ROP攻击原理与检测方法研究  

Research on the Principle and Detection Method of Return-Oriented Programming Attack

作　　者：乔延松 杜皓睿 赵绪营 QIAO Yansong;DU Haorui;ZHAO Xuying(Beijing Electronic Science and Technology Institute,Beijing 100070,P.R.China)

机构地区：[1]北京电子科技学院,北京市100070

出　　处：《北京电子科技学院学报》2021年第4期51-56,共6页Journal of Beijing Electronic Science And Technology Institute

摘　　要：本文介绍了一种经典的利用缓冲区溢出漏洞的攻击方法—ROP(Return-Oriented Programming)。详细描述了ROP攻击方法的思想和原理,并和以前的漏洞攻击方法进行比较,给出了他们之间的区别和联系。罗列了目前发现的一些可以结合ROP进行攻击的漏洞,并作了简单描述。相对应的,根据ROP攻击的特征,有针对性地给出静态的和动态的检测方法。最后通过实验方式展现了ROP攻击过程。In this paper, the ROP(Return-Oriented Programming) is introduced, which is a classical method exploiting the buffer overflow vulnerabilities. The idea and principle of the ROP attack method are described in detail. After comparisons, the distinctions and connections between the ROP method and previous vulnerability attack methods are given. Some heretofore discovered vulnerabilities with the possibility of being attacked with the ROP are listed and briefly descripted. Correspondingly, targeted static and dynamic detection methods are given according to the characteristics of the ROP attack. Finally, an ROP attack process is implemented experimentally.

关 键 词：缓冲区溢出 ROP攻击 检测 漏洞 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]