V8 자바스크립트 메모리 할당 분석 도구 jsmtrace

V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨
î ‹§ l
Eunchong Lee
(Email: gr4ce@korea.ac.kr)
CIST, Korea University
Homepage : https://sites.google.com/site/securesiplab/

Agenda
• Background
• Limitation - in Javascript Engine
• Research Objective
• Technical Background
1. V8’s SourcePositionTable
2. ASan’s Shadow Memory
• Experiment
• Conclusion
• Reference
• Q & A
Eunchong Lee (Email: gr4ce@korea.ac.kr) CIST, Korea University Homepage : https://sites.google.com/site/securesiplab/
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Background - ê§lΩ∏X T®¨ Ñ )ï
• Binary Instrument Tools (LLVM, Vargrind, PIN ... )
I ¡ ⌅¯®– ƒ! T‹| ΩÖXÏ ‰â⌘x T®¨X PÑD Ñ .
(Source from https://cug.org/proceedings/cug2014_proceedings/includes/files/pap114.pdf)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Limitation - in Javascript Engine
• Binary Instrument Tools (LLVM[1], Vargrind[3], PIN ... )
I ê§lΩ∏ ‘ƒX ‰â ¸ .
• ê§lΩ∏î Adaptive JIT )›< ⌘⌅∏¥| ¨© T ¸ D pX‡,
î ⌧ t∏T‹X ¸å ê§lΩ∏ |xD L0 ¥$¿.
(Source from https://github.com/v8/v8/wiki/Interpreter)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Research Objective - ê§lΩ∏ T®¨ î ‹§
• l ©
I ê§lΩ∏ XΩ– i T®¨ î Ñ ‹§
1. t∏T‹(⌘⌅∏¥) ‹X ‰â Ù| ê§lΩ∏ |x ‰â Ù ¿X.
2. ê§lΩ∏ |x–⌧X T®¨ `˘,t⌧,}0,0 Ù î
3. ‰⌧ XΩ– © • ‰â 1•X UÙ.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Agenda
• Background
1. V8’s SourcePositionTable - ê§lΩ∏ T‹ ⌅X –…
2. ASan’s Shadow Memory
• Experiment
• Conclusion
• Reference
• Q & A
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Technical Background - ê§lΩ∏ T‹ ⌅X –…
• 0 0Ω - ê§lΩ∏ T‹ ⌅X • Lt[5], SourcePositionTable
I ⌘⌅∏¥(IR) ¿X Ëƒ–⌧ ê§lΩ∏ |xX ⌅X| Lt– •h.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Technical Background - ê§lΩ∏ T‹ ⌅X –…
• JSMTrace - t∏T‹ ¿X ‹⇣–⌧ SourcePositionTable ⌅Ï.
I ⌘⌅∏¥(IR) ¿X Ëƒ–⌧ SourcePositionTable Ù| JSMTrace ⌅Ï.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Agenda
• Background
2. ASan’s Shadow Memory - Æ@ $Ñ‰‹X î )ï
• Experiment
• Conclusion
• Reference
• Q & A
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Technical Background - Æ@ $Ñ‰‹X î )ï
• 0 0Ω - LLVM’s ASanX T®¨ î 0ï
I ASan@ ‰x ƒl‰– Dt T®¨ –Ï Äú–⌧ `x 1•D –.
(Source from https://github.com/google/sanitizers/wiki/AddressSanitizerComparisonOfMemoryTools)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

• 0 0Ω - LLVM’s ASanX uÏ L‡¨ò
I T®¨X ¡‹| ò¿¥î Shadow Memory Ì `˘h.
(Source from http://research.google.com/pubs/pub37752.html)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

I T®¨X ÌX ¿T ⌧›Xt, Shadow Memory– ¡‹ ✓‰D ‹h.
(Source from https://github.com/google/sanitizers/wiki/AddressSanitizerExampleUseAfterFree)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

I T®¨ ⌘¸‹ MEM TO SHADOW ¡‹ Ux, O(1) 1•.
(Source from https://github.com/llvm-mirror/compiler-rt/blob/master/lib/asan/asan_mapping.h#L319)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Agenda
• Background
2. ASan’s Shadow Memory - JSMTraceX $Ñ‰‹ Ë∏d
• Experiment
• Conclusion
• Reference
• Q & A
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

• 0 0Ω - JSMTraceX î L‡¨ò
I T®¨ ¨© î D ⌅ MTrace Shadow Memory `˘.
(Source from V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l)
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

I T®¨ `˘t ⌧›Xt, PoisonMIdShadow| µt `˘ Ì– T®¨ `˘
‡ à8 mallocId| ‹h, O(1) 1•.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

I T®¨ ⌘¸t ⌧›Xt, t˘Xî ÌX `˘ ‡ à8 mallocId| 8@
ú%h, O(1) 1•.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Experiment - ‰ÿ XΩ lï
• ‰ÿ XΩ - §X»l ƒl| © 1• ‰ÿ¸, T®¨ î Ñ ‰ÿ
I |0 ¨©, |0 ⌧p Ñ⌅X 1• ‰ÿ¸ ê§lΩ∏ |xƒ, `˘
¯˘ƒ T®¨ î Ñ ‰ÿ.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Experiment - 1• ‰ÿ 1
• 1• ‰ÿ ∞¸ 1 - | 0 ⌧p Ñ⌅
I | 0 ⌧p Ñ⌅@, …‡ 1.2xX $Ñ‰‹| ÙÏ . T®¨X ¨©t Œ@
pdfjs.js–⌧ DP Œ@ $Ñ‰‹ ⌧›h.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Experiment - 1• ‰ÿ 2
• 1• ‰ÿ ∞¸ 2 - | 0 ¨© Ñ⌅
I | 0 ¨© Ñ⌅@, …‡ 3.1xX $Ñ‰‹| ÙÏ . T®¨X ¨©t Œ@
pdfjs.js–⌧ Ì‹ DP Œ@ $Ñ‰‹ ⌧›X ‡, ⌅¥ < | 0
⌧p Ñ⌅Ù‰ 1• $Ñ‰‹ ⌧›h.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Experiment - Ñ ‰ÿ 1
• Ñ ‰ÿ ∞¸ 1 - ê§lΩ∏ |xƒ T®¨ Ñ
I T®¨X ¨© î pt0| ê§lΩ∏ |xƒ ¸ < ‹ T Ñ ∞¸.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Experiment - Ñ ‰ÿ 2
• Ñ ‰ÿ ∞¸ 2 - ê§lΩ∏ T®¨ `˘ ¯˘ Ñ
I T®¨X ¨© î pt0| T®¨ `˘ ‡ Dtƒ ¯˘TXÏ ‹
‹ T Ñ ∞¸.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Conclusion
• V8 ê§lΩ∏–⌧ T®¨| î XÏ Ñ Xî ƒl| l⌅.
• V8’s SourcePositionTable - ê§lΩ∏ |xX Symbol ı–
• ASan’s Shadow Memory - T®¨ `˘ Ì î 1• T.
• 1• ‰ÿ, ll §X»l ƒl Octane–⌧ | 0 ⌧p, | 0 ¨© .
I …‡ 1.2x, 3.1xX î $Ñ‰‹ ⌧›.
• Ñ ‰ÿ, ê§lΩ∏ |xƒ, `˘ ¯˘ƒ T®¨ Ñ .
I Ñ ‰ÿD µt ê§lΩ∏–⌧ ⌧›Xî T®¨ ¿T| ‹ < ¸ ⇠
à»‡, T®¨X `˘¸ ¨© ¯¨‡ åx ¸0ƒ – ¸⇠ à»L.
• •ƒ Ë}⇣ êŸ Ñ Ñ|–⌧X ©.
I JSMTrace–⌧X ê§lΩ∏ T®¨ î pt0| 0⇠<, •ƒ Fuzzing¸
Symbolic Execution Ñ|–⌧ T± ®¸ x êŸ Ë}⇣ Ñ t tË¥ » ⇠
àDp| 0 h.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Reference
1. K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov.
Addresssanitizer: a fast address sanity checker. In Presented as part of
the 2012 USENIX Annual Technical Conference (USENIX ATC 12),
pages 309–318, 2012.
2. B. Hackett and S.-y. Guo. Fast and precise hybrid type inference for
javascript. ACM SIGPLAN Notices, 47(6):239–250, 2012.
3. N. Nethercote and J. Seward. Valgrind: a framework for heavyweight
dynamic binary instrumentation. In ACM Sigplan notices, volume 42,
pages 89–100. ACM, 2007.
4. C. Lattner. Llvm ir, 2015. Available online at
http://www.aosabook.org/en/llvm.html.
5. R. McIlroy. Firing up the ignition interpreter, 2015. Available online at
http://v8project.blogspot.kr/2016/08/ﬁring-up-ignition-interpreter.html.
6. L. Bak. What is v8?, 2008. Available online at
https://developers.google.com/v8.
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

Thank you !
Eunchong Lee (Email: gr4ce@korea.ac.kr )
Signal Processing and Advanced Intelligence (SPAI)
Web: https://sites.google.com/site/securesiplab/
V8 ê§lΩ∏ ‘ƒ–⌧X Ÿ T®¨ î ‹§ l

V8 자바스크립트 메모리 할당 분석 도구 jsmtrace

More Related Content

Recently uploaded

Featured

V8 자바스크립트 메모리 할당 분석 도구 jsmtrace