ROP图灵完备的普遍可实现性

发布时间：2018-06-02 18:42

本文选题：软件漏洞利用 + 返回导向编程　；参考：《软件学报》2017年10期

【摘要】：返回导向编程(return-oriented programming,简称ROP)被广泛用于软件漏洞利用攻击中,用来构造攻击代码.通过更新ROP构造技术,证实了图灵完备的纯ROP攻击代码在软件模块中是普遍可实现的.ROP构造功能代码的难点是实现条件转移逻辑.通过深入分析条件转移机器指令的执行上下文发现,对这些指令的传统认知存在一定的局限性.事实上,在已有代码中存在少量的条件转移指令,它们的两个分支的开始部分都是可复用的代码片段(称为gadgets),而且这两个gadgets会从不同的内存单元中取得下一个gadget的地址,因此,以这些条件转移指令开始的代码片段可以帮助ROP实现条件转移逻辑.把这种代码片段称为if-gadget.在Linux和Windows系统上的实验结果表明,if-gadget普遍存在,即使在代码量很小的日常可执行程序中也存在.在Binutils程序集上的实验结果表明,引入if-gadget后,构造图灵完备的ROP代码要比用传统方法容易得多.在Ubuntu这样的主流操作系统上,由于可执行程序上默认没有实施防御ROP攻击的保护机制,因此,攻击者可以在这些软件模块中构造纯ROP攻击代码来发动攻击.由此可见,ROP对系统安全的威胁比原来认为的严重得多.
[Abstract]:Return-oriented programming (ROP) is widely used to exploit software vulnerabilities and construct attack code. By updating the ROP construction technology, it is proved that Turing's complete pure ROP attack code is generally realizable in the software module. The difficulty of constructing the functional code of .ROP is to implement conditional transfer logic. Through in-depth analysis of the execution context of conditional transfer machine instructions, it is found that the traditional cognition of these instructions is limited. In fact, there are a small number of conditional transfer instructions in existing code, where both branches start with reusable snippets of code called gadgets, and the gadgets takes the address of the next gadget from a different memory unit, so, Code snippets starting with these conditional transfer instructions can help ROP implement conditional transfer logic. This code snippet is called if-gadget. Experimental results on Linux and Windows systems show that if-gadget is ubiquitous, even in daily executable programs with a small amount of code. The experimental results on Binutils assemblies show that it is much easier to construct Turing complete ROP code after the introduction of if-gadget. In mainstream operating systems such as Ubuntu, because there is no protection mechanism against ROP attacks by default on executable programs, attackers can construct pure ROP attack code in these software modules to launch attacks. This shows that ROP is a much more serious threat to system security than previously thought.
【作者单位】：南京大学计算机科学与技术系;计算机软件新技术国家重点实验室(南京大学);
【基金】：国家自然科学基金(61772266,61572248,61431008,61321491) 国家科技支撑计划(2012BAK26B01)~~
【分类号】：TP309;TP311.5

【相似文献】