基于运行时类型分析的整形漏洞二进制检测和定位系统

New Binary System for Detecting and Locating Integer-based Vulnerability on Run-time Type Analysis

整形漏洞(Integer-based vulnerability)是一种存在于C或C++代码中的漏洞,具有极其严重的破坏性。2006年CVE指出缓冲区溢出漏洞呈下降趋势,而其他一些漏洞,如整形溢出、符号转换错误等呈上升趋势。设计并实现了一种针对整形漏洞的二进制实时检测和定位的方法。针对整形漏洞攻击,首先将二进制文件转化为一种中间语言VEX;然后在运行时将与外部输入相关的数据着色,截获相关语句并记录信息;最后依据制定的检测策略对着色的数据进行检测并定位。选用常见的含有内存漏洞的程序来测试系统的有效性及其性能损耗。实验结果表明,该工具可以检测并且定位软件中绝大多数的整形漏洞,而且误报和漏报率都很低。

Integer-based vulnerability is an extremely serious bug for programs written in languages such as C/C＋＋.Common Vulnerability and Exploit（CVE） shows that as the percentage of buffer overflow has declined,there has been an increase in related vulnerability types,including integer overflows and signedness errors.Here we presented the design,implementation,and evaluation of a tool for run-time detecting and locating integer-based vulnerability.We first translated the binary code into intermediate language VEX on Valgrind,then intercepted integer related statements at run-time,recorded the necessary information,and finally detected and located vulnerability based on the checking scheme.We chose several utility applications,which contain real integer-based vulnerability,to evaluate the effectiveness and run-time performance of our system.Preliminary experimental results are quit promising,it can detect and locate most of integer-based vulnerability in real software,and has very low false positives and negatives.