基于函数注入的沙箱拦截识别方法  

Sandbox-interception Recognition Method Based on Function Injection

作　　者：赵旭[1,2] 颜学雄[1,2] 王清贤[1,2] 魏强[1,2] 

机构地区：[1]解放军信息工程大学,郑州450002 [2]数学工程与先进计算国家重点实验室,郑州450002

出　　处：《电子与信息学报》2016年第7期1823-1830,共8页Journal of Electronics & Information Technology

基　　金：国家863计划项目(2012AA012902)~~

摘　　要：沙箱验证机制的测试需要首先识别沙箱拦截,即识别沙箱截获的系统函数集。已有的Hook识别方法大多仅关注钩子的存在性,识别沙箱拦截的能力不足。该文设计了一种基于函数注入的沙箱拦截识别方法,该方法分析系统函数的指令执行记录(Trace)来识别沙箱截获的系统函数。首先,向不可信进程注入并执行系统函数来获取函数的执行记录;其次,根据沙箱截获系统函数执行记录的特点,设计了地址空间有限状态自动机,并在自动机内分析获取的执行记录来判别沙箱截获的系统函数;最后,遍历测试函数集来识别目标沙箱截获的系统函数集。该文设计实现了原型系统SIAnalyzer,并对Chromium和Adobe Reader进行了沙箱拦截识别测试,测试结果验证了方法的有效性和实用性。Testing sandbox authentication mechanism needs to recognize the sandbox interception first, i.e. to recognize the intercepted system function sets by the sandbox. Existing Hook recognition methods and tools mainly focus on the existence of the hook, lacking the ability of recognizing sandbox interception. This study proposes a sandbox interception recognition method based on function injection. The method recognizes the sandbox intercepts testing functions by analyzing the trace of system functions. First, the method injects and executes the system functions in untrusted process to record the function trace. Then, according to the features of intercepted system function trace, the paper designs the address space finite state automata and identifies intercepted system functions by analyzing the trace. Next, the function sets are traversed to identify the intercepted system function sets by target sandbox. Finally, a prototype is implemented—SIAnalyzer, and tested with Chromium Sandbox and Adobe Reader Sandbox. Results show the method proposed is effective and practical.

关 键 词：沙箱拦截 系统函数集 钩子 函数注入 自动机 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论]