Vulnerability Sample Analysis Based on Dynamic Binary Platform

Abstract

Based on the existing vulnerability exploitation detection technology, this paper analyzes the buffer overflow vulnerability exploitation process, and detects vulnerability triggering, protection mechanism bypassing and shellcode execution by dynamic binary instrumentation (DBI) monitoring program execution process; According to the analysis of vulnerability sample shellcode behavior, the method of recording instruction information and key API function information is designed based on instrumentation API function; A prototype platform of vulnerability sample transplantation and utilization based on dynamic binary is designed and implemented, and test analysis of 40 typical vulnerability samples is carried out to verify the effectiveness and feasibility of the system.