Self-modifying code detection method and device based on binary translation

Abstract

The invention discloses a self-modifying code detection method and device based on binary translation. The method includes detecting whether the operation indicated by the code to be executed is a write operation during the execution of the local code, wherein the local code includes a code obtained by performing a translation operation on the received instruction; if the code to be executed The operation instructed to be performed is the above-mentioned write operation, then query whether there is a virtual address mapping of the above-mentioned write operation in the instruction page table cache, wherein the above-mentioned virtual address mapping is used to record the page number of the virtual address and the physical address of the above-mentioned received instruction The above-mentioned virtual address mapping obtained in the process of executing the above-mentioned translation operation is stored in the above-mentioned instruction page table cache; if the virtual address mapping of the write operation is found in the instruction page table cache, it is determined that the above-mentioned write operation is a self-translation Modify the code operation. Through the present invention, the efficiency of detection and re-translation of self-modifying codes can be improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a binary translation-based self-modifying code detection method and device. Background technique [0002] Self-teaching code detection is a difficult point in binary translation research, which causes potential problems when binary translation is adopted, because the code actually executed is the translated code rather than the original source code. If the original source code had writes to itself, the translated version must produce exactly the same result. Runtime software must correctly emulate such instances of self-modifying code. [0003] The existing approach is to write-protect the original source code area by runtime software. Page-level write access is turned off for all pages containing translated source code. This can be done through system calls generated by the runtime software. Therefore, any attempt to write to a page containing translated code results in a ...

AI Technical Summary

Problems solved by technology

[0005] The main purpose of the present invention is to provide a self-modifying code detection method and device based on binary translation to solve the problem of low performance of self-modifying code detection performed by target processors in the prior art

Images