抗CFI代码小工具的自动化多体系结构发现
Automated Multi-Architectural Discovery of CFI-Resistant Code Gadgets
摘要：
内存损坏漏洞仍然是软件系统的严重威胁。为了阻止利用这些漏洞，过去已经提出了许多不同类型的防御措施。最突出的是，控制流完整性（CFI）最近受到了很多关注。已经发布了几个应用粗粒度策略的建议，这些策略具有较低的性能开销。然而，正如最近的袭击所表明的那样，这些设施的安全仍然令人怀疑。为了简化对给定CFI实现的评估，我们引入了一个框架来发现符合粗粒度CFI策略的代码重用攻击的代码小工具。为此，二进制代码被提取并以与体系结构无关的方式转换为符号表示。此外，验证代码小工具以提供安全研究人员所需的功能。我们表明，我们的框架发现更多的CFI兼容的小工具相比，其他代码小工具发现工具。此外，我们证明，代码小工具需要绕过CFI解决方案的ARM架构上可以发现我们的框架以及。
英文摘要：
Memory corruption vulnerabilities are still a severe threat for software systems. To thwart the exploitation of such vulnerabilities, many different kinds of defenses have been proposed in the past. Most prominently, Control-Flow Integrity (CFI) has received a lot of attention recently. Several proposals were published that apply coarse-grained policies with a low performance overhead. However, their security remains questionable as recent attacks have shown. To ease the assessment of a given CFI implementation, we introduce a framework to discover code gadgets for code-reuse attacks that conform to coarse-grained CFI policies. For this purpose, binary code is extracted and transformed to a symbolic representation in an architecture-independent manner. Additionally, code gadgets are verified to provide the needed functionality for a security researcher. We show that our framework finds more CFI-compatible gadgets compared to other code gadget discovery tools. Furthermore, we demonstrate that code gadgets needed to bypass CFI solutions on the ARM architecture can be discovered by our framework as well.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
