Ares:一个稳健的实时编译引擎保护系统(英文)  

Ares: a robust protection system for just-in-time engines

作　　者：朱若宇 张玉清[1,2] 燕敬博 

机构地区：[1]西安电子科技大学综合业务网理论及关键技术国家重点实验室,西安710071 [2]中国科学院大学国家计算机网络入侵防范中心,北京100049

出　　处：《中国科学院大学学报（中英文）》2014年第2期267-275,共9页Journal of University of Chinese Academy of Sciences

基　　金：Supported by National Natural Science Foundation of China(61272481);National Natural Science Foundation of Beijing(4122089)

摘　　要：JIT(实时)编译技术可以大大提高代码执行效率.目前大部分浏览器以及Java,Perl,Ruby,Flash都采用JIT技术提高性能.但是,JIT引擎为了达到较高的执行效率,将具有读写可执行权限的对象分配到可预期的偏移位置.这违背了数据执行保护以及随机地址分配的保护措施.我们分析了两个现有的JIT引擎保护工具.基于本文的分析,设计与实现了JIT引擎保护工具Ares.Ares不需要修改JIT引擎源码,使JIT引擎免受现有各种针对JIT引擎的攻击.实验证明其时间与内存开销在可接受范围内.JIT（just-in-time） compilation technique improves the efficiency of code execution. In almost all web browsers as well as Java, Perl, Python, Ruby and Flash, JIT is implemented into their already complex code base. However, for high effectiveness, JIT engines allocate memory with RWX （readable, writable, and executable） permissions to predictable offsets, which goes against DEP （data execution prevention） and ASLR （address space layout randomization）. We first analyze two existed JIT defense tools and show the defects of them. Based on our analysis, we design and implement an approach named Ares to protect JIT engines from normal JIT-based attack without modifying JIT engines＇ source code. Experiments show that our approach guarantees the safety of JIT compilation and the overhead is acceptable.

关 键 词：实时编译引擎 随机地址分配 数据执行保护 防范工具 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]