一种基于表达式树的gadget语义分析技术

doi:10.19678/j.issn.1000-3428.0056671

计算机工程 ›› 2021, Vol. 47 ›› Issue (1): 109-116. doi: 10.19678/j.issn.1000-3428.0056671

一种基于表达式树的gadget语义分析技术

蒋楚, 王永杰

国防科技大学电子对抗学院, 合肥 230037

收稿日期:2019-11-21 修回日期:2019-12-31 发布日期:2020-01-09
作者简介:蒋楚(1995-),男,硕士研究生,主研方向为软件安全;王永杰,副教授。
基金资助:
国家部委基金。

A Technique of gadget Semantic Analysis Based on Expression Tree

JIANG Chu, WANG Yongjie

College of Electronic Countermeasture, National University of Defense Technology, Hefei 230037, China

Received:2019-11-21 Revised:2019-12-31 Published:2020-01-09

摘要/Abstract

摘要： 代码重用攻击的实施过程较为繁杂，通常需要一些工具辅助人工来完成gadget序列的构建，但现有的自动化构建工具效率较低。在分析Ropper、angrop和BOPC等典型开源gadget工具语义分析内容的基础上，总结gadget语义分析应包含的要素，提出一种基于表达式树的gadget语义分析方法。通过表达式树变体描述寄存器和内存读写的表达式信息，提高gadget语义分析的效率。实现一个gadget搜索与语义分析工具SemExpr，针对现有gadget工具难以进行对比分析的问题，设计能对多种gadget工具进行效率和效能分析的实验系统gadgetAnalysis。基于该系统进行实验，结果表明，SemExpr工具能够权衡效率和效能，取得较好的语义分析效果。

关键词: 代码重用攻击, gadget序列自动化构建, 语义分析, 语义摘要, gadget工具

Abstract: Due to the complexity of implementing Code Reuse Attack(CRA),some tools are required to construct the gadget sequence,but the existing automation build tools are inefficient.Based on the semantic analysis of typical open-source gadget tools such as Ropper,angrop and BOPC,this paper abstracts the elements that should be included in the semantic analysis of gadget,and puts forward a kind of semantic analysis method for gadget based on expression tree.The method improves the efficiency of semantic analysis of gadget by using an variant of expression tree to describe the expression information of reading or writing registers and memory.On this basis,a gadget search and semantic analysis tool named SemExpr is implemented.As it is difficult to compare and analyze the existing tools,an experimental system named gadgetAnalysis is designed to analyze and compare the efficiency and performance of several gadget tools.Experimental results shows that SemExpr can balance the efficiency and performance,and achieve excellent semantic analysis effect.

Key words: Code Reuse Attack(CRA), automated gadget sequence generation, semantic analysis, semantic summary, gadget tool

中图分类号:

TP391

蒋楚, 王永杰. 一种基于表达式树的gadget语义分析技术[J]. 计算机工程, 2021, 47(1): 109-116.

JIANG Chu, WANG Yongjie. A Technique of gadget Semantic Analysis Based on Expression Tree[J]. Computer Engineering, 2021, 47(1): 109-116.

https://www.ecice06.com/CN/Y2021/V47/I1/109

图/表 12

20210125163541

20210125163544

20210125163547

20210125163550

20210125163554

20210125163556

20210125163559

20210125163602

20210125163605

20210125163608

20210125163611

20210125163614

参考文献

[1] LÁSZLÓ ERDDI,JSANG A.Exploit prevention,quo vadis?[C]//Proceedings of International Workshop on Security and Trust Management.Washington D.C.,USA:IEEE Press,2017:15-23.
[2] NERGA L.Advanced return-into-lib(c) exploits (PaX case study)[EB/OL].[2019-10-10].http://phrack.org/issues/58/4.html.
[3] SHACHAM H.The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86)[C]//Proceedings of ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2007:552-561.
[4] CHECKOWAY S,SHACHAM H.Escape from return-oriented programming:return-oriented programming without returns (on the x86)[EB/OL].[2019-10-10].https://hovav.net/ucsd/dist/noret.pdf.
[5] SCHWARTZ E J,AVGERINOS T,BRUMLEY D.Q:exploit hardening made easy[C]//Proceedings of USENIX Security Symposium.San Diego,USA:USENIX Association,2011:25-41.
[6] BRUMLEY D,SCHWARTZ E J.BAP:a binary analysis platform[C]//Proceedings of International Conference on Computer Aided Verification.Washington D.C.,USA:IEEE Press,2011:463-469.
[7] FLANAGAN C,SAXE J B.Avoiding exponential explosion[J].ACM SIGPLAN Notices,2001,36(3):193-205.
[8] JAGER I,BRUMLEY D.Efficient directionless weakest preconditions[EB/OL].[2019-10-10].https://www.cylab.cmu.edu/_files/pdfs/tech_reports/CMUCyLab 10002.pdf.
[9] DIJKSTRA E.Dijkstra on hamming's problem[M].Berlin,Germany:Springer,1976.
[10] HEITMAN C.BARF:a multiplatform open source binary analysis and reverse engineering framework[EB/OL].[2019-10-10].https://raw.githubusercontent.com/programa-stic/barf-project/master/doc/papers/barf.pdf.
[11] FOLLNER A,BARTEL A,PENG H,et al.PSHAPE:automatically combining gadgets for arbitrary method execution[C]//Proceedings of International Workshop on Security and Trust Management.Washington D.C.,USA:IEEE Press,2016:212-228.
[12] BOYAN-MILANOV.ROPgenerator[EB/OL].[2019-10-10].https://github.com/Boyan-MILANOV/ropgenerator.
[13] ISPOGLOU K K,ALBASSAM B,JAEGER T,et al.Block oriented programming:automating data-only attacks[C]//Proceedings of 2018 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2018:1868-1882.
[14] SNOW K Z,MONROSE F,DAVI L,et al.Just-in-time code reuse:on the effectiveness of fine-grained address space layout randomization[C]//Proceedings of 2013 IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2013:574-588.
[15] BLETSCH T,JIANG X,FREEH V W,et al.Jump-oriented programming:a new class of code-reuse attack[C]//Proceedings of the 6th ACM Symposium on Information,Computer and Communications Security.New York,USA:ACM Press,2011:30-40.
[16] CHECKOWAY S,DAVI L,DMITRIENKO A,et al.Return-oriented programming without returns[C]//Proceedings of the 17th ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2010:559-572.
[17] SADEGHI A,NIKSEFAT S,ROSTAMIPOUR M.Pure-Call Oriented Programming (PCOP):chaining the gadgets using call instructions[J].Journal of Computer Virology and Hacking Techniques,2018,14(2):139-156.
[18] DULLIEN T,PORST S.REIL:a platform-independent intermediate representation of disassembled code for static code analysis[EB/OL].[2019-10-10].http://www.zynamics.com/downloads/csw09.pdf.
[19] NETHERCOTE N,SEWARD J.Valgrind:a framework for heavyweight dynamic binary instrumentation[J].ACM SIGPLAN Notices,2007,42(6):89-90.
[20] SALWAN J.ROPgadget[EB/OL].[2019-10-10].https://github.com/JonathanSalwan/ROPgadget.

选择文件类型/文献管理软件名称

选择包含的内容

一种基于表达式树的gadget语义分析技术

A Technique of gadget Semantic Analysis Based on Expression Tree

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 12

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	何本伟, 郭云飞, 梁浩, 王庆丰. 面向二进制代码的细粒度软件多样化方法[J]. 计算机工程, 2024, 50(1): 138-144.
[2]	柔特, 色差甲, 才让加. 藏文句义分割方法[J]. 计算机工程, 2020, 46(2): 286-291.
[3]	柴强,李军辉,孔芳,周国栋. 多语言输入的神经语义分析方法研究[J]. 计算机工程, 2019, 45(3): 169-174.
[4]	李扬, 戴紫彬, 李军伟. 面向RISC处理器的控制流认证方案[J]. 计算机工程, 2019, 45(12): 134-140,146.
[5]	梁艳红, 坎启轩, 苏翌. 基于主题分布优化的模糊文本分类研究[J]. 计算机工程, 2019, 45(10): 221-226.
[6]	杨海彤. 基于图模型的中文多谓词语义角色标注方法[J]. 计算机工程, 2019, 45(1): 172-177.
[7]	欧阳,罗建桥,李柏林,李爽. 嵌入标记信息的铁路扣件状态检测主题模型[J]. 计算机工程, 2018, 44(6): 200-206.
[8]	明拓思宇,陈鸿昶,黄瑞阳,柳杨. 基于加权AMR图的语义子图预测摘要算法[J]. 计算机工程, 2018, 44(10): 292-297,302.
[9]	徐东,狄效国,孟宇龙,冯晓宁. 基于依赖图等价代换的SSDG构建算法[J]. 计算机工程, 2015, 41(12): 91-95,100.
[10]	李志欣, 施智平, 陈宏朝, 吴璟莉. 基于语义学习的图像多模态检索[J]. 计算机工程, 2013, 39(3): 258-263.
[11]	向河林, 张明西, 李珀瀚, 何震瀛, 汪卫. 一种基于聚类的语义检索算法[J]. 计算机工程, 2012, 38(2): 36-38.
[12]	任姚鹏, 陈立潮, 张英俊, 谢斌红. 基于潜在语义分析的构件聚类改进方法[J]. 计算机工程, 2011, 37(4): 67-69.
[13]	陈燕, 龙建勋. 基于明确语义分析的自动文摘算法[J]. 计算机工程, 2011, 37(3): 183-185.
[14]	张成, 曲明成, 倪宁, 仇光, 卜佳俊. 基于概率潜在语义分析模型的自动答案选择[J]. 计算机工程, 2011, 37(14): 70-72.
[15]	王卫国, 徐炜民. 基于潜在语义分析的个性化查询扩展模型[J]. 计算机工程, 2010, 36(21): 43-45.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

一种基于表达式树的gadget语义分析技术

A Technique of gadget Semantic Analysis Based on Expression Tree

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 12

参考文献

相关文章 15

编辑推荐

Metrics

本文评价