一种基于表达式树的gadget语义分析技术  

A Technique of gadget Semantic Analysis Based on Expression Tree

作　　者：蒋楚 王永杰 JIANG Chu;WANG Yongjie(College of Electronic Countermeasture,National University of Defense Technology,Hefei 230037,China)

机构地区：[1]国防科技大学电子对抗学院,合肥230037

出　　处：《计算机工程》2021年第1期109-116,共8页Computer Engineering

基　　金：国家部委基金。

摘　　要：代码重用攻击的实施过程较为繁杂,通常需要一些工具辅助人工来完成gadget序列的构建,但现有的自动化构建工具效率较低。在分析Ropper、angrop和BOPC等典型开源gadget工具语义分析内容的基础上,总结gadget语义分析应包含的要素,提出一种基于表达式树的gadget语义分析方法。通过表达式树变体描述寄存器和内存读写的表达式信息,提高gadget语义分析的效率。实现一个gadget搜索与语义分析工具SemExpr,针对现有gadget工具难以进行对比分析的问题,设计能对多种gadget工具进行效率和效能分析的实验系统gadgetAnalysis。基于该系统进行实验,结果表明,SemExpr工具能够权衡效率和效能,取得较好的语义分析效果。Due to the complexity of implementing Code Reuse Attack(CRA),some tools are required to construct the gadget sequence,but the existing automation build tools are inefficient.Based on the semantic analysis of typical opensource gadget tools such as Ropper,angrop and BOPC,this paper abstracts the elements that should be included in the semantic analysis of gadget,and puts forward a kind of semantic analysis method for gadget based on expression tree.The method improves the efficiency of semantic analysis of gadget by using an variant of expression tree to describe the expression information of reading or writing registers and memory.On this basis,a gadget search and semantic analysis tool named SemExpr is implemented.As it is difficult to compare and analyze the existing tools,an experimental system named gadgetAnalysis is designed to analyze and compare the efficiency and performance of several gadget tools.Experimental results shows that SemExpr can balance the efficiency and performance,and achieve excellent semantic analysis effect.

关 键 词：代码重用攻击 gadget序列自动化构建 语义分析 语义摘要 gadget工具 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]