CN118278018A - Binary code vulnerability detection method, device and equipment based on value stream state machine - Google Patents

Abstract

The present application relates to a binary code vulnerability detection method, device and equipment based on a value flow state machine, which obtains the corresponding intermediate code by preprocessing the program to be detected, determines the external data introduction point in the intermediate code, and constructs a static value flow graph based on the intermediate code. Based on the static value flow graph, the external data introduction point is used as the data source point, and a DC state machine is used to determine the state values of all value flow graph nodes that reference the data source point according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point, and the potential dangerous pointer access point is screened to obtain the final dangerous pointer access point, and finally the program to be detected is dynamically plugged according to the dangerous pointer access point to realize the detection of arbitrary address pointer dereference vulnerability in the program to be detected. The method can effectively detect arbitrary address pointer dereference vulnerability existing in software.

Description

Binary code vulnerability detection method, device and equipment based on value stream state machine

Technical Field

The present application relates to the field of information security technology, and in particular to a binary code vulnerability detection method, device and equipment based on a value stream state machine.

Background technique

Software vulnerabilities, also known as vulnerabilities, refer to defects in computer system security that threaten the confidentiality, integrity, availability, and access control of the system or its application data. Arbitrary address pointer dereference vulnerabilities are a type of software vulnerability that poses a greater threat. The mechanism of their occurrence is that the pointers used for memory reading, writing, and execution in the program can be controlled by attackers through external input data, allowing attackers to obtain the ability to read, write, and execute any memory through the vulnerability, causing serious threats such as data tampering, information leakage, and even arbitrary code execution.

The key to detecting arbitrary address pointer dereference vulnerabilities is to analyze whether the address parameters of memory read and write instructions can be contaminated by external input. However, for such vulnerabilities, due to the inability to track the propagation process of external data, traditional ASAN can only detect memory access errors when the address of the read and write access happens to be a red zone that is not allowed to be accessed, and it can only give an error report of illegal memory access, and cannot accurately analyze whether the illegal memory access is to write arbitrary data to an arbitrary address.

Summary of the invention

Based on this, it is necessary to provide a binary code vulnerability detection method, device and equipment based on a value stream state machine that can effectively perform software vulnerability detection in response to the above technical problems.

A binary code vulnerability detection method based on a value stream state machine, the method comprising:

Obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

Determining an external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code;

Based on the static value flow graph, the external data introduction point is used as the data source point, and the state values of all value flow graph nodes that reference the data source point are determined by a DC state machine according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point;

Screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The program to be detected is dynamically instrumented according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

In one embodiment, the program to be detected is a binary code.

In one embodiment, the preprocessing of the program to be detected to obtain the corresponding intermediate code includes:

The binary code is subjected to intermediate code promotion to obtain the intermediate code corresponding to the program to be detected.

In one embodiment, a tool including llvm-mctoll or mcsema is used to perform intermediate code promotion on the binary code;

When the tool mcsema is used to perform intermediate code promotion on the binary code, metadata is added to the obtained intermediate code to save the corresponding original assembly instruction address and instruction information.

In one embodiment, determining the external data introduction point in the intermediate code comprises:

The API function in the intermediate code is defined as a triple representation including a function name, a parameter position of external data in the function, and a read length;

In the intermediate code, the instructions of CallInst and InvokeInst are used to perform function calls, and it is determined whether the API functions in the form of triples are external data reading functions;

The external data introduction point is determined according to the location of the API function determined to be the external data reading function.

In one embodiment, the method of using a DC state machine to determine the state values of all value flow graph nodes that reference the data source point according to the value flow graph node type and the state update rule includes:

When the value flow graph node type is reading external data and creating an object, the node status value is updated to "1";

When the value flow graph node type is variable value copy, pointer calculation, variable comparison, variable binary operation, function actual parameter, function formal parameter, function actual return, function formal return, the node state value is updated to the parent node state value of the node;

When the value flow graph node type is memory read, and the parent node status value of the node is greater than "0", the node status value is updated according to the parent node status value minus 1;

When the value flow graph node type is memory write, if the parent node variable of the node is used as a value, the node state value is updated by adding 1 to the parent node state value; if the parent node variable of the node is used as a pointer, the node state value is updated to the parent node state value.

In one embodiment, screening the potential dangerous pointer access points to obtain the final dangerous pointer access points includes:

Among the potential dangerous pointer access points, dangerous pointer access points whose data only come from external input sources are retained, and other pointer access points are screened out;

Among the potential dangerous pointer access points after screening, the potential dangerous pointer access points on the execution path without performing a comparison operation on external data in the process of passing through the data source point to reach the dangerous pointer access point are determined as the final dangerous pointer access points.

In one embodiment, the dynamically instrumenting the program to be detected according to the dangerous pointer access point includes:

In the binary code, modify the instruction corresponding to the dangerous pointer access point into a jump instruction for executing vulnerability code detection;

The vulnerability code detection includes: vulnerability detection code and control flow context recovery code.

A binary code vulnerability detection device based on a value stream state machine, the device comprising:

A preprocessing module, used to obtain a program to be detected, and preprocess the program to be detected to obtain a corresponding intermediate code;

A module for obtaining a static value flow graph of an external data introduction point set, which is used to determine an external data introduction point in the intermediate code and obtain a static value flow graph based on the intermediate code;

A module for determining a potential dangerous pointer access point is used to determine the state values of all value flow graph nodes that reference the data source point based on the static value flow graph, using a DC state machine according to the value flow graph node type and a state update rule, and determining a pointer in a value flow graph node whose state value meets a preset value as a potential dangerous pointer access point;

A potential dangerous pointer access point screening module, used for screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The vulnerability detection module is used to dynamically insert the program to be detected according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

Obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

Determining an external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code;

Based on the static value flow graph, the external data introduction point is used as the data source point, and the state values of all value flow graph nodes that reference the data source point are determined by a DC state machine according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point;

Screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The program to be detected is dynamically instrumented according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

Obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

Determining an external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code;

Based on the static value flow graph, the external data introduction point is used as the data source point, and the state values of all value flow graph nodes that reference the data source point are determined by a DC state machine according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point;

Screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The program to be detected is dynamically instrumented according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

The above-mentioned binary code vulnerability detection method, device and equipment based on the value flow state machine obtains the corresponding intermediate code by preprocessing the program to be detected, determines the external data introduction point in the intermediate code, and constructs a static value flow graph based on the intermediate code. Based on the static value flow graph, the external data introduction point is used as the data source point, and the DC state machine is used to determine the state values of all value flow graph nodes that reference the data source point according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point, and the potential dangerous pointer access points are screened to obtain the final dangerous pointer access point, and finally the program to be detected is dynamically plugged according to the dangerous pointer access point to realize the detection of arbitrary address pointer dereference vulnerability in the program to be detected. This method can effectively detect arbitrary address pointer dereference vulnerability existing in software.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is an example diagram of an arbitrary address pointer dereference vulnerability in one embodiment;

FIG2 is a flow chart of a binary code vulnerability detection method based on a value stream state machine in one embodiment;

FIG3 is a schematic diagram of a local static value flow in one embodiment;

FIG4 is a schematic diagram of a state machine update process in one embodiment;

FIG5 is a schematic diagram of a binary code instrumentation method based on static code control flow modification and recovery in one embodiment;

FIG6 is a structural block diagram of a binary code vulnerability detection device based on a value stream state machine in one embodiment;

FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

Arbitrary address pointer dereference vulnerability is a type of vulnerability with a greater threat in software vulnerabilities. Take the code shown in Figure 1 as an example. The program reads external data from the standard input stream stdin through fgets in line 11 and puts it into data. Then, in lines 30 and 31, the content of data is assigned to linkedListPrev and linkedListNext. Then, in lines 32 and 33, it is used as a pointer to write to memory. At this point, the attacker can completely control the two pointers linkedListPrev and linkedListNext, that is, has a powerful attack capability to write data to arbitrary addresses.

A tool commonly used in academia and industry for vulnerability detection is AddressSanitizer (ASAN for short), which is a dynamic memory error detector for C/C++ programs. It is mainly used to detect many memory access errors that occur during program runtime. ASAN consists of a compiler instrumentation module and a runtime library. The instrumentation module is mainly used on stack memory, while the runtime library is mainly used on heap memory. ASAN can check for vulnerabilities and problems such as memory leaks, out-of-bounds, uninitialized, repeated releases, buffer overflows, stack overflows, wild pointers, and thread deadlocks. During operation, once a memory error is detected, ASAN will crash the program and output useful debugging information, including the call stack, shadow memory mapping, memory access violation type, content read or written, the computer that caused the memory access violation, and memory content.

The key to detecting arbitrary address pointer dereference vulnerabilities is to analyze whether the address parameters of the instructions for reading, writing, and executing memory in the program can be contaminated by external input. The key technology involved is taint analysis technology. The main idea of taint analysis (also known as taint propagation analysis) is to introduce corresponding taint labels for the input data read from the external environment (such as the file system, command line, network data message, etc.) in the target program, and then propagate the taint during the program execution. By judging whether "external input can have an impact on the sensitive program location", it is confirmed whether the target program has security issues. This technology has currently become a research hotspot in the field of information security.

However, in the prior art, due to the inability to track the propagation process of external data, traditional ASAN can only detect memory access errors when the address of the read or write access happens to be a Red Zone that is not allowed to be accessed. Moreover, it can only give an error report of illegal memory access, and cannot accurately analyze whether the illegal memory access is to write arbitrary data to any address. The key to successfully detecting arbitrary address pointer dereference vulnerabilities is to analyze the propagation process of external input. Therefore, a feasible solution is to use existing dynamic taint analysis tools (such as DataFlow Sanitizer) to perform online taint propagation. However, directly using such taint analysis tools will bring two problems: first, the shadow memory used to store taint information will conflict with the existing ASAN, resulting in failure of other vulnerability detection; second, taint analysis of all instructions will introduce very large operating overhead, and practicality is difficult to guarantee.

In view of the above technical defects, as shown in FIG2 , a binary code vulnerability detection method based on a value stream state machine is provided, and the method steps specifically include:

Step S100, obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code.

Step S110, determining the external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code.

Step S120, based on the static value flow graph, takes the external data introduction point as the data source point, uses the DC state machine to determine the state values of all value flow graph nodes that reference the data source point according to the value flow graph node type and the state update rule, and determines the pointer in the value flow graph node whose state value meets the preset value as a potentially dangerous pointer access point.

Step S130, screening the potential dangerous pointer access points to obtain the final dangerous pointer access points.

Step S140: dynamically insert the program to be detected according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

In this embodiment, from the perspective of combining dynamic and static, potential abnormal points are first screened out through the value flow state machine to avoid dynamic analysis of all instructions. On this basis, combined with dynamic stub technology, the corresponding arbitrary address pointer dereference vulnerability trigger logic is inserted into the abnormal point, thereby ensuring that such vulnerabilities are detected with low overhead and high accuracy. Specifically, based on the global static value flow graph, typical input functions are located and their impact on memory objects is tracked to find external input sources. Then, a value flow analysis framework based on a state machine is introduced to dynamically update the state of each node according to the data flow to distinguish whether the data is used as a pointer for memory access, thereby accurately locating potential dangerous pointer access points. Once the external input source and dangerous pointer access point are determined, this method only inserts stubs at these key points during dynamic operation to achieve efficient detection of arbitrary address pointer dereference vulnerabilities.

In step S100, the binary code generated by C/C++ compilation is converted into an LLVM IR intermediate representation that is convenient for analysis.

In this embodiment, when the binary code is preprocessed: intermediate code lifting is performed on the binary code to obtain the intermediate code corresponding to the program to be detected.

Specifically, for binary code, it is promoted to LLVM IR through existing tools such as Microsoft's llvm-mctoll or mcsema. In order to enable the dynamic instrumentation part to locate the original assembly instructions based on the abnormal points obtained by static analysis, the mcsema tool was modified to add metadata to the promoted intermediate code to save the corresponding original assembly instruction address and instruction information.

In this embodiment, the program to be detected can also be a source code, and when preprocessing it: first, each source code file is generated into a corresponding object file through the LLVM compiler framework, and each object file is linked. Then, the intermediate code is extracted from the linked object file to obtain the intermediate code corresponding to the program to be detected.

Specifically, for the source code, the front-end clang provided by the LLVM compiler framework is used to generate the object file corresponding to each source code file, and then these object files are linked, and then the intermediate code is extracted to generate a single IR intermediate representation file containing the IR corresponding to all source codes.

In step S110, the external data introduction point is determined in the intermediate code, that is, the location where the data is initially read from the outside is located in the intermediate code, and the possible sources of external data mainly include network data packets, command line parameters, files, configuration files, environment variables, etc. The way the program reads this data mainly relies on the API functions provided by the third-party library. For example, the API functions provided by libc The function helps the program read a line of data with a maximum of n characters from the specified stream (such as the standard input stream STDIN) and store it in the string pointed to by str. In order to unify the analysis, the API function in the intermediate code is defined as a unified form of a triple representation including the function name, the parameter position of the external data in the function, and the read length.

Specifically, the triple representation is expressed as: <name, input_pos, size>, where name is the function name, input_pos is the parameter position (or return value) of the external data in the function, and size is the length of the read. Taking fgets as an example, it can be expressed as .

Next, the CallInst and InvokeInst instructions are used in the intermediate code to perform function calls, determine whether the API functions represented by each triple are external data reading functions, and determine the external data introduction point based on the location of the API functions determined to be external data reading functions.

In this embodiment, there may be multiple external data introduction points determined.

In step S110, a corresponding static value flow graph is constructed based on the basic data flow direction relationship in the intermediate code.

Static Value Flow Graph (SVFG) is a graphical representation method for program analysis and optimization. It represents variables and memory objects in a program and the relationships between them in the form of a graph. On the basis of traditional data flow graphs, value flow graphs strengthen the value propagation relationship between program variables (especially pointers and memory objects), and are an important basis for studying data flow. In addition, the process of constructing a value flow graph also comprehensively considers the scope and life cycle of the variables, which can ensure that the final result can accurately reflect the semantic structure of the program. There are now mature tools that can complete the automatic construction of value flow graphs. The present invention uses the open source software SVF tool to generate a corresponding static value flow graph for the intermediate code corresponding to the target program.

As shown in Figure 3, the original static value flow graph (partial) of a program is given as an example. It can be seen that the value of variable %2 affects variable %16 through the getelementptr instruction, and variable %16 affects the instruction , until it is passed to the parameter of the function CWE123_Write_What_Where_Condition__fgets_51b_goodG2BSink.

In step S120, on the basis of the global static value flow graph, all usage points of external data are located, and the pointer usage points for memory reading, writing, and execution are screened out. For example, fgets will store the read data in the memory area specified by the first parameter. After locating the variable, the successor node analysis is performed on the static value flow graph to obtain all node sets that can be affected by the variable. In order to distinguish which nodes use the read data as a pointer for memory access, a value flow analysis framework based on a state machine is adopted in this method. In the static value flow graph, the external data introduction point is used as the data source point, and each node on its propagation path is assigned a state value, and then the state value of each node is dynamically updated according to the value flow propagation relationship.

In this embodiment, a DC state machine is used to determine the state values of all value flow graph nodes that reference the data source point according to the value flow graph node type and the state update rule, wherein the state update rule is: when the value flow graph node type is to read external data and create an object, the node state value is updated to "1", that is, the state value of the value flow graph node as the data source point is updated to "1". When the value flow graph node type is variable value copy, pointer calculation, variable comparison, variable binary operation, function actual parameter, function formal parameter, function actual return, function formal return, the node state value is updated to the parent node state value of the node. When the value flow graph node type is memory read, and the parent node state value of the node is greater than "0", the node state value is updated according to the parent node state value minus 1. When the value flow graph node type is memory write, if the parent node variable of the node is used as a value, the node state value is updated according to the parent node state value plus 1, and if the parent node variable of the node is used as a pointer, the node state value is updated to the parent node state value.

Specifically, the value flow graph node types and their state update rules are shown in Table 1, where Sc represents the current node state value and Sp represents its parent node state value. The state value represents the pointer level used by external data. For example, a state value of 0 means that the current node uses external data; a state value of 1 means that the current node uses a pointer to external data; a state value of 2 means that the current node uses a pointer to an external data pointer; the larger the state value, the higher the level of the pointer.

Table 1 Value flow graph node status update rules

Specifically, for the located read function call, first set the node state where the parameter of the stored data is located to 1, indicating that it is currently a pointer to external data. Then dynamically analyze the state value of each direct successor node according to the value flow relationship. When it is found that the node state value where the pointer of the LoadVFGNode or StoreVFGNode of a direct successor node is located is 0, it means that the pointer of the Load or Store operation is controllable by external data, that is, a dangerous pointer access point.

Take a data flow edge shown in Figure 4 as an example. The data flow edge is: , and its corresponding specific value flow nodes are as follows:

Assume that %2 is the first parameter of the fgets function, and its status is set to Sc = 1. Then the status value of the GepVFGNode node where the variable %5 is located is updated to 1. Finally, since %6 is the value obtained from %5 through the Load operation, its LoadVFGNode node status is updated to 0, that is, %6 is external data. Assuming that there are subsequent Load or Store operations using %6 as a pointer, these Load and Store operations are added to the dangerous pointer access points.

FIG4 is explained here. This is a simplified diagram of the static value flow graph and is not the original diagram. It is only used to illustrate the state change of the data flow edge.

In this embodiment, since there may be multiple external data introduction points determined according to step S110, each external data introduction point is used as a data source point on the value flow graph, and the state of each node on the edge of the data flow propagated by each data source point is dynamically assigned. Finally, the pointer in the node with a state value of "0" is a potentially dangerous pointer access point. In other words, there may be multiple potentially dangerous pointer access points. In order to balance efficiency and integrity, two optimization methods are also proposed in this method to screen multiple potentially dangerous pointer access points, including only processing dangerous pointer access points with data from external input sources, and treating paths without comparison operations on external data as potential vulnerabilities. This significantly reduces runtime overhead, while still being able to effectively detect potential arbitrary address read and write vulnerabilities in source code.

In step S130, the potential dangerous pointer access points are screened to obtain the final dangerous pointer access points, including: among the potential dangerous pointer access points, dangerous pointer access points whose data only comes from the external input source are retained, and other pointer access points are screened out. Then, among the screened potential dangerous pointer access points, the potential dangerous pointer access points on the execution path that does not perform a comparison operation on the external data in the process of passing through the data source point to the dangerous pointer access point are determined as the final dangerous pointer access points.

Specifically, during the first screening, only the dangerous pointer access points whose data only comes from external input sources are processed. The advantage of this is that only the data source point and the dangerous pointer access need to be instrumented. Once the program passes through the data source point and reaches the dangerous use point, the data of the dangerous pointer access point must come from the external input data, thereby avoiding the instrumentation of the entire data flow propagation path.

Specifically, during the second screening, only the execution paths that do not perform a compare operation on the external data in the process of passing through the data source point to the dangerous pointer access point are identified as vulnerable paths. Consider the following code example 1. Although x comes from external input and there is a dangerous pointer access point (a[x]), the code does not contain a vulnerability because it performs a legal check on the value of x. To fully analyze the legality of the value of external data when it is accessed as a pointer, it is necessary to use tools such as symbolic execution to obtain the possible value range of the external data, which will introduce huge operating overhead. Taking into account the principle that a comparison and verification of the external input is not necessarily a vulnerability, but a comparison and verification that is not performed is definitely a vulnerability, in this embodiment, only the execution paths that do not perform a compare operation on the external data in the process of passing through the data source point to the dangerous pointer access point are identified as vulnerabilities.

Therefore, in this embodiment, the comparison instruction with the state value of 0 is also plugged based on the state machine framework proposed above to support the specific implementation of the optimization.

Code Example 1:

int a[10];

unsigned x = input();

if (x<10) {

printf(a[x]);

}

In step S140, when the program to be detected is dynamically instrumented according to the dangerous pointer access point, when the program to be detected is source code, the vulnerability detection logic is directly inserted into the intermediate code through function calls by directly calling the Pass implementation of LLVM during compilation.

When the program to be detected is a binary code, a binary code instrumentation method for static code control flow modification and recovery is proposed in this embodiment. As shown in Figure 5, in the binary code, the instruction corresponding to the dangerous pointer access point is modified to a jump instruction for performing vulnerability code detection, wherein the vulnerability code detection includes: vulnerability detection code and control flow context recovery code.

Specifically, first, locate the original assembly instruction from the metadata of the abnormal point (i.e., the dangerous pointer access point) obtained from the static analysis, as shown in the box in Figure 5. Then, perform static control flow modification on the target binary program, and force the corresponding instruction in the box to be modified to the jmp loc.xxx jump instruction, where loc.xxx is the memory address containing the vulnerability detection code and the control flow + context recovery code (the memory address is mapped to a fixed position in the target program memory space during dynamic runtime). In this way, when the program executes to the position corresponding to the original box instruction (execution flow 1), it will jump to the loc.xxx address for execution (execution flow 2), and after executing the vulnerability detection code and the control flow + context recovery code (execution flow 3), it will return to the next instruction of the box line to continue execution (execution flow 4 and execution flow 5). In this way, stubbing for binary code can be achieved.

In the above binary code vulnerability detection method based on the value stream state machine, by combining static analysis and dynamic analysis, efficient and accurate detection of potential arbitrary address pointer dereference vulnerabilities in source code programs and binary programs can be achieved, and high-precision detection of such vulnerabilities can be achieved under low overhead conditions. By establishing different state transition rules for the semantics of different nodes in the value stream graph, accurate analysis of the data usage process is achieved, and stub analysis of any instruction in the released binary code is achieved with extremely low running overhead.

The main applications of this method are reflected in two aspects: first, software manufacturers can scan and analyze the source code software before releasing the product, discover potential vulnerabilities in the software and fix them, thereby ensuring that such vulnerabilities do not exist in the released version; second, third-party software evaluation agencies can scan and analyze the binary software released by the manufacturer, detect possible vulnerabilities therein, and generate corresponding analysis reports.

It should be understood that, although the various steps in the flowchart of Fig. 2 are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in Fig. 2 may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

In one embodiment, as shown in FIG6 , a binary code vulnerability detection device based on a value stream state machine is provided, comprising: a preprocessing module 200, a static value stream graph obtaining module 210 for an external data introduction point set, a potential dangerous pointer access point determination module 220, a potential dangerous pointer access point screening module 230 and a vulnerability detection module 240, wherein:

The preprocessing module 200 is used to obtain the program to be detected and preprocess the program to be detected to obtain the corresponding intermediate code.

The module 210 for obtaining the static value flow graph of the external data introduction point set is used to determine the external data introduction point in the intermediate code and to construct a static value flow graph based on the intermediate code.

The module 220 for determining a potentially dangerous pointer access point is used to determine the state values of all value flow graph nodes that reference the data source point based on the static value flow graph, using a DC state machine according to the value flow graph node type and the state update rule, and to determine the pointer in the value flow graph node whose state value meets the preset value as a potentially dangerous pointer access point.

The potential dangerous pointer access point screening module 230 is used to screen the potential dangerous pointer access points to obtain final dangerous pointer access points.

The vulnerability detection module 240 is used to dynamically insert the program to be detected according to the dangerous pointer access point, so as to detect any address pointer dereference vulnerability in the program to be detected.

For the specific limitations of the binary code vulnerability detection device based on the value stream state machine, please refer to the limitations of the binary code vulnerability detection method based on the value stream state machine above, which will not be repeated here. Each module in the above-mentioned binary code vulnerability detection device based on the value stream state machine can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a binary code vulnerability detection method based on a value stream state machine is implemented. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

Obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

Determining an external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code;

Based on the static value flow graph, the external data introduction point is used as the data source point, and the state values of all value flow graph nodes that reference the data source point are determined by a DC state machine according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point;

Screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The program to be detected is dynamically instrumented according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

Obtaining a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

Determining an external data introduction point in the intermediate code, and constructing a static value flow graph based on the intermediate code;

Based on the static value flow graph, the external data introduction point is used as the data source point, and the state values of all value flow graph nodes that reference the data source point are determined by a DC state machine according to the value flow graph node type and the state update rule, and the pointer in the value flow graph node whose state value meets the preset value is determined as a potential dangerous pointer access point;

Screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

The program to be detected is dynamically instrumented according to the dangerous pointer access point to detect any address pointer dereference vulnerability in the program to be detected.

Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims (10)

1. A binary code vulnerability detection method based on a value flow state machine, the method comprising:

acquiring a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

determining an external data introduction point in the intermediate code, and constructing a static value flow graph according to the intermediate code;

Based on the static value flow graph, taking the external data introducing point as a data source point, adopting a direct current state machine to determine state values of all value flow graph nodes referencing the data source point according to the value flow graph node type and a state updating rule, and determining pointers in the value flow graph nodes of which the state values accord with preset values as potential dangerous pointer access points;

screening the potential dangerous pointer access points to obtain a final dangerous pointer access point;

and dynamically instrumentation is carried out on the program to be detected according to the dangerous pointer access point so as to realize detection of any address pointer dereferencing loophole in the program to be detected.

2. The method for detecting a binary code vulnerability according to claim 1, wherein the program to be detected is a binary code.

3. The method for detecting a binary code vulnerability according to claim 2, wherein when the program to be detected is preprocessed to obtain the corresponding intermediate code, the method comprises:

And carrying out intermediate code lifting on the binary codes to obtain intermediate codes corresponding to the program to be detected.

4. A binary code vulnerability detection method as claimed in claim 3, wherein the intermediate code promotion of the binary code is performed using tools comprising llvm-mctoll or mcsema;

when the tool mcsema is used for carrying out intermediate code lifting on the binary code, metadata is added in the obtained intermediate code so as to store the corresponding original assembly instruction address and instruction information.

5. The binary code vulnerability detection method of claim 4, wherein the determining an external data introduction point in the intermediate code comprises:

Defining the API function in the intermediate code as a triple expression form comprising a function name, a parameter position of external data in the function and a reading length;

performing function call in the intermediate code by adopting instructions CallInst and InvokeInst, and judging whether the API function in each triplet expression form is an external data reading function or not;

and determining the external data introducing point according to the position of the API function which is judged to be the external data reading function.

6. The method of binary code vulnerability detection of claim 5, wherein determining the state values of all value flow graph nodes referencing the data source points using a direct current state machine according to value flow graph node types and state update rules comprises:

When the node type of the value flow graph is created for reading external data and an object, updating the state value of the node to be 1;

When the node type of the value flow graph is variable value copy, pointer calculation, variable comparison, variable binary operation, function real parameter, function shape parameter, function real return and function shape return, updating the node state value into the father node state value of the node;

when the node type of the value flow graph is memory reading and the parent node state value of the node is greater than 0, updating the node state value according to the parent node state value minus 1;

When the node type of the value flow graph is memory writing, if the father node variable of the node is used as a value, the state value of the node is updated according to the addition of 1 to the father node state value, and if the father node variable of the node is used as a pointer, the state value of the node is updated to the father node state value.

7. The method of binary code vulnerability detection of claim 6, wherein the screening the potentially dangerous pointer access points to obtain final dangerous pointer access points comprises:

among the potential dangerous pointer access points, the dangerous pointer access points with data only coming from external input sources are reserved, and other pointer access points are screened out;

and determining the potential dangerous pointer access point on the execution path which does not perform comparison operation on the external data in the process of reaching the dangerous pointer access point through the data source point as a final dangerous pointer access point in the screened potential dangerous pointer access points.

8. The method for detecting a binary code vulnerability according to claim 7, wherein when the program to be detected is dynamically instrumented according to the dangerous pointer access point, the method comprises:

Modifying an instruction corresponding to the dangerous pointer access point into a jump instruction for executing the detection of the vulnerability code in the binary code;

Wherein the vulnerability code detection comprises: vulnerability detection code and control flow context recovery code.

9. A binary code vulnerability detection apparatus based on a value flow state machine, the apparatus comprising:

The preprocessing module is used for acquiring a program to be detected, and preprocessing the program to be detected to obtain a corresponding intermediate code;

The external data introducing point set static value flow diagram obtaining module is used for determining external data introducing points in the intermediate code and constructing and obtaining a static value flow diagram according to the intermediate code;

The potential dangerous pointer access point determining module is used for determining state values of all value flow graph nodes referencing the data source point according to the value flow graph node type and the state updating rule by adopting a direct current state machine based on the static value flow graph, and determining pointers in the value flow graph nodes with the state values conforming to preset values as potential dangerous pointer access points;

The potential dangerous pointer access point screening module is used for screening the potential dangerous pointer access points to obtain final dangerous pointer access points;

and the vulnerability detection module is used for dynamically instrumentation the program to be detected according to the dangerous pointer access point so as to realize detection of any address pointer dereferencing vulnerability in the program to be detected.

10. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any of claims 1 to 8 when the computer program is executed.