【摘要】 针对单字节栈溢的分析效率低下且经验难以复用的情况,提出一种黑盒分析方法。根据畸形EBP特征,确定异常由单字节栈溢出导致;不断对异常样本进行变异并收集运行信息,直至获得更利于异常分析与漏洞利用的样本;对该样本简单修改,可实现软件漏洞的利用。该方法具有易实施、无需深入分析程序内部逻辑、自动化程度高的特点,能有效提高异常分析的效率,在程序及真实漏洞案例上的实验验证了该方法的有效性。更多还原

【Abstract】 The crash analysis for off-by-one stack based buffer overflow is time-consuming and labor-intensive.To deal with the problem,a black-box off-by-one stack based buffer overflow crash analysis method was presented to deal with the problem.Whether the crash was caused by off-by-one stack based buffer overflow was determined via malformed EBP register value.Mutation-based fuzzing approach was used to generate new malformed-samples,and run-time information was collected.A sample was obtained which was more suitable for exploit writing.Exploitation was achieved via simple modification of the sample.The proposed method does not require in-depth program analysis and it is easy to deploy and highly automated.Experiments on both self-developed and real software verify the effectiveness of the proposed method.更多还原