防御Windows栈溢出攻击的新方法

New Method to Defend against Stack Smashing Attacks for Windows

针对栈溢出攻击依然是流行的计算机系统攻击手段的状况,文章为Windows开发了一个工作在装配时刻的防御栈溢出攻击的新方法,它运用栈溢出攻击检测机制来改写给定的可执行文件,不需要源代码支持。本文建立了相应的技术原型,它可以应用于简单应用程序、DLL、多线程应用程序和多线程应用程序使用的DLL,并能成功防御现实攻击。

Stack smashing is still one of the most popular techniques for computer system attack. An anti-stack-smashing defense technique for Microsoft Windows systems is presented in this paper. This technique, which consists of instrumenting a given executable with a mechanism to detect stack smashing attacks, works at install-time and does not rely on having access to the source-code. This paper developed a prototype for simple applications, DLLs, muhithreaded applications, and DLLs used by muhithreaded applications, and verified that it successfully defends against actual exploit code.