二进制程序整型符号转换缺陷的动态检测方法  

Dynamic detection approach for integer sign conversion in binary programs

作　　者：朱雪梅[1] 王兴起[1] 方景龙[1] 王大全[1] 

机构地区：[1]杭州电子科技大学计算机学院,杭州310018

出　　处：《计算机工程与应用》2015年第18期56-61,共6页Computer Engineering and Applications

基　　金：国家部委基础科研重点项目;国家部委技术基础科研项目

摘　　要：针对符号转换错误引起缓冲区溢出的这类缺陷提出了一种面向二进制程序整型符号转换缺陷检测方法。以二进制插桩框架为基础,利用类型推断方法识别整型变量的符号类型信息,得到内存相关库函数中为冲突类型的参数的集合,并将其作为潜在的整型符号转换缺陷候选集。在中间代码层面插入检测代码做运行时检测,最终确定真正的整型符号转换缺陷。原型系统Sconvcheck的实验结果表明:该方法可以有效地检测出程序中的整型符号转换缺陷,并准确地定位错误发生的位置,而且误报率较低。For the integer sign conversion faults, which result in buffer overflow vulnerabilities, an approach to detect integer sign conversion faults in binary programs dynamically is presented. Type inference method, based on a framework for binary instrumentation, is used to identify the sign information of integer variables. Then, a set of parameters are obtained,which have a conflict type in memory-related library functions, and are taken as candidate set of potential integer sign conversion faults. The test is run after inserting detection code on the level of intermediate representation to determine the real integer sign conversion faults. The experimental results on Sconvcheck show that this method can effectively detect integer sign conversion faults in binary programs and accurately locate the position the faults have occurred with a lower rate of false positives.

关 键 词：整数符号转换缺陷 类型推断 冲突类型 二进制程序 中间代码 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]