A study of Binary Instrumentation techniques

A study of Binary Instrumentation techniques
复制标题

二进制仪器技术的研究

DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
S. Priyadarshan
S. Priyadarshan
中科院分区：
--
文献类型：
--
作者：
S. Priyadarshan

文献摘要

被引文献

相似文献

低级别的漏洞仍然是计算机系统受到危害的一个重要来源。尽管在操作系统级别/硬件级别部署了各种保护机制，但攻击者仍然能够利用内存损坏漏洞来危害程序执行。许多编译器或基于源代码的解决方案已被提出来检查内存损坏，控制分流等，然而，源代码的不可用性限制了大规模部署这样的解决方案。二进制插装可以在执行低级别安全策略方面发挥重要作用，例如CFI（控制流完整性），SFI（软件故障隔离）和代码随机化。二进制插装是将新代码引入程序而不改变其整体行为的过程。二进制插装可以在运行时完成（动态二进制插装），也可以在运行时完成（静态二进制插装）。静态二进制插装（SBI）可以以更少的性能开销产生有效的插装二进制文件。然而，SBI是具有挑战性的，因为数据嵌入在代码和间接分支。为了充分实施DEP（数据执行预防），现代编译器已经开始通过将不同的部分分配给代码和数据来将数据与代码分离。此外，为了使用ASLR（地址空间布局随机化），x86-64位程序被编译为位置独立的可执行程序。大多数x86-64 Linux发行版上的所有常用二进制文件都是PIE。PIE可执行文件具有可用于恢复间接分支目标的重定位信息。利用这些因素可以帮助SBI变得强大，完整和准确。本报告介绍了各种静态和动态二进制插装技术和安全策略的调查，例如使用二进制插装强制执行的CFI和代码随机化。在本报告的最后，我们介绍了我们针对x86-64 PIE二进制文件的细粒度代码随机化方法。我们利用搬迁信息的PIE二进制文件，以实现完整和正确的反汇编。这有助于我们在基本块级别实现细粒度的代码随机化，而无需使用任何符号或调试信息。
Low-level vulnerabilities have remained an important source of compromise in computer systems. Despite the deployment of various protection mechanisms at the OS level/hardware level, attackers have been able to exploit memory corruption vulnerabilities to compromise a program execution. Many compiler or source code based solutions have been proposed to check memory corruption, control flow diversion, etc. However, the unavailability of source code limits the large scale deployment of such solutions. Binary instrumentation can play an important role in enforcing low-level security policies such as CFI (Control flow integrity), SFI (Software fault isolation) and code randomization. Binary instrumentation is the process of introducing new code into a program without changing its overall behavior. Binary instrumentation can be done either at the runtime (Dynamic binary instrumentation) or offline (Static binary instrumentation). Static binary instrumentation (SBI) results in efficient instrumented binaries with less performance overhead. However, SBI is challenging because of data embedded within code and indirect branches. To enforce DEP (Data execution prevention) fully, modern compilers have started to separate data from code by assigning different sections to code and data. Also, to employ ASLR (Address space layout randomization), x86-64 bit programs are being compiled as position independent executable. All the commonly used binaries on most of the x86-64 LINUX distributions are PIE. PIE executables have relocation information which can be exploited to recover indirect branch targets. Exploiting these factors can help SBI become robust, complete and accurate. This report presents a survey of various static and dynamic binary instrumentation techniques and security policies such as CFI and code randomization that are enforced using binary instrumentation. At the end of this report, we introduce our fine-grained code randomization approach for x86-64 PIE bi-naries. We exploit the relocation information of the PIE binaries to achieve complete and correct disassembly. This helps us in achieving fine-grained code randomization at the basic block level, without using any symbol or debugging information.