基于指令校验的软硬件协同代码重用攻击防护方法

摘要

Code-reuse attacks (CRAs)are difficult to detect and defend,especially on widely used x86 processors. One reason is that lots of unintended but legal instructions exist in x86 binary codes.The unintended instructions make the finding of so called gadgets for CRAs is much easier than that of RISC processors.Previous studies rely on software-only means to tackle the unintended instruction problem,which makes their approaches are either very costly or can only be ap-plied under restricted conditions.In this paper,we propose a hardware/software co-design approach to tackle the unintended instruction problem.The proposed mechanism has little performance impact on the examined SPEC CPU 2006 benchmarks. We also propose using hardware control-flow locking as a complementary technique.By using the two techniques together, an attacker will have little chance to carry out CRAs on x86 processors.%面向x86处理器的代码重用攻击难于防护的一个重要原因是，在x86程序代码中存在大量合法但非编程者预期要执行的指令．这些在代码中大量存在的非预期指令可被用于构造实现CRA的组件．先前研究均采用软件方法解决非预期指令问题，运行开销大且应用受限．本文的主要贡献之一是提出了一种低开销的软硬件协同方法来解决x86的非预期指令问题．实验表明，本文的实现方法仅给应用程序带来了-0．093％～2．993％的额外运行开销．此外，本文还提出采用硬件实现的控制流锁定作为一项补充技术．通过同时采用两个技术，可以极大降低x86平台遭受代码重用攻击的风险．