代码复用攻防技术演化综述  

Survey on Code Reuse Attack and Defense Technology Evolution

作　　者：詹静 陈鹏 张茜 李永震 赵勇 ZHAN Jing;CHEN Peng;ZHANG Qian;LI Yongzhen;ZHAO Yong(Faculty of Information Technology,Beijing University of Technology,Beijing 100124,China;Beijing Key Laboratory of Trusted Computing,Beijing 100124,China)

机构地区：[1]北京工业大学信息学部,北京100124 [2]可信计算北京市重点实验室,北京100124

出　　处：《北京工业大学学报》2024年第5期632-650,共19页Journal of Beijing University of Technology

基　　金：国家重点研发计划资助项目(2016YFB0800204)。

摘　　要：当前代码复用攻击研究多从一种或多种代码复用攻击或防御技术角度进行现状和趋势分析,对影响攻防的关键特征及技术覆盖不全面,对攻防技术对抗演化发展规律分析较少。为解决上述问题,从经典代码复用攻击——返回导向编程(return-oriented programming,ROP)攻击的生命周期入手,归纳影响此类攻击成功与否的关键特征,基于时间线和这些特征,综合衡量安全和性能因素,给出了代码复用攻防技术的发展规律。Most current surveys on code reuse attack conclude the status quo and trends from the perspective of one or several attack or defense technologies,lacking analysis of key features related to the attack or defense affects.To solve the above problems,the key characteristics that affect the results of classic code reuse attack were summarized,starting from the life cycle of the classic code reuse attack,i.e.,return-oriented programing(ROP)attack.Based on the technology developing timeline and these characteristics,security and performance factors were comprehensively measured,and development rules and trends of code reuse attack and defense confrontation technologies were analyzed and summarized.

关 键 词：程序安全 代码复用攻击 攻防技术演化 指令结构特征 地址随机化 运行代码特征 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]