CAJ | 학술논문

针对传统的代码注入和代码复用等攻击技术的缺陷，返回导向编程（Return-OrientedProgramming，ROP）提出了复用以ret指令结尾的短指令序列，实现图灵完备编程的思想．ROP攻击可以绕开现有的针对代码注入的防御，且相比于传统代码复用技术，构造功能更为强大．但ROP攻击使用的ret指令结尾的指令序列具有明显的特征，这些特征导致ROP攻击容易被检测到．现有的ROP改进技术使用jmp指令结尾的短指令序列构造攻击，虽然消除了以ret指令结尾的特征，但同时引入了新的特征，且并不具有实用性．文中提出了一种分支指令导向（Branch Instruction-OrientedProgramming，BIOP）攻击技术，使用jmp指令或call 指令结尾的短指令序列构造攻击．相比于以前的工作，BIOP不引入新的特征，能有效避免现有的防御技术．同时我们分析并解决了构造攻击时寄存器的副作用，提出控制指令序列概念解决构造时内存冲突，实现自动化构造BIOP攻击．作者设计了一个自动化构造BIOP工具，构造了大量实际的BIOPshellcode，实验结果表明BIOP攻击可以绕过现有的ROP防御技术．
침대전통적대마주입화대마복용등공격기술적결함，반회도향편정（Return-OrientedProgramming，ROP）제출료복용이ret지령결미적단지령서렬，실현도령완비편정적사상．ROP공격가이요개현유적침대대마주입적방어，차상비우전통대마복용기술，구조공능경위강대．단ROP공격사용적ret지령결미적지령서렬구유명현적특정，저사특정도치ROP공격용역피검측도．현유적ROP개진기술사용jmp지령결미적단지령서렬구조공격，수연소제료이ret지령결미적특정，단동시인입료신적특정，차병불구유실용성．문중제출료일충분지지령도향（Branch Instruction-OrientedProgramming，BIOP）공격기술，사용jmp지령혹call 지령결미적단지령서렬구조공격．상비우이전적공작，BIOP불인입신적특정，능유효피면현유적방어기술．동시아문분석병해결료구조공격시기존기적부작용，제출공제지령서렬개념해결구조시내존충돌，실현자동화구조BIOP공격．작자설계료일개자동화구조BIOP공구，구조료대량실제적BIOPshellcode，실험결과표명BIOP공격가이요과현유적ROP방어기술．
Return-Oriented Programming (ROP)is a technique which leverages the instructionsnippets in existing libraries/executables to construct Turing Complete programs.Such techniquecan generate the shellcode which evades most code injection defenses.However,ROP attack isusually composed with gadgets which are ending in ret instruction without the corresponding callinstruction.Based on this fact,several defense mechanisms have been proposed to detect theROP malicious code.In this paper,we present Branch Instruction-Oriented Programming(BIOP)attack which uses the gadgets ending in jmp instruction or call instruction.This newtechnique,which uses jmp instruction or call instruction to replace the ret instruction,breaks thehypothesis of existing defense tools.Meanwhile we propose a tool to automatically construct thereal-world BIOP attack,which as demonstrated in our experiment can bypass most of the exiting ROP defenses.