2017 年 10 月 Chinese Journal of Network and Information Security October 2017
00208-1
第 3 卷第 10 期 网络与信息安全学报 Vol.3
No.10
Windows 内存防护机制研究
鲁婷婷
1
，王俊峰
1,2
（1. 四川大学计算机学院，四川 成都 610065；
2. 四川大学空天科学与工程学院，四川 成都 610065）
摘 要：近 30 年来，攻击者利用 Windows 内存漏洞发起的攻击事件层出不穷，其惯用手段是攻击控制数据
以劫持执行流。为此，微软在 Windows 上加注了层层防护以遏止此类攻击，但现阶段部署的防护机制无法阻
止针对非控制数据的攻击。鉴于目前研究 Windows 内存防护机制的文献寥寥无几，对 Windows 采用的各种
内存防护机制及其突破技术进行了深入研究，并详述非控制数据防护的研究现状，在此基础上，分析了
Windows 内存防护面临的挑战，并讨论了内存防护的未来之路。
关键词：Windows 内存防护；内存防护机制；控制数据防护；非控制数据防护
中图分类号：TP309
文献标识码：A
doi: 10.11959/j.issn.2096-109x.2017.00208
Research on Windows memory protection mechanism
LU Ting-ting
1
, WANG Jun-feng
1,2
(1. College of Computer Science, Sichuan University, Chengdu 610065, China;
2. School of Aeronautics and Astronautics, Sichuan University, Chengdu 610065, China)
Abstract: Over the past three decades, attacks exploiting Windows memory holes have emerged in an endless
stream, and the usual means is to attack control-data to hijack the execution flow of the program. To this end, Mi-
crosoft has added layers of protection mechanisms to Windows to prevent such attacks. But at this stage, the defen-
sive mechanisms deployed on Windows cannot prevent attacks against non-control-data. In view of the published ar-
ticles lacking comprehensive study of Windows memory protection mechanism, a detailed introduction to Windows
memory protection mechanism and its breakthrough techniques, and non-control-data protection research status was
conducted. On this basis, the challenges of Windows memory protection were analyzed and the future of memory
protection was discussed.
Key words: Windows memory protection, memory protection mechanism, control-data protection, non-control-data
protection
1 引言
近 30 年来，针对内存溢出漏洞发起的攻
击数不胜数，从第一代网络蠕虫 Morris
[1]
到
Heartbleed
[2]
，每次攻击都造成灾难性后果。此类
攻击大多通过缓冲区溢出修改影响程序执行流程
收稿日期：2017-09-06；修回日期：2017-09-18。通信作者：王俊峰，wangjf@scu.edu.cn
基金项目：国家重点研发计划基金资助项目（No.2016QY06X1205, No.2016YFB0800605）；国家自然科学基金资助项目
（No.91438120, No.91338107, No.91438119）；四川省重点研发计划基金资助项目（No.17ZDYF2583）
Foundation Items: The National Key Research and Development Program (No.2016QY06X1205, No.2016YFB0800605), The
N
ational Natural Science Foundation of China (No.91438120, No.91338107, No.91438119), The Technology Research and De-
velopment Program of Sichuan Province (No.17ZDYF2583)
剩余14页未读，继续阅读
资源评论
