CN108573143A - The stack guard method verified based on program pitching pile and multidate information - Google Patents
The stack guard method verified based on program pitching pile and multidate information Download PDFInfo
- Publication number
- CN108573143A CN108573143A CN201710155359.XA CN201710155359A CN108573143A CN 108573143 A CN108573143 A CN 108573143A CN 201710155359 A CN201710155359 A CN 201710155359A CN 108573143 A CN108573143 A CN 108573143A
- Authority
- CN
- China
- Prior art keywords
- information
- stack
- program
- verification information
- pitching pile
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
Abstract
The present invention provides a kind of stack guard method verified based on program pitching pile and multidate information, including following module：(1) the pitching pile module based on GCC compilers, for being inserted into the code segment for placing, checking check information and error handle when source program compiles；(2) the Hook modules based on dynamic shared library, for initiation verification message buffer items entry information, dynamic update check information.The present invention reduces attacker's attack cost by dynamic generation check information and fine-grained stack information integrity checking, improves the safety of computer system and software.
Description
Technical field
The invention belongs to field of computer technology, especially systems and software security field.The present invention provides a kind of bases
In the stack guard method that program pitching pile and multidate information are verified, the integrality for checking stacked data protects application software.
Background technology
Buffer-overflow vulnerability (Buffer Overflow) can influence run process stacks data the characteristics of give software peace
Bring serious challenge entirely.Therefore, software normal operation under circumstances not known is protected, the integrality of stacked data is detected and is prevented
Only control stream is kidnapped, and is become system and is not improved the major issue solved yet with one, software security field.Data integrity detects
As a kind of mode of software protection, it is widely accepted.Program pitching pile as a kind of basic means of testing, can utilize its
The code segment being inserted into program is detected the integrality of stacked data, prevents the control stream of program from maliciously being kidnapped.
Program pitching pile：On the basis of the detected program of guarantee original logic integrality, it is inserted into is used for information in a program
The code segment of acquisition, the characteristic run by the execution of code segment and program of dishing out can by the analysis to these data
To obtain the control stream and traffic flow information of program, to realize the purpose of data integrity detection.
GCC compilers and GCC plug-in units：The one kind of GCC compilers as compiler, main work are will to collect or high
Grade computer language source program (Source program) translates into object language (Target language) machine as input
The equivalence program of device code.Translation process includes four interrelated steps：Pretreatment, compiling, compilation and link.GCC is inserted
Part allows developer to add new function to compiler, without changing compiler itself.The pin function of GCC provide with
Under several advantages：1) it shortening structure and tests the time needed for new function, it is only necessary to the code needed for new function is realized in compiling,
That is GCC need not be guided；2) allow to develop and safeguard the compiler be not suitable for for some reason included in GCC releases
Feature；3) it simplifies and needs to change GCC, but no time is deep into the work of the developer inside compiler.
Stack is protected：Stack overflow protection is a kind of buffer overflow attack alleviation means, when there are buffer overflows to attack for function
When hitting loophole, attacker can cover the return address on stack to allow malicious code (following unification uses shellcode) can
It is executed.Meeting is first toward (the following unified use of insertion verification information in stack when function starts to execute after enabling stack protection
Canary), it is whether legal that canary information can be verified when function really returns, and fortune is shut down procedure if illegal
Row.Attacker will also tend to cause stack protection check to fail to overriding canary information when covering return address
And prevent the execution of shellcode.
Existing stack guard method includes following several：
1) data execution protection (Data Execution Prevention, DEP).Buffer overflow attack is usually at it
The malicious code that the core buffer write-in of its program can perform, then inveigles program to execute malicious code.Use the purpose of DEP
It is the execution for preventing malice from being inserted into code, operating mechanism is that operating system only includes the core position of data using DEP labels
For non-executable (No-eXecute, NX), when application program attempts to execute code from the core position labeled as NX, operation system
The DEP logics of system will prevent application program from doing so, and prevent from overflowing to reach protection system.
2) the shadow stack based on safety zone thought (Shadow stack).It is prevented in the shadow stack by the way that array to be put into
Return address is rewritten to the spilling of array.
3) StackGuard based on the detection of data integrity row.The way of StackGuard is the return in function stack hardwood
Random value canary is inserted into before address, and whether the value of detection canary is tampered before the function returns, if canary
It is not tampered with, function normally exits.Otherwise, the control stream of program is directed to error handling module execution.
Shared library：Shared library uses the code of function unlike static library in the link of program in copy, and
Only do some label.Then when program starts to start operation, required module is dynamically loaded.So application program exists
There is still a need for the supports of shared library when operation.After shared library installation is correct, the program of all startups uses automatic newly
Shared library.Under linux system, allow user：1) library is updated, and still supports old library；2) it is covered when executing specific program
Particular bin even specific function in library.
Hook technologies：Hook translators of Chinese are " hook " (following unification uses hook).In programming, hook indicates one
Programmer can be allowed to be inserted into the place of self defining programm, the interface provided in typically packed program.By hook, open
Originator can be called with Break-Up System, or hand over normal output result by the parameter that change system is called to change, it might even be possible to
Stop a current running process and by control right transfer to oneself on hand.
Invention content
On the basis of work on hand, it is an object of the invention to：It proposes a kind of new based on program pitching pile and dynamic to believe
The stack guard method for ceasing verification solves being easily cracked in existing stack guard method, serious, the deployable difference of performance loss etc. and asks
Topic.
The technical scheme is that：Based on the stack guard method that program pitching pile and multidate information are verified, it is characterized in that real
The unrelated dynamic shared library in existing address, hook Key Functions, distribution canary buffering areas (Random Canary Buffer,
RCB GCC plug-in units), are realized；
The present invention specifically includes following steps：
1) the unrelated dynamic shared library in address (following unification uses libMultiGuard), hook Key Functions are realized；
2) the MultiGuard plug-in units (following unification uses MultiGuard) based on GCC are realized, is inserted into and is placed, checks
The code segment of canary and error handle；
Further：
In step 1), the unrelated dynamic shared library in address mainly has two parts effect：The realization of power function and crucial letter
Several rewritings.Power function in shared library is mainly responsible for the distribution and setting of RCB, the generation of canary and update etc..It is shared
The purpose of library rewriting portion library function is：In the dynamic link library of (SuSE) Linux OS, LD_PRELOAD is as a ring
Border variable can influence the link (Runtime linker) when the operation of program, before it allows user to be defined on program operation
The dynamic link library preferentially loaded.Linker (loader) is when carrying out dynamic link, the symbol that can will have the same symbol name
Number covering at LD_PRELOAD specify .so files in symbol.Based on this, can be replaced by the function in oneself library .so
The function originally having in library, to achieve the purpose that hook.Based on obtained shared library, pass through the process creation letter of rewriting
Number pthread_create distributes canary buffering areas, setting thread local memory block before main function calls
(Thread Local Storage, TLS) is deviated, and preserves the entry addresses RCB, size and index information.RCB is assigned
Afterwards, canary generating functions generate non-repetitive canaries at random according to the size of buffering area, are sequentially positioned in RCB.
In step 2), based on the buffering area for having multiple and different canaries that step 1) obtains, source code passes through
When GCC compilers are compiled, MultiGuard options are opened, in the case where not influencing program semanteme originally, insertion placement,
Check the code segment of Canary and error handle.The Canary buffering areas preserved during instruction is mainly deviated by TLS are placed to enter
Port address and current index information obtain canary, are placed into before the return address of current function stack hardwood, each function stack hardwood
The canary values of upper preservation are all different.It checks that instruction is mainly responsible for and takes out current canary from TLS offsets, compare itself and stack
Whether the canary of upper preservation is consistent, and determining program is not affected by attack if consistent, and function normally exits.Otherwise, system is sentenced
Disconnected program is under attack, and error handling commands are by the control conductance of program to error handling module.
By using above technical scheme, the present invention has the following advantages：
1. applicability is extensive：The present invention is by GCC plug-in units and a shared library come work, for there is demand for security
Software, especially business software need to only open MultiGuard when GCC compile and option, the software after compiling is protected to transport
This shared library is loaded when row, can achieve the purpose that protect software.Meanwhile different software can customize according to different requirements,
It is suitble to the shared library of itself.
2. deployable is strong：The traditional stack guard method of protection mechanism back compatible of the present invention, opens MultiGuard
It can be worked normally between the module and conventional module of protection.To assembler insertions function code segment, during which pitching pile of the present invention is
Any hardware processor characteristic is not depended on, can be deployed on most hardware processor frameworks, deployable is strong.
3. program feature loss is low：The present invention tries hard to follow traditional stack protect-ing frame structure to greatest extent in design, only
Monitor limited function so that it is very low that protected program executes speed loss.
Description of the drawings
Fig. 1 is the deployment diagram for the stack guard method of the embodiment of the present invention verified based on program pitching pile and multidate information
Fig. 2 is the program pitching pile for the stack guard method of the embodiment of the present invention verified based on program pitching pile and multidate information
Figure.
Fig. 3 is the operation principle for the stack guard method of the embodiment of the present invention verified based on program pitching pile and multidate information
Figure.
Fig. 4 is the workflow for the stack guard method of the embodiment of the present invention verified based on program pitching pile and multidate information
Figure.
Fig. 5 be the verification information for the stack guard method of the embodiment of the present invention verified based on program pitching pile and multidate information more
New figure.
Specific implementation mode
The method of the present invention writes dynamic shared library libMultiGuard.so first, including the library function and function that are rewritten
Function.The purpose for rewriteeing library function is additionally to execute user-defined behavior in function call, pthread_create,
After fork functions are rewritten, in the process of establishment, while the canary buffering areas that user specifies are assigned with, the entrance of buffering area
Location, size and index information are stored in TLS；Power function includes generation and placement, the canary buffering area of canary
Erasing.Meanwhile the method for the present invention realizes a GCC plug-in unit MultiGuard, for being inserted into placement, inspection when source program compiles
The code segment of canary and error handle is looked into, when each function calls, is dynamically taken from canary buffering areas
Canary, and by 8 bytes before its pop down to the return address of the function stack hardwood at the end of function call, is checked and mistake
Process instruction checks whether the canary preserved on stack is consistent with the value in canary buffering areas, if unanimously, function normally returns
It returns, otherwise, program control flow is oriented to error handling module.The work of dynamic base libMultiGuard.so and MultiGuard plug-in unit
It is as mode：Source program opens MultiGuard options, obtains the executable journey that pitching pile is crossed when GCC compilers are compiled
Sequence, program by LD_PRELOAD load libMultiGuard.so, such program call pthread_create functions or
When person's fork functions, the function rewritten in libMultiGuard.so is just had invoked, while process or subprocess are created,
Canary buffering areas are assigned with, multiple canaries is generated at random and is placed into buffering area.Then, system calls main letters
Number, program starts to execute, and with the calling of function, there are one stack hardwoods, MultiGuard plug-in units to be inserted on stack for each function
To the code segment in each function, when function calls, canary is taken out from canary buffering areas and is pressed onto function return
Before address；At the end of function call, whether verification canary is tampered, and does respective handling.The method of the present invention passes through shared
Library libMultiGuard.so and MultiGuard plug-in unit, the integrality of data on dynamic check stack, to play protection software
Effect, also can effectively prevent Brute Force canary.
Related description figure with reference to the present invention and specific implementation：Journey is based on Intel-x86 frameworks and linux system
The realization of the stack guard method of sequence pitching pile and multidate information verification is described further.
The first step：Write the C++ source files of libMultiGuard.so.The main library letter for including power function and being written over
Number.Power function mainly has：
The method that power function renew_canary generates canary be read under linux system /dev/random texts
Part calculates fixed a certain number of random bits using the entropy pool of system current system, then using these bits as word
Throttling returns._ multi_start_routine functions are responsible for RCB storage allocations space, obtain the addresses TLS of thread, initially
Change and the entry in the relevant TLS of RCB.
The library function of rewriting includes mainly：
The rewriting of function pthread_create is mainly added to the distribution of RCB, the initial work of TLS relevant entries,
This work passes through _ multi_start_routine functions realization.Thread_ is additionally had invoked in the fork functions of rewriting
Two functions of cab_free and update_canaries.After fork function calls, in subprocess, except calling fork letters
Outside several threads, the RCB of other threads is emptied by thread_cab_free functions, re-establishes tid_tls_map.Then,
Update_canaries functions are responsible for being RCB assignment again, refresh canaries.Longjmp and setjmp functions are as non-office
Portion's skip instruction can skip several call frames on stack, be called back to current function in some function on path.This
When, if if MultiGuard stack protection mechanisms are not processed, even if function is not under fire, canary verifications can still malfunction.
The longjmp functions of rewriting have additionally done following work：Acquisition redirects rear top-of-stack pointer, calling _ multi_unwind_rcb letters
Number pops up all canaries below position pointed by current top-of-stack pointer on stack so that each on the index and stack in RCB
The canary that function stack hardwood preserves is corresponded.
Second step：Based on obtained dynamic shared library, the MultiGuard plug-in units based on GCC compilers are realized.From
V4.5.1 starts, and GCC, which is increased, carrys out the plug-in unit operated on the various intermediate languages (IL) that are used in entire translation process
The support of extension compiling assembly line.GCC assembly lines include three different components, i.e. front end, middle-end and rear end, will input conversion
For GENERIC, GIMPLE and RTL IL.GENERIC is a kind of expression that the language generated by each front end is unrelated, it is used for making
Interface between resolver and optimizer, GIMPLE and RTL are for optimizing program.MultiGuard is registered as RTL optimizations
Process, and loaded by GCC after vartrack processes.MultiGuard is placed on first reason in RTL optimization pipelines
It is to ensure that most of important optimizations have executed, therefore, the pitching pile code of MultiGuard will not be added to unrelated generation
In code.In addition, in this way, can ensure that all injection instructions for executing specific function are maintained at its appropriate location, and not
It is optimised during meeting afterwards.
MultiGuard saves the initial address, size and index of RCB in TLS.Under x86-64 architectures,
Offset in TLS from 0x2a0 to 0x2b8 is not used by as region is retained, since the position of register fs offsets 0 saves
The addresses TLS, the position that fs is deviated 0x2a0 by MultiGuard preserve RCB plots, and to save RCB big for the position of fs offsets 0x2b0
Small, the position of fs offsets 0x2b8 saves the value of canary under MultiGuard.Meanwhile in order to ensure with current glibc versions
Compatible, the position of fs offsets 0x28 remains the canary under traditional StackGuard mechanism.It is described in detail below
The instruction and its effect that MultiGuard is inserted into：
(1)push r13
(2)push r14
(3) mov%fs：0x2a0, %r13
(4) mov%fs：0x2a8, %r14
(5) mov (%r13, %r14,8) %rax
(6) mov%rax, -0x8 (%rbp)
(7) incq%fs：0x2a8
(8) pop%r14
(9) pop%r13
(10) xor%fs：0x2b8, %rcx
(11) decq%fs：0x2a8
Register r13 is used to preserve the index of RCB for preserving RCB plots, r14 in instruction (1) to (4)；(5) are instructed to read
RCB is taken currently to index in the canary to register rax of direction；The canary of taking-up is pressed onto on stack by instruction (6)；It instructs (7)
The index value of RCB is added one；(8) to (9) are instructed to pop up register r14, r13；It is preserved on instruction (10) verification stack
Whether canary is tampered.Wherein instruction (1) to (5) is responsible for reading the canary in RCB in pitching pile code segment, instructs (10)
It is responsible for the verifying work of canary integralities, error handle task transfers to _ _ stack_chk_fail functions processing.
To sum up, the present invention can efficiently solve the check information phase of all functions in traditional canary protection mechanisms
Together, easily by the defect of Brute Force, the safety of software is significantly improved.
Claims (6)
1. a kind of stack guard method verified based on program pitching pile and multidate information, it is characterised in that：Intermediate language IL
(Intermediate Language) pitching pile, Hook Key Functions, stack hardwood protection mechanism are that each function stack hardwood setting difference is tested
Information is demonstrate,proved, verification information update mechanism provides verification information more new demand servicing to process；To in the premise for ensuring that program is correctly transported
Under prevent attack, it is ensured that the safety and reliability of computer system and software.
2. the stack guard method verified according to claim 1 based on program pitching pile and multidate information, it is characterised in that including
Following steps：
1) intermediate language 1L pitching piles module, this module, which is responsible for being inserted into program, places, checks verification information and error handle
Code；
2) Hook modules, this module are responsible for rewriting related library function, and service is provided for the multidate information verification on stack；
3) verification information module, this module are responsible for distributing verification information buffering area, generate verification information at random；
4) verification information update module, this module are responsible for updating verification information buffering area in establishment process or subprocess.
3. the stack guard method according to claim 2 verified based on program pitching pile and multidate information, it is characterized in that step
1) in, pitching pile is to be registered as RTL optimization process based on intermediate language, after variable tracks process (vartrack pass)
It is loaded by GCC.
4. the stack guard method according to claim 2 verified based on program pitching pile and multidate information, it is characterized in that step
2) it in, is preferentially loaded using the customized dynamic link library of environmental variance LD_PRELOAD designated users, linker (loader)
When carrying out dynamic link, by the symbol for having the same symbol name covering at the symbol in dynamic link library specified LD_PRELOAD
Number, program is at runtime, it will calls user-defined function.
5. the stack guard method according to claim 2 verified based on program pitching pile and multidate information, it is characterized in that step
3) in, plot, size and the index information of verification information buffering area are stored in thread local memory block, place verification information
Instruction according to plot and index information, take out verification information from verification buffering area, with being put into the return of current called function
Before location, ensure that each function stack hardwood possesses different verification informations.After function execution terminates, system is slow according to verification information
It rushes area's plot and index information takes out verification information, check whether it is consistent with the verification information preserved in this function stack hardwood.If
Unanimously, then it normally exits, otherwise, the control stream of program is directed to error handling module.
6. the stack guard method according to claim 2 verified based on program pitching pile and multidate information, it is characterized in that step
4) in, when process fork generates subprocess, except the process for calling fork, the verification information buffering area of other processes is both needed to clearly
It removes, regenerates verification information buffering area, and in thread separate storage area setting verification information buffering area plot, size and rope
Fuse ceases.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710155359.XA CN108573143A (en) | 2017-03-10 | 2017-03-10 | The stack guard method verified based on program pitching pile and multidate information |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710155359.XA CN108573143A (en) | 2017-03-10 | 2017-03-10 | The stack guard method verified based on program pitching pile and multidate information |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108573143A true CN108573143A (en) | 2018-09-25 |
Family
ID=63575843
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710155359.XA Pending CN108573143A (en) | 2017-03-10 | 2017-03-10 | The stack guard method verified based on program pitching pile and multidate information |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108573143A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109558734A (en) * | 2018-11-28 | 2019-04-02 | 北京梆梆安全科技有限公司 | A kind of detection method and device, the mobile device of storehouse safety |
| CN109725951A (en) * | 2018-12-29 | 2019-05-07 | 上海掌门科技有限公司 | Control method, system, electronic equipment and computer-readable medium |
| CN112182517A (en) * | 2020-10-28 | 2021-01-05 | 北京智游网安科技有限公司 | CANARY security protection-based detection method, terminal and storage medium |
| CN113626805A (en) * | 2021-07-16 | 2021-11-09 | 中国科学院软件研究所 | Buffer overflow attack defense method and system based on RISC-V and unexecutable memory |
| WO2022011818A1 (en) * | 2020-07-14 | 2022-01-20 | 浙江大学 | Kernel sensitive data integrity protection method based on arm pointer authentication |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104766015A (en) * | 2015-04-10 | 2015-07-08 | 北京理工大学 | Function call based dynamic detection method for buffer overflow vulnerability |
| CN105468965A (en) * | 2014-08-21 | 2016-04-06 | 西安慧泽知识产权运营管理有限公司 | Dynamic stack memory management method |
| CN105843640A (en) * | 2016-03-21 | 2016-08-10 | 武汉斗鱼网络科技有限公司 | Dynamic link library injection method and apparatus |
-
2017
- 2017-03-10 CN CN201710155359.XA patent/CN108573143A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105468965A (en) * | 2014-08-21 | 2016-04-06 | 西安慧泽知识产权运营管理有限公司 | Dynamic stack memory management method |
| CN104766015A (en) * | 2015-04-10 | 2015-07-08 | 北京理工大学 | Function call based dynamic detection method for buffer overflow vulnerability |
| CN105843640A (en) * | 2016-03-21 | 2016-08-10 | 武汉斗鱼网络科技有限公司 | Dynamic link library injection method and apparatus |
Non-Patent Citations (1)
| Title |
|---|
| 谢金晶等: "一种防止堆栈溢出攻击的新方法", 《现代电子技术》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109558734A (en) * | 2018-11-28 | 2019-04-02 | 北京梆梆安全科技有限公司 | A kind of detection method and device, the mobile device of storehouse safety |
| CN109558734B (en) * | 2018-11-28 | 2021-10-15 | 北京梆梆安全科技有限公司 | Stack security detection method and device and mobile device |
| CN109725951A (en) * | 2018-12-29 | 2019-05-07 | 上海掌门科技有限公司 | Control method, system, electronic equipment and computer-readable medium |
| WO2022011818A1 (en) * | 2020-07-14 | 2022-01-20 | 浙江大学 | Kernel sensitive data integrity protection method based on arm pointer authentication |
| CN112182517A (en) * | 2020-10-28 | 2021-01-05 | 北京智游网安科技有限公司 | CANARY security protection-based detection method, terminal and storage medium |
| CN113626805A (en) * | 2021-07-16 | 2021-11-09 | 中国科学院软件研究所 | Buffer overflow attack defense method and system based on RISC-V and unexecutable memory |
| CN113626805B (en) * | 2021-07-16 | 2022-05-03 | 中国科学院软件研究所 | Buffer overflow attack defense method and system based on RISC-V and unexecutable memory |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Liljestrand et al. | {PAC} it up: Towards pointer integrity using {ARM} pointer authentication | |
| CN108573143A (en) | The stack guard method verified based on program pitching pile and multidate information | |
| US10698668B1 (en) | Custom code transformations during compilation process | |
| Zeng et al. | Combining control-flow integrity and static analysis for efficient and validated data sandboxing | |
| Abadi et al. | Control-flow integrity principles, implementations, and applications | |
| Kemerlis et al. | {kGuard}: Lightweight kernel protection against {Return-to-User} attacks | |
| Pewny et al. | Control-flow restrictor: Compiler-based CFI for iOS | |
| US9027075B2 (en) | Enforcing security rules at runtime | |
| US9250937B1 (en) | Code randomization for just-in-time compilers | |
| US8413240B2 (en) | Information processing device, information processing method, and computer readable recording medium | |
| Hedin et al. | Value-sensitive hybrid information flow control for a javascript-like language | |
| CN102592082A (en) | Security through opcode randomization | |
| De et al. | FIXER: Flow integrity extensions for embedded RISC-V | |
| Rohlf et al. | Attacking clientside JIT compilers | |
| CN103064784A (en) | Memory leak detection method facing Xen environment during operation and implement system thereof | |
| Moreira et al. | DROP THE ROP fine-grained control-flow integrity for the Linux kernel | |
| KR20220108176A (en) | Domain Transition Disable Configuration Parameters | |
| Davidsson et al. | Towards automated application-specific software stacks | |
| Zhang et al. | JITScope: Protecting web users from control-flow hijacking attacks | |
| US8423974B2 (en) | System and method for call replacement | |
| US10579457B1 (en) | Processor for achieving flow integrity and a method of providing notice of a fault in control flow | |
| Gens | OS-level Attacks and Defenses: from Software to Hardware-based Exploits | |
| Danger et al. | Processor Anchor to Increase the Robustness Against Fault Injection and Cyber Attacks | |
| KR20210108848A (en) | Cfi-based protection device and method for defending against got overwrite attacks | |
| US20230418950A1 (en) | Methods, Devices, and Systems for Control Flow Integrity |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| DD01 | Delivery of document by public notice | ||
| DD01 | Delivery of document by public notice |
Addressee: Zhu Jun Document name: Deemed withdrawal notice |
|
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20180925 |