信息网络安全

信息网络安全 ›› 2017, Vol. 17 ›› Issue (7): 1-10.doi: 10.3969/j.issn.1671-1122.2017.07.001

• •    下一篇

Windows堆地址随机化原理剖析与改进

文伟平1(), 贾世琳1, 杜嘉薇2, 秦策1   

  1. 1.北京大学软件与微电子学院,北京 102600
    2. 洛阳电子装备实验中心,河南洛阳 471032
  • 收稿日期:2017-04-19 出版日期:2017-07-20 发布日期:2020-05-12
  • 作者简介:

    作者简介： 文伟平（1976—）,男,湖南,副教授,博士,主要研究方向为网络攻击与防范、恶意代码研究、信息系统逆向工程等;贾世琳（1993—）,男,山东,硕士研究生,主要研究方向为网络攻击与防范、系统安全、系统逆向工程等;杜嘉薇（1985—）,女,河南,工程师,硕士,主要研究方向为网络安全、系统逆向工程等;秦策（1992—）,男,安徽,硕士研究生,主要研究方向为网络攻击与防范、系统逆向工程等。

  • 基金资助:
    国家自然科学基金[61170282]

Analysis and Improvement of Windows Heap Randomization

Weiping WEN1(), Shilin JIA1, Jiawei DU2, Ce QIN1   

  1. 1.School of Software & Microelectronics, Peking University, Beijing 102600, China;
    2. Luoyang Electric Equipment Test Center, Luoyang Henan 471032, China
  • Received:2017-04-19 Online:2017-07-20 Published:2020-05-12

RichHTML

3

PDF (PC)

84

摘要：

Windows作为公众使用最广泛的一类操作系统,其自身的安全性成为国内外攻击者和研究者关注的焦点。文章从Windows内存管理体系入手,使用逆向工程和动态调试的手段对Windows操作系统堆地址随机化机制进行分析,设计并实现了一种随机化改进方案。研究工作主要分为两方面：一方面是通过逆向调试,深入探索Windows堆内存区域,重点探查堆地址随机化机制的实现原理和方法,并结合已知的几种攻击手法对Windows堆地址随机化机制的脆弱性进行分析和验证;另一方面是根据分析结果设计相应的解决方案,进一步增强堆区地址排布的随机性,有针对性地降低已知攻击手法的危害。文章提出的方案可以有效弥补Windows系统在堆地址随机化方面设计的不足,降低相关攻击技术的危害,提升系统整体安全性能。

关键词: Windows, 堆, 随机化, 逆向工程

Abstract:

As the most widely used operating system, the security of Windows has become the focus of attackers and researchers at home and abroad. This paper starts with Windows memory management system, analyzes the heap address randomization mechanism of Windows operating system by reverse engineering and dynamic debugging, and designs and implements a randomized improvement scheme. The research work is divided into two parts: One is through the reverse debugging, exploring the Windows heap memory area, exploring the realization principle and method of heap address randomization mechanism, and analyzing and verifying the vulnerabilities of Windows heap address randomization mechanism by combined with several known attack methods. On the other hand, the corresponding solution is designed according to the analysis results to further enhance the randomness of the heap address configuration, and to reduce the harms of the known attack methods. The proposed scheme can effectively compensate for the lack of Windows system in heap address randomization design, reduce the harms of related attack technology, and improve the overall security performance of the system.

Key words: Windows, heap, randomization, reverse engineering

中图分类号: