WO2019237849A1

WO2019237849A1 - Formalized method for analyzing code vulnerabilities that may cause attack

Info

Publication number: WO2019237849A1
Application number: PCT/CN2019/085598
Authority: WO
Inventors: 杨力祥
Original assignee: 杨力祥
Priority date: 2018-06-12
Filing date: 2019-05-06
Publication date: 2019-12-19
Also published as: CN110598407A

Abstract

The present invention relates to information technology, in particular to the field of information security. Disclosed is a formalized method for analyzing code vulnerabilities that may cause an attack, specifically comprising searching for hidden execution sequences and hiding codes, and searching for privileged instructions. By applying the solution provided by the present invention, attacks such as a dirty cow vulnerability can be prevented, and unauthorized operations performed during running because of the existence of unnecessary instructions in a file can be prevented.

Description

A Formal Analysis Method for Code Vulnerabilities That May Cause Attack Risk

Technical field

The present application relates to the field of information technology, and in particular, to a formal analysis method for finding code loopholes that may cause attack risks.

Background technique

In the prior art, there is an attack manner in which a specific execution order branch is triggered to illegally obtain root authority. For example, the Dirty Cow and Huge Dirty Cow vulnerabilities discovered a while ago are a specific implementation of the aforementioned attack methods. Because it does not require the traditional buffer overflow and other methods, it is more concealed and more difficult to be identified by the pattern recognition-based anti-attack methods in the prior art, such as antivirus software, vulnerability detection tools, and so has greater harm.

Summary of the Invention

Aiming at the defect that it is difficult to find some hidden specific execution order branches in the prior art that may cause an attacker to obtain root privileges illegally, the present invention discloses an analysis method for discovering code vulnerabilities that may cause attack risks. A formal analysis method that finds code vulnerabilities that could pose an attack risk.

In a specific implementation manner of the present invention, a method for searching for a hidden execution order is characterized in that: all the execution orders of branches involved in the program are counted during the compilation phase; all branch execution orders that are executed are recorded at runtime, and Compare with the statistical results of the compilation stage to determine which branch execution order has not been executed, and the execution order that has not been executed is to hide the execution order.

In a specific implementation of the present invention, a method for searching for hidden code is characterized in that all the code of the program is counted during the compilation phase; all the executed code is recorded during the run time and compared with the statistical results of the compilation phase. To determine which code has not been executed, and the code that has not been executed is to hide the code.

In a specific implementation of the present invention, a method for searching for a privileged instruction is characterized in that: a user-specified machine instruction is searched in a file designated by the user, and if found, the instruction position is fed back to the user, On the contrary, there is no corresponding instruction.

The technical solution of the present invention can achieve the following technical effects:

By searching for the hidden execution order, you can find that the program does not appear in the normal state, and under the attack state, it will cause the execution order of the attack, such as DirtyCow.

By searching for hidden code methods, you can find vulnerabilities in the program that do not require external incentives, but can initiate attacks through specific conditions, such as logic bombs.

By searching for specific instructions, you can find out whether there are specified machine instructions in the specified file to prevent unauthorized instructions from appearing in the file and causing unauthorized operations at runtime.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly explain the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without paying creative labor.

Figure 1: Schematic diagram of syntax tree node record statement information

Figure 2: Execution diagram of all branches that may occur after the sample program is executed

Figure 3: Schematic diagram of the node corresponding to a statement in the sample program

detailed description

In the following, the technical solutions in the embodiments of the present invention will be clearly and completely described with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The technical content of the present invention will be specifically described below through specific embodiments.

Example 1

Search hidden execution order gadget implementation

In the process of compiling syntax analysis, record the file number of the source file where each statement is located, the line number in the source file, and the corresponding statement number in each line. A preferred solution is to record this information in Each statement forms at the root of the syntax tree. Figure 1 shows an alternative way to record the above information through the root node of the syntax tree.

The leftmost subtree of FIG. 1 describes the 0th statement in line 55 of the subtree corresponding to file number 0, and this information is recorded in the root node of the leftmost subtree of FIG. The sub-trees in the middle position and the back side of FIG. 1 record information of their corresponding sentences.

The compiled assembly instructions for each statement correspond to a set of file numbers, line numbers, and statement numbers. These positioning information, along with the assembly instructions, are stored in object file A. The scenario is as follows:

File number: 0 Line number: 55 Statement number: 0

Statement A compiled assembly instructions

File number: 1 Line number: 18 Statement number: 0

Statement B compiled assembly instructions

File number: 1 Line number: 18 Statement number: 1

Statement C compiled assembly instructions

The assembly instructions and positioning information in object file A are finally saved in the executable file.

In addition, you must determine and record all branch execution orders that may occur during program execution during the compilation phase, such as the following source program:

01: int main ()

02: {

03: int a = 4, b = 3, c = 2, d = 1;

04: intm = 10, n = 5;

05: if (a> b)

06: {

07: m = n;

08:}

09: if (a> c)

10: {

11: n = m;

12:}

13: else if (c> d)

14: {

15: m = n;

16:}

17: else

18: {

19: n = m;

20:}

21: num1:

22: switch (a)

twenty three:{

24: case 3:

25: m = n;

26: break;

27: case 4:

28: a = a + 1;

29: break;

30: case 5:

31: a = a + b;

32: break;

33: case 6:

34: a = a-1;

35: break;

36: default:

37: break;

38:}

39: return 0;

40:}

Figure 2 shows the execution sequence diagram of all branches that may occur after the above example program is executed. In the above example program, the codes labeled 05, 09, 13, 17, 24, 27, 30, and 33 may generate branches, and the structure on the right side of FIG. 2 corresponds to the branches that may be generated by the above program.

Taking the structure at reference numeral 09 as an example, FIG. 3 shows the structure in detail. Among them, "00" and "00" respectively represent the file number of the branch statement, the line number of the branch statement, and the statement number of the branch statement in the line; there are two branches below, where the branch with 0 represents the execution result of the branch statement The execution order when it is false; the branch that is 1 represents the execution order when the execution result of the branch statement is true.

The method of searching the hidden execution order in the executable file is: when the executable program is loaded and executed, set TF in the EFLAGES register to 1, so that each time the executable program executes an instruction, a debug exception is generated. Debugging an exception service program can determine whether the current instruction is a branch instruction based on the positioning information in the executable program. If it is not, it is not processed. If it is, determine which file, line number, and statement it belongs to, and Recorded in a binary tree structure. After the execution test of the executable program is completed, the executed branch statements will form a binary tree. Using this binary tree and the binary tree formed by all the branch statements formed during compilation, you can determine which execution orders have not been executed. These The execution order of the branch that is not executed is to hide the execution order.

Example 2

Search for code-behind gadget implementations

File number: 0 Line number: 55 Statement number: 0

Statement A compiled assembly instructions

File number: 1 Line number: 18 Statement number: 0

Statement B compiled assembly instructions

File number: 1 Line number: 18 Statement number: 1

Statement C compiled assembly instructions

The method of searching for hidden code in the executable file is: when the executable program is loaded and executed, set TF in the EFLAGES register to 1, so that each time the executable program executes an instruction, a debug exception is generated, and the kernel debugs The exception service program can determine which file, line number, and statement belong to the instructions executed at the time according to the positioning information in the executable program, and record them. After the execution test of the executable program is completed, the system can count the file numbers, line numbers, and statement numbers of the statements corresponding to all the executed instructions, and use this information to compare with all the positioning information formed during compilation to determine. Which statements have not been executed, and those statements that have not been executed are code hiding.

Example 3

Search for specific instruction gadget implementations

Provide a human-computer interaction interface for users, allowing users to enter machine instructions and target files to be scanned. According to the input, the gadget searches the specified target files for the existence of the corresponding machine instructions. If so, determines the location of the instructions and displays them to the user. Otherwise, the user is prompted that the corresponding instruction does not exist.

The above descriptions are merely preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

A method for searching for hidden execution order, which is characterized in that all execution orders of branches involved in the program are counted during the compilation phase; all execution order of branches that are executed are recorded at runtime and compared with the statistical results of the compilation phase, so that To determine which branch execution order has not been executed, the execution order that has not been executed is to hide the execution order.
A method for searching for hidden code, which is characterized in that all the code of the program is counted during the compilation phase; all the executed code is recorded at runtime and compared with the statistical results of the compilation phase to determine which codes have not been executed and not The executed code is the hidden code.
A method for searching for a privileged instruction, which is characterized in that a user-specified machine instruction is searched in a file designated by the user, and if found, the instruction position is fed back to the user, otherwise, there is no corresponding instruction.