需要在飘扬的二进制文件上进行安全评估的协助评估
我正在使用颤动开发一个Android应用程序，但是在脆弱性评估期间，客户提出了对基于ARM的二进制文件的安全性问题。
nx-共享对象没有NX位设置。 NX位提供防止 通过将记忆页标记为非 - 可执行。使用选项-NoexeCstack或-Z noexecstack将堆栈标记为非 - 可执行。
堆栈金丝雀 - 此共享对象没有堆栈金丝雀值添加到 堆栈。堆栈金丝雀用于检测和防止利用覆盖 返回地址。使用该选项 - fstack- protector-全部启用堆栈金丝雀。
无relro-此共享对象未启用RELRO。整个got（.got and .got.plt俩）都是可写的。没有此编译器标志，缓冲区在全局上溢出 变量可以覆盖有条目。使用选项-z，relro，-z，现在启用完整 relro，只有-z，启用部分relro。
文件：lib/armeabi-v7a/libapp.so（1,2,3），lib/mips/libmodpdfium.so（3），lib/armeabi-v7a/libtool-checker.so（2
）
I'm developing an android app using flutter but during vulnerability assessment client have raised security concerns on flutter compiled arm-based binaries.
NX - The shared object does not have an NX bit set. NX bit offers protection against
exploitation of memory-corruption vulnerabilities by marking the memory page as non-
executable. Use option --noexecstack or -z noexecstack to mark the stack as non-
executable.STACK CANARY - This shared object does not have a stack canary value added to
the stack. Stack canaries are used to detect and prevent exploits from overwriting
return address. Use the option - fstack- protector- all to enable stack canaries.No RELRO - This shared object does not have RELRO enabled. The entire GOT (.got and .got.plt both) are writable. Without this compiler flag, buffer overflows on a global
variable can overwrite GOT entries. Use the option -z,relro,- z,now to enable full
RELRO and only -z,relro to enable partial RELRO.
Files: lib/armeabi-v7a/libapp.so (1,2,3), lib/mips/libmodpdfium.so (3), lib/armeabi-v7a/libtool-checker.so (2)
Thanks in advance :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在安全误报上查看这篇文章 - https://docs.flutter.dev/reference/ Security-false-potitives
nx位未设置 - 来自MOBSF的消息具有误导性；它正在寻找堆栈是否标记为不可执行，而不是共享对象。
堆栈金丝雀 -Dart不会生成堆栈金丝雀，因为与C ++不同，DART没有堆栈分配的阵列（C/C ++中堆栈粉碎的主要来源）。
使用relro - DART完全不使用普通过程链接表（PLT）或全局偏移表（GOT）机制，因此lotagocation norly read-Read-Read-Read-Read-Real（Relro）技术不会对于飞镖来说真的很有意义。
Check this post on Security False Positives - https://docs.flutter.dev/reference/security-false-positives
NX bit not set- The message from MobSF is misleading; it's looking for whether the stack is marked as non-executable, not the shared object.
Stack Canary- Dart doesn't generate stack canaries because, unlike C++, Dart doesn't have stack-allocated arrays (the primary source of stack smashing in C/C++).
use RELRO- Dart doesn't use the normal Procedure Linkage Table (PLT) or Global Offsets Table (GOT) mechanisms at all, so the Relocation Read-Only (RELRO) technique doesn't really make much sense for Dart.