Indirect Call Devirtualization for Control Flow Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods to protect against control flow attacks, such as Use-After-Free, are limited to source codes written in object-oriented programming languages and require annotations, failing to effectively safeguard source codes in other programming languages like kernel, application, and RPC layers.
Innovation Solution
An electronic apparatus and control method that identify structures with function pointers in source code, modify indirect calls using unmodifiable variables to direct calls, preventing control flow attacks across various programming languages without the need for annotations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional devirtualization technique is used to replace indirect calls with direct calls, then security against control flow attacks is improved, but applicability is limited to object-oriented programming languages and requires annotations
Solution Approach 1:
The patent extends the devirtualization technique to work with multiple programming language paradigms including object-oriented, procedural, and functional languages. The system identifies and transforms indirect calls across different language types without requiring language-specific annotations, making the security solution universally applicable to diverse codebases
Solution Approach 2:
The patent extracts the language-specific constraints and annotation requirements from the devirtualization process. By removing the dependency on object-oriented syntax and optional annotations, the core transformation logic can be applied universally across different programming languages through automatic identification of indirect call patterns
2Reliability
If source code is modified to change indirect calls to direct calls, then security is improved, but code structure and flexibility may be worsened
Solution Approach 1:
The patent applies devirtualization selectively at the local level rather than globally. It identifies specific indirect call sites that can be safely transformed and modifies only those locations, preserving the overall code structure and flexibility while improving security at critical points. The transformation is applied locally where beneficial rather than forcing global structural changes
Data Source
AI summary
An electronic apparatus and a control method of the electronic apparatus is provided. The method includes acquiring source code written in a programing language, identifying a structure including a function pointer from the source code, identifying a plurality of initialized variables as a plurality first variables among variables of the function pointer included in the identified structure, and modifying the source code by changing an indirect call using an unmodifiable variable among the plurality of first variables to a direct call.