameters: Call the LoadInst.PointerOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0014] b) If the parameter If the type is StoreInst type, update the parameters: Call the StoreInst.ValueOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0015] c) If the parameter If the type is GetElementPtr type, update the parameters: The corresponding instruction calls the PointerOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0016] d) If the parameter The type is AllocaInst type: If the parameter If the corresponding instruction has a unique StoreInst reference, update the parameters: The StoreInst instruction calls the ValueOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Otherwise, the parameter As a call point Corresponding dependency address Add to collection V f , end the inspection;

[0017] e) If the parameter If the type is GlobalVariable or Argument, the parameter As a call point Corresponding dependency address Add to collection V f , end the inspection;

[0018] (a.3) For parameter set Each parameter Repeat step (a.2) to obtain set C f The dependency set V f :

[0019] (a.4) For parameter set Each parameter Repeat step (a.2) to obtain set C d The dependency set V d :

[0020] Furthermore, in step (2), the extraction obtains a set C m The parameter set V m , specifically including the following sub-steps:

[0021] (b.1) Extracting set C under the LLVM framework m Parameters of each call point in the get parameter set in, Represents the set C m Any call point in Parameters, k=1,…,k,…,L, L represents the parameter set There are a total of L parameters in ;

[0022] (b.2) For parameter set Each parameter Get Parameters All reference instructions as a set in, Representing a collection Any reference instruction in g=1,…,g,…,E m , E m Representing a collection China has E m Reference directives;

[0023] (b.3) For the collection Each reference instruction Perform reference check: If the reference instruction If the instruction type is not LoadInst or StoreInst, the reference instruction is skipped. To the next reference instruction Check; if the reference instruction If the instruction type is LoadInst or StoreInst, the reference instruction Call the PointerOperand method to get the return value And add to the delivery address collection Then return the value Then perform a reference check until the instruction type of the return value is not LoadInst or StoreInst type;

[0024] Complete the collection Each reference instruction After the reference check, the transfer address set is obtained

[0025] (b.4) For parameter set Each parameter Repeat step (b.3) to obtain set C m The transitive set V m :

[0026] Furthermore, in step (3), for the set C m , Set C f and set C d Performing instrumentation includes the following sub-steps:

[0027] (c.1) For set C f Every call point Insert additional state maintenance instruction __sanitizer_check_free, pass in and call point Corresponding dependency address As a parameter, we get the set C′ f ;

[0028] (c.2) For set C m Every call point Insert additional state maintenance instruction __sanitizer_check_malloc, pass in and call point Corresponding delivery address set As a parameter, we get the set C′ m ;

[0029] (c.3) For set C d Each instruction point Insert additional state maintenance instruction __sanitizer_check_deref, pass in the instruction point Corresponding dependency address As a parameter, we get the set C d ';

[0030] (c.4) For set C′ f , in the set C′ f Insert an additional instruction __sanitizer_unposion before the ReturnInst instruction of each terminal block.

[0031] Furthermore, inserting the additional state maintenance instructions __sanitizer_check_free, __sanitizer_check_malloc, and __sanitizer_check_deref requires maintaining the following principles:

[0032] (d.1) The shadow memory at the address of all malloc call pointers is set to the unpoison state;

[0033] (d.2) The shadow memory at the address of the root node of the dependency tree of all free calls is set to the poison state;

[0034] (d.3) All local variables have their address shadow memory set to the unpoison state before their context is destroyed.

[0035] Furthermore, in step (c.3), the state maintenance instruction __sanitizer_check_deref is inserted to check whether the shadow memory corresponding to the incoming parameter is in the poison state. When the use of the poison address is detected, the program flow is immediately terminated and an error message is output.

[0036] The beneficial effects of the present invention are:

[0037] 1) This invention can identify legitimate address reuse after free vulnerabilities that cannot be detected by traditional detection methods (AddressSanitizer);

[0038] 2) Compared with the existing FuZZan solution, the present invention achieves a constant-level single memory access complexity based on the expansion of the AddressSanitizer detection function. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of a C / C++ post-free dynamic re-reference detection method based on pointer dereference instrumentation.

[0040] Figure 2 This is a flowchart of a C / C++ post-free dynamic detection method based on pointer dereference instrumentation. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to illustrate the present invention, rather than to represent all embodiments. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0042] Example 1

[0043] like Figure 1 and Figure 2 As shown, the present invention provides a C / C++ post-free re-reference dynamic detection method based on pointer dereference instrumentation, comprising the following steps:

[0044] (1) Collect all memory allocation and release, pointer dereference instruction information during the compilation phase, and record all memory allocation call points as set C m , record all memory release call points as set C f , all pointer dereference instruction points are recorded as set C d .

[0045] (2) During the compilation phase, the set C collected in the previous step m , Set C f and set C d The parameters and return values ​​of the pointer analysis are analyzed, and the pointer analysis includes dependency analysis and value transfer chain analysis, and the set C is extracted. f and set C d The parameter dependency set V d and V f , and extract the set C m The memory allocation returns the passed set of values ​​V m .

[0046] (3) In the intermediate code stage, the set C m , Set C f and set C d Perform instrumentation, verify and update the corresponding V f and V m The shadow memory mapped by the address is made available, and the temporary variable is released from the unavailable state when the function returns.

[0047] In this embodiment, the malloc result is transferred to two local variables, one of the variables is released, and the other variable is assigned and transferred, and finally the result is released and then reused.

[0048] The following uses this as an example to introduce dependency analysis and value transfer chain analysis to extract C f and C d The parameter dependency set V d and V f The process includes:

[0049] (a.1) Extracting set C under the LLVM framework f Parameters of each call point in the get parameter set in, Represents the set C f Any call point in Parameters, i=1,…,i,…,N, N represents the parameter set There are a total of N parameters in the LLVM framework and extract the set C d Each instruction point Parameters, get the parameter set in, Represents the set C d The parameters of any instruction point in , j=1,…,j,…,M, where M represents the parameter set There are a total of M parameters in ;

[0050] (a.2) For parameter set Any parameter in The type is checked:

[0051] a) If the parameter If the type is LoadInst type, update the parameters: Call the LoadInst.PointerOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0052] b) If the parameter If the type is StoreInst type, update the parameters: Call the StoreInst.ValueOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0053] c) If the parameter If the type is GetElementPtr type, update the parameters: The corresponding instruction calls the PointerOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Type;

[0054] d) If the parameter The type is AllocaInst type: If the parameter If the corresponding instruction has a unique StoreInst reference, update the parameters: The StoreInst instruction calls the ValueOperand method to get the return value as the updated parameter And repeat step (a.2) to check the updated parameters Otherwise, the parameter As a call point Corresponding dependency address Add to collection V f , end the inspection;

[0055] e) If the parameter If the type is GlobalVariable or Argument, the parameter As a call point Corresponding dependency address Add to collection V f , end the inspection;

[0056] (a.3) For parameter set Each parameter Repeat step (a.2) to obtain set C f The dependency set V f :

[0057] (a.4) For parameter set Each parameter Repeat step (a.2) to obtain set C d The dependency set V d :

[0058] In step (2), the extraction obtains a set C m The parameter set V m , specifically including the following sub-steps:

[0059] (b.1) Extracting set C under the LLVM framework m Parameters of each call point in the get parameter set in, Represents the set C m Any call point in Parameters, k=1,…,k,…,L, L represents the parameter set There are a total of L parameters in ;

[0060] (b.2) For parameter set Each parameter Get Parameters All reference instructions as a set in, Representing a collection Any reference instruction in g=1,…,g,…,E m , E m Representing a collection China has E m Reference directives;

[0061] (b.3) For the collection Each reference instruction Perform reference check: If the reference instruction If the instruction type is not LoadInst or StoreInst, the reference instruction is skipped. To the next reference instruction Check; if the reference instruction If the instruction type is LoadInst or StoreInst, the reference instruction Call the PointerOperand method to get the return value And add to the delivery address collection Then return the value Then perform a reference check until the instruction type of the return value is not LoadInst or StoreInst type;

[0062] Complete the collection Each reference instruction After the reference check, the transfer address set is obtained

[0063] (b.4) For parameter set Each parameter Repeat step (b.3) to obtain set C m The transitive set V m :

[0064] For set C m , Set C f and set C d Performing instrumentation includes the following sub-steps:

[0065] (c.1) For set C f Every call point Insert additional state maintenance instruction __sanitizer_check_free, pass in and call point Corresponding dependency address As a parameter, we get the set C′ f ;

[0066] (c.2) For set C mEvery call point Insert additional state maintenance instruction __sanitizer_check_malloc, pass in and call point Corresponding delivery address set As a parameter, we get the set C′ m ;

[0067] (c.3) For set C d Each instruction point Insert additional state maintenance instruction __sanitizer_check_deref, pass in the instruction point Corresponding dependency address As a parameter, we get the set C d ';

[0068] (c.4) For set C′ f , in the set C′ f Insert an additional instruction __sanitizer_unposion before the ReturnInst instruction of each terminal block.

[0069] Inserting the additional state maintenance instructions __sanitizer_check_free, __sanitizer_check_malloc, and __sanitizer_check_deref requires maintaining the following principles:

[0070] (d.1) The shadow memory at the address of all malloc call pointers is set to the unpoison state;

[0071] (d.2) The shadow memory at the address of the root node of the dependency tree of all free calls is set to the poison state;

[0072] (d.3) All local variables have their address shadow memory set to the unpoison state before their context is destroyed.

[0073] In step (c.3), the state maintenance instruction __sanitizer_check_deref is inserted to check whether the shadow memory corresponding to the incoming parameter is in the poison state. When the use of the poison address is detected, the program flow is immediately terminated and an error message is output.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A C / C++ post-free dynamic re-reference detection method based on pointer dereference instrumentation, characterized in that: The following steps are involved: (1) Collect all memory allocation and release, pointer dereference instruction information during the compilation phase, and record all memory allocation call points as a set , record all memory release call points as a set , record all pointer dereference instruction points as a set ; (2) During the compilation phase, the collection collected in the previous step ,gather and collection The parameters and return values ​​of the pointer analysis, including dependency analysis and value transfer chain analysis, are extracted to obtain the set and collection The dependent set of parameters and , and extract the set The memory allocation return value of the transfer set ; In step (2), the extraction obtains a set and collection The dependent set of parameters and , specifically including the following sub-steps: (a.1) Extracting collections under the LLVM framework Parameters of each call point in the get parameter set : ,in, Representing a collection Any call point in Parameters, , Represents a parameter set The Chinese Communist Party has parameters; and extract the set under the LLVM framework Each instruction point Parameters, get the parameter set : ,in, Representing a collection Parameters of any instruction point in , Represents a parameter set The Chinese Communist Party has parameters; (a.2) For parameter sets Any parameter in The type is checked: a) If the parameter If the type is LoadInst type, update the parameters: Call the LoadInst.PointerOperand method to get the return value as the updated parameter , and repeat step (a.2) to check the updated parameters Type; b) If the parameter If the type is StoreInst type, update the parameters: Call the StoreInst.ValueOperand method to get the return value as the updated parameter , and repeat step (a.2) to check the updated parameters Type; c) If the parameter If the type is GetElementPtr type, update the parameters: The corresponding instruction calls the PointerOperand method to get the return value as the updated parameter , and repeat step (a.2) to check the updated parameters Type; d) If the parameter The type is AllocaInst type: If the parameter If the corresponding instruction has a unique StoreInst reference, update the parameters: The StoreInst instruction calls the ValueOperand method to get the return value as the updated parameter , and repeat step (a.2) to check the updated parameters Otherwise, the parameter As a call point Corresponding dependency address Add to collection , end the inspection; e) If the parameter If the type is GlobalVariable or Argument, the parameter As a call point Corresponding dependency address Add to collection , end the inspection; (a.3) For parameter sets Each parameter Repeat step (a.2) to get the set Dependency set : ; (a.4) For parameter sets Each parameter Repeat step (a.2) to get the set Dependency set : ; (3) Collection in the intermediate code stage ,gather and collection Perform instrumentation, verification, and update corresponding and The shadow memory mapped by the address is made available, and the temporary variable is released from the unavailable state when the function returns.

2. A C / C++ post-free re-reference dynamic detection method based on pointer dereference instrumentation according to claim 1, characterized in that: In step (2), the extraction obtains a set The memory allocation return value of the transfer set , specifically including the following sub-steps: (b.1) Extracting collections under the LLVM framework Parameters of each call point in the get parameter set : ,in, Representing a collection Any call point in Parameters, , Represents a parameter set The Chinese Communist Party has parameters; (b.2) For parameter sets Each parameter , get the parameters All reference instructions as a set : ,in, Representing a collection Any reference instruction in , Representing a collection The Chinese Communist Party has Reference directives; (b.3) For collections Each reference instruction Perform reference check: If the reference instruction If the instruction type is not LoadInst or StoreInst, the reference instruction is skipped. To the next reference instruction Check; if the reference instruction If the instruction type is LoadInst or StoreInst, the reference instruction Call the PointerOperand method to get the return value And add to the delivery address collection ; Then return the value Then perform a reference check until the instruction type of the return value is not LoadInst or StoreInst type; Complete the collection Each reference instruction After the reference check, the transfer address set is obtained ; (b.4) For parameter sets Each parameter Repeat step (b.3) to get the set The transitive set : .

3. The C / C++ post-free dynamic detection method based on pointer dereference instrumentation according to claim 2 is characterized in that: In step (3), the set ,gather and collection Performing instrumentation includes the following sub-steps: (c.1) For a collection Every call point Insert additional state maintenance instruction __sanitizer_check_free, pass in and call point Corresponding dependency address As a parameter, get the collection ; (c.2) For a collection Every call point Insert additional state maintenance instruction __sanitizer_check_malloc, pass in and call point Corresponding delivery address set As a parameter, get the collection ; (c.3) For collections Each instruction point Insert additional state maintenance instruction __sanitizer_check_deref, pass in the instruction point Corresponding dependency address As a parameter, get the collection ; (c.4) For collections , in the collection Insert an additional instruction __sanitizer_unposion before the ReturnInst instruction of each terminal block.

4. The C / C++ post-free dynamic detection method based on pointer dereference instrumentation according to claim 2 is characterized in that: Inserting the additional state maintenance instructions __sanitizer_check_free, __sanitizer_check_malloc, and __sanitizer_check_deref requires maintaining the following principles: (d.1) The shadow memory at the address of all malloc call pointers is set to the unpoison state; (d.2) The shadow memory at the address of the root node of the dependency tree of all free calls is set to the poison state; (d.3) All local variables have their address shadow memory set to the unpoison state before their context is destroyed.

5. The C / C++ post-free dynamic detection method based on pointer dereference instrumentation according to claim 2 is characterized in that: In step (c.3), the state maintenance instruction __sanitizer_check_deref is inserted to check whether the shadow memory corresponding to the incoming parameter is in the poison state. If the use of the poison address is detected, the program flow will be terminated immediately and an error message will be output.

Images