Windows平台下地址空间分布随机化技术研究及实现

ON RANDOMISATION OF ADDRESS SPACE LAYOUT ON WINDOWS PLATFORM AND ITS IMPLEMENTATION

使用不安全语言编写的程序容易受到诸如缓冲区溢出等攻击。这些攻击成功与否取决于对进程组件地址的分布是否熟悉。因此,防御内存攻击的一个对策就是随机化进程组件位置。地址空间分布随机化就是实现进程组件地址随机化的一个方法。分析了Windows Vista操作系统采用的地址空间分布随机化的优点与不足之处,并提出了在Windows XP操作系统上实现地址随机化的简易方案。

The programs written with unsafe languages are likely to be attacked by buffer overflows,etc.Since the success of these attacks depends on whether the address layout of the process components is familiar with or not,therefore a countermeasure of memory attacks defending is to randomise the locations of the process components.Address space layout randomisation is an approach for achieving randomisation of the process components addresses.In this paper we analyse the advantages and disadvantages of address space layout randomisation used by the Windows Vista operating system,and present a simplified solution for implementing the address randomisation on Windows XP operating system.