Windows内存防护机制研究

doi:10.11959/j.issn.2096-109x.2017.00208

网络与信息安全学报 ›› 2017, Vol. 3 ›› Issue (10): 1-15.doi: 10.11959/j.issn.2096-109x.2017.00208

• 综述 • 下一篇

Windows内存防护机制研究

鲁婷婷¹,王俊峰^1,²()

¹ 四川大学计算机学院，四川成都 610065
² 四川大学空天科学与工程学院，四川成都 610065

修回日期:2017-09-18 出版日期:2017-10-01 发布日期:2017-11-13
作者简介:鲁婷婷（1994-），女，甘肃正宁人，四川大学博士生，主要研究方向为信息安全。|王俊峰（1976-），男，安徽芜湖人，博士，四川大学教授、博士生导师，主要研究方向为空间信息网络、网络与信息安全、大数据处理在医学和交通等领域应用。
基金资助:
国家重点研发计划基金资助项目(2016QY06X1205);国家重点研发计划基金资助项目(2016YFB0800605);国家自然科学基金资助项目(91438120);国家自然科学基金资助项目(91338107);国家自然科学基金资助项目(91438119);四川省重点研发计划基金资助项目(17ZDYF2583)

Research on Windows memory protection mechanism

Ting-ting LU¹,Jun-feng WANG^1,²()

¹ College of Computer Science,Sichuan University,Chengdu 610065,China
² School of Aeronautics and Astronautics,Sichuan University,Chengdu 610065,China

Revised:2017-09-18 Online:2017-10-01 Published:2017-11-13
Supported by:
The National Key Research and Development Program(2016QY06X1205);The National Key Research and Development Program(2016YFB0800605);The National Natural Science Foundation of China(91438120);The National Natural Science Foundation of China(91338107);The National Natural Science Foundation of China(91438119);The Technology Research and Development Program of Sichuan Province(17ZDYF2583)

摘要/Abstract

摘要：

近30年来，攻击者利用Windows内存漏洞发起的攻击事件层出不穷，其惯用手段是攻击控制数据以劫持执行流。为此，微软在Windows上加注了层层防护以遏止此类攻击，但现阶段部署的防护机制无法阻止针对非控制数据的攻击。鉴于目前研究Windows内存防护机制的文献寥寥无几，对Windows采用的各种内存防护机制及其突破技术进行了深入研究，并详述非控制数据防护的研究现状，在此基础上，分析了Windows内存防护面临的挑战，并讨论了内存防护的未来之路。

关键词: Windows内存防护, 内存防护机制, 控制数据防护, 非控制数据防护

Abstract:

Over the past three decades,attacks exploiting Windows memory holes have emerged in an endless stream,and the usual means is to attack control-data to hijack the execution flow of the program.To this end,Microsoft has added layers of protection mechanisms to Windows to prevent such attacks.But at this stage,the defensive mechanisms deployed on Windows cannot prevent attacks against non-control-data.In view of the published articles lacking comprehensive study of Windows memory protection mechanism,a detailed introduction to Windows memory protection mechanism and its breakthrough techniques,and non-control-data protection research status was conducted.On this basis,the challenges of Windows memory protection were analyzed and the future of memory protection was discussed.

Key words: Windows memory protection, memory protection mechanism, control-data protection, non-control-data protection

中图分类号:

TP309

鲁婷婷,王俊峰. Windows内存防护机制研究[J]. 网络与信息安全学报, 2017, 3(10): 1-15.

Ting-ting LU,Jun-feng WANG. Research on Windows memory protection mechanism[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 1-15.

图/表 13

图1

图2

图3

图4

图5

图6

图7

图8

图9

图10

图11

图12

表1

各类防护方案分析"

	防护方案	防护对象	优点	缺点
非控制数据防护方案	DIFT	决策数据＆控制数据	对应用程序完全透明执行开销小仅有1.1%无误报	采用宽松的不可信数据追踪规则，导致引入不必要的陷阱
	PointerTaintednessDetection	指针解引用	对应用程序完全透明执行开销小误报率低逼近于0	存在漏报引入硬件开销
	DFI	程序的所有变量	不需要修改源码无误报	执行开销大存在漏报
	DSR	内存数据	较DFI执行开销小，平均15%	需修改源码等价类掩码计算不精确
	WIT	可写对象＆控制数据	不需要修改源码较DFI、DSR开销小，平均7%无误报	存在漏报引入空间开销未检查读操作，无法阻止越界读
	SIDAN	系统调用参数及影响其调用的变量	执行开销小无误报	需修改源码存在漏报只能检测非法系统调用
	ValueGuard	程序的所有变量	无误报	需修改源码全局防护执行开销很大只能检测堆栈攻击
	DCI	安全敏感数据	较DFI、DSR大范围防护，DCI执行开销小，最大16.34%较WIT只能检查读操作，DCI可同时检查读操作和写操作	需修改源代码需人工干预存在漏报
Windows已部署的内存防护机制	GS	返回地址	遏止直接修改返回地址	Security cookie易泄露
	SafeSEH	异常处理函数指针	保证了异常处理函数据的有效性	对指向堆区的异常处理函数指针无效
	SEHOP	SEH链	在SafeSEH前检查SEH链的完整性	可通过伪造SEH链绕过检查
	DEP	数据页	阻止执行部署到数据页的shellcode	多数第三方应用的DLL不支持对可写可执行页不起作用
	ASLR	控制数据地址	加大定位通用跳板等跳转地址的难度	映像随机化只对映射基值的前 2 个字节进行了随机化堆栈随机化只能防止精准攻击
	CFG	间接跳转地址	可防范对间接跳转目标地址的攻击	位图映射基址固定调用 NtAllocVirtualMemory 分配的可执行虚拟内存对应位图位全为1进程加载不支持CFG的模块，将不受CFG保护
	RFG	返回地址	返回地址保存在攻击者不可控的Thread Control Stack	只能防护针对返回地址的攻击，验证失败后执行的处理可以通过其他方式修改
	Safeunlinking	堆块块首	在分配堆块之前验证flink和blink 的有效性	只考虑了堆块分配时指针的完整性，没有处理堆块回收时的情况
	Heapmetadatacookies	堆块块首	可防止直接溢出覆盖块首中的 flink 和blink	和GS一样都存在cookie泄露的风险
	Heapmetadataencryption	堆块块首	对堆块块首数据加密存储，可防止对其进行直接修改	只对块首元素进行加密存储，并没有加密存储堆块数据
	Heapguard pages	堆块	堆块首尾加入防护页，有效防止跨堆块攻击块首	对同堆块的堆数据还不能起到保护作用，仍可覆盖同一堆块中的函数指针实施攻击

表1

参考文献 50

[1]	Morris worm[EB/OL]. .
[2]	DURUMERIC Z , LI F , KASTEN J ,et al. The matter of heartbleed[C]// 2014 Conference on Internet Measurement. 2014: 475-488.
[3]	ZATKO P . How to write buffer overflows[EB/OL]. .
[4]	HOGLUND G . Advanced buffer overflow technique[EB/OL]. .
[5]	ABADI M , BUDIU M , ERLINGSSON U ,et al. Control-flow integrity[C]// The 12th ACM Conference on Computer and Communications Security. 2005: 340-353.
[6]	KUZNETSOV V , SZEKERES L , PAYER M ,et al. Code-pointer integrity[C]// The 11th USENIX Symposium on Operating Systems Design and Implementation. 2014: 147-163.
[7]	CHEN S , XU J , SEZER E C ,et al. Non-control-data attacks are realistic threats[C]// The 14th USENIX Security Symposium. 2005: 177-191.
[8]	CARR S A , PAYER M . DataShield:configurable data confidentiality and integrity[C]// 2017 ACM on Asia Conference on Computer and Communications Security. 2017: 193-204.
[9]	CASTRO M , COSTA M , HARRIS T . Securing software by enforcing data-flow integrity[C]// The 7th USENIX Symposium on Operating Systems Design and Implementation. 2006: 147-160.
[10]	BHATKAR S , SEKAR R . Data space randomization[C]// The 5th International Conference on Detection of Intrusion and Malware,and Vulnerability Assessment. 2008: 1-22.
[11]	Usage share of operating systems[EB/OL]. .
[12]	ANDERSEN S . Memory protection technologies[EB/OL]. .
[13]	Control flow guard[EB/OL]. .
[14]	COWAN C , PU C , MAIER D ,et al. StackGuard:automatic adaptive detection and prevention of buffer-overflow attacks[C]// The 7th USENIX Security Symposium. 1998: 63-77.
[15]	GS compiler option documentation for Visual Studio 2003[EB/OL]. .
[16]	RICHARTE G . Four different tricks to bypass StackShield and StackGuard protection[EB/OL]. .
[17]	strict_gs_check pragma documentation for Visual Studio 2005[EB/OL]. .
[18]	LITCHFIELD D . Defeating the stack based buffer overflow prevention mechanism of Microsoft Windows 2003 server[EB/OL]. .
[19]	PIETREK M . A crash course on the depths of Win32 structured exception handling[EB/OL]. .
[20]	SAFESEH linker option documentation for Visual Studio 2003[EB/OL]. .
[21]	Preventing the exploitation of structured exception handler (SEH) overwrites with SEHOP[EB/OL]. .
[22]	Miller M . Preventing the exploitation of SEH overwrites[EB/OL]. .
[23]	BERRE S L , CAUQUIL D . Bypassing SEHOP[EB/OL]. .
[24]	SOTIROV A , DOWD M . Bypassing browser memory protections[EB/OL]. .
[25]	SHACHAM H , . The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86)[C]// The 14th ACM CCS. 2007: 552-561.
[26]	BUCHANAN E , ROEMER R , SAVAGE S ,et al. Return-oriented programming:exploitation without code Injection[EB/OL]. .
[27]	Bypassing Windows hardware-enforced data execution prevention[EB/OL]. .
[28]	PaX ASLR[EB/OL]. .
[29]	WHITEHOUSE O . An analysis of address space layout randomization on Windows VistaTM[EB/OL]. .
[30]	SOTIROV A . Windows ANI header buffer overflow[EB/OL]. .
[31]	Heap spraying[EB/OL]. .
[32]	Guard compiler option documentation for Visual Studio 2015[EB/OL]. .
[33]	TANG J . Exploring control flow guard in Windows 10[EB/OL]. .
[34]	THEORI.Chakra jit cfg bypass[EB/OL]. .
[35]	SUN K , OU Y , ZHAO Y H ,et al. Never let your guard down:finding unguarded gates toby-pass control flow guard with big data[EB/OL]. .
[36]	Return flow guard[EB/OL]. .
[37]	Mitigate threats by using Windows 10 security features[EB/OL]. .
[38]	HU H , CHUA Z L , ADRIAN S ,et al. Automatic generation of data-oriented exploits[C]// The 24th USENIX Security Symposium. 2015: 177-192.
[39]	HU H , SHINDE S , ADRIAN S ,et al. Data-oriented programming:on the expressiveness of non-control data attacks[C]// 2016 IEEE Symposium on Security and Privacy. 2016: 969-986.
[40]	AKRITIDIS P , CADAR C , RAICIU C ,et al. Preventing memory error exploits with WIT[C]// 2008 IEEE Symposium on Security and privacy. 2008: 263-277.
[41]	SUH G E , LEE J W , ZHANG D ,et al. Secure program execution via dynamic information flow tracking[C]// The 11th International Conference on Architectural Support for Programming Languages and Operating Systems. 2004: 85-96.
[42]	CHEN S , XU J , NAKKA N ,et al. Defeating memory corruption attacks via pointer taintedness detection[C]// 2005 International Conference on Dependable Systems and Networks. 2005: 378-387.
[43]	BARRANTES E G , ACKLEY D , PALMER T S ,et al. Randomized instruction set emulation to disrupt binary code injection attacks[C]// The 10th ACM Conference on Computer and Communications Security. 2003: 281-289.
[44]	KC G S , KEROMYTIS A D , PREVELAKIS V . Countering code injection attacks with instruction-set randomization[C]// The 10th ACM Conference on Computer and Communications Security. 2003: 272-280.
[45]	STEENSGAARD B , . Points-to analysis in almost linear time[C]// The 23rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. 1996: 32-41.
[46]	DEMAY J C , TOTEL E , TRONEL R . SIDAN:a tool dedicated to software instrumentation for detecting attacks on non-control- data[C]// 2009 Fourth International Conference on Risks and Security of Internet and Systems. 2009: 51-58.
[47]	ACKER S V , NIKIFORAKIS N , PHILIPPAERTS P ,et al. Valueguard:protection of native applications against data-only buffer overflows[C]// The 6th International Conference on Information Systems Security. 2010: 156-170.
[48]	DING R , QIAN C X , SONG C Y ,et al. Efficient protection of path-sensitive control security[C]// The 26th USENIX Security Symposium. 2017: 131-148.
[49]	VEEN V V D , ANDRIESSE D , G?KTAS E ,et al. Practical context-sensitive CFI[C]// The 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015: 927-940.
[50]	G?KTAS E , ATHANASOPOULOS E , BOS H ,et al. Out of control:overcoming control-flow integrity[C]// 2014 IEEE Symposium on Security and Privacy. 2014: 575-589.

Windows内存防护机制研究

Research on Windows memory protection mechanism

在线阅读

pdf下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 13

参考文献 50

相关文章 15

Metrics

推荐阅读 0

[1]	王艺龙, 李震宇, 巩道福, 刘粉林. 基于块邻域的图像双脆弱水印算法[J]. 网络与信息安全学报, 2023, 9(3): 38-48.
[2]	陈任峰, 朱鸿斌. 基于PU learning的信用卡交易安全监管研究[J]. 网络与信息安全学报, 2023, 9(3): 73-78.
[3]	冯冠云, 付才, 吕建强, 韩兰胜. 基于操作注意力和数据增强的内部威胁检测[J]. 网络与信息安全学报, 2023, 9(3): 102-112.
[4]	谢根琳, 程国振, 王亚文, 王庆丰. 基于gadget特征分析的软件多样性评估方法[J]. 网络与信息安全学报, 2023, 9(3): 161-173.
[5]	侯鹏, 李智鑫, 张飞, 孙旭, 陈丹, 崔毅浩, 张寒冰, 荆一楠, 柴洪峰. 金融数据安全治理智能化技术与实践[J]. 网络与信息安全学报, 2023, 9(3): 174-187.
[6]	肖敏, 毛发英, 黄永洪, 曹云飞. 基于属性签名的车载网匿名信任管理方案[J]. 网络与信息安全学报, 2023, 9(2): 33-45.
[7]	许建龙, 林健, 黎宇森, 熊智. 分布式用户隐私保护可调节的云服务个性化QoS预测模型[J]. 网络与信息安全学报, 2023, 9(2): 70-80.
[8]	陈训逊, 李明哲, 吕宁, 黄亮. 内禀安全：网络安全能力体系化构建方法[J]. 网络与信息安全学报, 2023, 9(1): 92-102.
[9]	宋佳烁, 李祯祯, 丁海洋, 李子臣. 椭圆曲线上高效可完全模拟的不经意传输协议[J]. 网络与信息安全学报, 2023, 9(1): 158-166.
[10]	李凤华, 李晖, 牛犇, 邱卫东. 隐私计算的学术内涵与研究趋势[J]. 网络与信息安全学报, 2022, 8(6): 1-8.
[11]	唐飞, 甘宁, 阳祥贵, 王金洋. 基于区块链与国密SM9的抗恶意KGC无证书签名方案[J]. 网络与信息安全学报, 2022, 8(6): 9-19.
[12]	白雪, 秦宝东, 郭瑞, 郑东. 基于SM2的两方协作盲签名协议[J]. 网络与信息安全学报, 2022, 8(6): 39-51.
[13]	刘军, 袁霖, 冯志尚. 集群网络密钥管理方案研究综述[J]. 网络与信息安全学报, 2022, 8(6): 52-69.
[14]	肖敏, 姚涛, 刘媛妮, 黄永洪. 具有隐私保护的动态高效车载云管理方案[J]. 网络与信息安全学报, 2022, 8(6): 70-83.
[15]	林佳滢, 周文柏, 张卫明, 俞能海. 空域频域相结合的唇型篡改检测方法[J]. 网络与信息安全学报, 2022, 8(6): 146-155.