基于符号执行的异常处理结构体覆写攻击自动检测方法  

Automatic detection of structure exception handler overwritten based on symbolic execution

作　　者：黄宁 黄曙光 黄钊 HUANG Ning;HUANG Shu-guang;HUANG Zhao(College of Electronic Countermeasure,National University of Defense Technology,Hefei 230037,China)

机构地区：[1]国防科技大学电子对抗学院,合肥230037

出　　处：《吉林大学学报（工学版）》2020年第3期1024-1030,共7页Journal of Jilin University:Engineering and Technology Edition

基　　金：国家重点研发计划项目(2017YFB0802905).

摘　　要：已有的面向控制流劫持的漏洞自动分析技术缺乏对S.E.H攻击的研究,导致分析结果的准确性不高。为此,本文提出了一种基于符号执行的S.E.H覆写攻击自动检测方法。该方法通过定位目标异常处理函数在内存中的位置,分析覆盖异常处理函数指针的程序控制流和数据流依赖条件,建立异常处理函数劫持的约束。通过约束求解实现S.E.H覆写攻击的自动检测,生成可触发S.E.H攻击的测试用例。实验结果表明,该方法能有效分析程序漏洞是否满足S.E.H攻击条件。Existed technologies of automatic detection of control-flow hijacking vulnerability do not study the conditions of Structure Exception Handler(S.E.H)overwritten,which lead to the low accuracy of their analysis results.In order to solve this problem,this paper proposes a method for automatic detection of S.E.H overwritten based on control-flow hijack.In this method,first the address of exceptional function pointers is located.Then,the control-flow and data-flow conditions of S.E.H overwritten are analyzed,and the constraints of S.E.H overwritten are constructed.Finally,s implemented and the test case is generated by solving the constraints.Experimental results show that our method is able to analyze whether the vulnerability satisfies the conditions of S.E.H overwritten effectively.

关 键 词：计算机应用 异常处理结构体 缓冲区溢出 符号执行 控制流劫持 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论]