Research on the defense method of vtable hijacking

Memory corruption vulnerability is an oldest type of vulnerabilities in software vulnerabilities. Attackers typically use a technique called virtual function table hijacking to exploit memory corruption vulnerability. In this paper, we propose a defense method which extracting virtual function tables and virtual function call related location information from the binary program. Then instrumenting identifier on vtables or backuping the vtables' pointers to detect vtables' integrity. Finally, the defense method is verified by Firefox, Chrome, IE browsers. Experiments show that the method can fully and effectively defend the real-world virtual function table hijacking attack with the small performance overhead and good compatibility.