• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>European Symposium on Research in Computer Security(ESORICS 2004); 20040913-15; Sophia Antipolis(FR) >ARCHERR: Runtime Environment Driven Program Safety
【24h】

ARCHERR: Runtime Environment Driven Program Safety

机译：ARCHER：运行时环境驱动程序安全

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Parameters of a program's runtime environment such as the machine architecture and operating system largely determine whether a vulnerability can be exploited. For example, the machine word size is an important factor in an integer overflow attack and likewise the memory layout of a process in a buffer or heap overflow attack. In this paper, we present an analysis of the effects of a runtime environment on a language's data types. Based on this analysis, we have developed Archerr, an automated one-pass source-to-source transformer that derives appropriate architecture dependent runtime safety error checks and inserts them in C source programs. Our approach achieves comprehensive vulnerability coverage against a wide array of program-level exploits including integer overflows/underflows. We demonstrate the efficacy of our technique on versions of C programs with known vulnerabilities such as Sendmail. We have benchmarked our technique and the results show that it is in general less expensive than other well-known runtime techniques, and at the same time requires no extensions to the C programming language. Additional benefits include the ability to gracefully handle arbi-trary pointer usage, aliasing, and typecasting.
机译：程序运行时环境的参数（例如计算机体系结构和操作系统）在很大程度上决定是否可以利用漏洞。例如，机器字大小是整数溢出攻击中的重要因素，同样是缓冲区或堆溢出攻击中进程的内存布局。在本文中，我们对运行时环境对语言数据类型的影响进行了分析。基于此分析，我们开发了Archerr，这是一种自动的单程源到源转换器，可导出依赖于体系结构的适当运行时安全错误检查并将其插入C源程序中。我们的方法针对各种程序级别的漏洞（包括整数上溢/下溢）实现了全面的漏洞覆盖。我们在具有已知漏洞（例如Sendmail）的C程序版本上证明了我们的技术的有效性。我们已经对我们的技术进行了基准测试，结果表明，它通常比其他众所周知的运行时技术便宜，并且同时不需要扩展C编程语言。其他好处包括能够优雅地处理arbi-trary指针的用法，别名和类型转换的功能。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号