关键词: 控制流完整性,执行路径,硬件特性,控制流保护,内核陷入

Abstract: Facing the threat of control flow hijacking,the industry uses control flow integrity protection technology.It is difficult to achieve the goal for those traditional control-flow integrity protection mechanisms which depend on dynamic binary rewriting technology,and it’s not easy for analysis and implementation.It may also bring out the problem of binary compatibility.The recently proposed context-sensitive control-flow integrity,PathArmor,only verifies the control flow when tasks are calling system functions.To achieve enhanced protection,an improved method was proposed in this paper.The improved method means to trigger more page fault intentionally by modifying the pages’ protection flag of the target task,with the kernel’s mechanism of page fault.Then it hooks the origin system IDT (Interrupt Description Table) and creates new do_page_fault function to handle the generated page fault.With doing some experiments on typi-cal application like nginx,bzip2,SQLite and so on,the result shows that the counts for tasks to be verified increase significantly,and it can get better protection with the improved method.

Key words: Control-flow integrity,Execution path,Hardware feature,Control-flow protection,Kernel trap