Research on Windows memory protection mechanism

Ting-ting LU; Jun-feng WANG

doi:10.11959/j.issn.2096-109x.2017.00208

您当前的位置：

首页 >

文章列表页 >

Research on Windows memory protection mechanism

Comprehensive Reviews | 更新时间：2024-06-03

- Research on Windows memory protection mechanism
- Chinese Journal of Network and Information Security Vol. 3, Issue 10, Pages: 1-15(2017)
- 作者机构：
  
  1. 四川大学计算机学院，四川成都 610065
  2. 四川大学空天科学与工程学院，四川成都 610065
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00208
  CLC： TP309
- Online First：2017-10，
  
  Published：15 October 2017
- 稿件说明：
移动端阅览
Ting-ting LU, Jun-feng WANG. Research on Windows memory protection mechanism[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 1-15.
DOI：

Ting-ting LU, Jun-feng WANG. Research on Windows memory protection mechanism[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 1-15. DOI： 10.11959/j.issn.2096-109x.2017.00208.

摘要

近30年来，攻击者利用Windows内存漏洞发起的攻击事件层出不穷，其惯用手段是攻击控制数据以劫持执行流。为此，微软在Windows上加注了层层防护以遏止此类攻击，但现阶段部署的防护机制无法阻止针对非控制数据的攻击。鉴于目前研究Windows内存防护机制的文献寥寥无几，对Windows采用的各种内存防护机制及其突破技术进行了深入研究，并详述非控制数据防护的研究现状，在此基础上，分析了Windows内存防护面临的挑战，并讨论了内存防护的未来之路。

Abstract

Over the past three decades

attacks exploiting Windows memory holes have emerged in an endless stream

and the usual means is to attack control-data to hijack the execution flow of the program.To this end

Microsoft has added layers of protection mechanisms to Windows to prevent such attacks.But at this stage

the defensive mechanisms deployed on Windows cannot prevent attacks against non-control-data.In view of the published articles lacking comprehensive study of Windows memory protection mechanism

a detailed introduction to Windows memory protection mechanism and its breakthrough techniques

and non-control-data protection research status was conducted.On this basis

the challenges of Windows memory protection were analyzed and the future of memory protection was discussed.

关键词

Keywords

references

Morris worm [EB/OL ] . https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm .

DURUMERIC Z , LI F , KASTEN J , et al . The matter of heartbleed [C ] // 2014 Conference on Internet Measurement . 2014 : 475 - 488 .

ZATKO P . How to write buffer overflows [EB/OL ] . http://insecure.org/stf/mudge_buffer_overflow_tutorial.html http://insecure.org/stf/mudge_buffer_overflow_tutorial.html .

HOGLUND G . Advanced buffer overflow technique [EB/OL ] . http://www.blackhat.com/presentations/bh-asia-00/greg/greg-asia-0 0-stalking.ppt http://www.blackhat.com/presentations/bh-asia-00/greg/greg-asia-0 0-stalking.ppt .

ABADI M , BUDIU M , ERLINGSSON U , et al . Control-flow integrity [C ] // The 12th ACM Conference on Computer and Communications Security . 2005 : 340 - 353 .

KUZNETSOV V , SZEKERES L , PAYER M , et al . Code-pointer integrity [C ] // The 11th USENIX Symposium on Operating Systems Design and Implementation . 2014 : 147 - 163 .

CHEN S , XU J , SEZER E C , et al . Non-control-data attacks are realistic threats [C ] // The 14th USENIX Security Symposium . 2005 : 177 - 191 .

CARR S A , PAYER M . DataShield:configurable data confidentiality and integrity [C ] // 2017 ACM on Asia Conference on Computer and Communications Security . 2017 : 193 - 204 .

CASTRO M , COSTA M , HARRIS T . Securing software by enforcing data-flow integrity [C ] // The 7th USENIX Symposium on Operating Systems Design and Implementation . 2006 : 147 - 160 .

BHATKAR S , SEKAR R . Data space randomization [C ] // The 5th International Conference on Detection of Intrusion and Malware,and Vulnerability Assessment . 2008 : 1 - 22 .

Usage share of operating systems [EB/OL ] . https://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Desktop_and_laptop_computers https://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Desktop_and_laptop_computers .

ANDERSEN S . Memory protection technologies [EB/OL ] . https://technet.microsoft.com/en-us/library/bb457155(d=printer).aspx https://technet.microsoft.com/en-us/library/bb457155(d=printer).aspx .

Control flow guard [EB/OL ] . https://msdn.microsoft.com/library/Windows/desktop/mt637065(v=vs.85).aspx https://msdn.microsoft.com/library/Windows/desktop/mt637065(v=vs.85).aspx .

COWAN C , PU C , MAIER D , et al . StackGuard:automatic adaptive detection and prevention of buffer-overflow attacks [C ] // The 7th USENIX Security Symposium . 1998 : 63 - 77 .

GS compiler option documentation for Visual Studio 2003 [EB/OL ] . https://msdn.microsoft.com/en-us/library/8dbf701c(v=vs.71).aspx https://msdn.microsoft.com/en-us/library/8dbf701c(v=vs.71).aspx .

RICHARTE G . Four different tricks to bypass StackShield and StackGuard protection [EB/OL ] . https://www.cs.purdue.edu/homes/xyzhang/fall07/Papers/defeat-stackguard.pdf https://www.cs.purdue.edu/homes/xyzhang/fall07/Papers/defeat-stackguard.pdf .

strict_gs_check pragma documentation for Visual Studio 2005 [EB/OL ] . https://msdn.microsoft.com/en-us/library/bb507721 (v=vs.80).aspx https://msdn.microsoft.com/en-us/library/bb507721 (v=vs.80).aspx .

LITCHFIELD D . Defeating the stack based buffer overflow prevention mechanism of Microsoft Windows 2003 server [EB/OL ] . http://www.blackhat.com/presentations/bh-federal-03/bh-fed-03-litc hfield.pdf http://www.blackhat.com/presentations/bh-federal-03/bh-fed-03-litc hfield.pdf .

PIETREK M . A crash course on the depths of Win32 structured exception handling [EB/OL ] . https://www.microsoft.com/msj/0197/exception/exception.aspx https://www.microsoft.com/msj/0197/exception/exception.aspx .

SAFESEH linker option documentation for Visual Studio 2003 [EB/OL ] . https://msdn.microsoft.com/en-us/library/9a89h429 (v=vs.71).aspx https://msdn.microsoft.com/en-us/library/9a89h429 (v=vs.71).aspx .

Preventing the exploitation of structured exception handler (SEH) overwrites with SEHOP [EB/OL ] . https://blogs.technet.microsoft.com/srd/2009/02/02/preventing-the-exploitation-of-structured-exce ption-hander-seh-overwrites-with-sehop/ https://blogs.technet.microsoft.com/srd/2009/02/02/preventing-the-exploitation-of-structured-exce ption-hander-seh-overwrites-with-sehop/ .

Miller M . Preventing the exploitation of SEH overwrites [EB/OL ] . http://www.uninformed.org/?v=5＆a =2＆t=pdf http://www.uninformed.org/?v=5＆a =2＆t=pdf .

BERRE S L , CAUQUIL D . Bypassing SEHOP [EB/OL ] . https://repo.zenk-security.com/Reversing%20.%20cracking/Bypassi ng%20SEHOP.pdf https://repo.zenk-security.com/Reversing%20.%20cracking/Bypassi ng%20SEHOP.pdf .

SOTIROV A , DOWD M . Bypassing browser memory protections [EB/OL ] . http://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf http://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf .

SHACHAM H , . The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86) [C ] // The 14th ACM CCS . 2007 : 552 - 561 .

BUCHANAN E , ROEMER R , SAVAGE S , et al . Return-oriented programming:exploitation without code Injection [EB/OL ] . http://www.blackhat.com/presentations/bh-usa-08/Shacham/BH_US_08_Shacham_Return_Oriented_Programming.pdf http://www.blackhat.com/presentations/bh-usa-08/Shacham/BH_US_08_Shacham_Return_Oriented_Programming.pdf .

Bypassing Windows hardware-enforced data execution prevention [EB/OL ] . http://www.uninformed.org/?v=2＆a=4＆t=pdf http://www.uninformed.org/?v=2＆a=4＆t=pdf .

PaX ASLR [EB/OL ] . http://pax.grsecurity.net/docs/aslr.txt http://pax.grsecurity.net/docs/aslr.txt .

WHITEHOUSE O . An analysis of address space layout randomization on Windows VistaTM [EB/OL ] . http://www.symantec.com/ avcenter/reference/Address_Space_Layout_Randomization.pdf http://www.symantec.com/ avcenter/reference/Address_Space_Layout_Randomization.pdf .

SOTIROV A . Windows ANI header buffer overflow [EB/OL ] . http://www.phreedom.org/research/vulner-abilities/ani-header/ http://www.phreedom.org/research/vulner-abilities/ani-header/ .

Heap spraying [EB/OL ] . https://en.wikipedia.org/wiki/Heap_spraying# cite_note-8 https://en.wikipedia.org/wiki/Heap_spraying# cite_note-8 .

Guard compiler option documentation for Visual Studio 2015 [EB/OL ] . https://msdn.microsoft.com/en-us/library/8dbf701c (v=vs.71).aspx https://msdn.microsoft.com/en-us/library/8dbf701c (v=vs.71).aspx .

TANG J . Exploring control flow guard in Windows 10 [EB/OL ] . http://sjc1-te-ftp.trendmicro.com/assets/wp/exploring-control-flowguard-in-Windows10.pdf http://sjc1-te-ftp.trendmicro.com/assets/wp/exploring-control-flowguard-in-Windows10.pdf .

THEORI.Chakra jit cfg bypass [EB/OL ] . http://theori.io/research/chakra-jit-cfg-bypass http://theori.io/research/chakra-jit-cfg-bypass .

SUN K , OU Y , ZHAO Y H , et al . Never let your guard down:finding unguarded gates toby-pass control flow guard with big data [EB/OL ] . https://www.blackhat.com/docs/asia-17/materials/asia-1 7-Sun-Never-Let-Your-Guard-Down-Finding-Unguarded-Gates-ToBypass-Control-Flow-Guard-With-Big-Data.pdf https://www.blackhat.com/docs/asia-17/materials/asia-1 7-Sun-Never-Let-Your-Guard-Down-Finding-Unguarded-Gates-ToBypass-Control-Flow-Guard-With-Big-Data.pdf .

Return flow guard [EB/OL ] . http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ .

Mitigate threats by using Windows 10 security features [EB/OL ] . https://docs.microsoft.com/en-us/Windows/threat-protection/overvi ew-of-threat-mitigations-in-Windows-10 https://docs.microsoft.com/en-us/Windows/threat-protection/overvi ew-of-threat-mitigations-in-Windows-10 .

HU H , CHUA Z L , ADRIAN S , et al . Automatic generation of data-oriented exploits [C ] // The 24th USENIX Security Symposium . 2015 : 177 - 192 .

HU H , SHINDE S , ADRIAN S , et al . Data-oriented programming:on the expressiveness of non-control data attacks [C ] // 2016 IEEE Symposium on Security and Privacy . 2016 : 969 - 986 .

AKRITIDIS P , CADAR C , RAICIU C , et al . Preventing memory error exploits with WIT [C ] // 2008 IEEE Symposium on Security and privacy . 2008 : 263 - 277 .

SUH G E , LEE J W , ZHANG D , et al . Secure program execution via dynamic information flow tracking [C ] // The 11th International Conference on Architectural Support for Programming Languages and Operating Systems . 2004 : 85 - 96 .

CHEN S , XU J , NAKKA N , et al . Defeating memory corruption attacks via pointer taintedness detection [C ] // 2005 International Conference on Dependable Systems and Networks . 2005 : 378 - 387 .

BARRANTES E G , ACKLEY D , PALMER T S , et al . Randomized instruction set emulation to disrupt binary code injection attacks [C ] // The 10th ACM Conference on Computer and Communications Security . 2003 : 281 - 289 .

KC G S , KEROMYTIS A D , PREVELAKIS V . Countering code injection attacks with instruction-set randomization [C ] // The 10th ACM Conference on Computer and Communications Security . 2003 : 272 - 280 .

STEENSGAARD B , . Points-to analysis in almost linear time [C ] // The 23rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages . 1996 : 32 - 41 .

DEMAY J C , TOTEL E , TRONEL R . SIDAN:a tool dedicated to software instrumentation for detecting attacks on non-control- data [C ] // 2009 Fourth International Conference on Risks and Security of Internet and Systems . 2009 : 51 - 58 .

ACKER S V , NIKIFORAKIS N , PHILIPPAERTS P , et al . Valueguard:protection of native applications against data-only buffer overflows [C ] // The 6th International Conference on Information Systems Security . 2010 : 156 - 170 .

DING R , QIAN C X , SONG C Y , et al . Efficient protection of path-sensitive control security [C ] // The 26th USENIX Security Symposium . 2017 : 131 - 148 .

VEEN V V D , ANDRIESSE D , GöKTAS E , et al . Practical context-sensitive CFI [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 927 - 940 .

GÖKTAS E , ATHANASOPOULOS E , BOS H , et al . Out of control:overcoming control-flow integrity [C ] // 2014 IEEE Symposium on Security and Privacy . 2014 : 575 - 589 .

Views

4517

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰