Software integrity verifying system and method based on VMM (virtual machine monitor)

Abstract

The invention discloses a software integrity verifying system and method based on a VMM (virtual machine monitor). The system comprises a virtual machine and the VMM. The virtual machine comprises an initial detecting module and a circulating detecting module. The VMM comprises a hard disk integrity verifying module, an internal memory integrity verifying module and a hash value calculating module. The method includes: initiating, creating a detecting thread, calculating the hash value of the software file in a hard disk, verifying hard disk integrity, calculating the hash value of the code segment in an internal memory, verifying internal memory integrity, and finishing software integrity verification. The system and the method has the advantages that integrity verification can be performed efficiently by actively being caught into the VMM, and internal memory integrity monitoring is achieved by creating a circulating detecting thread; the system and the method can be used for detecting software's malice modification of an executable file, crack prevention of software, and detecting internal memory patch's modification of the software image in the internal memory.

Description

technical field [0001] The invention belongs to the field of computer technology, and further relates to a software integrity checking system and method based on a virtual machine monitor (Virtual Machine Monitor, VMM) in the technical field of software security. The present invention transfers the software flow to the VMM by invoking the virtualization instruction, and performs the integrity check on the software at the VMM layer, which is used for detecting malicious modification of the software executable file itself, anti-cracking of the software, and detecting the impact of memory patches on the software in the software. Modification of the in-memory image. Background technique [0002] With the rapid development of computer technology, software has increasingly become an indispensable part of people's lives. The scale of software is increasing and the complexity is getting higher and higher, correspondingly, more and more resources are invested in software development...

AI Technical Summary

Problems solved by technology

But, the weak point that this method still exists is: 1, this method obtains the path of executable file by intercepting the system call of upper layer operating system at VMM layer, because the system call in the modern operating system is very frequent, frequently intercept system call It will affect system performance; 2. This method does not verify the integrity of the memory, and cannot prevent memory patches from modifying the image of the software in memory

The disadvantage of this system is: the system obtains the path of the executable file by intercepting the system call of the upper operating system in the VMM. Because the system call of the operating system is very frequent, the frequency of passively falling into the VMM is very high, which affects the system. Performance; the system does not verify the integrity of the software in memory, and cannot prevent memory patches from modifying the image of the software in memory

Images