Embedded network equipment closed source protocol grey box fuzzy test method and system

Abstract

The invention relates to the technical field of software security testing, in particular to an embedded network equipment closed source protocol grey box fuzzy testing method and system, and the method comprises the steps: extracting a condition jump instruction address in a target program, constructing a terminal debugging environment, and obtaining an initial population for generating a test case; reading all seeds of the seed path, establishing communication between the sub-process and the debugging port, and setting a breakpoint at a conditional jump instruction address of the target program; executing a target program in a terminal debugging environment, if a breakpoint signal is received, executing and recording instruction addresses before and after execution of flow jump when a program segment is executed to a breakpoint in a single step to generate an edge identifier, allocating a variation strategy to seeds in a seed path based on the edge identifier, and executing a seed variation operation, and taking the current fuzzy input as a vulnerability sample and storing the vulnerability sample until a crash signal is triggered during execution of the target program. According to the method, automatic vulnerability mining of a closed source protocol and an embedded system can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of software security testing, and particularly relates to a method and system for grey-box fuzz testing of closed-source protocols for embedded network devices. Background Art

[0002] Fuzzing is the current mainstream vulnerability discovery technology, which triggers abnormal behaviors by inputting a large number of mutated data to the target program. Existing tools such as AFL (American Fuzzy Lop) collect code coverage through instrumentation technology to guide testing, but it relies on source code instrumentation or QEMU dynamic instrumentation and cannot perform fuzz testing on persistent programs, making it difficult to be directly applied to closed-source protocols. Summary of the Invention

[0003] Therefore, the present invention provides a method and system for grey-box fuzz testing of closed-source protocols for embedded network devices, which solves the problem that existing fuzz testing cannot be directly applied to closed-source protocols. By identifying the addresses of conditional jump instructions, capturing real-time execution flow jump information, and optimizing test case generation in combination with genetic algorithms, grey-box testing for closed-source protocols can be achieved.

[0004] According to the design scheme provided by the present invention, on the one hand, a method for grey-box fuzz testing of closed-source protocols for embedded network devices is provided, including:

[0005] Extracting conditional jump instructions and the addresses of conditional jump instructions in the binary target program of the embedded network device, constructing a terminal debugging environment for the embedded network device, enabling the target program to be debugged in this terminal debugging environment, and obtaining an initial population for generating test cases;

[0006] Reading all seeds in the seed path, establishing communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, and setting breakpoints at the addresses of the conditional jump instructions of the target program by using the terminal debugging environment;

[0007] Executing the target program in the terminal debugging environment. If a breakpoint signal is received, single-step execute the corresponding program segment and record the instruction addresses before and after the execution flow jumps when the program segment reaches the breakpoint. Generate an edge identifier corresponding to the program segment by using the two instruction addresses, and assign a mutation strategy to the seeds in the seed path based on the edge identifier and perform the seed mutation operation until a crash signal is triggered during the execution of the target program. Save the current fuzz input as a vulnerability sample, and the mutation strategy is a strategy for obtaining constrained path fuzz inputs by using the edge identifier feedback mechanism.

[0008] As the method for grey-box fuzz testing of closed-source protocols for embedded network devices of the present invention, further, extracting conditional jump instructions and the addresses of conditional jump instructions in the binary target program of the embedded network device includes:

[0009] Manually extract the binary target program of the embedded network device;

[0010] Use the disassembly tool to extract the conditional jump instructions in the target program through disassembly and obtain the addresses of the conditional jump instructions.

[0011] As the black-box fuzz testing method for the closed-source protocol of the embedded network device of the present invention, further, construct the terminal debugging environment of the embedded network device, including:

[0012] Turn off the environment address randomization;

[0013] Set the configuration parameters in the terminal debugging environment so that the target program can be remotely debugged in the terminal environment and the program base address can be viewed. The configuration parameters include the breakpoint table path, the initial seed directory, the vulnerability sample storage directory, the server IP, the client protocol port, the main program base address, and the target service port.

[0014] As the black-box fuzz testing method for the closed-source protocol of the embedded network device of the present invention, further, establish the communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, including:

[0015] Establish a TCP connection between the seed path subprocess and the server in the terminal debugging environment through the GDB RSP protocol, and negotiate the communication between the execution subprocess and the debugging port of the server in the terminal debugging environment through the GDP RSP protocol.

[0016] As the black-box fuzz testing method for the closed-source protocol of the embedded network device of the present invention, further, use two instruction addresses to generate the edge identifier corresponding to the program segment, including:

[0017] When the breakpoint is triggered, record the instruction address before the execution of the conditional jump instruction as the first execution instruction address;

[0018] After single-stepping the corresponding conditional jump instruction, record the instruction address after the execution of the conditional jump instruction as the second execution instruction address;

[0019] Perform a hash operation on the first execution instruction address and the second execution instruction address to obtain the corresponding first hash value and second hash value, and perform an exclusive OR operation between the second hash value shifted one bit to the right and the first hash value to obtain the edge identifier corresponding to the conditional jump instruction program segment.

[0020] As the black-box fuzz testing method for the closed-source protocol of the embedded network device of the present invention, further, allocate mutation strategies to the seeds in the seed path based on the edge identifier and perform seed mutation optimization, including:

[0021] In each round of genetic operation, a global hash map is used to record the triggering times of all edge identifiers;

[0022] For the triggering times of edge identifiers recorded in the fuzzy input corresponding to each seed, the historical triggering times of each edge identifier are read from the global hash map, the survival probability of the seed is set according to the historical triggering times, and the seed is mutated according to the survival probability to retain the seeds of the corresponding low-frequency paths.

[0023] As the black-box fuzz testing method for closed-source protocols of the embedded network device in the present invention, further, the seed mutation operation includes:

[0024] Randomly select a byte in the fuzzy input corresponding to the seed, and generate a specified number of modulus inputs by deleting, adding, and / or modifying the randomly selected byte.

[0025] On the other hand, the present invention also provides a black-box fuzz testing system for closed-source protocols of an embedded network device, including: an environment configuration module, a breakpoint setting module, and a test output module, where

[0026] The environment configuration module is used to extract the conditional jump instructions and the addresses of the conditional jump instructions in the binary target program of the embedded network device, construct a terminal debugging environment for the embedded network device, so that the target program is debugged in this terminal debugging environment, and obtain an initial population for generating test cases;

[0027] The breakpoint setting module is used to read all the seeds of the seed path, establish communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, and set breakpoints at the addresses of the conditional jump instructions of the target program by using the terminal debugging environment;

[0028] The test output module is used to execute the target program in the terminal debugging environment. If a breakpoint signal is received, it will execute the corresponding program segment step by step and record the instruction addresses before and after the execution flow jumps when the program segment executes to the breakpoint, generate an edge identifier corresponding to the program segment by using the two instruction addresses, and allocate a mutation strategy to the seeds in the seed path based on the edge identifier and execute the seed mutation operation until a crash signal is triggered during the execution of the target program. The current fuzzy input is saved as a vulnerability sample, and the mutation strategy is a strategy for obtaining a constrained path fuzzy input by using an edge identifier feedback mechanism.

[0029] The beneficial effects of the present invention:

[0030] The present invention extracts the conditional jump instruction addresses of the target program through disassembly, sets dynamic breakpoints and monitors the execution flow jump in combination with the GDB RSP protocol, and constructs a debugging channel based on TCP connection; adopts a dual-address recording mechanism to generate edge identifiers to represent program path characteristics, and optimizes test cases for triggering low-frequency paths through genetic algorithms; supports custom protocol interaction functions to achieve multi-protocol adaptation, uses phase diagrams to count path trigger frequencies to guide seed mutation, breaks through the limitations of traditional grey-box testing tools, realizes automatic vulnerability mining for closed-source protocols and embedded systems, and has the characteristics of significantly optimized path coverage, strong protocol adaptability, and accurate capture of crash samples, providing an effective solution for binary program security testing. Description of the Drawings

[0031] Figure 1 It is a schematic diagram of the grey-box fuzz testing process for the closed-source protocol of an embedded network device in the embodiment;

[0032] Figure 2 It is a schematic diagram of the principle block diagram of the grey-box fuzz testing algorithm for the closed-source protocol in the embodiment. Detailed Embodiments

[0033] To make the objectives, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below in conjunction with the drawings and technical solutions.

[0034] Aiming at the problem that existing fuzz testing tools rely on source code instrumentation and are difficult to adapt to closed-source protocols, an embodiment of the present invention provides a grey-box fuzz testing method for the closed-source protocol of an embedded network device, as Figure 1 shown, which specifically includes the following contents:

[0035] S101. Extract conditional jump instructions and conditional jump instruction addresses in the binary target program of the embedded network device, construct a terminal debugging environment for the embedded network device, so that the target program can be debugged in this terminal debugging environment, and obtain an initial population for generating test cases.

[0036] Specifically, the binary target program of the embedded network device can be manually extracted; the disassembly tool is used to extract conditional jump instructions in the target program through disassembly and obtain the conditional jump instruction addresses.

[0037] By turning off the environmental address randomization; setting each configuration parameter in the terminal debugging environment, so that the target program can be remotely debugged in the terminal environment and the program base address can be viewed, and the configuration parameters include the breakpoint table path, the initial seed directory, the vulnerability sample storage directory, the server IP, the client protocol port, the main program base address, and the target service port.

[0038] For embedded network devices, the target binary program can be extracted from the system. By disassembling the target binary program, the addresses of conditional jump instructions can be automatically extracted. Disable address randomization in the environment, and then construct a terminal environment to ensure that the target program can be normally debugged using gdbserver in this environment (set environment variables, shared libraries, etc.). By the way, use the "vmmap" view command to view the base address of the program. When setting breakpoints later, the breakpoint address will be the relative address in the breakpoint table + the program base address.

[0039] Among them, when writing the configuration file, set each parameter in the configuration file, and the format can be described as follows:

[0040] <key> ＝ <value>

[0041] The following key - values need to be set currently

[0042] breakpoint_list: The path of the breakpoint table, that is, the file generated by get_breakpoint_list.py

[0043] seed_file_path: The directory of the initial seeds, from which the fuzzer will read different seeds

[0044] result_file_path: The directory where the crashed samples are stored (currently the code concatenates strings, and the directory must end with the ' / ' symbol)

[0045] ip: The ip of the server, the address of the protocol target and the debugging target

[0046] gdb_port: The port of the gdb protocol

[0047] base_address: The base address is the base address of the previous main program, which can be read by vmmap during gdb debugging

[0048] target_port: The target server port

[0049] S102. Read all the seeds in the seed path, establish communication between the seed path subprocess of the embedded network device binary target program and the debugging port in the terminal debugging environment, and set breakpoints at the conditional jump instruction addresses of the target program using the terminal debugging environment.

[0050] Specifically, the seed path subprocess can establish a TCP connection with the server in the terminal debugging environment through the GDB RSP protocol, and negotiate the communication between the execution subprocess and the debugging port of the server in the terminal debugging environment through the GDP RSP protocol. Among them, the GDB RemoteSerial Protocol (RSP) is a simple protocol for transmitting ASCII messages through media that support at least half - duplex communication such as serial lines and networks.

[0051] The current fuzzing code is that each time a test is performed, a TCP socket is established and an attempt is made to connect. After success, the seeds are sent, then data reception is awaited, and the socket is closed. The target port is determined by the parameter target_port in the configuration file.

[0052] S103. Execute the target program in the terminal debugging environment. If a breakpoint signal is received, execute the corresponding program segment step by step and record the instruction addresses before and after the execution flow jumps when the program segment executes to the breakpoint. Generate an edge identifier corresponding to the program segment using the two instruction addresses, and assign a mutation strategy to the seeds in the seed path based on the edge identifier and perform the seed mutation operation until a crash signal is triggered during the execution of the target program. Save the current fuzzing input as a vulnerability sample. The mutation strategy is a strategy for obtaining constrained path fuzzing inputs using an edge identifier feedback mechanism.

[0053] Start fuzz testing. First, read all the seeds in the seed path, then read the breakpoint addresses of the target program in the breakpoint table, establish a child process to communicate with the debugging port. After a successful TCP connection, perform the basic negotiation of the RSP protocol, then control gdbserver to set breakpoints for the program, and then control the program to run. When a signal caused by a breakpoint is received, this system will record the execution instruction address of the program at this time and execute step by step, and record the execution instruction address of the program again. Generate a unique edge identifier using the two execution instruction addresses for the genetic algorithm. If it is a crash signal, record this fuzzing input. If a sample is triggered, save the seed at this time in the directory specified in the parameter table, and use the sample to calculate the hash as the saved crash sample name to ensure that the crash samples do not repeat.

[0054] Almost all the code is included in the function protocol_interaction(const std::string& message) in the code gdb_fuzz_client.cpp, where const std::string& message is the seed to be sent. For this function, it can be modified according to the protocol supported by the target file. Only need to design this function by oneself to implement a robust client. On this basis, only need to set the atomic signal variable fuzz_start = true; after sending data, and fuzz_start = false; after receiving data. This semaphore will notify the automatic debugging thread void gdb_debugging() whether to record the coverage. There may be the following special cases: If the custom protocol is a connectionless protocol, after the target process crashes, the client cannot know that the target has crashed and has been blocked in receiving data. At this time, it is necessary to set in the automatic debugging thread void gdb_debugging() that after gdb receives the crash signal, stop receiving data. For different protocols, users can easily customize the corresponding fuzz testing format to improve the quality of fuzzing inputs and make the grey-box fuzz testing in this case highly extensible.

[0055] Among them, the edge identifier corresponding to the program segment is generated using two instruction addresses, which can be designed to include:

[0056] When the breakpoint is triggered, record the instruction address before the execution of the conditional jump instruction as the first execution instruction address;

[0057] After single-stepping the corresponding conditional jump instruction, record the instruction address after the execution of the conditional jump instruction as the second execution instruction address;

[0058] Perform a hash operation on the first execution instruction address and the second execution instruction address to obtain the corresponding first hash value and second hash value, and perform an exclusive OR operation on the first hash value after shifting the second hash value one bit to the right to obtain the edge identifier corresponding to the program segment of the conditional jump instruction.

[0059] In fuzz testing, the main process will attempt to send seed data. The sending function is in protocol_interaction(const std::string& message), and the user can modify it according to the protocol supported by the target file. When the fuzz input is sent, start recording the generated edge identifiers, and stop recording the generated edge identifiers when a reply is received. All the edge identifiers recorded during this period will represent the program execution path situation caused by this fuzz input.

[0060] Specifically, based on the edge identifier, allocate a mutation strategy to the seeds in the seed path and perform seed mutation optimization, which can include:

[0061] In each round of genetic algorithm, use the global hash map to record the trigger times of all edge identifiers;

[0062] For the trigger times of the edge identifiers recorded in the fuzz input corresponding to each seed, read the historical trigger times of each edge identifier in the global hash map, set the survival probability of the seeds according to the historical trigger times, and perform mutation operations on the seeds according to the survival probability to retain the seeds corresponding to the low-frequency paths.

[0063] Among them, a specified number of modulus inputs can be generated by randomly selecting a byte in the fuzz input corresponding to the seed and deleting, adding, and / or modifying the randomly selected byte.

[0064] Each time a mutation occurs, by randomly selecting one byte from the seed, randomly selecting to delete, add, or modify one byte, each seed generates 10 fuzzed inputs. When all fuzzed inputs are generated, all fuzzed inputs will be rearranged, input in sequence, and all edge identifiers will be recorded in the above manner. These edge identifiers will be inserted into a global hash map implemented by std::map. The map records how many times different edge identifiers have been triggered in total. Find the one that has been triggered the least by other fuzzed inputs among all the edge identifiers of this fuzzed input. Suppose it has been triggered x times, then the probability of this seed surviving is 1 / x. Such a genetic algorithm will retain the seeds that pass through low-frequency paths and is suitable for improving code coverage.

[0065] Furthermore, based on the above method, an embodiment of the present invention also provides a closed-source protocol grey-box fuzz testing system for an embedded network device, including: an environment configuration module, a breakpoint setting module, and a test output module, where,

[0066] The environment configuration module is used to extract conditional jump instructions and the addresses of conditional jump instructions in the binary target program of the embedded network device, construct a terminal debugging environment for the embedded network device, so that the target program can be debugged in this terminal debugging environment, and obtain an initial population for generating test cases;

[0067] The breakpoint setting module is used to read all the seeds of the seed path, establish communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, and set breakpoints at the addresses of the conditional jump instructions of the target program using the terminal debugging environment;

[0068] The test output module is used to execute the target program in the terminal debugging environment. If a breakpoint signal is received, it will execute the corresponding program segment step by step and record the instruction addresses before and after the execution flow jumps when the program segment reaches the breakpoint. Use the two instruction addresses to generate the edge identifier corresponding to the program segment, and allocate a mutation strategy to the seeds in the seed path based on the edge identifier and perform the seed mutation operation until a crash signal is triggered during the execution of the target program. Save the current fuzzed input as a vulnerability sample, and the mutation strategy is a strategy for obtaining a constrained path fuzzed input using an edge identifier feedback mechanism.

[0069] Unless otherwise specifically stated, the relative steps, numerical expressions, and values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0070] In the present specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple. For the relevant parts, reference can be made to the description in the method section.

[0071] The units and method steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation is not considered to exceed the scope of the present invention.

[0072] Those of ordinary skill in the art can understand that all or part of the steps in the above methods can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disc, etc. Optionally, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits. Correspondingly, the various modules / units in the above embodiments can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of the combination of hardware and software.

[0073] Finally, it should be noted that the above-described embodiments are only specific implementation manners of the present invention, used to illustrate the technical solutions of the present invention, rather than to limit it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or make equivalent replacements for some of the technical features; and these modifications, changes, or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.< / value> < / key>

Claims

1. An embedded network device closed-source protocol grey-box fuzz testing method, characterized in that, Include: Extract conditional jump instructions and their addresses in the binary target program of the embedded network device, construct a terminal debugging environment for the embedded network device, so that the target program can be debugged in this terminal debugging environment, and obtain the initial population for generating test cases; Read all seeds in the seed path, establish the communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, and set breakpoints at the addresses of the conditional jump instructions of the target program using the terminal debugging environment; Execute the target program in the terminal debugging environment. If a breakpoint signal is received, execute the corresponding program segment step by step and record the instruction addresses before and after the execution flow jumps when the program segment reaches the breakpoint. Generate the edge identifier corresponding to the program segment using the two instruction addresses, and assign mutation strategies to the seeds in the seed path based on the edge identifier and perform seed mutation operations until a crash signal is triggered during the execution of the target program. Save the current fuzzing input as a vulnerability sample. The mutation strategy is a strategy for obtaining constrained path fuzzing inputs using the edge identifier feedback mechanism.

2. The gray-box fuzz testing method for the closed-source protocol of the embedded network device according to claim 1, wherein Extract conditional jump instructions and their addresses in the binary target program of the embedded network device, including: Manually extract the binary target program of the embedded network device; Use a disassembler tool to disassemble and extract the conditional jump instructions in the target program and obtain the addresses of the conditional jump instructions.

3. The closed-source protocol grey-box fuzz testing method for the embedded network device according to claim 1, wherein, Construct a terminal debugging environment for the embedded network device, including: Turn off address randomization of the environment; Set each configuration parameter in the terminal debugging environment so that the target program can be remotely debugged in the terminal environment and view the program base address. The configuration parameters include the breakpoint table path, initial seed directory, vulnerability sample storage directory, server IP, client protocol port, main program base address, and target service port.

4. The closed-source protocol grey-box fuzz testing method for the embedded network device according to claim 1, wherein Establish the communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, including: Establish a TCP connection between the seed path subprocess and the server in the terminal debugging environment through the GDB RSP protocol, and negotiate the communication between the execution subprocess and the debugging port of the server in the terminal debugging environment through the GDP RSP protocol.

5. The closed-source protocol grey-box fuzz testing method for the embedded network device according to claim 1, characterized in that, Generate the edge identifier corresponding to the program segment using the two instruction addresses, including: When the breakpoint is triggered, record the instruction address before the execution of the conditional jump instruction as the first execution instruction address; After executing the corresponding conditional jump instruction step by step, record the instruction address after the execution of the conditional jump instruction as the second execution instruction address; Perform hash operations on the first execution instruction address and the second execution instruction address to obtain the corresponding first hash value and second hash value, and perform an exclusive OR operation between the second hash value shifted one bit to the right and the first hash value to obtain the edge identifier corresponding to the conditional jump instruction program segment.

6. The closed-source protocol grey-box fuzz testing method for an embedded network device according to claim 1, wherein Assign mutation strategies to the seeds in the seed path based on the edge identifier and perform seed mutation optimization, including: In each round of genetic evolution, use a global hash map to record the trigger times of all edge identifiers; For the trigger times of the edge identifiers recorded in the fuzzy input corresponding to each seed, read the historical trigger times of each edge identifier in the global hash map, set the survival probability of the seeds according to the historical trigger times, and perform mutation operations on the seeds according to the survival probability to retain the seeds of the corresponding low-frequency paths.

7. The closed-source protocol grey-box fuzz testing method for an embedded network device according to claim 1 or 6, characterized in that The seed mutation operation includes: Randomly select a byte in the fuzzy input corresponding to the seed, and generate a specified number of modulus inputs by deleting, adding, and / or modifying the randomly selected byte.

8. An embedded network device closed-source protocol grey-box fuzz testing system, characterized in that, It includes: an environment configuration module, a breakpoint setting module, and a test output module, where The environment configuration module is used to extract the conditional jump instructions and the addresses of the conditional jump instructions in the binary target program of the embedded network device, construct a terminal debugging environment for the embedded network device, so that the target program can be debugged in this terminal debugging environment, and obtain the initial population used to generate test cases; The breakpoint setting module is used to read all the seeds of the seed path, establish the communication between the seed path subprocess of the binary target program of the embedded network device and the debugging port in the terminal debugging environment, and set breakpoints at the addresses of the conditional jump instructions of the target program by using the terminal debugging environment; The test output module is used to execute the target program in the terminal debugging environment. If a breakpoint signal is received, it will execute the corresponding program segment step by step and record the instruction addresses before and after the execution flow jumps when the program segment executes to the breakpoint. Use the two instruction addresses to generate the edge identifier corresponding to the program segment, and allocate mutation strategies to the seeds in the seed path based on the edge identifier and perform the seed mutation operation until a crash signal is triggered during the execution of the target program. Save the current fuzzy input as a vulnerability sample. The mutation strategy is a strategy for obtaining the constrained path fuzzy input by using the edge identifier feedback mechanism.

9. An electronic device, characterized in that, It includes: At least one processor, and a memory coupled to the at least one processor; Wherein, the memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program is executed, it can implement the method according to any one of claims 1 to 7.

Images