Research Article

A Detection Approach for Vulnerability Exploiter Based on the Features of the Exploiter

Algorithm 1

CFG generation algorithm.
Input: Exploit/ Instruction of the exploit /
Output: CFG/ CFG nodes information stored in the database /
(1)  CFG = new CFG (); / Initialize CFG /
(2)  Instruction instruction; / The command information of the current read line /
(3)  Stack jN = new Stack <>(); / Create a stack to store the number of instruction lines for conditional jumps and path forks /
(4)  Stack R = new Stack <>(); / Create a stack to store the address that should be returned when calling the function /
(5)  int id = 1; / Record the number of CFG nodes /
(6)  for (int i = 0; i < n; i++) do
(7)   if (instruction.exist (Call)) then
(8)    CFGNode = new CFG (instruction);
(9)    if (!isSame (CFGNode)) then
(10)     CFGAdd (CFGNode);
(11)    id++;
(12)   end if;
(13)  else if (instruction.exist (Return)) then
(14)   Return (R); / Return the address stored in R/
(15)  else if (instruction.exist (JXX)) then
(16)   if (instruction.exist (jmp)) then
(17)    CFGNode = new CFG (instruction);
(18)    if (!isSame (CFGNode)) then
(19)     CFGAdd (CFGNode);
(20)    else
(21)     Return (jN) / Return the address stored in jN /
(22)    end if;
(23)   else if (instruction.exist (jnz) or instruction.exist (jz)) then
(24)    CFGNode = new CFG (instruction);
(25)    if (!isSame (CFGNode) or (isSame (CFGNode).second == null)) then
(26)     CFGAdd (CFGNode);
(27)    else
(28)     Return (jN) / Return the address stored in jN /
(29)     end if;
(30)    end if;
(31)  end if;
(32)end for.