CN104881610A - Method for defending hijacking attacks of virtual function tables - Google Patents

Abstract

The present invention provides a defense method against virtual function table hijacking attacks, which includes: constructing an effective virtual function table set and an effective virtual function set; The reading address of the function data and the calling address of the virtual function; during the running of the executable program, a backup callback function is inserted at the reading address of the virtual function data, and a verification callback function is inserted at the calling address of the virtual function; The virtual function table pointer and the virtual function table it points to are backed up; the backup virtual function table pointer and the virtual function table it points to are verified, and the virtual function is executed or not according to the verification result. The present invention is based on the binary rewriting technology, and deployment can be completed without source code; and it can effectively protect important objects in the program from being affected by virtual function table hijacking attacks; and the system overhead brought by the present invention is also within an acceptable range within.

Description

A defense method against virtual function table hijacking attack

technical field

The invention belongs to the technical field of application programs, and in particular relates to a defense method against virtual function table hijacking attacks.

Background technique

Memory corruption bugs (memory corruption bugs) widely exist in programs written in low-level languages such as C/C++. Vulnerabilities such as stack overflow, heap overflow, and reuse after release are memory corruption bugs. By exploiting such vulnerabilities, attackers can control the data and codes in the memory of the application, change the behavior of the program and even hijack the control flow of the program.

There are the following two processing methods in the prior art:

VTGuard: VTGuard is a virtual function table protection technology deployed in IE browser. The basic idea is: insert a private cookie into each virtual function table, and check when the virtual function is called, whether the cookie in the current table is consistent with the corresponding cookie, and if not, the call will be prohibited. This scheme can effectively reduce virtual function table reuse attacks, but is ineffective against virtual function table corruption and virtual function table injection attacks.

SafeDispatch: SafeDispatch is a compiler-based virtual function table hijacking attack defense solution. It first analyzes the class relationship of the entire program, infers the effective virtual function table set and virtual function set in the program; then executes when the virtual function is called Security check, check whether the current virtual function and virtual function table are in the valid set, if not, the call is prohibited. For the virtual function check, it will bring 7% extra overhead; for the virtual function table check, it will bring 30% extra overhead, and it is invalid for the virtual function table damage attack.

DieHard: DieHard provides a custom memory allocator to achieve randomization and isolation during memory allocation. This technical solution is effective against virtual function table hijacking attacks to some extent, but there are uncertainties.

However, the above schemes have the following defects: Effectiveness: VTGuard, SafeDispatch, and DIeHard cannot guarantee effective protection against all types of virtual function table hijacking attacks; binary compatibility: VTGuard, SafeDispatch, and DieHard are not binary compatible, that is, source code. It is extremely difficult to obtain the source code of the target protection program in practice; system overhead: the system overhead (%7 and %30) brought by SafeDispatch makes it difficult to be applied in practice.

Contents of the invention

In order to solve the above problems, the present invention provides a defense method against virtual function table hijacking attacks. The present invention is based on the binary rewriting technology, and deployment can be completed without source code; and it can effectively protect important objects in the program from being affected by virtual function table hijacking attacks; and the system overhead brought by the present invention is also within an acceptable range within.

The defense method against virtual function table hijacking attack of the present invention comprises:

Step 1. Build a valid virtual function table set and a valid virtual function set; the valid virtual function table set is used to store the virtual function table pointer, and the virtual function table pointer points to the virtual function table; the valid virtual function set is used to store the virtual function table, and the virtual function The table is used to store virtual function pointers, and virtual function pointers point to virtual functions;

Step 2, determine the object that may be hijacked by the virtual function table in the executable program, the object that needs to be protected and the virtual function in the object, and analyze the read address of the virtual function data and the calling address of the virtual function; wherein, the virtual function data includes : virtual function table pointer and virtual function table; different virtual function data of the same object use the same read address, and the virtual function table pointer and virtual function table in the virtual function data use the same read address;

Step 3. During the running of the executable program, a dynamic binary instrumentation method is used to insert a backup callback function at the reading address of the virtual function data, and insert a verification callback function at the calling address of the virtual function;

Step 4. When the executable program executes to the backup callback function corresponding to the virtual function data of a certain object X, in the backup callback function, the virtual function table pointer of the object X and the virtual function table pointed to are backed up, wherein The virtual function table pointer is backed up to the valid virtual function table set, and the virtual function table is backed up to the valid virtual function set;

Step 5. When the executable program executes to the verification callback function corresponding to a certain virtual function, in the verification callback function, check whether the virtual function table pointer Y of the virtual function table where the called virtual function is located is in the valid virtual function in the table collection;

If the virtual function table pointer Y is not in the effective virtual function table set, the verification fails, the virtual function is refused to be called, and the executable program is terminated immediately;

If the virtual function table pointer Y is in the effective virtual function table set, then according to the backed up effective virtual function table set and the effective virtual function set, find the virtual function table Z pointed to by the virtual function table pointer Y; judge whether the called virtual function pointer is In the virtual function table Z, if it exists, the verification is successful, and the executable program is run to call the virtual function; otherwise, the verification fails, the virtual function is refused to be called, and the executable program is terminated.

Further, after the backup in step 4, modify the access attribute of the memory page where the backup data is located to read-only.

Beneficial effect:

The present invention uses the binary instrumentation technology to back up the virtual function table pointer and the virtual function table by inserting the code when the object is instantiated; when the virtual function of the object is called, according to the current virtual function table pointer and The value is compared to determine whether the call can be made. In this way, the present invention protects the virtual function table at the binary level, and effectively protects objects from being affected by virtual function table hijacking attacks.

Description of drawings

Fig. 1 (a) is the schematic diagram of the defense method against virtual function table hijacking attack of the present invention;

Fig. 1 (b) is the backup data schematic diagram of the present invention;

Fig. 1 (c) is the verification process flowchart of the present invention;

Fig. 2 is the schematic diagram of the code that the executable program calls the virtual function;

Fig. 3 (a) is the class structure of object d in the embodiment of the present invention;

Fig. 3(b) is the virtual function table memory layout of the object d in the embodiment of the present invention.

Detailed ways

There are many objects in the PE file, and the virtual function tables of some objects are vulnerable to attacks by attackers, which can seize the control flow of the program, execute dangerous codes, and affect system security.

The technical solution of the present invention is shown in Figure 1(a). First, pre-analyze the PE file to be protected to obtain the generation point of the virtual function table and the call point of the virtual function of the object to be protected; next, perform instrumentation at the point of generation and the call point of the virtual function to add protection to the target program . In order to instrument the target program, it is necessary to obtain through pre-analysis: 1. The virtual function table generation location for instrumentation and data backup; 2. The virtual function call location for security verification when instrumentation is called. There are currently a variety of analysis methods for binary files that can achieve this goal, including automated analysis platforms, static analysis, dynamic analysis, etc.

The defense method against virtual function table hijacking attack of the present invention comprises:

Step 1. Build a valid virtual function table set and a valid virtual function set; the valid virtual function table set is used to store the virtual function table pointer, and the virtual function table pointer points to the virtual function table; the valid virtual function set is used to store the virtual function table, and the virtual function The table is used to store virtual function pointers, and virtual function pointers point to virtual functions.

Step 2, determine the object that may be hijacked by the virtual function table in the executable program, the object that needs to be protected and the virtual function in the object, and analyze the read address of the virtual function data and the calling address of the virtual function; wherein, the virtual function data includes : virtual function table pointer and virtual function table; different virtual function data of the same object use the same read address, and the virtual function table pointer and virtual function table in the virtual function data use the same read address;

The way to obtain the virtual function call address is:

Obtain the attack code through the network, modify the assignment statement of the attack code to the virtual function pointer or virtual function table pointer, and when the executable program calls the virtual function and the virtual function is attacked by the modified attack code, the executable program reports an error, then you can When the execution program reports an error, the address of the instruction executed by the executable program is the calling location of the virtual function.

The way to get the read address of virtual function data is:

In the executable program, the code when the virtual function is called is analyzed, and the data flow of the object to which the virtual function belongs is traced to determine the reading position of the virtual function data of the object.

Step 3. During the running of the executable program, a dynamic binary instrumentation method is used to insert a backup callback function at the reading address of the virtual function data, and insert a verification callback function at the calling address of the virtual function.

Step 4. When the executable program executes to the backup callback function corresponding to the virtual function data of a certain object X, in the backup callback function, the virtual function table pointer of the object X and the virtual function table pointed to are backed up, wherein The virtual function table pointer is backed up in the effective virtual function table set, and the virtual function table is backed up in the effective virtual function set.

Step 5. When the executable program executes to the verification callback function corresponding to a certain virtual function, in the verification callback function, check whether the virtual function table pointer Y of the virtual function table where the called virtual function is located is in the valid virtual function in the table collection;

If the virtual function table pointer Y is not in the effective virtual function table set, the verification fails, the virtual function is refused to be called, and the executable program is terminated immediately;

If the virtual function table pointer Y is in the effective virtual function table set, then according to the backed up effective virtual function table set and the effective virtual function set, find the virtual function table Z pointed to by the virtual function table pointer Y; judge whether the called virtual function pointer is In the virtual function table Z, if it exists, the verification is successful, and the executable program is run to call the virtual function; otherwise, the verification fails, the virtual function is refused to be called, and the executable program is terminated.

Further, after the backup in step 4, modify the access attribute of the memory page where the backup data is located to read-only.

Figure 2 shows the process of calling a virtual function obtained by decompiling a certain program (Intel syntax). Calling a virtual function in a program includes three steps: the first step is to obtain the address of the object calling the virtual function, and then obtain the address of the virtual function table stored at the first address of the object (the starting address of the virtual function table in memory), Finally, the offset of the called virtual function in the virtual function table is obtained according to the calling instruction, and the virtual function is called according to the offset. Wherein, if the object has a virtual function table, its virtual function table is located at the front end of the exclusive. Among them, the first address of the object is stored in the eax register, and the ecx register is the pointer of the virtual function table, and its value is the address of the virtual function table. It can be seen from the calling process that whether the virtual function table pointer is tampered (virtual function table injection/reuse attack) or the virtual function table (virtual function table destruction attack) is tampered with, the integrity of the program control flow will be destroyed.

Now assume that through the pre-analysis stage, it is known that an object stores the virtual function table address (virtual function pointer) in the eax register after the allocation of the virtual function table, and the code location at this time is set_address; there are The virtual function call of the object, the calling instruction is cal[ecx+14c], call[ecx+20c], etc.

Perform instrumentation at the set_address address. The virtual function table pointer stored in the backup register eax is backed up, and the called virtual function pointer is backed up in turn. The virtual function pointer to be called can obtain its position in the virtual function table through the call instruction, for example, call[ecx+14c], which means that the virtual function at the offset of 14c in the virtual function table is called, and needs to be backup. All backed-up virtual function pointers called are called effective virtual function table sets. The virtual function table pointer and the virtual function pointer are backed up in the newly applied memory page. After the backup operation is completed, the attribute of the current page is set as read-only.

Effectiveness analysis: the present invention will check the virtual function table pointer when the virtual function is called, so it can effectively defend against the virtual function table reuse attack and virtual function table injection attack; and the backup of the virtual function pointer for the call ensures that the program Immune to vtable corruption attacks. At the same time, the present invention backs up data in the read-only pages of the memory. Under the threat model defined in the present invention, although the attacker has scanned the backup data, it cannot be tampered with.

The above virtual function table (virtual table, referred to as virtual table or vtable): C++ dynamic polymorphism is realized by virtual function (Vitrual Function). Each class containing virtual functions has a virtual function table, each item in the table is the address of a virtual function, and the virtual function table solves the problems of inheritance and coverage.

Virtual function table hijacking attack (vtable hijacking attack) refers to a class that achieves the purpose of hijacking program control flow by tampering with virtual function table or virtual function table pointer (pointer to virtual function table, whose value is the starting address of virtual function table) attack.

For the protected program, the present invention assumes that the protected program is a PE format file; the binary file is not code-obfuscated; the program is generated by mainstream compilers such as gcc and visual C++.

Object virtual function table memory layout: When using the pointer of the parent class to operate a subclass, the virtual function table is like a map, indicating the actual function that should be called. By traversing the function pointers in the table, the corresponding virtual function can be called. Figure 3(a) shows the class structure of object d, and Figure 3(b) describes the virtual function table memory layout of object d. It can be seen from the figure that each parent class has its own virtual table, and the virtual function table of the subclass The function is placed in the virtual table of the first parent class (determined by the order of declaration); the virtual function covered by the subclass is placed in the virtual function of the original parent class in the virtual table, and the function that is not covered remains unchanged; as shown in Figure 3 ( b), the virtual function table pointer of the object is located in the front position of the object's memory layout; in Figure 3(a), Base1 declares three virtual functions f(), g(), h() in turn, as shown in Figure 3(a) From the virtual function table of Base1 in b), it can be seen that the virtual functions are placed in the table according to the order of their declaration; Figure 3 (a) Derive class diagram, this class is multiple inheritance and the subclass covers a virtual function f of the parent class (); (b) The memory layout of the Derive class object d, the virtual function table pointer is located in the front position of the object instance, it points to each virtual function table of the object, and the position of f() in the parent class virtual function table is replaced by Replaced by a function pointer of the subclass.

The main methods of virtual function table hijacking attack include:

1. Virtual function table corruption (vtable corruption): The attacker overwrites the virtual function pointer stored in the virtual function table to achieve the purpose of attack.

2. Virtual function table injection (vtable injection): The attacker overwrites the virtual function table pointer, making the pointer point to the virtual function table constructed by the attacker. This method is reliable and efficient, and is the most commonly used attack method by attackers.

3. Virtual function table reuse (vtable reuse): The attacker overwrites the virtual function table pointer and makes the pointer point to the existing virtual function table in memory. This method is difficult to use and unstable, and has not yet appeared in actual attacks

Binary instrumentation refers to modifying the program at the binary level, by adding, deleting, and modifying codes to achieve the purpose of adding functions and monitoring program operation.

The present invention assumes that the attacker meets the following conditions:

1. The attacker can read the entire memory, so that the attacker can carry out information leakage attacks (informationleakage attacks), and bypass ASLR (Adress space layout randomization). The difficulty of predicting the destination address, the defense method to prevent the attacker from directly locating the location of the attack code) and other defense mechanisms;

2. The attacker can perform write operations on all writable memory pages, so that the attacker can modify important data such as function return addresses and virtual function table pointers to achieve the purpose of changing the program execution flow;

3. Attackers cannot directly read and write registers;

The above assumptions are strict enough to meet the conditions of attacks using memory corruption vulnerabilities in the real world; at the same time, attackers can also achieve the above conditions by using memory corruption vulnerabilities.

Of course, the present invention can also have other various embodiments, and those skilled in the art can make various corresponding changes and deformations according to the present invention without departing from the spirit and essence of the present invention, but these corresponding Changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (2)

1. A method for defense against virtual function table hijacking attacks, characterized in that it comprises: Step 1. Build a valid virtual function table set and a valid virtual function set; the valid virtual function table set is used to store the virtual function table pointer, and the virtual function table pointer points to the virtual function table; the valid virtual function set is used to store the virtual function table, and the virtual function The table is used to store virtual function pointers, and virtual function pointers point to virtual functions; Step 2, determine the object that may be hijacked by the virtual function table in the executable program, the object that needs to be protected and the virtual function in the object, and analyze the read address of the virtual function data and the calling address of the virtual function; wherein, the virtual function data includes : virtual function table pointer and virtual function table; Step 3. During the running of the executable program, a dynamic binary instrumentation method is used to insert a backup callback function at the reading address of the virtual function data, and insert a verification callback function at the calling address of the virtual function; Step 4. When the executable program executes to the backup callback function corresponding to the virtual function data of a certain object X, in the backup callback function, the virtual function table pointer of the object X and the virtual function table pointed to are backed up, wherein The virtual function table pointer is backed up to the valid virtual function table set, and the virtual function table is backed up to the valid virtual function set; Step 5. When the executable program executes to the verification callback function corresponding to a certain virtual function, in the verification callback function, check whether the virtual function table pointer Y of the virtual function table where the called virtual function is located is in the valid virtual function in the table collection; If the virtual function table pointer Y is not in the effective virtual function table set, the verification fails, the virtual function is refused to be called, and the executable program is terminated immediately; If the virtual function table pointer Y is in the effective virtual function table set, then according to the backed up effective virtual function table set and the effective virtual function set, find the virtual function table Z pointed to by the virtual function table pointer Y; judge whether the called virtual function pointer is In the virtual function table Z, if it exists, the verification is successful, and the executable program is run to call the virtual function; otherwise, the verification fails, the virtual function is refused to be called, and the executable program is terminated. 2. The defense method for virtual function table hijacking attack as claimed in claim 1, characterized in that, after the backup in step 4, the access attribute of the memory page where the backup data is located is modified to read-only.