基于指针时空分析的软件异常可利用性判定  

Exploitable inference based on space-time analysis of pointers

作　　者：彭建山[1] 王清贤[1] 欧阳永基[1] 

机构地区：[1]解放军信息工程大学数学工程与先进计算国家重点实验室,郑州450002

出　　处：《计算机应用研究》2016年第5期1504-1508,共5页Application Research of Computers

基　　金：国家"863"计划资助项目(2012AA012902)

摘　　要：软件异常的可利用性是评估漏洞威胁等级的重要指标。针对目前二进制程序异常可利用性判定方法存在检测模式少、分析深度和精度不足、准确率低的问题,通过分析多重指针的时空局部有效性,利用独立可控数据的内存布局构造从异常指令到跳转指令的指针引用路径,能够快速收敛搜索域,提高控制流劫持成功率和判定准确率。实验结果表明,该方法适用于栈溢出、堆溢出、整型溢出导致覆盖返回地址、函数指针等模式,具有较高的准确率和较小的性能开销。Whether exception can be exploitable is important to evaluate threaten level of vulnerability. There are some problems in the current automation exploitable inference methods for binary program： lack of exploiting model,or less depth and precision in analysis. These problems result in a high rate of false positives and false negatives. To reduce searching range in memory and improve the exploitable rate,this paper researched local effectiveness of space-time of multiple pointers,used the independent controllable data to construct the path from the exception instruction to a jump instruction. The test results show that,this method is applicable to the stack overflow,heap overflow and integer overflow caused by the return address and function pointer rewriting. Its accuracy and time performance are better than similar tools.

关 键 词：可利用性判定 污点分析 控制流劫持 多重指针引用 

分 类 号：TP311.53[自动化与计算机技术—计算机软件与理论]