KR102267618B1 - Apparatus and Method for crash risk classification of program - Google Patents

Abstract

The present invention relates to a crash risk analysis apparatus and method for a program, wherein the crash risk analysis apparatus performs taint analysis through execution of a binary to be analyzed, and crashes the binary. A risk analyzer for analyzing the risk of the crash by statically analyzing all the instructions affected by each of the instructions that caused the crash, wherein the risk analyzer is, for each of the instructions that caused the crashes, the arrival point of the instructions Identification of locations and availability, and an instruction capable of transferring control of a program based on the arrival points and availability, wherein the identified instruction is a store series instruction, or a branch In the case of a series command, the attack potential can be analyzed, and the level of risk can be classified based on the analysis result.

Description

Apparatus and Method for crash risk classification of program

The present invention relates to an apparatus and method for analyzing a crash risk of a program, and more particularly, to an apparatus and method for analyzing a crash risk of a program that more precisely classifies the crash risk through a step-by-step static analysis.

Binary program analysis is very important to understand the program structure and execution flow without depending on the source code. However, as with all other analyzes, accurate program analysis takes a lot of time in proportion to the size of the program, and a simple analysis method that takes less time has a very small application range or increases the probability of deriving incorrect analysis results. . Therefore, research to efficiently analyze binary programs is needed.

Binary static analysis is used in vulnerability analysis, malicious code analysis, and plagiarism detection. During static analysis of such binary, a crash may occur. Crash refers to an exception situation in which the program is terminated because no exception handling is made when executing the program. This is an unintended execution flow that the developer may abuse, such as executing malicious code, so it must be fixed.

Manually analyzing crashes at this time is very time consuming and laborious, so the use of automated tools is unavoidable.

Accordingly, there is a need to develop a technology capable of automatically analyzing a crash of a binary program.

Korean Patent Publication No. 10-1482073 (2006.04.24.)

SUMMARY OF THE INVENTION An object of the present invention is to provide an apparatus and method for analyzing a crash risk of a program capable of automatically analyzing a crash risk for a binary file step by step.

The problem to be solved by the present invention is not limited to the problem(s) mentioned above, and another problem(s) not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above problem, the crash risk analysis apparatus according to an embodiment of the present invention performs taint analysis through execution of a binary to be analyzed, and crashes the binary. ) including a risk analyzer that statically analyzes all instructions affected by each of the instructions that generated the crash and analyzes the risk of the crash, wherein the risk analyzer includes the arrival of the instructions for each of the instructions that caused the crashes Identifies points and availability, identifies an instruction capable of transferring control of a program based on the arrival points and availability, wherein the identified instruction is a store family instruction or a branch ) in the case of a series of commands, it is characterized in that the attack potential is analyzed, and the level of risk is classified based on the analysis result.

Preferably, the arrival points are identified using the following equation, but In can be obtained by using union as a meet operator.

[Equation]

는 집합 out,

는 전달함수로,

를 의미하고,

는 집합 in를 의미함.where B is the basic block,

is set out,

is the transfer function,

means,

means the set in.

Preferably, the usability is identified using the following equation, but In can be obtained by using the intersection (∩) as a meet operator.

[Equation]

Preferably, the level of risk may include SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), and NE (Not Exploitable).

Preferably, in the crash risk analyzer, an instruction capable of transferring control of the program is a branch series instruction, and a target address of the branch series instruction is affected by the instruction that caused the crash. In this case, it is determined that the crash is attackable, but if the instruction is a branch-based instruction identified based on the arrival points, the risk is classified as an E (exploitable) level, and the branch identified based on the availability of the instruction In the case of a series of instructions, the degree of risk can be classified into SE (Strongly Exploitable) level.

Preferably, in the risk analyzer, when the instruction capable of transferring control of the program is a storage series instruction, and a register having data to be stored or a memory location to be stored of the storage series instruction is affected by the instruction that caused the crash , it is determined that the crash is attackable, but if the command is a stored command identified based on the arrival points, the risk is classified into a level of E (exploitable) or PE (probably exploitable), and the command is available In the case of a storage sequence command identified based on , the risk may be classified into a strongly exploitable (SE) level.

Preferably, the risk analyzer is configured to: when the instruction is a storage family instruction identified based on arrival points, and only a register having data to store of the storage family instruction is affected by the instruction causing the crash, or When only the storage memory location of the storage sequence instruction is affected by the instruction that caused the crash, the risk is classified as a level of probably exploitable (PE), and the register having the data to be stored and the memory location to be stored of the storage sequence instruction are the above. If it is affected by the command that caused the crash, the level of risk can be classified as E (exploitable).

Preferably, the risk analyzer is, when the instruction is a storage family instruction identified based on availability, and a register having data to store and a memory location to store of the storage family instruction are affected by the instruction that caused the crash. Risk can be classified into SE (Strongly Exploitable) level.

In order to solve the above problems, commands that cause a crash with respect to the binary by performing taint analysis through the execution of the binary (binary) to be analyzed according to another embodiment of the present invention A static analysis unit that statically analyzes all commands affected by each, and identifies the arrival points and availability of the commands for each of the commands that caused the crashes, the identified arrival points and usage An exploitable point analysis unit that identifies an instruction capable of transferring control of a program based on the possibility, and if the identified instruction is a store series instruction or a branch series instruction, the attack potential is analyzed, and the It includes a risk analysis unit for classifying the risk level based on the analysis result.

Preferably, a Reaching Definition analysis module that identifies the arrival points of the instructions that caused the crashes, and an Availability-Def analysis module that identifies the availability of the instructions that caused the crashes , it may include a memory availability-def analysis module that sees and kills the memory like a register.

Preferably, the reaching-def analysis module identifies the arrival points using the following equation, but may obtain In using union as a meet operator.

[Equation]

는 집합 out,

는 전달함수로,

를 의미하고,

는 집합 in를 의미함.where B is the basic block,

is set out,

is the transfer function,

means,

means the set in.

Preferably, the availability-def analysis module identifies the usability using the following equation, but may obtain In by using an intersection (∩) as a meet operator.

[Equation]

Preferably, the risk analysis unit may classify the level of risk into at least one of Strongly Exploitable (SE), Exploitable (E), Probably Exploitable (PE), and Not Exploitable (NE).

In order to solve the above problem, in the method for the crash risk analysis apparatus according to another embodiment of the present invention to analyze the crash risk, taint analysis is performed through the execution of the binary to be analyzed. Thus, identifying arrival points and availability for each of the instructions that caused crashes with respect to the binary, and identifying an instruction capable of transferring control of the program based on the arrival points and availability Step, when the identified instruction is a store series instruction or a branch series instruction, analyzing the attack potential, and classifying it into a level of risk based on the analysis result.

According to the present invention, by performing static analysis with binary files and crash information, automatically determining the risk of crashes and reporting them to the user, crashes that can cause relatively more serious problems are preferentially supplemented or crashes with no attack potential are corrected. Not only can it be excluded from the range, but it can also help supplement with information on the possibility of attack.

In addition, according to the present invention, by classifying the crash risk into five categories, the user can know the crash risk more precisely.

In addition, according to the present invention, by performing a three-stage static analysis of a crash, it is possible to divide the crash risk into several stages and notify the user, which allows the user to know the crash risk more reliably and the risk of program vulnerabilities. By knowing the , the order of the patches can be known.

Effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a schematic block diagram of a crash risk analysis apparatus according to an embodiment of the present invention.
2 is a block diagram illustrating a risk analyzer according to an embodiment of the present invention.
FIG. 3 is a block diagram illustrating a detailed configuration of the static analysis unit shown in FIG. 2 .
4 is an exemplary diagram for explaining Reaching Definition and Avaliable Definition according to an embodiment of the present invention.
5 is a diagram for explaining the characteristics of Reaching Definition, Avaliable Definition, and Menory Avaliable Definition according to an embodiment of the present invention.
6 is a diagram for explaining the criteria for risk classification according to an embodiment of the present invention.
7 is a schematic flowchart of a crash risk analysis method according to an embodiment of the present invention.
8 is a flowchart illustrating a method of determining a level of risk according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

Terms such as first, second, A, and B may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being “connected” or “connected” to another component, it is understood that the other component may be directly connected or connected to the other component, but other components may exist in between. it should be On the other hand, when it is mentioned that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic block diagram of a crash risk analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 1 , the crash risk analysis apparatus 100 according to an embodiment of the present invention includes a disassembler 110 , an intermediate language converter 120 , a crash generator 130 , and a crash risk analyzer 140 .

The disassembler 110 converts input data into machine language. In particular, the disassembler 110 disassembles a binary program (eg, an ARM binary program) that is a crash risk analysis target and converts it into machine language, and the control flow information obtained from the machine language (Control Flow Graph) ) is output.

The intermediate language converter (Abstract Interpretation Framework) 120 converts the machine language output from the disassembler 110 into an intermediate language. For example, the intermediate language converter 120 converts the machine language into an intermediate language called Reverse Engineering Intermediate Language (REIL). In this case, the conversion of the machine language to the intermediate language is to reduce the number of excessively large instructions to provide convenience of static analysis. For example, if about 300 ARM instructions are input, it can be reduced to 17 when converted into an intermediate language called REIL.

The crash generator 130 intentionally causes the crash. To this end, the crash generator 130 contains a pre-made crash-inducing program to intentionally generate a plurality of crashes, and generates a plurality of crashes by the crash-inducing program (eg, a Fuzzer program). In general, hackers use a crash-inducing program such as a fuzzer to generate many crashes in the target program, analyze the crashes one by one, and, if there is an attack potential, find the attack code for the vulnerability. This is to reverse exploit the attack pattern that is written and attacked. That is, it is to automatically analyze the attack potential (ie, the degree of risk) for each of the crashes intentionally generated as described above.

The crash risk analyzer 140 analyzes the risk of a corresponding crash based on the commands converted into the intermediate language by the intermediate language converter 120 and crash information generated by the crash generator 130 . That is, the crash risk analyzer 140 statically analyzes all the commands affected by each of the commands that caused a plurality of crashes among the commands converted into the intermediate language to analyze the risk of the corresponding crash. To this end, the risk analyzer 140 identifies the reaching points (Reaching Definitions) of the instructions for each of the instructions causing a plurality of crashes, and the point at which the instruction is actually used among the reaching points (Def-Use Chaining) ), and then derive the result as a point of use graph. In addition, the risk analyzer 140 identifies the availability of the instructions for each of the instructions that caused a plurality of crashes, and the point where the instruction is actually used among the available points (Def-Use Chaining) ), and then derive the result as a point of use graph.

Then, the risk analyzer 140 identifies a command capable of transferring control of the program from the usage point graph based on the arrival points and availability, and analyzes the attack potential for the command. At this time, the risk analyzer 140 analyzes the attack potential when the command that caused the crash is a store-based command or a branch-based command, and classifies it into a level of risk based on the analysis result. At this time, the risk analyzer classifies the level of risk into SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), and NE (Not Exploitable).

For a detailed description of the risk analyzer 140, refer to FIG. 2 .

Figure 2 is a block diagram for explaining the risk analyzer according to an embodiment of the present invention, Figure 3 is a block diagram for explaining the detailed configuration of the static analysis unit shown in Figure 2, Figure 4 is an embodiment of the present invention FIG. 5 is a view for explaining the characteristics of Reaching Definition, Avaliable Definition, and Menory Avaliable Definition according to an embodiment of the present invention, FIG. 6 is an embodiment of the present invention It is a diagram for explaining the standard of risk classification according to

Referring to FIG. 2 , the risk analyzer according to an embodiment of the present invention includes a static analyzer 142 , an exploitable point analyzer 144 , and a risk analyzer 146 .

The static analysis unit 142 performs taint analysis through the execution of the binary to be analyzed, so that all instructions affected by each of the instructions causing a crash with respect to the binary are analyzed. static analysis. In this case, the static analysis unit 142 performs static analysis of the binary program in three stages: Reaching Definition, Avaliable Definition, and Menory Avaliable Definition.

Accordingly, the static analysis unit 142, as shown in FIG. 3 , the reaching-def analysis module 142a, the availability-def analysis module 142b, the memory availability-def (Memory) Avaliable Definition) analysis module 142c is included.

The reaching-def analysis module 142a identifies the arrival points of the instructions that caused the crashes.

The purpose of Reaching-Definition analysis is to find out how far the command that defines the variable can affect, that is, how far it reaches. The domain of Reaching-Definition analysis is a set of instructions that update registers, and two sets of gen and kill are required to perform this analysis. The set gen is a set of instructions that newly define a register in the basic block, and the set kill is a set of all other instructions that define a register defined in the basic block. At this time, if there is an instruction defining the same register in the same basic block, It is calculated based on the subcommand according to the execution order. The set in is a group of instructions that arrive without being affected by other instructions up to the point in time when the instructions of the corresponding basic block among the instructions that update the registers are started to be executed, and the set out is the time when all the instructions of the basic block are executed The set of update commands reached. To obtain the sets in and out, the set out of the parent basic block of each basic block is initialized to , and Equation 1 below is repeatedly applied.

[Equation 1]

는 집합 out,

는 전달함수로,

를 의미하고,

는 집합 in를 의미할 수 있다. where B is the basic block,

is set out,

is the transfer function,

means,

may mean a set in.

As shown in Equation 1, the Reaching Definition may be an analysis algorithm made based on a transfer function and an equation. where kill is a set of constants that are fixed for each command. So, before starting the analysis of Equation 1, the set kill for each command must be calculated. However, there are some things to consider about memory when looking for this set kill for binaries. In binary, when accessing memory, it is either indirectly accessed with registers or directly accessed with constant values.

The availability-def analysis module 142b identifies the availability of the instructions that caused the crashes.

Avaliable definition analysis is similar to reaching definition, but in order to obtain sets in and out, the set out of the parent basic block of each basic block is initialized to Uuniverse, and Equation 2 below is repeatedly applied.

[Equation 2]

Avaliable definition analysis obtains In by using intersection (∩) instead of union used as meet operator in Reaching definition analysis.

According to this Avaliable Definition analysis, as a result of the overall analysis, it can be confirmed whether the contaminated data is reliably propagated regardless of the program path.

Reaching-Definition and Avaliable Definition will be described with reference to the example of FIG. 4 .

Changing the code in (a) of FIG. 4 to CFG may be the same as (b). If Reaching Definition is performed for (b), it can be the same as (c). Referring to (c), the new value of variable b is defined as null in the 3rd basic block, but in the Exit basic block, the result of the union of outs of the basic blocks of 2 and 3 is entered as In. That is, it is seen that the definition of b defined in 1 is also valid in the Exit basic block.

Therefore, the Reaching-Definition analysis may result in the analysis that an invalid definition is reachable depending on the path of the program.

If Available definition is performed for (b), it can be the same as (d). Contrary to the Reaching definition, In is obtained by the intersection of the outs of the basic blocks of 2 and 3 in the Exit basic block. Therefore, it can be seen that a higher level warning can be issued because only explicit data propagation is seen regardless of the path.

The memory availability-def analysis module 142c sees the memory as a register and kills it. Since the reaching-def analysis module 142a and the availability-def analysis module 142b do not kill the memory, it is necessary to kill the memory. Accordingly, the memory availability-def analysis module 142c sees the memory as a register and kills it.

Available Definition kills only registers. Even if two registers point to one memory space, they do not kill each other because they are different registers. Registers that are not killed in this way can lead to inaccuracies in later analysis. However, Memory Available Definition kills registers pointing to the same memory when a register points to memory. As in the previous example, if two registers point to one memory space and a new value is written to that memory space through one register, the other registers are also killed.

Each of the above-described Reaching-Definition, Avaliable Definition, and Memory Avaliable Definition features may be as shown in FIG. 5 .

Referring back to FIG. 2 , the exploitable point analysis unit 144 identifies a command capable of transferring control of a program based on arrival points and availability identified by the static analysis unit 142 . That is, the exploitable pointer analyzer 144 finds a point where the instruction is actually used among the arrival points and availability, and then derives the result as a point of use graph. Then, the exploitable pointer analysis unit 144 identifies an instruction capable of transferring the control right of the program from the point of use graph.

The risk analysis unit 146 analyzes the attack potential when the command causing the crash identified by the exploitable pointer analysis unit 144 is a store series command or a branch series command, and the analysis result based on the level of risk. At this time, the risk analysis unit 146 classifies the level of risk into SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), and NE (Not Exploitable) according to the criteria shown in FIG. 6 . Since the branch instruction can change the execution flow by changing the value of the register pointing to the instruction to be executed literally, control can be transferred. If the target address to which the control is transferred is affected by the crash point, the crash can be said to be attackable. Here, the crash point may mean a command that caused the crash. In addition, the storage instruction cannot change the value of the register pointing to the instruction to be executed directly, but the control can be transferred by changing the return address of the function or the address of the function in the IAT (Import Address Table) or EAT (Export Address Table). can Commands with such attack potential may be shown in Table 1 below.

[Table 1]

Specifically, the risk analysis unit 146 is a branch-series instruction that can transfer control of the program, and the target address of the branch-series instruction is affected by the instruction that caused the crash. Determines the crash as attackable. At this time, when the corresponding instruction is a branch-based instruction identified based on the arrival points, the risk analysis unit 146 classifies the risk into an E (exploitable) stage, and the branch-based instruction identified based on the availability of the instruction. In case of , the risk is classified as SE (Strongly Exploitable) level.

In addition, the risk analysis unit 146 is a storage-type instruction that can transfer control of the program, and when the register having data to be stored or the memory location to be stored of the storage-type instruction is affected by the instruction that caused the crash, the corresponding crash is determined to be attackable. At this time, the risk analysis unit 146 classifies the risk into a level of E (exploitable) or PE (probably exploitable), when the corresponding command is a stored command identified based on the arrival points, and the corresponding command is based on usability. In the case of a storage sequence command identified based on the classification, the degree of risk is classified into a strongly exploitable (SE) level. That is, the risk analysis unit 146 is a storage sequence command identified based on the arrival points of the command, and only the register having data to be stored of the storage sequence instruction is affected by the instruction that caused the crash or the storage sequence instruction. If only the memory location to be stored is affected by the instruction that caused the crash, the risk is classified as a level of PE (probably exploitable), and the register with the data to be saved and the memory location to be saved in the store instruction are affected by the instruction that caused the crash. If received, the risk is classified as E (exploitable) level.

In addition, the risk analysis unit 146 determines the risk if the instruction is a storage series instruction identified based on availability, and a register having data to store and a memory location to store of the storage series instruction are affected by the instruction that caused the crash. (Strongly Exploitable).

7 is a schematic flowchart of a crash risk analysis method according to an embodiment of the present invention.

Referring to FIG. 7 , the disassembler 110 disassembles a binary program and converts it into machine language ( S710 ). In particular, the disassembler 110 disassembles a binary program (eg, an ARM binary program) that is a crash risk analysis target and converts it into a machine language.

When S710 is performed, the disassembler 110 obtains control flow information from the machine language (S720). In this case, the control flow information may be used as a reference for deriving where the arrival point of each command is or where the actual use point is in the risk analysis step ( S500 ) performed later.

When step S720 is performed, the intermediate language converter 120 converts the machine language into an intermediate language (S730). For example, the intermediate language converter 120 converts the machine language into an intermediate language called Reverse Engineering Intermediate Language (REIL). In this case, the conversion of the machine language to the intermediate language as described above is to reduce the number of excessively large commands to provide convenience of static analysis. For example, if about 300 ARM instructions are input, it can be reduced to 17 when converted into an intermediate language called REIL.

When step S730 is performed, the crash generator 130 intentionally causes a crash (S740). To this end, the crash generator 130 contains a pre-made crash-inducing program to intentionally generate a plurality of crashes, and generates a plurality of crashes by the crash-inducing program (eg, a Fuzzer program). In general, hackers use a crash-inducing program such as a fuzzer to generate many crashes in the target program, analyze the crashes one by one, and, if there is a possibility of an attack, find an attack code suitable for the vulnerability. This is to reverse exploit the attack pattern that is written and attacked. That is, it is to automatically analyze the attack potential (ie, the degree of risk) for each of the crashes intentionally generated as described above.

When step S740 is performed, the crash risk analyzer 140 analyzes the risk of the corresponding crash based on the commands converted into the intermediate language in step S730 and the crash information generated in step S740 ( S750 ). That is, the crash risk analyzer 140 statically analyzes all commands that are affected by each of the crash-causing commands among the commands converted into the intermediate language to analyze the crash risk.

A detailed description of how the risk analyzer analyzes the crash risk will be described with reference to FIG. 8 .

8 is a flowchart illustrating a method of determining a level of risk according to an embodiment of the present invention.

Referring to FIG. 8, the risk analyzer identifies arrival points and availability for each of the instructions that caused crashes (S802), and based on the arrival points and availability, the control of the program can be transferred. Identifies a command (S804).

When step S804 is performed, the risk analyzer determines whether the identified command is a store series command (S806).

As a result of the determination in step S806, in the case of a storage instruction, the risk analyzer determines whether both the register having the data to be stored and the memory location to be stored of the storage instruction are affected by the instruction causing the crash (S808).

If both the register having the data to be stored and the memory location to be stored are affected as a result of the determination in step S808, the risk analyzer determines whether the corresponding storage sequence command is an identified command based on the arrival point (S810).

As a result of the determination in step S810, if the corresponding stored sequence command is a command identified based on the arrival point, the risk analyzer classifies the risk into the E (exploitable) step (S812).

If, as a result of the determination of step S810, if the corresponding storage series command is not a command identified based on the arrival point, the risk analyzer determines whether the command is identified based on availability (S814).

As a result of the determination in step S814, if the corresponding stored sequence command is a command identified based on availability, the risk analyzer classifies the risk into a strongly exploitable (SE) step (S816).

If, as a result of the determination of step S808, neither the register having the data to be stored nor the memory location to be stored are affected, the risk analyzer determines whether one of them is affected (S818).

As a result of the determination of step S818, if it is affected by either the register having the data to be stored or the memory location to be stored, the risk analyzer classifies the risk as a level of PE (probably exploitable) (S820), and if not affected, sets the risk to NE ( not exploitable) (S822).

If, as a result of the determination of step S806, it is not a storage series instruction, the risk analyzer determines whether it is a branch series instruction (S824).

If the determination result of step S824 is a branched instruction, the risk analyzer determines whether the target address of the branched instruction is affected by the instruction that caused the crash (S826).

As a result of the determination in step S826, if the destination address of the branch instruction is affected, the risk analyzer determines whether the corresponding branch instruction is an instruction identified based on the arrival point (S828).

As a result of the determination in step S828, if the branch-series instruction is an instruction identified based on the arrival point, the risk analyzer classifies the risk into the E (exploitable) stage (S830).

If it is determined in step S828 that the branch instruction is not an instruction identified based on the arrival point, the risk analyzer determines whether the branch instruction is an instruction identified based on availability (S832).

As a result of the determination in step S832, if the command is identified based on the usability, the risk analyzer classifies the risk into a strongly exploitable (SE) step (S834).

So far, the present invention has been looked at with respect to preferred embodiments thereof. Those of ordinary skill in the art to which the present invention pertains will understand that the present invention can be implemented in modified forms without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments are to be considered in an illustrative rather than a restrictive sense. The scope of the present invention is indicated in the claims rather than the foregoing description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

100: crash risk analysis device
110 : disassembler
120: Intermediate language converter
130: crash generator
140: risk analyzer
142: static analysis unit
144: exploitable point analysis unit
146: risk analysis unit

Claims (14)

By performing taint analysis through the execution of the binary to be analyzed, static analysis of all instructions affected by each of the instructions causing a crash in the binary, the risk of the corresponding crash including a risk analyzer to analyze the
The risk analyzer is
for each of the instructions that caused the crashes, identify points of arrival and availability of the instructions, and based on the points of arrival and availability, identify an instruction capable of transferring control of the program based on the points of arrival and availability; If the command is a store-type instruction or a branch-type instruction, the attack potential is analyzed, and based on the analysis result, it is classified into a level of risk,
The level of risk is
Including SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), NE (Not Exploitable),
The risk analyzer is
When the instruction that can transfer control of the program is a storage instruction, and the register having data to be stored or the memory location to be stored of the storage instruction is affected by the instruction that caused the crash, the risk is evaluated in a strongly exploitable (SE) step. , and determine that the crash is attackable, but
When the corresponding instruction is a storage-type instruction identified based on arrival points, the risk is classified as E (exploitable) or PE (probably exploitable) level, and when the corresponding instruction is a storage-type instruction identified based on availability Crash risk analysis device, characterized in that the risk is classified into SE (Strongly Exploitable) stage. According to claim 1,
Crash risk analysis apparatus, characterized in that the identification of the arrival points is obtained by using the following equation, but using the union as a meet operator (meet operator).
[Equation]

where B is the basic block,

is set out,

is the transfer function,

means,

means the set in. According to claim 1,
The usability is identified using the following equation, but Crash risk analysis apparatus, characterized in that In is obtained by using the intersection (∩) as a meet operator (meet operator).
[Equation]

delete According to claim 1,
The risk analyzer is
If the instruction capable of transferring the control of the program is a branch instruction, and the target address of the branch instruction is affected by the instruction that caused the crash, it is determined that the crash is attackable. ,
When the corresponding instruction is a branch-based instruction identified based on arrival points, the risk is classified as E (exploitable) level, and when the corresponding instruction is a branch-based instruction identified based on availability, the risk is set to SE (Strongly Exploitable) Crash risk analysis device characterized in that it is classified into stages. delete According to claim 1,
The risk analyzer is
The instruction is a storage series instruction identified based on arrival points,
When only the register having data to be stored of the storage instruction is affected by the instruction that caused the crash, or when only the memory location to store of the storage instruction is affected by the instruction that caused the crash, the risk is set to PE ( Classified as a stage of probably exploitable,
Crash risk analysis apparatus, characterized in that when the register having the data to be stored and the memory location to be stored of the storage series instruction are affected by the instruction causing the crash, the risk is classified into an E (exploitable) stage. delete By performing taint analysis through the execution of the binary to be analyzed, static analysis of all instructions affected by each of the instructions that caused a crash with respect to the binary, a static analysis unit for identifying arrival points and availability of the commands for each of the generated commands;
an exploitable point analysis unit for identifying a command capable of transferring control of a program based on the identified arrival points and availability; and
If the identified instruction is a store series instruction or a branch series instruction, a risk analysis unit that analyzes the attack potential and classifies it into a level of risk based on the analysis result
including,
The level of risk is
Including SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), NE (Not Exploitable),
The risk analysis unit,
When the instruction that can transfer control of the program is a storage instruction, and the register having data to be stored or the memory location to be stored of the storage instruction is affected by the instruction that caused the crash, the risk is evaluated in a strongly exploitable (SE) step. , and determine that the crash is attackable, but
When the corresponding instruction is a storage-type instruction identified based on arrival points, the risk is classified as E (exploitable) or PE (probably exploitable) level, and when the corresponding instruction is a storage-type instruction identified based on availability Crash risk analysis device that classifies risk into SE (Strongly Exploitable) level. 10. The method of claim 9,
a Reaching Definition analysis module that identifies the arrival points of the instructions that caused the crashes;
an availability-def analysis module that identifies the availability of instructions that caused crashes; and
A crash risk analysis device comprising a memory availability-def analysis module that sees and kills the memory like a register. 11. The method of claim 10,
The reaching-def analysis module,
Crash risk analysis device, characterized in that the arrival points are identified using the following equation, but In is obtained by using a union as a meet operator.
[Equation]

where B is the basic block,

is set out,

is the transfer function,

means,

means the set in. 11. The method of claim 10,
The usability-def analysis module,
Crash risk analysis apparatus, characterized in that the use is identified using the following equation, but In is obtained by using the intersection (∩) as a meet operator.
[Equation]

11. The method of claim 10,
The risk analysis unit,
A crash risk analysis device, characterized in that the level of risk is classified into at least one of SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), and NE (Not Exploitable). In the method of the crash risk analysis device analyzing the crash risk,
performing taint analysis through execution of a binary to be analyzed, and identifying arrival points and availability for each of the instructions that caused crashes with respect to the binary;
identifying an instruction capable of transferring control of the program based on the arrival points and availability;
When the identified instruction is a store series instruction or a branch series instruction, analyzing the attack potential and classifying the attack potential into a level of risk based on the analysis result
including,
The level of risk is
Including SE (Strongly Exploitable), E (Exploitable), PE (Probably Exploitable), NE (Not Exploitable),
The step of classifying the risk level is:
When the instruction that can transfer control of the program is a storage instruction, and the register having data to be stored or the memory location to be stored of the storage instruction is affected by the instruction that caused the crash, the risk is evaluated in a strongly exploitable (SE) step. , and determine that the crash is attackable, but
When the corresponding instruction is a storage-type instruction identified based on arrival points, the risk is classified as E (exploitable) or PE (probably exploitable) level, and when the corresponding instruction is a storage-type instruction identified based on availability Crash risk analysis method that classifies risk into SE (Strongly Exploitable) level.

Images