基于二进制重写的软件多样化方法

何本伟; 郭云飞; 王亚文; 王庆丰; 扈红超

doi:10.11959/j.issn.2096-109x.2023024

您当前的位置：

首页 >

文章列表页 >

基于二进制重写的软件多样化方法

学术论文 | 更新时间：2024-06-03

- 基于二进制重写的软件多样化方法
- Software diversification method based on binary rewriting
- 网络与信息安全学报 2023年9卷第2期页码：94-103
- 作者机构：
- 作者简介：
  
  [ "何本伟（1998- ），男，安徽滁州人，信息工程大学硕士生，主要研究方向为网络空间安全和软件多样化" ]
  [ "郭云飞（1963- ），男，河南郑州人，信息工程大学教授、博士生导师，主要研究方向为网络空间安全、云安全和电信网安全" ]
  [ "王亚文（1990- ），男，河南郑州人，信息工程大学助理研究员，主要研究方向为拟态防御和云计算" ]
  [ "王庆丰（1995- ），男，河南周口人，信息工程大学助理研究员，主要研究方向为拟态防御和软件多样化" ]
  [ "扈红超（1982- ），男，河南商丘人，信息工程大学研究员，主要研究方向为云计算和网络安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB1006200);国家重点研发计划;The National Key R＆D Program of China(2021YFB1006201);国家自然科学基金;The National Natural Science Foundation of China(62072467)
- DOI：10.11959/j.issn.2096-109x.2023024
  中图分类号： TP311.5
- 网络首发：2023-04，
  
  纸质出版：2023-04-25
- 稿件说明：
移动端阅览
何本伟, 郭云飞, 王亚文, 等. 基于二进制重写的软件多样化方法[J]. 网络与信息安全学报, 2023,9(2):94-103.

Benwei HE, Yunfei GUO, Yawen WANG, et al. Software diversification method based on binary rewriting[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 94-103.
何本伟, 郭云飞, 王亚文, 等. 基于二进制重写的软件多样化方法[J]. 网络与信息安全学报, 2023,9(2):94-103. DOI： 10.11959/j.issn.2096-109x.2023024.

Benwei HE, Yunfei GUO, Yawen WANG, et al. Software diversification method based on binary rewriting[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 94-103. DOI： 10.11959/j.issn.2096-109x.2023024.

摘要

软件多样化是应对代码重用攻击的有效方法，但现有软件多样化技术大多基于源代码实现，相比二进制文件，程序源代码并不容易获得。二进制文件难以做到精准拆卸、区分代码指针和数据常量，使得对二进制文件的多样化转换有限，难以产生足够高的随机化熵，容易被攻击者暴力破解。针对此问题，提出一种面向二进制文件的软件多样化方法，指令偏移随机化，该方法基于静态二进制重写技术在程序指令前以一定概率插入不同字节长度的无操作（NOP）指令，不仅能够减少程序中非预期的gadget数量，还使原指令地址发生随机偏移，打乱程序原有的内存布局，增加了代码重用攻击的成本。同时，针对所提方法设计了基于“热”代码的优化策略，通过动态插桩获得二进制文件中基本块的执行次数，以此调整每个基本块中NOP指令的插入概率，在执行频率更高的基本块中插入更少的NOP指令，可以保证较低性能开销的同时产生更高的随机化熵。实验部分使用SPEC基准测试程序，从性能开销、gadget存活率、文件大小等角度对优化后的方法进行实例测试，结果表明：当插入概率为 15%时效果最好，程序中 gadget 平均存活率趋于稳定且小于1.49%，增加攻击者重复利用相同gadget攻击链攻击难度的同时，该安全性下仅额外增加了4.1%的运行开销和7.7%的文件膨胀率。

Abstract

Software diversity is an effective defense against code-reuse attacks

but most existing software diversification technologies are based on source code.Obtaining program source code may be difficult

while binary files are challenging to disassemble accurately and distinguish between code pointers and data constants.This makes binary file diversification difficult to generate high levels of randomization entropy

and easily compromised by attackers.To overcome these challenges

a binary file oriented software diversification method was proposed based on static binary rewriting technology

namely instruction offset randomization.This method inserted NOP instructions of varying byte lengths before program instructions with a certain probability

reducing the number of unintended gadgets in the program and randomly offsetting the original instruction address.This disrupts the program’s original memory layout and increases the cost of code-reuse attacks.At the same time

an optimization strategy based on hot code was designed for this method.The execution times of basic blocks in binary files were obtained by dynamic pile insertion

so as to adjust the NOP instruction insertion probability in each basic block.The higher the execution frequency

the fewer NOP instructions were inserted into the basic block

which can ensure lower performance overhead and produce higher randomization entropy.In the experimental part

the SPEC benchmark program was used to test the optimized method from the aspects of performance overhead

gadget survival rate and file size.The results show that a 15% insertion probability achieves the best effect

with an average gadget survival rate of less than 1.49%

increasing attackers’ difficulty in reusing the same gadget attack chain.Furthermore

only a 4.1% operation overhead and 7.7% space overhead are added

maintaining high levels of security.

关键词

Keywords

references

FRANZ M , . E unibus pluram:massive-scale software diversity as a defense mechanism [C ] // Proceedings of the 2010 New Security Paradigms Workshop . 2010 : 7 - 16 .

LARSEN P , HOMESCU A , Brunthaler S , et al . SoK:automated software diversity [C ] // Proceedings of 2014 IEEE Symposium on Security and Privacy . 2014 : 276 - 291 .

COHEN F B . Operating system protection through program evolution [J ] . Comput Secur , 1993 , 12 ( 6 ): 565 - 584 .

MARCO-GISBERT H , RIPOLL I . On the effectiveness of full-ASLR on 64-bit Linux [C ] // Proceedings of the In-Depth Security Conference . 2014 .

JACKSON T , SALAMAT B , HOMESCU A , et al . Compiler-generated software diversity [M ] // Moving Target Defense . New York : Springer , 2011 : 77 - 98 .

HISER J , NGUYEN-TUONG A , CO M , et al . ILR:where＇d my gadgets go [C ] // Proceedings of 2012 IEEE Symposium on Security and Privacy . 2012 : 571 - 585 .

COFFMAN J , KELLY D M , WELLONS C C , et al . ROP gadget prevalence and survival under compiler-based binary diversification schemes [C ] // Proceedings of the 2016 ACM Workshop on Software PROtection . 2016 : 15 - 26 .

CONTI M , . Selfrando:securing the tor browser against de- anonymization exploits [C ] // Proceedings of Priv Enhancing Technol . 2016 : 454 - 469 .

JUNOD P , RINALDINI J , WEHRLI J , et al . Obfuscator-LLVM--software protection for the masses [C ] // Proceedings of 2015 IEEE/ACM 1st International Workshop on Software Protection . 2015 : 3 - 9 .

BANESCU S , COLLBERG C , PRETSCHNER A . Predicting the resilience of obfuscated code against symbolic execution attacks via machine learning [C ] // Proceedings of 26th USENIX Security Symposium (USENIX Security 17) . 2017 : 661 - 678 .

WENZL M , MERZDOVNIK G , ULLRICH J , et al . From hack to elaborate technique—a survey on binary rewriting [J ] . ACM Computing Surveys （CSUR） , 2019 , 52 ( 3 ): 1 - 37 .

HOMESCU A , NEISIUS S , LARSEN P , et al . Profile-guided automated software diversity [C ] // Proceedings of the 2013 IEEE/ACM Interna-tional Symposium on Code Generation and Optimization (CGO) . 2013 : 1 - 11 .

MURPHY M , LARSEN P , BRUNTHALER S , et al . Software profiling options and their effects on security based diversification [C ] // Proceedings of the First ACM Workshop on Moving Target Defense . 2014 : 87 - 96 .

HOMESCU A , JACKSON T , CRANE S , et al . Large-scale automated software diversity-program evolution redux [J ] . IEEE Transactions on Dependable and Secure Computing , 2015 , 14 ( 2 ): 158 - 171 .

KRAHMER S . x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique [R ] . 2005 .

彭国军 , 梁玉 , 张焕国 , 等 . 软件二进制代码重用技术综述 [J ] . 软件学报 , 2017 , 28 ( 8 ): 2026 - 2045 .

PENG G J , LIANG Y , ZHANG H G , et al . Survey on software binary code reuse technologies [J ] . Journal of Software , 2017 , 28 ( 8 ): 2026 - 2045 .

DAVI L , SADEGHI A R . Building secure defenses against code-reuse attacks [M ] . Berlin : Springer International Publishing , 2015 .

柳童 , 史岗 , 孟丹 . 代码重用攻击与防御机制综述 [J ] . Journal of信息安全学报 , 2016 , 1 ( 2 ).

LIU T , SHI G , MENG D . A survey of code reuse attack and defense mechanisms [J ] . Journal of Cyber Security , 2016 , 1 ( 2 ).

AHMED S , XIAO Y , SNOW K Z , et al . Methodologies for quantifying (Re-) randomization security and timing under JIT-ROP [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . 2020 : 1803 - 1820 .

侯宇 . 基于动态随机化和只可执行内存的JIT-ROP防御研究 [D ] . 南京:南京大学 , 2016 .

HONG Y . Defence aginst JIT-ROP based on dynamic randomization and executable only memory [D ] . Nanjing:Nanjing University , 2016 .

WILLIAMS-KING D , KOBAYASHI H , WILLIAMS-KING K , et al . Egalito:layout-agnostic binary recompilation [C ] // Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems . 2020 : 133 - 147 .

LUK C K , COHN R , MUTH R , et al . Pin:building customized program analysis tools with dynamic instrumentation [J ] . ACM Sigplan Notices , 2005 , 40 ( 6 ): 190 - 200 .

CHATTERJEE N , BOSE S , DAS P P . Dynamic weaving of aspects in C/C++ using PIN [C ] // Proceedings of the International Conference on High Performance Compilation,Computing and Communications . 2017 : 55 - 59 .

陈小全 , 薛锐 . 程序漏洞:原因,利用与缓解——以 C 和 C++语言为例 [J ] . 信息安全学报 , 2017 , 2 ( 4 ).

CHEN X Q , XUE R . Cause,exploitation and mitigation of program vulnerability—C and C++ language as an example [J ] . Journal of Cyber Security , 2017 , 2 ( 4 ).

MARCO-GISBERT H , RIPOLL I . Address space layout randomization next generation [J ] . Applied Sciences , 2019 , 9 ( 14 ): 2928 .

GUIDE P . Intel® 64 and ia-32 architectures software developer’s manual [J ] . Volume 3B:System programming Guide,Part , 2011 , 2 ( 11 ).

PRIYADARSHAN S , NGUYEN H , SEKAR R . Practical fine-grained binary code randomization [C ] // Proceedings of Annual Computer Security Applications Conference . 2020 : 401 - 414 .

SALWAN J , WIRTH A . ROPGadget [EB ] .

COPPENS B , DE SUTTER B , DE BOSSCHERE K . Protecting your software updates [J ] . IEEE Security ＆ Privacy , 2012 , 11 ( 2 ): 47 - 54 .

WARTELL R , MOHAN V , HAMLEN K W , et al . Binary stirring:self-randomizing instruction addresses of legacy X86 binary code [C ] // Proceedings of the 2012 ACM Conference on Computer and Communications Security . 2012 : 157 - 168 .

浏览量

354

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于软硬件结合的控制流完整性保护技术