As one of the most notorious programming errors, memory access errors still hurt modern software security. Particularly, they are hidden deeply in important software systems written in memory unsafe languages like C/C++. Plenty of work have been proposed to detect bugs leading to memory access errors. However, all existing works lack the ability to handle two challenges. First, they are not able to tackle fine-grained memory access errors, e.g., data overflow inside one data structure. These errors are usually overlooked for a long time since they happen inside one memory block and do not lead to program crash. Second, most existing works rely on source code or debugging information to recover memory boundary information, so they cannot be directly applied to detection of memory access errors in binary code. However, searching memory access errors in binary code is a very common scenario in software vulnerability detection and exploitation.In order to overcome these challenges, we propose Memory Access Integrity (MAI), a dynamic method to detect fine-grained memory access errors in off-the-shelf binary executables. The core idea is to recover fine-grained accessing policy between memory access behaviors and memory ranges, and then detect memory access errors based on the policy. The key insight in our work is that memory accessing patterns reveal information for recovering the boundary of memory objects and the accessing policy. Based on these recovered information, our method maintains a new memory model to simulate the life cycle of memory objects and report errors when any accessing policy is violated. We evaluate our tool on popular CTF datasets and real world softwares. Compared with the state of the art detection tool, the evaluation result demonstrates that our tool can detect fine-grained memory access errors effectively and efficiently. As the practical impact, our tool has detected three 0-day memory access errors in an audio decoder.

中文翻译：

---

内存访问完整性：检测二进制代码中的细粒度内存访问错误

作为最臭名昭著的编程错误之一，内存访问错误仍然损害现代软件安全。特别是，它们深深地隐藏在用 C/C++ 等内存不安全语言编写的重要软件系统中。已经提出了大量工作来检测导致内存访问错误的错误。然而，所有现有的工作都缺乏应对两个挑战的能力。首先，它们无法解决细粒度的内存访问错误，例如，一个数据结构内的数据溢出。这些错误通常会在很长一段时间内被忽视，因为它们发生在一个内存块内，不会导致程序崩溃。其次，现有的大部分工作都依赖于源代码或调试信息来恢复内存边界信息，因此它们不能直接应用于检测二进制代码中的内存访问错误。然而，在二进制代码中搜索内存访问错误是软件漏洞检测和利用中非常常见的场景。为了克服这些挑战，我们提出了内存访问完整性（MAI），这是一种动态检测细粒度内存访问错误的方法。 -shelf 二进制可执行文件。核心思想是在内存访问行为和内存范围之间恢复细粒度的访问策略，然后基于该策略检测内存访问错误。我们工作中的关键见解是内存访问模式揭示了用于恢复内存对象边界和访问策略的信息。基于这些恢复的信息，我们的方法维护了一个新的内存模型来模拟内存对象的生命周期，并在违反任何访问策略时报告错误。我们在流行的 CTF 数据集和现实世界的软件上评估我们的工具。与最先进的检测工具相比，评估结果表明我们的工具可以有效且高效地检测细粒度内存访问错误。作为实际影响，我们的工具在音频解码器中检测到三个 0 天内存访问错误。