Abstract:

As the most widely used operating system, the security of Windows has become the focus of attackers and researchers at home and abroad. This paper starts with Windows memory management system, analyzes the heap address randomization mechanism of Windows operating system by reverse engineering and dynamic debugging, and designs and implements a randomized improvement scheme. The research work is divided into two parts: One is through the reverse debugging, exploring the Windows heap memory area, exploring the realization principle and method of heap address randomization mechanism, and analyzing and verifying the vulnerabilities of Windows heap address randomization mechanism by combined with several known attack methods. On the other hand, the corresponding solution is designed according to the analysis results to further enhance the randomness of the heap address configuration, and to reduce the harms of the known attack methods. The proposed scheme can effectively compensate for the lack of Windows system in heap address randomization design, reduce the harms of related attack technology, and improve the overall security performance of the system.

Key words: Windows, heap, randomization, reverse engineering