函数粒度的程序地址空间随机化技术研究

Address space layout randomization is an effective system protection mechanisms for it enhances the diversity of the software system. Lack of solutions to determine the destination address of the indirect transfer instruction, without the dependent relationship of the functions current researches are not able to do fine-grained randomization on the function level. This project attempts to perfect indirect transfer instruction pattern analysis, summarize and improve existing variety of popular machine code analysis technologies; with the help of these technologies, according to the define-use relation of the expression in indirect transfer instructions, this project is going to do inter-procedural backtrace and pattern matching on several kinds of scenes which generate by switch-case statements, virtual function calls and function pointers, and design a kind of goal driven inter-procedural indirect transfer instruction address recognization system, which is on the basis of the ayalysis techniques above; this project integrates the indirect tranfer instruction analyze system into fine-grained address space layout randomization on the function level, constructs inter-procedural dependency, and develops a solution to executable fine-grained address space layout randomization on the function level. Finally, the project will implement fine-grained address space layout randomization on function level in Linux loader;In addition, this project will conduct ROP attack defense capability test.

程序地址空间随机化丰富了软件系统的多样性，是一种有效的系统防护机制。由于二进制机器代码中间接转移指令的存在，函数间的依赖关系难以构造，所以目前的研究没有能够做到函数粒度地址空间随机化的。本项目旨在完善间接转移指令类型分析，整理并改进现有的多种优秀的机器代码分析技术；并在上述分析技术的基础上，根据间接转移指令中目标表达式的定义使用关系，针对由switch-case语句、虚函数调用以及函数指针所产生的间接转移指令的场景进行过程间的回溯追踪与模式匹配，建立一个目标驱动的跨过程地址识别系统；本项目将上述目的地址分析识别系统整合至函数粒度地址空间随机化的研究中，构造函数间依赖关系，结合函数可随机化性的研究，给出可执行程序函数粒度地址空间随机化解决方案。最后，本项目将在Linux加载器中实现函数粒度地址空间随机化，并对ROP等攻击的防御能力进行验证。

程序地址空间随机化是一种有效的系统防护机制。由于二进制机器代码中间接转移指令的存在，函数间的依赖关系无法构造，所以目前的研究没有能够做到函数粒度随机化的。本项目完善间接转移指令类型分析，整理并改进现有的多种优秀的机器代码分析技术；并在上述分析技术的基础上，根据间接转移指令中目标表达式的定义使用关系，针对由switch-case语句、虚函数调用与函数指针的间接转移指令的场景进行过程间的回溯追踪与模式匹配，建立一个目标驱动的跨过程地址识别系统；本项目将上述目的地址分析识别系统整合至函数粒度随机化的研究中，构造函数间依赖关系，结合函数可随机化性的研究，给出可执行程序函数粒度地址空间随机化解决方案。最后，本项目将实现一个基于操作系统加载器的自动化函数粒度地址空间随机化工具，并对ROP等攻击的防御能力进行相关测试。