SafeBird:A Dynamic and Transparent Toolkit for Run-Time Buffer Overflow Preventions
Zhi-qiang LIN,Yi WANG,Bing MAO,Li XIE
DOI: https://doi.org/10.3321/j.issn:0372-2112.2007.05.016
2007-01-01
Tien Tzu Hsueh Pao/Acta Electronica Sinica
Abstract:This paper presents a dynamic and transparent toolkit, SafeBird, to defend against run-time buffer overflows by combining several techniques. SafeBird consists of three tools: SIET, LibsafeXP and SLI. SIET extracts the size and starting address information of program global variables from the symbol section of ELF executable file. LibsafeXP, a dynamic shared library and an extension to Libsafe, contains wrapper functions for all the buffer related C Standard Library functions. These wrapper functions are enforced to check the source and target buffer's size using the following information: global buffer knowledge provided by SIET, heap buffer knowledge by intercepting/tracking memory allocation family functions, and stack buffer bound information by dynamically determined from the frame pointer. The third tool SLI is used to accomplish the function interception and inject the shared library, LibsafeXP, into the running process online without interruption. Compared with existing approaches, SafeBird is more transparent to programs: it works on binary mode, and neither requires the source code or any debug information, nor needs to stop/restart the protected software. Performance and effectiveness evaluations indicate that SafeBird could be used to prevent run-time buffer overflow attacks efficiently, and imposes only about 10 percent overhead on average.