Computer Engineering and Applications ›› 2024, Vol. 60 ›› Issue (9): 299-308.DOI: 10.3778/j.issn.1002-8331.2212-0026

• Network, Communication and Security • Previous Articles     Next Articles

Xgadget: Binary Gadget Search Method Based on Combination of Dynamic and Static Technique

LYU Jianqiang, FU Cai, HE Shuai, JIANG Shuai, LI Ming, HAN Lansheng   

  1. 1.School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
    2.Hubei Key Laboratory of Distributed System Security, Wuhan 430074, China
  • Online:2024-05-01 Published:2024-04-29

Xgadget:基于动静结合的二进制Gadget搜索

吕建强,付才,何帅,江帅,李明,韩兰胜   

  1. 1.华中科技大学 网络空间安全学院,武汉 430074
    2.分布式系统安全湖北省重点实验室,武汉 430074

Abstract: Code reuse techniques have consistently been a popular area of software security research. ROP (return-oriented programming), JOP (jump-oriented programming) and DOP (data-oriented programming) are representative techniques, and Gadget search is the basis for code reuse. The existing static Gadget search algorithm supports a few types of Gadgets and cannot search the dependent dynamic link libraries at the same time. To address these problems, this paper proposes a binary Gadget search method named Xgadget based on a combination of dynamic and static. Xgadget first disassembles all functions in image by using dynamic image-level staking, then designs token-level and instruction-level DFAs, and implements a static search algorithm based on the DFA. In this paper, Xgadget is evaluated in five applications. The experimental results show that Xgadget supports multiple Gadget types such as ROP, JOP, DOP, etc. , and can simultaneously perform Gadget searches on the dynamic link libraries that the target program depends on. The number of Gadgets searched is 12.5 times higher than that of ROPgadget, and the search time per instruction is reduced by 32.1%. Xgadget provides broader support for code reuse with different requirements, and the output is a binary Gadget, which is more direct for subsequent reuse and easy to utilize for code reuse automation.

Key words: code reuse, Gadget search, dynamic and static combination, deterministic finite automaton (DFA), binary, data-oriented programming (DOP), dynamic link library

摘要: 代码复用技术一直以来都是软件安全研究领域的热点,ROP(return-oriented programming)、JOP(jump-oriented programming)和DOP(data-oriented programming)技术是典型代表。Gadget搜索是代码复用的基础,针对现有静态搜索算法存在支持的Gadget类型不多,不能同时搜索动态链接库等问题,提出了基于动静结合的二进制Gadget搜索方法,基于此开发了搜索工具Xgadget。利用动态映像级插桩,对所有函数进行反汇编;设计了Token级和指令级有穷自动机,实现了基于自动机的静态搜索算法;在五款应用程序中对其进行了测试与评估。实验结果表明,算法支持ROP、JOP、DOP等多种Gadget类型的搜索,能够同时对目标程序动态链接库进行搜索,搜索数量是ROPgadget的12.5倍,单位指令搜索时间较之降低32.1%。算法为不同需求的代码复用提供更为广泛的支持,且输出结果是二进制Gadget,后续复用更直接,有利于代码复用自动化利用。

关键词: 代码复用, Gadget搜索, 动静结合, DFA算法, 二进制, DOP方法, 动态链接库