Heap vulnerability testing method, device, equipment and storage medium
By constructing a state transition model and optimization path for heap vulnerabilities, the problem of existing tools struggling to integrate vulnerability primitive sequences and state transitions from top to bottom in heap vulnerability exploitation is solved, thus achieving automated exploitation and efficient driving of heap vulnerabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 15 INST OF CHINA ELECTRONICS TECH GRP
- Filing Date
- 2025-06-18
- Publication Date
- 2026-05-12
AI Technical Summary
Existing tools struggle to effectively integrate the mapping relationship between vulnerability primitive sequences, state transition processes, and control flow hijacking code from top to bottom during heap vulnerability exploitation. This results in the vulnerability exploitation logic not being able to unfold effectively, and the automation capability of heap layout is weak, making it difficult to adapt to complex heap scenarios.
A state transition model for the target heap vulnerability is constructed. Multiple state transition paths are determined through the state transition model. The path is optimized by utilizing the attribute information and weight values of the nodes, and the target-driven logic is generated to realize the automated exploitation of the heap vulnerability.
It enables automated exploitation of heap vulnerabilities, improving the efficiency and accuracy of vulnerability exploitation, and can efficiently drive the driver to the exploit state in complex scenarios.
Smart Images
Figure CN120781357B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of security protection technology and related technical fields, specifically to a method, apparatus, device, and storage medium for testing and exploiting heap vulnerabilities. Background Technology
[0002] With increasingly stringent security measures, automated vulnerability discovery has become relatively mature. However, automated vulnerability exploitation still faces numerous technical challenges, particularly in the area of heap vulnerabilities. While mainstream fuzzing tools such as AFL and libFuzzer can detect anomalous program behavior, the effective conversion of these anomalous test cases into exploitable paths still heavily relies on manual intervention.
[0003] First, there is a disconnect between the vulnerability primitives and the exploit code. Most tools only focus on the exception trigger point and do not perform in-depth modeling of the program's execution state space, nor do they integrate the mapping relationship between the vulnerability primitive sequence, state transition process, and the final control flow hijacking code from top to bottom, resulting in the exploit logic not being able to unfold effectively. Second, the automation capability of heap layout is weak. Heap vulnerabilities often rely on precise memory structure states, such as heap block adjacency relationships and internal metadata control, but existing tools such as HLM are only suitable for simple heap scenarios and are difficult to adapt to multi-step situations involving heap block migration and metadata reuse. More importantly, whether the driver can successfully reach the preset memory layout state required for exploitation has become a key challenge to further automate the exploitation process. Summary of the Invention
[0004] The embodiments described herein provide a method, apparatus, device, and storage medium for testing and exploiting heap vulnerabilities, addressing problems existing in the prior art.
[0005] Firstly, based on the content of this disclosure, a method for testing and exploiting heap vulnerabilities is provided, including:
[0006] Construct a state transition model from the target heap vulnerability to the target state, wherein the state transition model is the state transition model from the abnormal triggering state of the target heap vulnerability to the target state;
[0007] Based on the state transition model, multiple state transition paths from the target heap vulnerability to the target state are determined. The state transition model includes states and vulnerability primitives. The states are nodes on the state transition paths, and the vulnerability primitives are the relationships between nodes on the state transition paths. The states include structural states or control states, and the vulnerability primitives include behavioral patterns and operation types. The vulnerability primitives drive the state transitions.
[0008] An initial state transition path is determined based on the attribute information of the nodes included in each state transition path, wherein the attribute information includes the distance information from the node to the target state, the utilization rate of the node, and whether the node executes a heap operation function.
[0009] Based on the relationship between the initial state transition path and the constraint function, the initial state transition path is optimized to obtain the target state transition path;
[0010] Based on the target state transition path, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state.
[0011] Before constructing the state transition model from the target heap vulnerability to the target state, the following is also included:
[0012] Based on the status information of each vulnerability, heap vulnerabilities are filtered out, wherein the status information includes memory layout status and heap overflow status;
[0013] Obtain the abnormal trigger status of each heap vulnerability and the target status set by the target object.
[0014] In some embodiments of this disclosure, determining multiple state transition paths from the target heap vulnerability to the target state based on the state transition model includes:
[0015] Obtain the state transition model, including the states and the vulnerability primitives between states with relationships;
[0016] Determine the initial state based on the abnormal triggering state of the target heap vulnerability;
[0017] Based on the states included in the state transition model and the vulnerability primitives between states with related relationships, multiple state transition paths from the initial state to the target state are determined.
[0018] In some embodiments of this disclosure, determining the initial state transition path based on the attribute information of the nodes included in each state transition path includes:
[0019] The weight value of each state transition path is determined based on the attribute information of the nodes included in each state transition path.
[0020] Select the state transition path with the largest weight value as the initial state transition path.
[0021] In some embodiments of this disclosure, determining the weight value of each state transition path based on the attribute information of the nodes included in each state transition path includes:
[0022] Based on the distance information from the nodes to the target state included in the state transition path, determine the first sub-weight value of each node;
[0023] Based on the node utilization rate included in the state transition path, determine the second sub-weight value of each node;
[0024] The third sub-weight value of each node is determined based on whether the nodes included in the state transition path execute heap operation functions.
[0025] The weight values of each node included in each state transition path are determined based on the first sub-weight value, the second sub-weight value, and the third sub-weight value corresponding to each node in each state transition path.
[0026] The weight value of each state transition path is determined based on the weight values of each node included in each state transition path.
[0027] In some embodiments of this disclosure, optimizing the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path includes:
[0028] Determine whether the system's memory addresses and heap block pointers meet preset thresholds during an attack based on the initial state migration path;
[0029] If the memory address and heap block pointer satisfy a preset threshold, then the initial state transition path is the target state transition path;
[0030] When the memory address and heap block pointer do not meet the preset threshold, the node with the smallest weight value is selected and removed according to the weight value of each node in the initial state migration path.
[0031] In some embodiments of this disclosure, the target-driven logic for generating the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path includes:
[0032] Based on the target state transition path, determine the target operation sequence;
[0033] Based on the target operation sequence, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state.
[0034] Secondly, according to the present disclosure, a heap vulnerability testing and exploitation apparatus is provided, comprising:
[0035] The state transition model construction module is used to construct a state transition model from the target heap vulnerability to the target state, wherein the state transition model is a state transition model from the abnormal triggering state of the target heap vulnerability to the target state.
[0036] The state transition path determination module is used to determine multiple state transition paths from the target heap vulnerability to the target state based on the state transition model. The state transition model includes states and vulnerability primitives. The states are nodes on the state transition path, and the vulnerability primitives are the relationships between nodes on the state transition path. The states include structural states or control states, and the vulnerability primitives include behavioral patterns and operation types. The vulnerability primitives drive state transitions.
[0037] The initial state transition path determination module is used to determine the initial state transition path based on the attribute information of the nodes included in each state transition path, wherein the attribute information includes the distance information from the node to the target state, the utilization rate of the node, and whether the node executes the heap operation function.
[0038] The target state transition path determination module is used to optimize the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path.
[0039] The target-driven logic generation module is used to generate target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path.
[0040] Thirdly, according to the present disclosure, a computer device is provided, comprising:
[0041] One or more processors;
[0042] Storage device for storing one or more programs.
[0043] When the one or more programs are executed by the one or more processors, the one or more processors perform the method as described in any of the first aspects.
[0044] Fourthly, according to the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described in any of the first aspects.
[0045] The heap vulnerability testing and exploitation method, apparatus, device, and medium provided in this disclosure first construct a state transition model from the target heap vulnerability to the target state; then, based on the state transition model, determine multiple state transition paths from the target heap vulnerability to the target state; and determine an initial state transition path based on the attribute information of the nodes included in each state transition path; further, optimize the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path; finally, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path. First, a state transition model for heap vulnerabilities is defined from the perspective of states and vulnerability primitives, standardizing and structuring the complex and unpredictable vulnerability exploitation process. Then, by calculating the weight values of each state transition path, the calculation process of the weight values of each state transition path takes into account both the efficiency and quality of the state transition path, determining an initial state transition path. Then, the initial state transition path is further optimized through a feedback guidance mechanism to obtain the target state transition path. Finally, the target-driven logic from the abnormal triggering state of the heap vulnerability to the target state is generated based on the target state transition path, realizing the exploitation of the abnormal triggering state of the heap vulnerability with high efficiency.
[0046] The above description is merely an overview of the technical solutions of the embodiments of this application. In order to better understand the technical means of the embodiments of this application and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of this application more obvious and understandable, specific implementation methods of this application are described below. Attached Figure Description
[0047] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein:
[0048] Figure 1 This is a flowchart illustrating a heap vulnerability testing and exploitation method provided in an embodiment of this disclosure;
[0049] Figure 2 This is a schematic diagram of the structure of a heap vulnerability testing and exploitation device provided in an embodiment of this disclosure;
[0050] Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure.
[0051] In the accompanying diagram, markers with the same last two digits correspond to the same elements. It should be noted that the elements in the diagram are schematic and not drawn to scale. Detailed Implementation
[0052] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.
[0053] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. As used herein, the statement of “connecting” or “coupling” two or more parts together shall mean that these parts are directly joined together or joined through one or more intermediate components.
[0054] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of the phrase "embodiment" in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.
[0055] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists, A and B exist simultaneously, or B exists. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.
[0056] Furthermore, in all embodiments of this disclosure, terms such as “first” and “second” are used only to distinguish one component (or part of a component) from another component (or another part of a component).
[0057] In the description of this application, unless otherwise stated, "multiple" means two or more (including two), and similarly, "multiple groups" means two or more (including two groups).
[0058] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.
[0059] Based on the problems existing in the prior art, this disclosure provides a method for testing and exploiting heap vulnerabilities. Figure 1 This is a flowchart illustrating a heap vulnerability testing and exploitation method provided in an embodiment of this disclosure, as shown below. Figure 1 As shown, the specific process of heap vulnerability testing and exploitation includes:
[0060] S110. Construct a state transition model from the target heap vulnerability to the target state.
[0061] Among them, the state transition model is the state transition model from the abnormal triggering state of the target heap vulnerability to the target state.
[0062] With the increasing emphasis on security protection, the automatic discovery of vulnerabilities has become relatively mature. However, the automatic exploitation of vulnerabilities still faces many technical challenges, especially in the area of heap vulnerabilities. While mainstream fuzzing tools such as AFL and libFuzzer can detect abnormal program behavior, whether abnormal test cases can be effectively converted into exploitable paths still heavily relies on manual intervention.
[0063] In the heap vulnerability testing and exploitation method provided in this embodiment, heap vulnerabilities are first identified based on the obtained status information of each vulnerability in the program. Specifically, it can be determined whether the current vulnerability is a heap vulnerability based on the memory layout status and heap overflow status of the vulnerability.
[0064] After identifying a heap vulnerability, its initial state is determined based on its abnormal triggering state, and its target state is determined based on the target object's desired final attack target. The state transition model for the heap vulnerability then represents all possible paths from its abnormal triggering state to its target state.
[0065] S120. Based on the state transition model, determine multiple state transition paths from the target heap vulnerability to the target state.
[0066] The state transition model includes states and vulnerability primitives. States are nodes on the state transition path, and vulnerability primitives are the relationships between nodes on the state transition path. States include structural states, and vulnerability primitives include behavioral patterns and operation types. Vulnerability primitives drive state transitions.
[0067] State S describes the structural state of the heap memory and the values of key variables.
[0068] A vulnerability primitive refers to a basic, exploitable behavior pattern or operation type in a program, such as "arbitrary address write(addr,val)", "heap block free(p)", and "dynamic memory allocation malloc(p,size)" in heap overflows. Vulnerability primitives are the basic unit of granularity for constructing and combining state transition paths during heap vulnerability exploitation.
[0069] Heap exploitation refers to an automatically identifiable and executable exploit path consisting of a series of states and state transitions. Based on vulnerability primitives, heap exploitation describes the transition from the abnormal triggering state S0 of the heap vulnerability to the target state S through program state transitions. n The complete process, the description of program state transitions includes states and vulnerability primitives, with vulnerability primitives driving state transitions.
[0070] State transition is the process by which a program, during execution, changes from one memory structure or control state to another due to changes in input or memory operations. In heap vulnerability exploitation, precisely manipulating the program to enter an exploitable state is key to the attack.
[0071] A state transition path refers to a sequence of state transitions executed in the order of exploit primitives, starting from an abnormal trigger state, in order to achieve the final attack objective (such as controlling the program counter PC). This path is the core strategy part used to guide fuzzing in generating exploit inputs.
[0072] Specifically, one state transition path can be represented as: Transitions from one state to another are driven by vulnerability primitives, where S i O represents the state, and O represents the vulnerability primitive.
[0073] In a specific implementation, based on the state transition model, multiple state transition paths from the target heap vulnerability to the target state are determined, including: obtaining the states included in the state transition model and the vulnerability primitives between states with relationships; determining the initial state based on the abnormal triggering state of the target heap vulnerability; and determining multiple state transition paths from the initial state to the target state based on the states included in the state transition model and the vulnerability primitives between states with relationships.
[0074] S130. Determine the initial state transition path based on the attribute information of the nodes included in each state transition path.
[0075] The attribute information includes the distance from the node to the target state, the node's utilization rate, and whether the node executes heap operation functions.
[0076] In constructing exploit paths for heap vulnerabilities, the theoretical construction of state transition paths is only the first step. The test cases required to implement these paths are the key to whether the final attack can be successfully launched. Therefore, this invention first explores the control flow and data flow progressively, allowing the driver to reach each intermediate critical exploit state.
[0077] Specifically, the weight-guided fuzzing phase based on state transition paths is guided by a static weighted control flow graph (WCFG). By analyzing the utilization, operational capability, and path length of each node in each state transition path of the state transition network, the weight value corresponding to each node in the state transition path is determined, thereby determining the weight value of each state transition path. Finally, the fuzzy engine selects the state transition path with the largest weight value from the state transition paths as the initial state transition path.
[0078] The weight values of each node in the state transition path are determined based on the following factors:
[0079] 1. The distance a node travels to the target state in WCFG;
[0080] 2. Information on the number of state transition paths covered by the node;
[0081] 3. Whether heap operation functions (such as free, write) are executed during the migration process from node to the next node.
[0082] This phase effectively addresses the Control Flow Arrival (CFA) problem by prioritizing coverage of paths most likely to reach the exploited nodes.
[0083] In a specific implementation, the initial state transition path is determined based on the attribute information of the nodes included in each state transition path, including: determining the weight value of each state transition path based on the attribute information of the nodes included in each state transition path; and selecting the state transition path with the largest weight value as the initial state transition path.
[0084] Specifically, based on the attribute information of the nodes included in each state transition path, the weight value of each state transition path is determined, including: determining a first sub-weight value for each node based on the distance information from the node included in the state transition path to the target state; determining a second sub-weight value for each node based on the utilization rate of the node included in the state transition path; determining a third sub-weight value for each node based on whether the node included in the state transition path executes a heap operation function; determining the weight value of each node included in each state transition path based on the first, second, and third sub-weight values corresponding to each node included in each state transition path; and determining the weight value of each state transition path based on the weight value of each node included in each state transition path.
[0085] A specific example is that if a state transition path from the target heap vulnerability to the target state is... That is, the exception trigger state is S0, which is also the starting node of the state transition path, and the target state is S. n That is, the terminal node of the state transition path, and the intermediate nodes on the state transition path are S1, S2, ..., S...n-1 The weight value of each node is determined by sequentially determining the first sub-weight value, the second sub-weight value, and the third sub-weight value corresponding to each intermediate node.
[0086] For example, based on the distance from the state corresponding to node S1 to the target state, the first sub-weight value of node S1 is determined to be A11. Based on the number of state transition paths covered by the state corresponding to node S1, the second sub-weight value of node S1 is determined to be A12. Based on whether the state corresponding to node S1 executes a heap operation function, the third sub-weight value of node S1 is determined to be A13. Then, the first sub-weight value A11, the second sub-weight value A12, and the third sub-weight value A13 of node S1 are summed and averaged to determine the weight value of node S1. Similarly, the weight values of nodes S2, ..., S are calculated. n-1 The weight value.
[0087] After obtaining the weight values of each node, the average weight values of each node can be calculated to obtain the weight value of the state transition path. After determining the weight values of each state transition path, the probability of the nodes included in the state transition path being used as nodes can be determined. The state transition path with the largest weight value is selected as the initial state transition path.
[0088] It should be noted that since there may be multiple state transition paths from the abnormal trigger state to the target state, the utilization rate of a node refers to the proportion of the number of state transition paths covered by the node to the total number of state transition paths from the abnormal trigger state to the target state.
[0089] S140. Based on the relationship between the initial state transition path and the constraint function, optimize the initial state transition path to obtain the target state transition path.
[0090] In a specific implementation, the initial state transition path is optimized based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path. This includes: obtaining whether the memory address and heap pointer of the system meet a preset threshold during the attack based on the initial state transition path; if the memory address and heap pointer meet the preset threshold, then the initial state transition path is the target state transition path; if the memory address and heap pointer do not meet the preset threshold, then nodes in the initial state transition path that do not meet the preset weight value are removed.
[0091] After obtaining the initial state transition path, the system utilizes the abnormal trigger state based on the initial state transition path. During the utilization of the abnormal trigger state, the system determines whether the memory addresses and heap block pointers involved in the initial state transition path meet the preset thresholds by obtaining the abnormal trigger state utilization based on the initial state transition path.
[0092] When the memory address and heap pointer meet the preset threshold, the initial state transition path is the target state transition path. When the memory address and heap pointer do not meet the preset threshold, the node with the smallest weight value is selected and removed according to the weight value of each node in the initial state transition path, and the initial state transition path is reconstructed. The memory address and heap pointer parameters are calculated again, and so on, until the memory address and heap pointer parameters meet the preset threshold.
[0093] S150. Based on the target state transition path, generate the target-driven logic from the abnormal trigger state of the target heap vulnerability to the target state.
[0094] In a specific implementation, the target driving logic from the abnormal triggering state of the target heap vulnerability to the target state is generated according to the target state transition path, including: determining the target operation sequence according to the target state transition path; and generating the target driving logic from the abnormal triggering state of the target heap vulnerability to the target state according to the target operation sequence.
[0095] The heap vulnerability testing and exploitation method provided in this disclosure starts from the abnormal triggering state of the heap vulnerability, analyzes the exploitability of each state transition path in the state transition model layer by layer, and the exploitability of each node in each state transition path, determines the target driving logic from the abnormal triggering state to the target state, and realizes the exploitation of the abnormal triggering state of the target heap vulnerability.
[0096] In addition, shellcode layout optimization is performed under constraint solving.
[0097] The ultimate goal of this invention is to create an automated exploitation system capable of hijacking control flow and redirecting to an attacker-deployed shellcode region under specific inputs. Therefore, the shellcode layout optimization process includes:
[0098] 1. Generate the payload address jump structure, determine the test cases based on the target state transition path, and determine the distribution of stack frames and heap blocks in the test cases to generate appropriate jump positions;
[0099] 2. Bad character handling mechanism: identifies and removes illegal characters such as 0x00 and 0x0A that cause input truncation;
[0100] 3. Size padding and encoding avoidance strategies, such as using English shellcode or using the egghunter mechanism to avoid length limits;
[0101] 4. Constraint solver-assisted positioning jump offset, such as Z3 solver-assisted solution for input combinations that satisfy the control PC as the target address;
[0102] 5. Dynamic feedback adapts to layout adjustments. If the shellcode area is corrupted, consider searching for alternative jump points or dynamically adjusting the heap layout to relocate the shellcode to a safe area.
[0103] By embedding these mechanisms, the shellcode generation module can generate highly reliable control hijacking inputs based on the dynamic behavioral characteristics of the target program, and has strong platform adaptability, suitable for various architecture environments such as x86 and x64.
[0104] The heap vulnerability testing and exploitation method provided in this disclosure first constructs a state transition model from the target heap vulnerability to the target state; then, based on the state transition model, it determines multiple state transition paths from the target heap vulnerability to the target state; and based on the attribute information of the nodes included in each state transition path, it determines an initial state transition path; furthermore, based on the relationship between the initial state transition path and the constraint function, it optimizes the initial state transition path to obtain the target state transition path; finally, based on the target state transition path, it generates the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state. First, it defines a state transition model for heap vulnerabilities from the perspective of states and vulnerability primitives, standardizing and structuring the complex and unpredictable vulnerability exploitation process. Then, by calculating the weight values of each state transition path, the calculation process of the weight values of each state transition path takes into account both the efficiency and quality of the state transition path, determining an initial state transition path. Then, through a feedback guidance mechanism, it further optimizes the initial state transition path to obtain the target state transition path. Finally, based on the target state transition path, it generates the target-driven logic from the abnormal triggering state of the heap vulnerability to the target state, realizing the exploitation of the abnormal triggering state of the heap vulnerability with high efficiency.
[0105] Based on the above embodiments, Figure 2 This is a schematic diagram of a heap vulnerability testing and exploitation device provided in an embodiment of this disclosure, as shown below. Figure 2 As shown, the heap vulnerability testing and exploitation device includes:
[0106] The state transition model construction module 210 is used to construct a state transition model from the target heap vulnerability to the target state, wherein the state transition model is a state transition model from the abnormal triggering state of the target heap vulnerability to the target state.
[0107] The state transition path determination module 220 is used to determine multiple state transition paths from the target heap vulnerability to the target state according to the state transition model. The state transition model includes states and vulnerability primitives. The states are nodes on the state transition path, and the vulnerability primitives are the relationships between the nodes on the state transition path. The states include structural states or control states, and the vulnerability primitives include behavioral patterns and operation types. The vulnerability primitives drive state transitions.
[0108] The initial state transition path determination module 230 is used to determine the initial state transition path based on the attribute information of the nodes included in each state transition path, wherein the attribute information includes the distance information from the node to the target state, the utilization rate of the node, and whether the node executes a heap operation function.
[0109] The target state transition path determination module 240 is used to optimize the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path.
[0110] The target-driven logic generation module 250 is used to generate target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state according to the target state migration path.
[0111] The heap vulnerability testing and exploitation apparatus provided in this disclosure first constructs a state transition model from the target heap vulnerability to the target state; then, based on the state transition model, it determines multiple state transition paths from the target heap vulnerability to the target state; and based on the attribute information of the nodes included in each state transition path, it determines an initial state transition path; furthermore, based on the relationship between the initial state transition path and the constraint function, it optimizes the initial state transition path to obtain the target state transition path; finally, based on the target state transition path, it generates target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state. First, it defines a state transition model for heap vulnerabilities from the perspective of states and vulnerability primitives, standardizing and structuring the complex and unpredictable vulnerability exploitation process. Then, by calculating the weight values of each state transition path, the calculation process of the weight values of each state transition path takes into account both the efficiency and quality of the state transition path, determining an initial state transition path. Then, through a feedback guidance mechanism, it further optimizes the initial state transition path to obtain the target state transition path. Finally, based on the target state transition path, it generates target-driven logic from the abnormal triggering state of the heap vulnerability to the target state, realizing the exploitation of the abnormal triggering state of the heap vulnerability with high efficiency.
[0112] In a specific implementation, before constructing the state transition model from the target heap vulnerability to the target state, the method further includes:
[0113] Based on the status information of each vulnerability, heap vulnerabilities are filtered out, wherein the status information includes memory layout status and heap overflow status;
[0114] Obtain the abnormal trigger status of each heap vulnerability and the target status set by the target object.
[0115] In a specific implementation, determining multiple state transition paths from the target heap vulnerability to the target state based on the state transition model includes:
[0116] Obtain the state transition model, including the states and the vulnerability primitives between states with relationships;
[0117] Determine the initial state based on the abnormal triggering state of the target heap vulnerability;
[0118] Based on the states included in the state transition model and the vulnerability primitives between states with related relationships, multiple state transition paths from the initial state to the target state are determined.
[0119] In a specific implementation, determining the initial state transition path based on the attribute information of the nodes included in each state transition path includes:
[0120] The weight value of each state transition path is determined based on the attribute information of the nodes included in each state transition path.
[0121] Select the state transition path with the largest weight value as the initial state transition path.
[0122] In a specific implementation, determining the weight value of each state transition path based on the attribute information of the nodes included in each state transition path includes:
[0123] Based on the distance information from the nodes to the target state included in the state transition path, determine the first sub-weight value of each node;
[0124] Based on the node utilization rate included in the state transition path, determine the second sub-weight value of each node;
[0125] The third sub-weight value of each node is determined based on whether the nodes included in the state transition path execute heap operation functions.
[0126] The weight values of each node included in each state transition path are determined based on the first sub-weight value, the second sub-weight value, and the third sub-weight value corresponding to each node in each state transition path.
[0127] The weight value of each state transition path is determined based on the weight values of each node included in each state transition path.
[0128] In a specific implementation, optimizing the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path includes:
[0129] Determine whether the system's memory addresses and heap block pointers meet preset thresholds during an attack based on the initial state migration path;
[0130] If the memory address and heap block pointer satisfy a preset threshold, then the initial state transition path is the target state transition path;
[0131] When the memory address and heap block pointer do not meet the preset threshold, the node with the smallest weight value is selected and removed according to the weight value of each node in the initial state migration path.
[0132] In a specific implementation, the step of generating the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path includes:
[0133] Based on the target state transition path, determine the target operation sequence;
[0134] Based on the target operation sequence, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state.
[0135] This application also provides a computer device, please refer to the following for details. Figure 3 , Figure 3 This is a basic structural block diagram of the computer device in this embodiment.
[0136] The computer device includes a memory 510 and a processor 520 that are interconnected via a system bus. It should be noted that only a computer device with components 510-520 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components may be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.
[0137] Computer devices can include desktop computers, laptops, handheld computers, and cloud servers. These devices allow for human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.
[0138] The memory 510 includes at least one type of readable storage medium, including non-volatile memory or volatile memory, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. RAM may include static RAM or dynamic RAM. In some embodiments, the memory 510 may be an internal storage unit of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory 510 may also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, or flash card equipped on the computer device. Of course, the memory 510 may include both internal storage units and external storage devices of the computer device. In this embodiment, the memory 510 is typically used to store the operating system and various application software installed on the computer device, such as the program code of the method described above. In addition, the memory 510 may also be used to temporarily store various types of data that have been output or will be output.
[0139] The processor 520 is typically used to perform the overall operation of a computer device. In this embodiment, the memory 510 is used to store program code or instructions, including computer operation instructions. The processor 520 is used to execute the program code or instructions stored in the memory 510 or to process data, such as program code that runs the methods described above.
[0140] In this article, the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus system can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.
[0141] Another embodiment of this application also provides a computer-readable medium, which may be a computer-readable signal medium or a computer-readable medium. A processor in a computer reads computer-readable program code stored in the computer-readable medium, enabling the processor to execute the functional actions specified in each step or combination of steps in the above method; and to generate means for implementing the functional actions specified in each block or combination of blocks in the block diagram.
[0142] Computer-readable media include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared memory or semiconductor systems, devices or apparatuses, or any suitable combination thereof, wherein the memory is used to store program code or instructions, the program code including computer operation instructions, and the processor is used to execute the program code or instructions of the above-described methods stored in the memory.
[0143] The definitions of memory and processor can be found in the description of the foregoing computer device embodiments, and will not be repeated here.
[0144] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0145] In the various embodiments of this application, the functional units or modules can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0146] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0147] Unless otherwise expressly indicated by the context, the singular form of words used herein and in the appended claims includes the plural form, and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the terms “comprising” and “including” shall be interpreted as including rather than exclusively. Likewise, the terms “including” and “or” shall be interpreted as including unless such interpretation is expressly prohibited herein. Where the term “example” is used herein, particularly when it follows a set of terms, the “example” is merely exemplary and illustrative and should not be considered exclusive or extensive.
[0148] Further aspects and scope of adaptation become apparent from the description provided herein. It should be understood that various aspects of this application may be implemented individually or in combination with one or more other aspects. It should also be understood that the descriptions and specific embodiments herein are for illustrative purposes only and are not intended to limit the scope of this application.
[0149] Several embodiments of this disclosure have been described in detail above. However, it is obvious that those skilled in the art can make various modifications and variations to the embodiments of this disclosure without departing from the spirit and scope of this disclosure. The scope of protection of this disclosure is defined by the appended claims.
Claims
1. A method for testing and exploiting heap vulnerabilities, characterized in that, include: Construct a state transition model from the target heap vulnerability to the target state, wherein the state transition model is the state transition model from the abnormal triggering state of the target heap vulnerability to the target state; Based on the state transition model, multiple state transition paths from the target heap vulnerability to the target state are determined. The state transition model includes states and vulnerability primitives. The states are nodes on the state transition paths, and the vulnerability primitives are the relationships between nodes on the state transition paths. The states include structural states or control states, and the vulnerability primitives include behavioral patterns and operation types. The vulnerability primitives drive the state transitions. An initial state transition path is determined based on the attribute information of the nodes included in each state transition path, wherein the attribute information includes the distance information from the node to the target state, the utilization rate of the node, and whether the node executes a heap operation function. Based on the relationship between the initial state transition path and the constraint function, the initial state transition path is optimized to obtain the target state transition path; Based on the target state transition path, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state. The step of determining the initial state transition path based on the attribute information of the nodes included in each state transition path includes: Based on the distance information from the nodes to the target state included in the state transition path, determine the first sub-weight value of each node; Based on the node utilization rate included in the state transition path, determine the second sub-weight value of each node; The third sub-weight value of each node is determined based on whether the nodes included in the state transition path execute heap operation functions. The weight values of each node included in each state transition path are determined based on the first sub-weight value, the second sub-weight value, and the third sub-weight value corresponding to each node in each state transition path. The weight value of each state transition path is determined based on the weight values of each node included in each state transition path. Select the state transition path with the largest weight value as the initial state transition path.
2. The method according to claim 1, characterized in that, Before constructing the state transition model from the target heap vulnerability to the target state, the following is also included: Based on the status information of each vulnerability, heap vulnerabilities are filtered out, wherein the status information includes memory layout status and heap overflow status; Obtain the abnormal trigger status of each heap vulnerability and the target status set by the target object.
3. The method according to claim 1, characterized in that, The step of determining multiple state transition paths from the target heap vulnerability to the target state based on the state transition model includes: Obtain the state transition model, including the states and the vulnerability primitives between states with relationships; Determine the initial state based on the abnormal triggering state of the target heap vulnerability; Based on the states included in the state transition model and the vulnerability primitives between states with related relationships, multiple state transition paths from the initial state to the target state are determined.
4. The method according to claim 1, characterized in that, The step of optimizing the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path includes: Determine whether the system's memory addresses and heap block pointers meet preset thresholds during an attack based on the initial state migration path; If the memory address and heap block pointer satisfy a preset threshold, then the initial state transition path is the target state transition path; When the memory address and heap block pointer do not meet the preset threshold, the node with the smallest weight value is selected and removed according to the weight value of each node in the initial state migration path.
5. The method according to claim 1, characterized in that, The target-driven logic for generating the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path includes: Based on the target state transition path, determine the target operation sequence; Based on the target operation sequence, generate the target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state.
6. A heap vulnerability testing and exploitation device, characterized in that, include: The state transition model construction module is used to construct a state transition model from the target heap vulnerability to the target state, wherein the state transition model is a state transition model from the abnormal triggering state of the target heap vulnerability to the target state. The state transition path determination module is used to determine multiple state transition paths from the target heap vulnerability to the target state based on the state transition model. The state transition model includes states and vulnerability primitives. The states are nodes on the state transition path, and the vulnerability primitives are the relationships between nodes on the state transition path. The states include structural states or control states, and the vulnerability primitives include behavioral patterns and operation types. The vulnerability primitives drive state transitions. The initial state transition path determination module is used to determine the initial state transition path based on the attribute information of the nodes included in each state transition path, wherein the attribute information includes the distance information from the node to the target state, the utilization rate of the node, and whether the node executes the heap operation function. The target state transition path determination module is used to optimize the initial state transition path based on the relationship between the initial state transition path and the constraint function to obtain the target state transition path. The target-driven logic generation module is used to generate target-driven logic from the abnormal triggering state of the target heap vulnerability to the target state based on the target state transition path. The step of determining the initial state transition path based on the attribute information of the nodes included in each state transition path includes: Based on the distance information from the nodes to the target state included in the state transition path, determine the first sub-weight value of each node; Based on the node utilization rate included in the state transition path, determine the second sub-weight value of each node; The third sub-weight value of each node is determined based on whether the nodes included in the state transition path execute heap operation functions. The weight values of each node included in each state transition path are determined based on the first sub-weight value, the second sub-weight value, and the third sub-weight value corresponding to each node in each state transition path. The weight value of each state transition path is determined based on the weight values of each node included in each state transition path. Select the state transition path with the largest weight value as the initial state transition path.
7. A computer device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 5.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.