基于Return-Oriented Programming的程序攻击与防护  

Program Attack and Protection Based on Return-Oriented Programming

作　　者：黄志军[1] 郑滔[1] 

机构地区：[1]南京大学软件学院,南京210093

出　　处：《计算机科学》2012年第B06期1-5,23,共6页Computer Science

基　　金：国家自然科学基金项目(60773171);国家"863"计划基金重点项目(2007AA01Z448)资助

摘　　要：随着W⊕X等技术的引入,传统的代码注入攻击几乎被消除,return-to-lib攻击受到很大程度的抑制。在此背景下,Hovav Shacham提出了Return-Oriented Programming(ROP)的思想,该思想基于栈溢出的原理,通过使用程序库中有效的以ret指令结尾的短指令序列构建gadget集合,使之具有图灵完备特性,来完成计算和攻击。讲述ROP思想自提出以来的一些研究成果和其实际的攻击能力,阐述ROP自动化的当前成果与未来可能的发展方向,进而分析和预测ROP自动化的下一步的研究方向。同时,也将从ROP的几个特征分析消除这种攻击的策略和方法,并介绍目前已有的防护思想和成果,论述这些方法的优缺点和改进方向。综合阐述ROP攻击与ROP防护这一矛与盾的问题,力争使读者理解ROP的思想,知悉当前的发展状态,并在此基础上能够进一步推进ROP攻击及其防范的研究。With the adoption of W⊕X technology,the traditional code injection attacks have been almost eliminated,so the return-to-lib attack has been greatly restrained.Under this circumstance,Doc.Hovav Shacham promoted the ROP idea,which is short for Return-Oriented Programming.Based on the theory of stack overflow,making using of the valid short instruction sequences that end with ret instructions to construct gadget collections with Turning-Complete features,the ROP idea can accomplish the task of compute and attack.In this paper,we presented achievements in ROP field and ROP’s ability of attack since its promotion,and then illustrated the direction for development of the automation of ROP attack and its current achievements,after that,analyzed and predicted the future development of ROP automation.Simultaneously,we discussed strategies and methods aiming at eliminating this attack based on its characteristics,introduced exisiting achievements of defending this attack by comparing their merits and demerits,gave our own perspectives of these defending strategies and methods about how to change and improve them.

关 键 词：ROP 程序自动化 地址随机化 栈溢出 程序控制流 程序安全 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]