基于源代码的软件同源性分析与漏洞检测系统（C++和QT）

桃扇骨 2024-04-01 14:38 3阅读 0赞

目 录 ································ ································ ································ ··········· I  
1 课程设计任务书································ ································ ··························· 1

1.1 课程设计目的 ································ ································ ···························· 1  
1.2 课程设计要求 ································ ································ ···························· 1  
1.3 系统环境 ································ ································ ································ ·· 1  
1.4 实验过程记录 ································ ································ ···························· 1  
2 绪言································ ································ ································ ·········· 3  
2.1 标准 ································ ································ ································ ········ 3  
3 系统方案设计································ ································ ······························ 4  
3.1 利用字符串匹配进行同源性检测································ ································ ····· 4  
3.2 利用控制流程图 CFG 进行源代码同源性检测································ ····················· 4  
3.3 支持分布式任务调度································ ································ ···················· 4  
3.4 栈缓冲区溢出 ································ ································ ···························· 5  
3.5 堆缓冲区溢出 ································ ································ ···························· 5  
3.6 整数宽度漏洞检测································ ································ ······················· 5  
3.7 整数运算漏洞检测································ ································ ······················· 6  
3.8 整数符号漏洞检测································ ································ ······················· 6  
3.9 格式化字符串漏洞检测································ ································ ················· 6  
4 系统实现································ ································ ································ ···· 7  
4.1 文件预处理 ································ ································ ······························· 7  
4.2 字符串同源性匹配································ ································ ······················· 9  
4.3 判断是函数体以及生成函数链表································ ································ ····· 9  
4.4 生成 CFG 图并进行 CFG 图的比较································ ································ 11  
4.5 多线程进行 CFG 图的比较 ································ ································ ·········· 11  
4.6 栈溢出漏洞检测中的函数体链表形成································ ····························· 12  
4.7 栈溢出漏洞检测中的漏洞的检测································ ································ ··· 13  
4.8 堆溢出漏洞检测 ································ ································ ······················· 13  
4.9 整数宽度溢出漏洞检测································ ································ ··············· 14  
4.10 整数运算溢出漏洞检测································ ································ ··············· 15  
4.11 整数符号溢出漏洞检测································ ································ ··············· 18  
4.12 格式化字符串漏洞检测································ ································ ··············· 19  
5 系统测试································ ································ ································ ·· 21  
6 总结与展望································ ································ ······························· 29  
6.1 实验总结与展望 ································ ································ ······················· 29  
7 对该课程的建议与意见································ ································ ················ 30  
8 参考文献 31  
3系统方案设计

3.1利用字符串匹配进行同源性检测  
任务 R1：图形化界面  
任务 R6 以及 C1：提供样本库（以上二者已在文件中提供或呈现出来） 任务 R2：字符串匹配  
通过代码有效字符串对比匹配，分析样本之间的拷贝比率。  
思路：将需要进行比较的两个文件分别进行预处理，之后将两个预处理后的文件分别存入两个新文件之中，其中第一个文件直接一样的一行一行输出，而第二个文件中取消行之间的换行而变成一个很长的字符串，之后对于第一个文件中的每一行进行 KMP 算法，记录查找到相同的字符串的总长度以及文件本身的长度，从而得出相似度。

有一些在编程中注意到的注意事项：  
1、关键字暂时支持到 99 标准，若更新仅需在数组中添加几个关键字即可。  
2、由于读取方式是一次读一行，故需要检测样本默认源代码文件一行一个语句。  
3、检测样本默认为使用 VS 编写的，使用默认代码美化格式的，即字符间空格严格存在。  
4、为求简化，默认样本无头文件。如需对头文件替换为空，其实已在代码中实现。  
4、以上默认对于后续的检测样本均适用。

3.2利用控制流程图 CFG 进行源代码同源性检测  
任务 R3：CFG  
通过提取代码的调用关系图，检测样本之间各个函数调用关系图是否相似，得出相似的概率。  
思路：将需要进行比较的两个文件分别进行预处理，之后将两个预处理后的文件分别存入两个新文件之中，两个文件均为直接一样的一行一行输出。利用得到的两个文件进行构造函数调用关系图，计算两个关系图相似程度。

3.3支持分布式任务调度  
任务 A2：实现多进程并发检测，此处仅认为 CFG 较需要，故在 CFG 上实现多线程，其

他功能实现起来极为类似，不再赘述。  
思路：在 CFG 的基础上进行，之前的 CFG 是两个文件之间进行 CFG 检测，此处使用多个进程并发执行，将一个文件同时与多个文件进行 CFG 检测。这里采用了五个线程，实际上可以使用很多但五个时已经能够直观的看出使用了多线程，并且便于输入和理解。输出未进行整理而是呈现出较为凌乱的语句，以便于老师检测多线程的实现状况。

3.4栈缓冲区检测  
任务 R4：栈缓冲区检测  
根据栈缓冲区原理分析分配的栈数据区是否存在溢出的问题，给出可疑代码行数与列数。思路：  
构造代码中可能与栈溢出发生关联的变量们构成的链表，之后构造代码中与栈溢出有关的函数们构成的链表，从第一行遍历代码，寻找敏感函数出现的地方，并通过对于参数等的分类讨论来判断是否会发生溢出。

3.5堆缓冲区检测  
任务 B1：堆缓冲区检测  
根据堆缓冲区原理分析分配的数据区是否存在溢出的问题，给出可疑代码行数与列数。思路：  
构造代码中可能与堆溢出发生关联的变量们构成的链表，之后构造代码中与堆溢出有关的函数们构成的链表，之后构造代码中与堆溢出有关的缓冲区设置以及边界审查们构成的链表，从第一行遍历代码，寻找敏感函数出现的地方，并通过对于参数等的分类讨论来判断是否会发生溢出。

3.6整数宽度溢出检测  
任务 B2：整数宽度溢出检测  
根据整数宽度溢出原理分析分配的数据是否存在溢出的问题，给出可疑代码行数与列数。思路：  
构造代码中可能与整数宽度溢出发生关联的变量们构成的链表，之后构造代码中与整数宽度溢出有关的函数们构成的链表，之后构造代码中与整数宽度溢出有关的缓冲区设置以及边界审查们构成的链表，本文转载自http://www.biyezuopin.vip/onews.asp?id=16992从第一行遍历代码，寻找敏感函数出现的地方，并通过对于参数等的分类讨论（例如发生赋值处两变量容纳大小宽度）来判断是否会发生溢出。

int f1(int a, int b);
    int f2(char a, float x);
    float f3(int x, int y);
    int f21(int a, int b);
    int f22(char a, float x);
    float f23(int x, int y);
    int f222(char a, float x);
    
    int func(int x)
    {
        
    	int m;
    	//abcdefg 
    	int f1(int x, int m);
    	return m;
    }
    
    int f2(char a, float x)
    {
        
    	int m;
    	int f1(int x, int m);
    	//m = func(x);
    }
    /*栈溢出：7.cpp
    堆溢出：8.cpp
    宽度：b2.cpp
    运算：b3.cpp
    符号：b4.cpp
    格式化：r5.cpp
    
    样本库！！！！
    
    50个样本(每个100行以上)每10个为相似的一组，1分，最高5分
    
    漏洞检测与同源性检测样本库，样本数量不少于10个，
    每个代码行数不少于100行；每种漏洞至少一个。*/
    
    float f3(int x, int y)
    {
        
    	int m;
    	char n;
    	x = x * y;
    	y = y + y;
    	int f2(char a, float x);
    	int f1(int x, int m);
    }
    
    int func2(int x)
    {
        
    	int m;
    	//abcdefg 
    	int f21(int x, int m);
    	/*lalalalalalalal
    	aaaaaaaaaaaaaaaaa
    	Liiiiiiiiiiiiiiii
    	Saaaaaaaaaaaaaaa
    	Lalisa*/
    	return m;
    }
    
    int f22(char a, float x)
    {
        
    	int m;
    	int f21(int x, int m);
    	//m = func(x);
    }
    
    /*栈溢出：7.cpp
    堆溢出：8.cpp
    宽度：b2.cpp
    运算：b3.cpp
    符号：b4.cpp
    格式化：r5.cpp
    
    样本库！！！！
    
    50个样本(每个100行以上)每10个为相似的一组，1分，最高5分
    
    漏洞检测与同源性检测样本库，样本数量不少于10个，
    每个代码行数不少于100行；每种漏洞至少一个。*/
    
    float f23(int x, int y)
    {
        
    	int m;
    	char n;
    	x = x * y;
    	y = y + y;
    	int f22(char a, float x);
    	int f21(int x, int m);
    }
    
    //What can we say
    //But I don’t care I’ll do it over and over
    
    int f222(char a, float x)
    {
        
    	int m;
    	int f1(int x, int m);
    	//m = func(x);
    }

![在这里插入图片描述][7278028ee79b48d6b9e78f093d0e135b.png_pic_center]  
![在这里插入图片描述][5e26bc8f828340f586a20edb0b2dd94e.png_pic_center]  
![在这里插入图片描述][2dfc5044d9fa4637bc6a52d1392ad5c9.png_pic_center]  
![在这里插入图片描述][5e2ad0d6b4d84030a2c1e52527189531.png_pic_center]  
![在这里插入图片描述][b6ed0ff9227345b2a768a1e5ecebf3ee.png_pic_center]  
![在这里插入图片描述][87a32e782ffb4af88cc75f9ef286152b.png_pic_center]  
![在这里插入图片描述][cc4f83b89b6c4a47a99b543288bff998.png_pic_center]  
![在这里插入图片描述][463ed5d440674910bd25b3c9499e0844.png_pic_center]  
![在这里插入图片描述][4d98e5ecc4924b85908a9fc91542651b.png_pic_center]  
![在这里插入图片描述][16ecdbf26c1c4533bcb8481f6accc5f5.png_pic_center]  
![在这里插入图片描述][707662bdac1e4fc1987382e810326a78.png_pic_center]  
![在这里插入图片描述][ec184c22c12048b498c42ffe25a6c5d4.png_pic_center]  
![在这里插入图片描述][5630c32cc8384b6faef37aacb0902718.png_pic_center]  
![在这里插入图片描述][513c834fda9d430ea81a7c1d0d31e18c.png_pic_center]  
![在这里插入图片描述][b6f78382421440dca3e8b51962ad054f.png_pic_center]  
![在这里插入图片描述][7ac2bdd459bc463895c889554a89480e.png_pic_center]  
![在这里插入图片描述][92dd3ee1fffc4e8dae235c66e677f074.png_pic_center]  
![在这里插入图片描述][4c4ee8da35bb468ba73d16173d83e2e4.png_pic_center]  
![在这里插入图片描述][e13d471766bf410eb4ba38cc8807b263.png_pic_center]

[7278028ee79b48d6b9e78f093d0e135b.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/862e41d9ecc64c23b7f53e69d9f0d736.png
[5e26bc8f828340f586a20edb0b2dd94e.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/2a5465ac68ad4da39a4b92f122569a8a.png
[2dfc5044d9fa4637bc6a52d1392ad5c9.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/f34761fe100f4a45932bf91af3f61418.png
[5e2ad0d6b4d84030a2c1e52527189531.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/4724cec592674344b6eb9713bd8ac1f0.png
[b6ed0ff9227345b2a768a1e5ecebf3ee.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/df1b5a51be4a4a9186799b8b47a1b7d9.png
[87a32e782ffb4af88cc75f9ef286152b.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/2ec124b5525e42a59f6610be98445e15.png
[cc4f83b89b6c4a47a99b543288bff998.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/41545ead1fde4ce1ad2be99d809c107a.png
[463ed5d440674910bd25b3c9499e0844.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/b011899352254c558af22acb0c19291c.png
[4d98e5ecc4924b85908a9fc91542651b.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/ab93698aa6fa49d79d4cb2dc0dcc47ab.png
[16ecdbf26c1c4533bcb8481f6accc5f5.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/cda421a3c9444b598e356593ef2ca797.png
[707662bdac1e4fc1987382e810326a78.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/763077dd2f554b7f9c2034a8c1b012be.png
[ec184c22c12048b498c42ffe25a6c5d4.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/dfdd37af90934e6387c553d096221cd4.png
[5630c32cc8384b6faef37aacb0902718.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/2aefcec55aa54690b97e339f19a9e9be.png
[513c834fda9d430ea81a7c1d0d31e18c.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/bcd26ad491f2495d862f300759a820cb.png
[b6f78382421440dca3e8b51962ad054f.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/c34322c2bc414b59ba12985ba2673116.png
[7ac2bdd459bc463895c889554a89480e.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/b0d1dc11d7104b9b8d6558142f606485.png
[92dd3ee1fffc4e8dae235c66e677f074.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/d9204f1c982f40aca3c28647dfd09fe9.png
[4c4ee8da35bb468ba73d16173d83e2e4.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/874ff6e7b7fe4f8f97668de003b8241b.png
[e13d471766bf410eb4ba38cc8807b263.png_pic_center]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/80d608c1c9e9494ebef1cc2c45e5abb2.png