KR20180047767A - Method of generating a computer program for efficiently defending against a return-oriented programing - Google Patents

Abstract

According to the present specification, disclosed is a method for generating a computer program to effectively detect an ROP attack. The method for generating a computer program according to the present invention performs a compiling operation for converting a high-grade language into a machine language by using a processor. The processor comprises the steps of: (a) receiving a program generation command including a function and gadget; (b) setting a variable on a main function caller of a program requested to be generated, and inputting a command to initialize the variable value to ″0″; (c) searching a call command in the program requested to be generated, and inputting a command to increase the variable by ″1″ to a function including the searched call command; (d) searching a return command in the program requested to be generated, and inputting a function for reducing the variable by ″1″ to a gadget and a function including the searched return command; and (e) inputting a command for determining whether the value of the variable within the program requested to be generated is equal to or less than ″0″.

Description

METHOD OF GENERATING A COMPUTER PROGRAM FOR EFFICIENTLY DEFENDING AGAINST RETURN-ORIENTED PROGRAMING [0002]

The present invention relates to defending a return-oriented programming attack, and more particularly, to a method of generating a computer program that is capable of defending a return-oriented programming attack.

A return-oriented programming attack (ROP attack) is an attack that interrupts a call-return relationship in a program, overflows the process, To attack.

A return-oriented programming attack (ROP attack) is a program that performs a call-return relationship on a program with a combination of instructions present on the normal program without performing the call instruction. It is an attack technique that causes an abnormal return to cause malicious behavior.

To explain the ROP attack, we first explain the call-return mechanism.

Figure 1 is a reference diagram of the call-return mechanism.

Referring to FIG. 1, the two functions shown in the figure can be identified. For convenience of explanation, it is assumed that a function shown on the left side is a 'main function caller', and a function shown on the right side of the drawing is called a called function callee. It can be confirmed that the "CALL" command is written in the second line of the main function caller. By the "CALL" command, the process moves to the address "0X2002" (①). At this time, the processor stores "0x1006", which is the address of the instruction to be executed after the "CALL" instruction, in the buffer stack (②). Then, the process sequentially executes the commands from "0x2002 to 0x2011" of the called callee of the called function. The processor returns to the address "0x1006" stored in the buffer stack by "RETURN" command of "0x2011" and executes the command of the main function caller (③).

The above is the call-return mechanism of the basic program. An ROP attack is an attack using this call-return mechanism. It is an attack that destroys the intended flow of a normal program and connects the attacker with the desired code with a return command to cause malicious behavior.

2 is a conceptual diagram of an ROP attack.

Referring to FIG. 2, it can be seen that it is divided into three zones. A program can contain functions and gadgets. At this time, including both the "CALL" command and the "RETURN" command can be referred to as a "main function caller" or a "called function callee". And it can be called 'gadjet' to include only "RETURN" command (without "CALL" command, "without call"). A "gadget" is a small snippet of code that ends with a return command, and is the basic building block of an ROP attack. Figure 2 (a) is a main function caller, Figure 2 (b) is a called callee, and Figure 2 (c) is a gadget.

First, you can call the "foo" function in the main function caller and the "foo" function in the middle of the call to see that the "bar" gadget is called in the middle of execution. In the normal case without an ROP attack, the "bar" gadget will return to the main function caller again with the function "foo" (the solid arrow direction in FIG. 2). However, if there is an ROP attack, another gadget can be called without returning directly to the "foo" function in the gadget. This is referred to as "hijack". If a hijack occurs due to an ROP attack, there may be a situation in which the programmer does not intentionally call the gadget continuously. Therefore, the function or gadget that should be executed originally can not be executed, and the result is that the processor executes the intended gadget by the ROP attacker.

As a reference, an ROP attack can be initiated by invading the buffer stack, which is essential for the call-return mechanism. The processor stores the address of the instruction that should be executed next to the "CALL" instruction on the buffer stack when it is returned, causing the ROP attacker to hijack the return address stored in the buffer stack and into the unintended gadget.

As a conventional technique for detecting and defending an ROP attack, there is a technique called a zero-sum defender.

3 is a conceptual diagram of a method of detecting an ROP attack by a zero-sum hypothesis.

Referring to FIG. 3, the zero-sum hypothesis will be briefly described as follows. Sets a variable, increments the value of the variable by '+1' every time the call instruction is executed, and decrements the value of the variable by '-1' each time it is returned. If it is a normal call-return, the value of the variable will be '0' when returning to the main function caller. On the other hand, when an unintended gadget is executed due to an ROP attack, the gadget is only returned without a call, so that the value of the variable may drop below '0'. Therefore, when the value of the variable becomes negative, it is determined that there is an ROP attack and the defense is started.

In the example shown in Fig. 3, the functions f1 to f5 are called five times by the call, and the current value of the variable is '5'. At this time, when the ROP attack is started, the variable continues to be decremented (ie, there is no '+1' process) because only the return is made without the call function (that is, the variable is not '+1'). Then, after the fifth gadget is executed, when the next gadget is executed, the value of the variable becomes '0', which indicates that the ROP attack is performed.

However, in the case of the zero-island divider, there is a problem that the ROP attack itself can not be detected when the number of gadgets is smaller than the number of call commands.

Korean Patent Registration No. 10-1480821

And an object of the present invention is to provide a defensive method capable of detecting an efficient ROP attack according to the present specification.

The solutions described herein are not limited to those mentioned above, and other solutions not mentioned may be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided a method of generating a computer program for performing a compiling operation for converting a high-level language into a machine language using a processor, the method comprising the steps of: (a) Receiving a program creation command including a gadget; (b) setting a variable on a main function caller of the program requested to be created and inputting a command for initializing the variable value to '0'; (c) searching for a call command in the program requested to be generated and inputting a command for incrementing the variable by '1' to a function including the searched call command; (d) searching for a return instruction in the program requested to be generated, and inputting a command to decrease the variable by '1' to a function and a gadget including the searched return instruction; And (e) inputting a command to determine whether the value of the variable in the program requested to be generated is less than or equal to '0'.

According to an embodiment of the present invention, the step (c) may be a step of inputting a command for incrementing the variable by '1' to the caller's return line in the next line of the searched call function (appropriate term).

According to an embodiment of the present invention, the step (d) may be a step of inputting a command to decrease the variable by '1' in a line preceding the searched return command.

According to an embodiment of the present invention, the step (e) may be a step of inputting a command in a gadget and a function including a return command retrieved in step (d).

Preferably, the step (e) may be performed in a line immediately before the return instruction retrieved in step (d).

According to an aspect of the present invention, there is provided a computer program for causing a processor to perform a compiling operation for converting a high-level language into a machine language, the computer program comprising: (a) receiving a program creation command including a function and a gadget step; (b) setting a variable on a main function caller of the program requested to be created and inputting a command for initializing the variable value to '0'; (c) searching for a call command in the program requested to be generated and inputting a command for incrementing the variable by '1' to a function including the searched call command; (d) searching for a return instruction in the program requested to be generated, and inputting a command to decrease the variable by '1' to a function and a gadget including the searched return instruction; And (e) inputting a command for determining whether the value of the variable in the program requested to be generated is less than or equal to '0', and recorded in a computer-readable recording medium.

The computer program described above may be stored in a computer-readable storage medium.

The computer-readable storage medium comprising: a computer-readable storage medium; And a processor for executing the computer-readable storage medium.

According to the present specification, the following effects are obtained.

First, because it has a compiler-based approach, it can be applied independently to a program or module, requiring only very low performance overhead.

Second, it is possible to create a fast program because only the 'call' and 'return' are searched and added to the original program.

Third, the amount of increase in the size of the original program is very small because the added instruction is simple.

Fourth, fast ROP detection is possible regardless of the number of called callees compared to the conventional ROP attack detection time.

The effects described in the present specification are not limited to those mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

Figure 1 is a reference diagram of the call-return mechanism.
2 is a conceptual diagram of an ROP attack.
3 is a conceptual diagram of a method of detecting an ROP attack by a zero-sum hypothesis.
4 is a flowchart of a computer program creation method according to the present specification.
5 is an exemplary diagram of a program generated by a computer program creation method according to the present specification.
6 is a conceptual diagram of ROP attack detection in a program generated by a computer program creation method according to the present specification.
FIG. 7 is a comparative view of a ROP attack monitoring point of a program generated according to the prior art and the present specification.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. Wherever possible, the same or similar parts are denoted using the same reference numerals in the drawings.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular forms as used herein include plural forms as long as the phrases do not expressly express the opposite meaning thereto.

Means that a particular feature, region, integer, step, operation, element and / or component is specified and that other specific features, regions, integers, steps, operations, elements, components, and / It does not exclude the existence or addition of a group.

All terms including technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Predefined terms are further interpreted as having a meaning consistent with the relevant technical literature and the present disclosure, and are not to be construed as ideal or very formal meanings unless defined otherwise.

Hereinafter, a method of generating a computer program according to the present specification will be described with reference to the drawings.

4 is a flowchart of a computer program creation method according to the present specification.

A computer program creation method according to the present invention is a method for creating a computer program for performing a compile operation for converting a high-level language into a machine language using a processor. The software used by the high-level language and the programmer to write the algorithm, which means JAVA, C language, and the like.

The computer program creation method according to the present invention can be understood as a step performed by the processor since each step can be operated by a processor.

First, the processor can receive a program creation command including a function and a gadget (S10).

Next, the processor sets a variable on the main function caller of the generated program and inputs a command to initialize the variable to '0' (S20).

Next, the processor searches for a call command in the program requested to be generated, and inputs a command for incrementing the variable by '1' to a function including the searched command (S30).

Next, the processor may search for a return instruction in the program requested to be generated, and input a command to decrease the variable '1' to a function including the searched return instruction and a gadget (S40).

Next, the processor may input a command to determine whether the value of the variable in the program requested to be generated is less than or equal to '0' (S50).

According to an embodiment of the present invention, in step S30, a command for incrementing the variable by '1' may be input to the caller's return line in the next line of the searched call function (appropriate term?).

According to an embodiment of the present invention, in step S40, a command for decrementing the variable by '1' may be input in a line preceding the searched return command.

According to an embodiment of the present invention, the step S50 may input a command in the gadget and the function including the retrieved return command.

Preferably, the step S50 may be performed in a row immediately before the searched return instruction.

5 is an exemplary diagram of a program generated by a computer program creation method according to the present specification.

Referring to Fig. 5, it can be seen that similar to Fig. However, in the example shown in Fig. 5, when compared with Fig. 1, it can be seen that an instruction to increase a variable after a call instruction, an instruction to decrease a variable before a return instruction, and an instruction to check a variable value are added.

6 is a conceptual diagram of ROP attack detection in a program generated by a computer program creation method according to the present specification.

Referring to FIG. 6, it can be confirmed that the value of the variable is set to '1' in the main function caller. Also, it can be confirmed that even if the f1 function and the f5 function are successively called, the value of the variable is maintained at '1' without increasing. It differs from the conventional zero-island divider. Each time a call is returned from a called callee, the value of the variable is reduced to zero. The reduced variable value is incremented again after returning and is maintained at '1'. Therefore, in a normal case without an ROP attack, the value of the variable does not fall below '0'.

On the other hand, suppose that an ROP attack occurs after the f5 function. The value of the variable will be '0' in the process of return command after f5 function. And the gadget g1 executed by the ROP attack does not increase the variable because there is no call instruction. The value of the variable will be '-1' because it does not increase the variable but performs only the return instruction. Therefore, the ROP attack can be detected by sensing that the value of the variable has fallen below '0'.

FIG. 7 is a comparative view of a ROP attack monitoring point of a program generated according to the prior art and the present specification.

Referring to FIG. 7, it is possible to detect an ROP attack when the gadget is executed in proportion to the number (n) of normally invoked function callees in the case of the conventional zero-sum hypothesis. On the other hand, in the case of the program according to the present specification, it is possible to detect an ROP attack immediately when the gadget is executed more than once, irrespective of the number of function callees normally called.

The method of generating a computer program according to the present invention may be implemented as a computer program for causing a processor to perform a compiling operation for converting an advanced language to a machine language.

In this case, the computer program may be stored in a computer-readable storage medium.

The storage medium is a machine readable medium. The term machine readable medium may be defined as a medium that stores and provides data to a type of information that can be detected by a physical mechanism that reads information so that the machine can read the information. The storage medium may include non-volatile media and volatile media. The machine-readable medium includes, but is not limited to, a floppy disk, a flexible disk, a hard disk, a magnetic tape, a compact disc read-only memory (CD-ROM) , A punch card, a papertape, a ram, a programmable read-only memory (PROM), an erasable PROM (EPROM), and a flash-EPROM have.

The computer-readable storage medium may further comprise: a computer-readable storage medium; And a processor for executing the computer-readable storage medium.

The information processing device described in the present specification may be a mobile phone, a smart phone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation device, a slate PC PCs), tablet PCs, ultrabooks, wearable devices (e.g., smartwatches, smart glass, HMDs (head mounted displays), etc.) .

The embodiments and the accompanying drawings described in the present specification are merely illustrative of some of the technical ideas included in the present invention. Accordingly, the embodiments disclosed herein are for the purpose of describing rather than limiting the technical spirit of the present invention, and it is apparent that the scope of the technical idea of the present invention is not limited by these embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims (12)

A method of generating a computer program for performing a compiling operation for converting an advanced language into a machine language using a processor,
(a) receiving a program creation instruction including a function and a gadget;
(b) setting a variable on a main function caller of the program requested to be created and inputting a command for initializing the variable value to '0';
(c) searching for a call command in the program requested to be generated and inputting a command for incrementing the variable by '1' to a function including the searched call command;
(d) searching for a return instruction in the program requested to be generated, and inputting a command to decrease the variable by '1' to a function and a gadget including the searched return instruction; And
(e) inputting a command to determine whether the value of the variable in the program requested to be generated is less than or equal to '0'. The method according to claim 1,
Wherein the step (c) is a step of inputting a command for incrementing the variable by '1' to the caller's return line in the next line of the searched call function (appropriate term?). The method according to claim 1,
Wherein the step (d) comprises the step of inputting a command for decrementing the variable by '1' in a line preceding the searched return command. The method according to claim 1,
Wherein the step (e) is a step of inputting a command in a gadget and a function including a return command retrieved in step (d). The method of claim 4,
Wherein the step (e) is a step of inputting a line immediately before the return instruction retrieved in the step (d). A computer program for causing a processor to perform a compiling operation for converting an advanced language into a machine language,
(a) receiving a program creation instruction including a function and a gadget;
(b) setting a variable on a main function caller of the program requested to be created and inputting a command for initializing the variable value to '0';
(c) searching for a call command in the program requested to be generated and inputting a command for incrementing the variable by '1' to a function including the searched call command;
(d) searching for a return instruction in the program requested to be generated, and inputting a command to decrease the variable by '1' to a function and a gadget including the searched return instruction; And
(e) inputting a command to determine whether the value of the variable in the program requested to be generated is less than or equal to '0', and recorded in a recording medium readable by a computer. The method of claim 6,
Wherein the step (c) is a step of inputting a command for incrementing the variable by '1' to the caller's return line in the next line of the searched call function (appropriate term?). The method of claim 6,
Wherein the step (d) is a step of inputting a command for decrementing the variable by '1' in a line preceding the searched return command. The method of claim 6,
Wherein the step (e) is a step of inputting a command in a gadget and a function including a return command retrieved in step (d). The method of claim 9,
Wherein the step (e) is a step of inputting a line immediately before a return instruction retrieved in the step (d). A computer-readable storage medium characterized in that a computer program according to any one of claims 6 to 10 is stored. A computer-readable storage medium according to claim 11; And
And a processor for executing the computer-readable storage medium.

Images