A technique to locate control-flow hijacking point for vulnerability exploitation based on jump-oriented features
junxiu li, chao feng, Chaojing Tang · 2024
Vulnerability is an important threat to current cyberspace security, and the vulnerability exploitation code is the carrier for attackers to attack information systems through vulnerabilities. By analyzing the exploit code, security personnel can understand the vulnerability location of the information system and the common exploitation techniques used by attackers, which is of great significance to cyberspace defense. In the common arbitrary code execution and other vulnerability exploitation code, the control-flow hijacking point is the key location where the attacker uses the vulnerability to modify the execution process of the program. Locating the control-flow hijacking point can provide insight into the attacker's exploitation path and can help security personnel formulate a more complete vulnerability defense strategy. This paper proposes a method to locate the control-flow hijacking point of vulnerability exploitation based on jump-oriented features. The algorithm analyzes the program's jump-oriented features during indirect jumps, invocations and function returns, and detects and locates the control-flow hijacking point of vulnerability exploitation based on the different jump-oriented features. The experimental results of five real vulnerability exploitation cases show that the method in this paper achieves good results on the real vulnerability exploitation cases and has a high degree of accuracy and performance.