PE file signature detection method and device and storage medium

Abstract

The invention relates to the field of signature verification, and discloses a PE file signature detection method and device and a storage medium. The method comprises the steps that file information corresponding to all PE files is stored in a. Bat batch processing script, and batch processing files are obtained; performing de-duplication processing on the batch processing file to obtain a de-duplication batch processing file; extracting PE file information to be signed from the duplicate removal batch processing file; in a Windows registry, querying corresponding installation information matched with the preset key value; according to the to-be-signed PE file information, performing traversal query on files in the installation path to obtain a query PE file; judging whether the PE file has a digital signature or not; and when the digital signature exists, performing consistency detection processing on the digital signature in the query PE file and a preset signature template to obtain a detection result. In the embodiment of the invention, the integrity and correctness of the digital signature of the PE file can be quickly detected by checking the consistency of the file in the installation path and the PE file information.

Description

Technical Field

[0001] The present invention relates to the field of signature verification, and in particular to a PE file signature detection method, device and storage medium. Background Art

[0002] PE file, full name Portable Executable file, is a file format mainly used in Microsoft Windows operating system. PE file format is the standard format for program execution on Windows platform. It contains program code, resources, metadata and other necessary information, so that the program can run on Windows operating system. Common PE files are .exe and .dll suffix files. If the PE file in the software has no digital signature or the signature is illegal, it may cause the software to fail to run normally in the operating system or involve software file infringement. Therefore, it is very important to detect the legitimacy of the digital signature of the PE file in modern software development. It can ensure the security of the software, prevent code tampering, enhance user trust, and meet the security and industry compliance requirements of the software supply chain. At the same time, this technology also ensures that the software can run smoothly in the operating system, improves the security and reliability of the update process, and is the core mechanism to ensure software security and credibility.

[0003] The current method for detecting PE file signatures in software testing is to manually verify by looking for the corresponding file in the software installation path and checking the digital signature information in the properties. This method is not efficient. Once there are too many PE files to be detected, the tester needs to spend a lot of time, and manual detection may result in errors and omissions. Therefore, in order to solve the problem that the current PE file signature verification is inefficient and prone to errors and omissions, a technology is needed to solve the current technical problems. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problems that the current PE file signature verification is inefficient and prone to errors and omissions.

[0005] A first aspect of the present invention provides a method for detecting a PE file signature, the method comprising:

[0006] Store all the file information corresponding to the PE files in the .bat batch script to obtain the batch file;

[0007] Using a preset character processing library and preset keywords, the batch file is deduplicated to obtain a deduplicated batch file;

[0008] Utilizing a PE file processing library, extracting the PE file information to be signed from the deduplication batch file;

[0009] In the Windows registry, query the installation information corresponding to the preset key value match, wherein the installation information includes: an installation path;

[0010] According to the information of the PE file to be signed, the files in the installation path are traversed and queried to obtain the query PE file;

[0011] Determine whether the queried PE file has a digital signature;

[0012] When a digital signature exists, the digital signature in the query PE file is subjected to consistency detection processing with a preset signature template to obtain a detection result.

[0013] Optionally, in a first implementation of the first aspect of the present invention, the deduplication processing of the batch file is performed using a preset character processing library and preset keywords to obtain a deduplication batch file, comprising:

[0014] Based on the open function, the batch file is opened, and the data of the batch file is read line by line to obtain batch data;

[0015] Using a preset character processing library, filtering the data containing preset keywords in the batch data by regular expressions to obtain filtered data;

[0016] The screening data is deduplicated to obtain deduplicated screening data, and the batch files are transferred and screened for deduplication based on the deduplicated screening data to obtain a deduplicated batch file.

[0017] Optionally, in a second implementation of the first aspect of the present invention, the keyword includes: / output / Release / .

[0018] Optionally, in a third implementation of the first aspect of the present invention, the traversing and querying the files in the installation path according to the PE file information to be signed to obtain the query PE file includes:

[0019] Using the OS.path function, determine whether the PE file corresponding to the PE file information to be signed exists in the installation path;

[0020] If it does not exist in the installation path, the logging.warning plug-in is used to generate abnormal log data of the PE file information to be signed;

[0021] If it exists in the installation path, the PE file corresponding to the PE file information to be signed in the installation path is obtained to obtain the query PE file.

[0022] Optionally, in a fourth implementation of the first aspect of the present invention, querying the Windows registry for installation information corresponding to the preset key value match includes:

[0023] Use the winreg.OpenKey function to query the installation information corresponding to the preset key value in the Windows registry.

[0024] Optionally, in a fifth implementation of the first aspect of the present invention, the key value includes: HKE Y_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

[0025] Optionally, in a sixth implementation of the first aspect of the present invention, the determining whether the queried PE file has a digital signature includes:

[0026] Utilizing the concurrent.futures function, multiple threads concurrently determine whether the queried PE file has a digital signature.

[0027] Optionally, in a seventh implementation of the first aspect of the present invention, after extracting the PE file information to be labeled from the deduplication batch file using the PE file processing library, the method further includes:

[0028] Based on the preset Jenkins platform and the preset signature template, the PE file corresponding to the PE file information to be tagged is digitally signed to obtain a signed PE file.

[0029] A second aspect of the present invention provides a PE file signature detection device, comprising: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via a line; the at least one processor calls the instructions in the memory so that the PE file signature detection device executes the above-mentioned PE file signature detection method.

[0030] A third aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned PE file signature detection method.

[0031] In the embodiment of the present invention, the PE file information stored in the .bat batch script is deduplicated by using the designed keywords to obtain the PE file information for verification. Then, based on the set key value, the installation path of the program is obtained from the registry of the Windows system. Finally, the consistency between the files in the installation path and the PE file information is verified, so that the PE file signature information of the PC program is automatically verified, and the integrity and correctness of the PE file digital signature can be quickly detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of an embodiment of a method for detecting a PE file signature in an embodiment of the present invention;

[0033] Figure 2 It is a schematic diagram of an embodiment of step 102 of the method for detecting a PE file signature in an embodiment of the present invention;

[0034] Figure 3 It is a schematic diagram of an embodiment of step 105 of the method for detecting a PE file signature in an embodiment of the present invention;

[0035] Figure 4 The figure is a schematic diagram of an embodiment of a PE file signature detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The embodiment of the present invention provides a PE file signature detection method, device and storage medium.

[0037] The embodiments disclosed in the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments disclosed in the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments disclosed in the present invention are only for exemplary purposes and are not intended to limit the scope of protection disclosed in the present invention.

[0038] In the description of the embodiments disclosed in the present invention, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0039] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the method for detecting a PE file signature in an embodiment of the present invention includes:

[0040] 101. Store all the file information corresponding to the PE files in the .bat batch script to obtain a batch file;

[0041] In this embodiment, a text editor is created, and a for loop is used to traverse the directory containing PE files. For each PE file, a command is used to extract the required information such as file name, file size, storage path, creation date and other data. The extracted information is written into the text editor using the echo command and saved as script data with a .bat suffix to obtain a batch file.

[0042] 102. Using a preset character processing library and preset keywords, perform deduplication processing on the batch file to obtain a deduplication batch file;

[0043] In this embodiment, the character processing library re() is used and keywords are set to remove duplicates from the data including keywords in the list or set in the batch file to obtain a deduplicated batch file.

[0044] For details, please refer to Figure 2 , Figure 2 This is an embodiment of step 102 of the method for detecting a PE file signature in an embodiment of the present invention, and step 102 includes the following specific implementation methods:

[0045] 1021. Based on the open function, open the batch file, read the data of the batch file line by line, and obtain batch data;

[0046] 1022. Using a preset character processing library, filter the data containing preset keywords in the batch data by using a regular expression to obtain filtered data;

[0047] 1023. Perform deduplication processing on the filtered data to obtain deduplication filtered data, and perform transfer filtering and deduplication processing on the batch file based on the deduplication filtered data to obtain a deduplication batch file.

[0048] In steps 1021-1023, the batch file is first opened using Python's file operation method open() function, and file.read reads the data of the batch file line by line to obtain the batch data in the batch file.

[0049] Then use the character processing library re() and the regular expression re.findall to filter the data containing keywords in the read content to obtain the filtered data.

[0050] Finally, the filtered data is deduplicated through list(set) to obtain deduplicated filtered data. Based on the deduplication filtering logic of the deduplication filtered data, the data of the batch file is adjusted in the same manner to obtain a deduplication batch file.

[0051] Specifically, the keywords include: / output / Release / .

[0052] 103. Using a PE file processing library, extract the PE file information to be signed from the deduplication batch file;

[0053] In this embodiment, the PE file processing library pefile.PE() is used to extract the PE file information that needs to be signed from the deduplication screening file. The PE file corresponding to the PE file information to be signed has not been signed with a data signature at this time. Steps 101-103 are mainly to generate the PE file information that needs to verify the data signature later. The PE file information to be signed is used as the query basis for the subsequent verification of the data signature of the PE file.

[0054] Specifically, after step 103, the following specific implementation methods are also included:

[0055] 1031. Based on the preset Jenkins platform and the preset signature template, the PE file corresponding to the PE file information to be tagged is digitally signed to obtain a signed PE file.

[0056] In step 1031, the Jenkins platform is an open source server that can automate various tasks, including building, testing and deploying software, and an automatic tagging program is developed through the Jenkins platform. Then, the signature template is used as the signature basis of the digital signature, and the PE file corresponding to the tag PE file information is digitally signed to obtain a digitally signed PE file, which is used for subsequent data signature verification.

[0057] 104. In the Windows registry, query the installation information corresponding to the preset key value match, wherein the installation information includes: an installation path;

[0058] In this embodiment, the Windows system program installation information is stored in the Windows registry, so the registry editor (regedit) is used to query the information in the Windows registry. Using the set key value, the program installation information matching the key value is queried from the Windows registry, and the installation information includes installation path, version information, configuration settings, etc.

[0059] Specifically, step 104 includes the following specific implementation methods:

[0060] 1041. Use the winreg.OpenKey function to query the installation information corresponding to the preset key value in the Windows registry.

[0061] In this embodiment, the winreg.OpenKey function is a function of the winreg module of Python, which provides the function of operating the Windows registry. First, the registry path and key value to be queried are defined. Then, an attempt is made to open the key under this path and enumerate all subkeys. If a subkey matching key_name is found, the subkey will be further opened and all key values ​​under it will be enumerated. In this way, the installation information corresponding to the key value matching can be queried.

[0062] Specifically, the key value includes: HKEY_LOCAL_MACHINE\SOFTWARE\Micros oft\Windows\CurrentVersion\Uninstall.

[0063] 105. According to the information of the PE file to be signed, the files in the installation path are traversed and queried to obtain a query PE file;

[0064] In this embodiment, the files corresponding to the directory tree of the installation path are traversed, and the find_pe_files function is used to traverse the specified directory and all its subdirectories to check whether each file is a PE file. If so, the file path is added to the list to obtain multiple query PE files.

[0065] See also Figure 3 , Figure 3 This is an embodiment of step 105 of the method for detecting a PE file signature in an embodiment of the present invention, and step 105 includes the following specific implementation methods:

[0066] 1051. Using the OS.path function, determine whether the PE file corresponding to the PE file information to be signed exists in the installation path;

[0067] 1052. If the PE file to be signed does not exist in the installation path, the logging.warning plug-in is used to generate abnormal log data of the PE file information to be signed;

[0068] 1053. If it exists in the installation path, obtain the PE file corresponding to the PE file information to be signed in the installation path to obtain the query PE file.

[0069] In steps 1051-1053, the OS.path function is used to find out whether each PE file in the PE file information to be signed exists in the program installation path. If it does not exist in the installation path, the logging.warning plug-in is used to generate abnormal log data of the PE file information to be signed, recording key steps and error information. If the specified file exists in the installation path, the PE file corresponding to the PE file information to be signed is obtained to obtain the query PE file.

[0070] 106. Determine whether the queried PE file has a digital signature;

[0071] In this embodiment, it is determined whether the PE file has a digital signature. If not, logging.info is called to remind the user that the PE file does not have a digital signature.

[0072] Furthermore, step 106 includes the following specific implementations:

[0073] 1061. Utilize the concurrent.futures function to concurrently determine, using multiple threads, whether the queried PE file has a digital signature.

[0074] In step 1061, when there are multiple PE files to be queried, the concurrent.futures function is used to perform multi-threaded concurrent determination to determine whether there are digital signatures in multiple PE files to be queried at the same time, and 4) the detection results are output simultaneously to improve the efficiency of the detection.

[0075] When testing 100 PE files at a time, it takes about 10 minutes to do it manually, but it takes about 10s-15s to do it with this method. The effect is more obvious when performing multiple regression tests, which greatly improves the efficiency of the test and the quality and safety assurance.

[0076] 107. When a digital signature exists, the digital signature in the query PE file is subjected to consistency detection processing with a preset signature template to obtain a detection result.

[0077] In this embodiment, when the PE file is queried for a digital signature, the expected digital signature is a preset signature template for signing. The digital signature in the queried PE file is checked for consistency with the preset signature template to obtain a test result, and finally the test result is output to the user through logging.log.

[0078] In the embodiment of the present invention, the PE file information stored in the .bat batch script is deduplicated by using the designed keywords to obtain the PE file information for verification. Then, based on the set key value, the installation path of the program is obtained from the registry of the Windows system. Finally, the consistency between the files in the installation path and the PE file information is verified, so that the PE file signature information of the PC program is automatically verified, and the integrity and correctness of the PE file digital signature can be quickly detected.

[0079] Figure 4 4 is a schematic diagram of the structure of a PE file signature detection device provided by an embodiment of the present invention. The PE file signature detection device 400 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 410 (for example, one or more processors) and a memory 420, and one or more storage media 430 (for example, one or more massive storage devices) storing application programs 433 or data 432. Among them, the memory 420 and the storage medium 430 can be short-term storage or permanent storage. The program stored in the storage medium 430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the PE file signature detection device 400. Furthermore, the processor 410 can be configured to communicate with the storage medium 430 to execute a series of instruction operations in the storage medium 430 on the PE file signature detection device 400.

[0080] The detection device 400 based on PE file signature may also include one or more power supplies 440, one or more wired or wireless network interfaces 450, one or more input and output interfaces 460, and / or one or more operating systems 431, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It can be understood by those skilled in the art that Figure 4 The structure of the PE file signature detection device shown does not constitute a limitation on the PE file signature-based detection device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0081] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the PE file signature detection method.

[0082] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0083] In addition, although each operation is described in a specific order, this should be understood as requiring such operation to be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations should be performed to obtain desired results. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation can also be implemented in multiple implementations individually or in any suitable sub-combination mode.

[0084] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A method for detecting a PE file signature, characterized in that: Includes steps: Store all the file information corresponding to the PE files in the .bat batch script to obtain the batch file; Using a preset character processing library and preset keywords, the batch file is deduplicated to obtain a deduplicated batch file; Utilizing a PE file processing library, extracting the PE file information to be signed from the deduplication batch file; In the Windows registry, query the installation information corresponding to the preset key value match, wherein the installation information includes: an installation path; According to the information of the PE file to be signed, the files in the installation path are traversed and queried to obtain the query PE file; Determine whether the queried PE file has a digital signature; When a digital signature exists, the digital signature in the query PE file is subjected to consistency detection processing with a preset signature template to obtain a detection result.

2. The method for detecting a PE file signature according to claim 1, characterized in that: The process of performing deduplication processing on the batch file by using the preset character processing library and the preset keywords to obtain the deduplication batch file comprises: Based on the open function, the batch file is opened, and the data of the batch file is read line by line to obtain batch data; Using a preset character processing library, filtering the data containing preset keywords in the batch data by regular expressions to obtain filtered data; The screening data is deduplicated to obtain deduplicated screening data, and the batch files are transferred and screened for deduplication based on the deduplicated screening data to obtain a deduplicated batch file.

3. The method for detecting a PE file signature according to claim 2, characterized in that: The keywords include: / output / Release / .

4. The method for detecting a PE file signature according to claim 1, characterized in that: The step of traversing and querying the files in the installation path according to the information of the PE file to be signed to obtain the query PE file includes: Using the OS.path function, determine whether the PE file corresponding to the PE file information to be signed exists in the installation path; If it does not exist in the installation path, the logging.warning plug-in is used to generate abnormal log data of the PE file information to be signed; If it exists in the installation path, the PE file corresponding to the PE file information to be signed in the installation path is obtained to obtain the query PE file.

5. The method for detecting a PE file signature according to claim 1, characterized in that: The querying of the installation information corresponding to the preset key value match in the Windows registry includes: Use the winreg.OpenKey function to query the installation information corresponding to the preset key value in the Windows registry.

6. The method for detecting a PE file signature according to claim 5, characterized in that: The key values ​​include: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

7. The method for detecting a PE file signature according to claim 1, characterized in that: The determining whether the queried PE file has a digital signature includes: Utilizing the concurrent.futures function, multiple threads concurrently determine whether the queried PE file has a digital signature.

8. The method for detecting a PE file signature according to claim 1, characterized in that: After extracting the PE file information to be labeled from the deduplication batch file by using the PE file processing library, the method further includes: Based on the preset Jenkins platform and the preset signature template, the PE file corresponding to the PE file information to be tagged is digitally signed to obtain a signed PE file.

9. A PE file signature detection device, characterized in that: The PE file signature detection device comprises: a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor calls the instruction in the memory so that the PE file signature detection device executes the PE file signature detection method according to any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting a PE file signature according to any one of claims 1 to 8 is implemented.

Images