Exploits constitute malware in the form of application inputs. They take advantage of security vulnerabilities inside programs in order to yield execution control to attackers. The root cause of successful exploitation lies in emergent functionality introduced when programs are compiled and loaded in memory for execution, called `Weird Machines' (WMs). Essentially WMs are unexpected virtual machines that execute attackers' bytecode, complicating malware analysis whenever the bytecode set is unknown. We take the direction that WM bytecode is best understood at the level of the process memory layout attained by exploit execution. Each step building towards this memory layout comprises an exploit primitive, an exploit's basic building block. This work presents a WM reconstruction algorithm that works by identifying pre-defined exploit primitive-related behaviour during the dynamic analysis of target binaries, associating it with the responsible exploit segment - the WM bytecode. In this manner any analyst familiar with exploit programming will immediately recognise the reconstructed WM bytecode's semantics. This work is a first attempt at studying the feasibility of this method and focuses on web browsers when targeted by JavaScript exploits.
翻译:Exploities 构成应用程序投入形式的恶意软件。 它们利用程序内的安全弱点, 以便向攻击者提供执行控制。 成功开发的根源在于当程序编集并加载用于执行的记忆中, 称为“ WWMS ” (WMS ) 的程序时, 引入了突发功能。 WMS 基本上是出乎意料的虚拟机器, 执行攻击者” 字节码, 当字节码组未知时, 使恶意软件分析复杂化。 我们采用WM 字节代码在过程内存布局上最能理解的方向。 朝着这一内存布局的每一个步骤都是利用原始的, 开发的基本建筑块。 这项工作展示了WM 重建算法, 在目标二进制的动态分析中, 确定与原始相关的行为, 将其与负责任的开发部分( WM bytecode) 联系起来。 这样, 熟悉开发程序的任何分析师将立即识别经过重建的WM bytecode 的语义学。 。 这项工作首次尝试研究这种方法的可行性, 在JavaScript 开发时, 瞄准网络浏览器时, 。