KR101961818B1 - Method for memory randomization without process stop and computing device performing thereof - Google Patents

Abstract

Disclosed are a memory randomization method without a process stop and a computing device performing the same. According to one embodiment of the present invention, the memory randomization method includes: (a) injecting a memory randomization module to perform memory randomization on a target program being executed; (b) allocating, by the memory randomization module, an arbitrary address space for relocating a shared library used by the target program; (c) copying, by the memory randomization module, the shared library into the allocated memory address space to create a stand-by shared library; (d) modifying a pointer to the shared library by the memory randomization module; and (e) activating the stand-by shared library by the memory randomization module. Steps (b) to (e) are repeatedly performed according to a predetermined period during the execution of the target program.

Description

[0001] METHOD FOR MEMORY RANDOMIZATION WITHOUT PROCESS STOP AND COMPUTING DEVICE PERFORMING THEREOF [0002]

Embodiments of the invention relate to techniques for defending against memory attacks on software.

 A memory attack, such as a buffer overflow attack or a format string attack, is a serious risk that a hacker can remotely acquire a shell with administrator privileges. Defense mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) have been developed to prevent such memory attacks. However, as newer memory attack technologies such as code reuse attacks and return-oriented programming (ROP) attacks have been developed, these defense techniques have also become possible to bypass.

ROP attacks are subdivided into attacks such as JIT-ROP and Blind-ROP. Several defense techniques have been proposed to cope with these latest attack techniques. However, these methods have limitations to recompile the software for memory randomization or interrupt the process and restart it. Mission Critical Application).

U.S. Published Patent Application No. US 2017/0364452 (published on December 21, 2017)

Embodiments of the present invention provide a method for performing memory randomization without process interruption and a computing device for performing the method.

A method of randomizing a memory according to an embodiment of the present invention includes the steps of: (a) injecting a memory randomizing module to perform memory randomizing on a target program being executed; (b) allocating an arbitrary address space for relocating the shared library used by the target program; (c) copying the shared library into the allocated memory address space to create a stand-by shared library; (d) the memory randomization module modifying a pointer to the shared library; And (e) activating the pre-shared library by the memory randomizing module, wherein the steps (b) to (e) are repeatedly performed according to a predetermined period of time during execution of the target program.

The memory randomization module may be injected into the memory space in the form of a shared library during execution of the target program.

The memory randomization module may perform the memory randomization through a thread created for the memory randomization within the process of the target program.

The step (d) may modify a pointer to each function of the shared library so that a pointer to each function of the shared library points to a function address of the spare shared library.

The step (e) may change an address of functions of the shared library in a procedure linkage table (PLT) to an address of functions of the preliminary shared library.

A computing device according to an embodiment of the present invention executes a memory randomization by injecting a memory randomizing module into a target program that is being executed, the memory randomizing module comprising: (a) Allocating an arbitrary address space for relocating a shared library to be used; (b) creating a stand-by shared library by copying the shared library into the allocated memory address space; (c) modifying a pointer to the shared library; And (d) activating the preliminary shared library, the instructions for repeatedly executing the preliminary shared library according to a predetermined period during execution of the target program.

The memory randomization module may be injected into the memory space in the form of a shared library during execution of the target program.

The memory randomization module may perform the memory randomization through a thread created for the memory randomization within the process of the target program.

In the step (c), a pointer to each function of the shared library may be modified such that a pointer to each function of the shared library points to a function address of the spare shared library.

In step (d), the address of the functions of the shared library in the procedure linkage table (PLT) may be changed to the addresses of the functions of the preliminary shared library.

According to the embodiments of the present invention, memory randomization can be performed without recompilation or process interruption using an injected memory randomization module during the execution of a target program, so that an application program, such as a mission-critical application, To defend against memory attacks.

1 is a block diagram illustrating and illustrating a computing environment including a computing device suitable for use in embodiments of the present invention.
2 is a flowchart of a memory randomization method according to an embodiment of the present invention
3 is an exemplary diagram for explaining memory randomization according to an embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification. The terms used in the detailed description are intended only to describe embodiments of the invention and should in no way be limiting. Unless specifically stated otherwise, the singular form of a term includes plural forms of meaning. In this description, the expressions "comprising" or "comprising" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, Should not be construed to preclude the presence or possibility of other features, numbers, steps, operations, elements, portions or combinations thereof.

1 is a block diagram illustrating and illustrating a computing environment including a computing device suitable for use in embodiments of the present invention. In the illustrated embodiment, each of the components may have different functions and capabilities than those described below, and may include additional components in addition to those not described below.

The illustrated computing environment 10 includes a computing device 12. The computing device 12 includes at least one processor 14, a computer readable storage medium 16, The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiment discussed above. For example, processor 14 may execute one or more programs stored on computer readable storage medium 16. The one or more programs may include one or more computer-executable instructions, which when executed by the processor 14 cause the computing device 12 to perform operations in accordance with the illustrative embodiment .

The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, the computer-readable storage medium 16 may be any type of storage medium such as a memory (volatile memory such as random access memory, non-volatile memory, or any suitable combination thereof), one or more magnetic disk storage devices, Memory devices, or any other form of storage medium that can be accessed by the computing device 12 and store the desired information, or any suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12, including processor 14, computer readable storage medium 16.

The computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. The exemplary input and output device 24 may be any type of device, such as a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touch pad or touch screen), a voice or sound input device, An input device, and / or an output device such as a display device, a printer, a speaker, and / or a network card. The exemplary input and output device 24 may be included within the computing device 12 as a component of the computing device 12 and may be coupled to the computing device 12 as a separate device distinct from the computing device 12 It is possible.

2 is a flowchart of a memory randomization method according to an embodiment of the present invention.

The method shown in FIG. 2 may be performed, for example, by the computing device 12 shown in FIG.

Referring to FIG. 2, first, the computing device 12 injects a memory randomization module into a running target program (210).

Specifically, the memory randomization module can be injected into the memory space during the process execution of the target program in the form of a shared library.

Meanwhile, the injected memory randomization module can perform memory randomization by creating a thread for memory randomization in the process of the target program. Specifically, the memory randomization performed by the memory randomizing module can be performed through a separate thread that is different from the main thread in the process of the target program. In addition, when the memory randomizing module is introduced to the target program, the process of initializing the data structure, class, and variables of the injected memory randomizing module may be involved.

Meanwhile, when the memory randomizing module is inserted, the memory randomizing module allocates an arbitrary address space for relocating the shared library used by the target program (220).

Thereafter, the memory randomizing module copies the shared library into the allocated address space to create a stand-by shared library (230).

Thereafter, the memory randomization module modifies the pointer to the shared library (240).

Specifically, the memory randomization module may modify the pointer to each function of the shared library so that a pointer to each function of the shared library points to a function address of the spare shared library.

Thereafter, the memory randomization module activates the spare shared library (250).

Specifically, the memory randomization module synchronizes the thread for memory randomization with the main thread of the target program, and registers the address of the functions of the shared library in the Procedure Linkage Table (PLT) as addresses for the functions of the spare shared library By changing this, the reserve shared library can be activated.

Thereafter, the memory randomizing module repeatedly performs steps 220 through 250 at predetermined time intervals to continuously relocate the shared library in the memory space.

In the flowchart shown in FIG. 2, the method is described by dividing into a plurality of steps. However, at least some of the steps may be performed in reverse order, performed in combination with other steps, omitted, , Or one or more steps not shown may be added.

3 is an exemplary diagram for explaining memory randomization according to an embodiment of the present invention.

Referring to FIG. 3, the memory randomizing module 310 injected into the memory space copies the currently activated shared library 320 to an arbitrary address space, thereby creating a spare shared library 330.

Thereafter, the memory randomizing module 320 adjusts the pointer so that the pointer to each function of the shared library points to the function address of the spare shared library 330, and then changes the PLT 340 to activate the spare shared library (350).

Thereafter, the memory randomizing module 320 repeatedly performs the memory randomizing process shown in FIG. 3 at a predetermined interval (for example, 50 ms) to continuously relocate the shared library in the memory space.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I will understand. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

10: Computing environment
12: computing device
14: Processor
16: Computer readable storage medium
18: Communication bus
20: Program
22: I / O interface
24: input / output device
26: Network communication interface

Claims (10)

(a) injecting a memory randomization module to perform memory randomization on a running target program;
(b) allocating an arbitrary address space for relocating the shared library used by the target program;
(c) copying the shared library into the allocated memory address space to create a stand-by shared library;
(d) the memory randomization module modifying a pointer to the shared library; And
(e) activating the pre-shared library by the memory randomization module,
Wherein the steps (b) to (e) are repeatedly performed according to a predetermined period during execution of the target program.
The method according to claim 1,
Wherein the memory randomization module is injected into a memory space in the form of a shared library during execution of the target program.
The method according to claim 1,
Wherein the memory randomization module performs the memory randomization through a thread created for the memory randomization in a process of the target program.
The method according to claim 1,
Wherein the step (d) modifies a pointer to each function of the shared library such that a pointer to each function of the shared library points to a function address of the spare shared library.
The method according to claim 1,
Wherein the step (e) includes: replacing an address of the shared library functions in a procedure linkage table (PLT) with an address of functions of the spare shared library.
1. A computing device for performing memory randomization by injecting a memory randomization module into a target program in execution, the memory randomizing module comprising:
(a) allocating an arbitrary address space for relocating a shared library used by the target program;
(b) creating a stand-by shared library by copying the shared library into the allocated memory address space;
(c) modifying a pointer to the shared library; And
and (d) repeatedly executing a process of activating the preliminary shared library according to a predetermined period of time during execution of the target program.
The method of claim 6,
Wherein the memory randomization module is injected into a memory space in the form of a shared library during execution of the target program.
The method of claim 6,
Wherein the memory randomization module performs the memory randomization through a thread created for the memory randomization within a process of the target program.
The method of claim 6,
Wherein the step (c) modifies a pointer to each function of the shared library such that a pointer to each function of the shared library points to a function address of the spare shared library.
The method of claim 6,
Wherein the step (d) changes an address of functions of the shared library in a procedure linkage table (PLT) to an address of functions of a spare shared library.

Images