论文标题
在二进制程序上自动检测漏洞的原始漏洞
Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs
论文作者
论文摘要
自动化发电（AEG）是一项众所周知的艰巨任务，尤其是对于堆漏洞。先前的工作首先检测到堆漏洞，然后通过在二进制程序上使用符号执行和模糊技术来搜索可剥削状态。但是，使用模糊或符号技术发现错误并难以解决堆对象的内部溢出，并不总是那么容易。在本文中，我们提出了一个解决方案DEPA，以检测基于基于原始至关重要的行为模型的堆漏洞的原始漏洞。 DEPA的核心包含两种新型技术，1）通过指针依赖分析的原始至关重要的行为识别，以及2）利用原始确定方法，其中包括触发脆弱性和利用原始素。我们评估了具有堆积漏洞的11个现实世界中的depa（捕获标志）程序，而DEPA可以发现任意写入和任意跳跃的启用十个程序的原始图，除了程序多主-HEAP。结果表明，通过使用我们的方法，原始的至关重要的行为识别和确定剥削原始基原始人是准确有效的。此外，DEPA优于确定对堆对象内部溢出的原始原始的最新工具
Automated Exploit Generation (AEG) is a well-known difficult task, especially for heap vulnerabilities. Previous works first detected heap vulnerabilities and then searched for exploitable states by using symbolic execution and fuzzing techniques on binary programs. However, it is not always easy to discovery bugs using fuzzing or symbolic technologies and solvable for internal overflow of heap objects. In this paper, we present a solution DEPA to detect exploit primitives based on primitive-crucial-behavior model for heap vulnerabilities. The core of DEPA contains two novel techniques, 1) primitive-crucial-behavior identification through pointer dependence analysis, and 2) exploit primitive determination method which includes triggering both vulnerabilities and exploit primitives. We evaluate DEPA on eleven real-world CTF(capture the flag) programs with heap vulnerabilities and DEPA can discovery arbitrary write and arbitrary jump exploit primitives for ten programs except for program multi-heap. Results showed that primitive-crucial-behavior identification and determining exploit primitives are accurate and effective by using our approach. In addition, DEPA is superior to the state-of-the-art tools in determining exploit primitives for the heap object internal overflow
