程序语义驱动的间接调用目标识别方法

doi:10.3969/j.issn.1671-1122.2026.09.009

摘要/Abstract

摘要：

系统软件常通过间接调用实现动态程序行为，这使静态分析难以构建精确的控制流图，而控制流图是许多静态分析和系统强化技术的基础。现代编译器默认无法识别间接调用目标，现有方法也多局限于类型信息，容易产生较高的误报率。因此，文章提出一种程序语义驱动的间接调用目标识别方法HRefIC。由于有效目标更容易到达调用点，从Linux内核、Bash和MySQL中随机抽取的1000个有效目标统计结果表明，57.4%有效目标的调用距离为0，81.9%有效目标的调用距离不超过2。调用者与被调用者以及同一间接调用的不同目标之间通常存在相关性，78.95%有效目标的函数名与调用者相似。HRefIC对数据流、路径、语义和文本相似性信息进行综合分析，在类型分析所得的粗粒度目标基础上进一步精炼，同时采用按需设计以控制开销，并借助多层规则降低漏报率。实验结果表明，与基于函数签名的传统类型分析方法相比，HRefIC在Linux内核、Bash和MySQL上的平均目标数量分别减少了98.6%、94.4%和95.0%，相较于MLTA进一步减少了38%~66%。此外，HRefIC还可服务于语义错误检测，利用该方法在Linux内核中发现8个新错误。

关键词: 静态分析, 污点分析, 间接调用目标, 函数指针, 控制流完整性

Abstract:

Indirect call is widely used in system software to implement dynamic program behavior, but it hinders the construction of accurate control-flow graphs, which underpins many static analyses and system-hardening techniques. Modern compilers can’t identify indirect-call targets by default, while most existing methods rely only on type information and produce many false positives. This paper proposed a program semantics-driven indirect call target recognition method called HRefIC. Due to the fact that effective targets were easier to reach the call point, the statistical results of 1000 randomly selected effective targets in Linux kernel, Bash, and MySQL showed that 57.4% of the call distances are 0, and 81.9% of the call distances do not exceed 2. There was usually a correlation between the caller, the called, and different objectives of the same indirect call, with 78.95% of valid objectives being similar to the caller’s function name. HRefIC integrated data flow, path, semantic, and text similarity information based on this, further refining the coarse-grained target obtained from type analysis. At the same time, on-demand design was adopted to control overhead, and multi-layer rules were used to reduce false alarm rates. The experimental results show that compared with traditional type analysis based on function signatures, HRefIC reduces the average number of targets by 98.6%, 94.4%, and 95.0% on Linux kernel, Bash, and MySQL, respectively, and further reduces by 38% to 66% compared to MLTA. In addition, HRefIC can also serve semantic error detection, using this method to discover 8 new errors in the Linux kernel.

Key words: static analysis, taint analysis, indirect-call target, function pointer, control-flow integrity

中图分类号:

TP309

孟辉, 许嘉星. 程序语义驱动的间接调用目标识别方法[J]. 信息网络安全, 2026, 26(9): 1435-1446.

Meng Hui, Xu Jiaxing. Program semantics-driven indirect call target recognition method[J]. Netinfo Security, 2026, 26(9): 1435-1446.

图/表 7

图1

表1

表2

表3

图2

表4

表5

参考文献 37

[1]	Lu Kangjie, Hu Hong. Where does it go?: refining indirect-call targets with multi-layer type analysis[C]// 2019 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2019: 1867-1881.
[2]	Blaszczyk Z M, Liang Yanting, Ecker K, et al. On the prevalence of indirect function calls in middleware software systems[C]// 2017 IEEE International Conference on Electro Information Technology (EIT). New York: IEEE, 2017: 86-91.
[3]	Liu Yongzhi, Chen Xiarun, Yang Zhou, et al. Automatically constructing peer slices via semantic-and context-aware security checks in the Linux kernel[C]// 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W). New York: IEEE, 2021: 108-113.
[4]	Kang Yuan, Ray B, Jana S. APEx: automated inference of error specifications for C APIs[C]// The 31st IEEE/ACM International Conference on Automated Software Engineering. New York: ACM, 2016: 472-482.
[5]	Saha S, Lozi J P, Thomas G, et al. Hector: detecting resource-release omission faults in error-handling code for systems software[C]// 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). New York: IEEE, 2013: 1-12.
[6]	Xu Meng, Qian Chenxiong, Lu Kangjie, et al. Precise and scalable detection of double-fetch bugs in OS kernels[C]// 2018 IEEE Symposium on Security and Privacy (SP). New York: IEEE, 2018: 661-678.
[7]	Lu Kangjie, Pakki A, Wu Qiushi. Detecting missing-check bugs via semantic-and context-aware criticalness and constraints inferences[C]// The 28th USENIX Security Symposium (USENIX Security 19). Berkeley: USENIX, 2019: 1769-1786.
[8]	Min C, Kashyap S, Lee B, et al. Cross-checking semantic correctness: the case of finding file system bugs[C]// The 25th Symposium on Operating Systems Principles. New York: ACM, 2015: 361-377.
[9]	Yun I, Min C H, Si Xujie, et al. APISan: sanitizing API usages through semantic cross-checking[C]// The 25th USENIX Security Symposium (USENIX Security 16). Berkeley: USENIX, 2016: 363-378.
[10]	Boonstoppel P, Cadar C, Engler D. RWset: attacking path explosion in constraint-based test generation[C]// Tools and Algorithms for the Construction and Analysis of Systems. Heidelberg: Springer, 2008: 351-366.
[11]	Trabish D, Mattavelli A, Rinetzky N, et al. Chopped symbolic execution[C]// The 40th International Conference on Software Engineering. New York: ACM, 2018: 350-360.
[12]	Abadi M, Budiu M, Erlingsson U, et al. Control-flow integrity[C]// The 12th ACM Conference on Computer and Communications Security. New York: ACM, 2005: 340-353.
[13]	Burow N, Carr S A, Nash J, et al. Control-flow integrity: precision, security, and performance[J]. ACM Computing Surveys, 2018, 50(1): 1-33.
[14]	Niu Ben, Tan Gang. Modular control-flow integrity[C]// The 35th ACM SIGPLAN Conference on Programming Language Design and Implementation. New York: ACM, 2014: 577-587.
[15]	Tice C, Roeder T, Collingbourne P, et al. Enforcing forward-edge control-flow integrity in GCC and LLVM[C]// The 23rd USENIX Security Symposium (USENIX Security 14). Berkeley: USENIX, 2014: 941-955.
[16]	Zhang Chao, Wei Tao, Chen Zhaofeng, et al. Practical control flow integrity and randomization for binary executables[C]// 2013 IEEE Symposium on Security and Privacy. New York: IEEE, 2013: 559-573.
[17]	Zhang Mingwei, Sekar R. Control flow integrity for COTS binaries[C]// The 22nd USENIX Security Symposium (USENIX Security 13). Berkeley: USENIX, 2013: 337-352.
[18]	Aigner G, Holzle U. Eliminating virtual function calls in C++ programs[C]// ECOOP’96-Object-Oriented Programming. Heidelberg: Springer, 1996: 142-166.
[19]	Carlini N, Barresi A, Payer M, et al. Control-flow bending: on the effectiveness of control-flow integrity[C]// The 24th USENIX Security Symposium (USENIX Security 15). Berkeley: USENIX, 2015: 161-176.
[20]	Conti M, Crane S, Davi L, et al. Losing control: on the effectiveness of control-flow integrity under stack attacks[C]// The 22nd ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2015: 952-963.
[21]	Goktas E, Athanasopoulos E, Bos H, et al. Out of control: overcoming control-flow integrity[C]// 2014 IEEE Symposium on Security and Privacy. New York: IEEE, 2014: 575-589.
[22]	Schuster F, Tendyck T, Liebchen C, et al. Counterfeit object-oriented programming: on the difficulty of preventing code reuse attacks in C++ applications[C]// 2015 IEEE Symposium on Security and Privacy. New York: IEEE, 2015: 745-762.
[23]	Akritidis P, Cadar C, Raiciu C, et al. Preventing memory error exploits with WIT[C]// 2008 IEEE Symposium on Security and Privacy. New York: IEEE, 2008: 263-277.
[24]	Bletsch T, Jiang Xuxian, Freeh V. Mitigating code-reuse attacks with control-flow locking[C]// The 27th Annual Computer Security Applications Conference. New York: ACM, 2011: 353-362.
[25]	Milanova A, Rountev A, Ryder B G. Precise call graphs for C programs with function pointers[J]. Automated Software Engineering, 2004, 11(1): 7-26. doi: 10.1023/B:AUSE.0000008666.56394.a1
[26]	Sui Yulei, Xue Jingling. Value-flow-based demand-driven pointer analysis for C and C++[J]. IEEE Transactions on Software Engineering, 2020, 46(8): 812-835. doi: 10.1109/TSE.32 URL
[27]	Biallas S, Olesen M C, Cassez F, et al. PtrTracker: pragmatic pointer analysis[C]// 2013 IEEE 13th International Working Conference on Source Code Analysis and Manipulation (SCAM). New York: IEEE, 2013: 69-73.
[28]	Farkhani R M, Jafari S, Arshad S, et al. On the effectiveness of type-based control-flow integrity[C]// The 34th Annual Computer Security Applications Conference. New York: ACM, 2018: 28-39.
[29]	Ge Xinyang, Talele N, Payer M, et al. Fine-grained control-flow integrity for kernel software[C]// 2016 IEEE European Symposium on Security and Privacy (EuroS&P). New York: IEEE, 2016: 179-194.
[30]	Ding Ren, Qian Chenxiong, Song Chengyu, et al. Efficient protection of path-sensitive control security[C]// The 26th USENIX Security Symposium (USENIX Security 17). Berkeley: USENIX, 2017: 131-148.
[31]	Ge Xinyang, Cui Weidong, Jaeger T. GRIFFIN: guarding control flows using Intel Processor Trace[J]. ACM SIGPLAN Notices, 2017, 52(4): 585-598. doi: 10.1145/3093336.3037716 URL
[32]	Ispoglou K K, Albassam B, Jaeger T, et al. Block-oriented programming: automating data-only attacks[C]// The 2018 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2018: 1868-1882.
[33]	Niu Ben, Tan Gang. Per-input control-flow integrity[C]// The 22nd ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2015: 914-926.
[34]	Van D V V, Andriesse D, Goktas E, et al. Practical context-sensitive CFI[C]// The 22nd ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2015: 927-940.
[35]	Hu Hong, Qian Chenxiong, Yagemann C, et al. Enforcing unique code target property for control-flow integrity[C]// The 2018 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2018: 1470-1486.
[36]	Schumilo S, Aschermann C, Gawlik R, et al. kAFL: hardware-assisted feedback fuzzing for OS kernels[C]// The 26th USENIX Security Symposium (USENIX Security 17). Berkeley: USENIX, 2017: 167-182.
[37]	Kuznetsov V, Szekeres L, Payer M, et al. Code-pointer integrity[C]// The Continuing Arms Race: Code-Reuse Attacks and Defenses. New York: ACM, 2018: 81-116.

程序	函数数量/个	源代码行数/行	第一阶段耗时/s	第二阶段耗时/s
Linux	552000	15579000	232	375
Bash	3000	115000	0.3	0.8
MySQL	114000	3936000	107	149

程序	间接调用目标数量/个	地址获取函数数量/个	平均目标数量/个
程序	间接调用目标数量/个	地址获取函数数量/个	传统签名分析	MLTA	HRefIC
Linux	63000	216000	318(96%↓)	12.7	4.3(66%↓)
Bash	133	527	108(88%↓)	13	6.0(54%↓)
MySQL	14700	33500	140(92%↓)	11.2	7.0(38%↓)

文件	函数	变量	影响
drm/i915/gem/i915_gem_phys.c	i915_gem_object_put_pages_phys	pages	NULL Pointer Deference
drivers/gpu/drm/i915/gem/i915_gem_stolen.c	i915_gem_object_put_pages_stolen	pages	NULL Pointer Deference
drivers/i2c/i2c_core_base.c	i2c_probe_func_quick_read	adap	NULL Pointer Deference
drivers/pci/quirks.c	delay_250ms_after_flr	dev	NULL Pointer Deference
drivers/gpu/drm/i915/gt/intel_ggtt.c	i915_gmch_remove	vm	Redundant Code
drm/amdgpu_dm_debugfs.c	dp_dsc_clocken_read	rd_buf	Memory Leak
drm/amdgpu_dm_debugfs.c	dp_dsc_slice_width_read	rd_buf	Memory Leak
drm/amdgpu_dm_debugfs.c	dp_dsc_slice_height_read	rd_buf	Memory Leak

编译选项	间接调用目标数量/个	地址获取函数数量/个	平均目标数量/个		HRefIC的目标数量相对MLTA的降幅
编译选项	间接调用目标数量/个	地址获取函数数量/个	MLTA	HRefIC	HRefIC的目标数量相对MLTA的降幅
-O0-g-fno-inlining	133	527	13.0	6.0	54%
-O2	121	498	11.5	5.2	55%