A user space program Inlinehook method based on loongarch architecture and medium

Abstract

This application discloses a user-space program inline hooking method and medium based on the Loongarch architecture, mainly relating to the field of user-space program technology. It addresses the problems of existing solutions being unable to hook functions of the application itself or functions loaded by static libraries based on the Loongarch architecture, unable to hook the behavior of applications calling ordinary library functions, and heavily reliant on the system kernel version. The method includes: jumping to the second-level jump board of the hook module through a preset first-level jump board assembly code; saving the current execution context through the second-level jump board, and executing the preset unified hook logic execution function; calling a user-defined function through the preset unified hook logic execution function; after executing the user-defined function, jumping back to the second-level jump board, jumping to the repaired assembly instruction code, and jumping to an offset of 6 bytes from the beginning of the hooked function.

Description

Technical Field

[0001] This application relates to the field of user-space program inlinehook technology, and in particular to a user-space program inlinehook method and medium based on the Loongarch architecture. Background Technology

[0002] Inline hooks, also known as inline function calls, are a method for intercepting target function calls, primarily used in antivirus software, security software, and sandboxes. The basic idea is to redirect a function call to our own function so that processing can be performed before or after the function execution; this can include: checking parameters, stubbing, logging, modifying return data, and filtering calls. Security software often uses this technique to prevent / monitor potential malicious operations.

[0003] Existing inline hook frameworks do not support LoongArch CPU. Currently, domestic systems based on LoongArch, such as Galaxy Kylin and UnionTech UOS, often use preload hook, kernel syscall hook, and ebpf to implement behavior monitoring and other functions. However, these technologies all have their limitations. Specifically, preload hook cannot hook functions of the application itself or functions loaded by static libraries; kernel syscall hook cannot hook the behavior of the application calling ordinary library functions; and ebpf is heavily dependent on the system kernel version, making most functional modules unusable. Summary of the Invention

[0004] This application provides a user-space program inlinehook method and medium based on the Loongarch architecture to solve the problems of existing solutions that cannot hook application's own functions or functions loaded by static libraries, cannot hook the behavior of application calling ordinary library functions, and are heavily dependent on the system kernel version.

[0005] Firstly, this application provides a user-space program inlinehook method based on the Loongarch architecture, the method including:

[0006] The control program itself, tracer, uses ptrace's attach operation to hijack the preset controlled process tracee.

[0007] After the attach operation is successfully hijacked, the current registers of the process tracer are obtained and cached.

[0008] By using the libc library loading address and mmap function address of process tracer and the library loading address of process tracee, the mmap function address of process tracee can be obtained.

[0009] Configure the registers related to the mmap function in the tracer process, run the mmap function of the tracer process, allocate a preset memory in the tracer process, obtain the return address of the mmap function of the tracer process, and inject the hook module into the preset memory.

[0010] The backup process tracee hooks the first 5 bytes of assembly instructions of a function into the allocated preset memory; it then repairs the first 5 bytes of the backup assembly instructions by performing address jump instructions to obtain the repaired assembly instructions.

[0011] Replace the first 5 bytes of the function to be hooked with the preset first-level jump board assembly code, and convert the function to be hooked into the function to be hooked; after the replacement is completed, terminate the hijacking process tracee;

[0012] Once the process tracee resumes normal operation, when it reaches the hooked function, it executes the preset first-level jump board assembly code, which then jumps to the second-level jump board of the hook module. The second-level jump board saves the current execution context, retrieves the input parameter information of the hooked function, and then jumps to the preset unified hook logic execution function for execution. The preset unified hook logic execution function is used to extend user-defined functions.

[0013] The user-defined function is called by a pre-defined unified hook logic execution function, and the input parameters are passed to the user-defined function. After the user-defined function is executed, the process jumps back to the second-level jump board, restores the execution context, jumps to the repaired assembly instruction code, jumps to the beginning of the hooked function at an offset of 6 bytes, and executes the process trace of the hooked function.

[0014] In one implementation of this application, the attach operation of ptrace is used to hijack the preset control process tracee, specifically including:

[0015] Based on the process ID (PID) of the preset control process tracee, use the ptrace attach operation to the process with the process ID PID;

[0016] Waiting for the process to enter the STOPPED state, the current registers of the process tracer are retrieved and cached.

[0017] In one implementation of this application, the address of the mmap function in the process tracer is obtained by using the libc library load address and mmap function address of the process tracer, and the library load address of the process tracee. Specifically, this includes:

[0018] Use dlsym to obtain the address of the mmap function in the tracer process;

[0019] Use the Linux system's / proc / pid / maps to obtain the address of the tracer process and the libc library function of the tracee process;

[0020] The relative offset is calculated based on the offset of the mmap function address of the tracer process relative to the address of its own libc library function.

[0021] Add a relative offset to the address of the libc library function of process tracee to obtain the address of the mmap function of process tracee.

[0022] In one implementation of this application, the tracer process modifies the register configuration of the tracee process, and then calls the mmap function of the tracee process. The mmap function allocates a preset memory segment in the tracee process, specifically including:

[0023] According to the Loongarch register defaults, the tracer process uses ptrace PTRACE_SETREGSET to set the six parameters of the tracer process's mmap function address to the tracer process's r4-r9 registers, set the tracer process's r1 register to an invalid address, and set the tracer process's pc register to the mmap function address.

[0024] The tracer process uses ptrace PTRACE_CONT to resume execution of the tracee process. The tracee process executes the mmap function, allocating a pre-defined memory segment specified by the mmap function within the tracee process.

[0025] In one implementation of this application, injecting a hook module into preset memory specifically includes:

[0026] The hook module binary file is read into the tracer process's memory, and then the ptrace PTRACE_POKEDATA is used to write the hook module into the preset memory allocated by the tracer process.

[0027] In one implementation of this application, the backup process tracer hooks the first 5 bytes of assembly instructions of a function into a pre-allocated memory location; the first 5 bytes of the backed-up assembly instructions are repaired by address jump instructions to obtain the repaired assembly instructions, specifically including:

[0028] Use ptrace PTRACE_SETREGSET to set the r1 register of process tracee to an illegal address and set the pc register to the preset memory start address allocated by process tracee.

[0029] Use ptrace PTRACE_CONT to resume execution of the tracee process and execute the injected function of the hook module;

[0030] By injecting the function into the preset memory, the first 5 bytes of assembly code of the function to be hooked are copied into the preset memory.

[0031] The address jump instruction is repaired by injecting a function to fix the first 5 bytes of copied assembly instructions:

[0032] Repair branch jump instructions relative to the PC register and determine the instruction type of the branch jump instructions that need to be repaired; among them, the instruction type includes non-logical judgment instructions and logical judgment instructions;

[0033] When it is a non-logical conditional instruction, obtain the PC address and relative offset of the non-logical conditional instruction, according to the formula:

[0034] Absolute address = PC address + sign_extend64(off, 28),

[0035] Calculate the absolute address of the jump; where sign_extend64 is the unsigned extension defined by Loongarch; transfer the calculated absolute address to the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d; then use the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d together with the jirl instruction as the repaired assembly instruction code;

[0036] When it is a logical judgment instruction, the value and offset of the PC register are obtained according to the formula:

[0037] Absolute address = value of PC register + offset value

[0038] Calculate the absolute address of the jump, and replace the branch jump instruction with the instruction that is logically opposite to the branch jump instruction, as the repaired assembly instruction code.

[0039] In one implementation of this application, after the replacement is completed, the attach operation hijacking process tracee is terminated, specifically including:

[0040] Once the injection function of the hook module injected into the process tracee has completed replacing the first 5 bytes of the function to be hooked with the preset first-level jumper assembly code,

[0041] Use ptrace PTRACE_SETREGS to set the registers to the register values ​​cached when the attach operation was successfully hijacked, restoring the initial register state of the process tracee when it was hijacked;

[0042] Calling ptrace PTRACE_DETACH releases the hijacking of the tracee process, allowing the tracee process to resume normal execution.

[0043] In one implementation of this application, the current execution context is saved through a secondary jump table, the input parameter information of the hooked function is obtained, and then execution is performed by jumping to a preset unified hook logic execution function, specifically including:

[0044] The hook module's secondary stepping board saves the execution context of the currently hooked function; specifically, it saves the values ​​of the current CPU registers to the stack using assembly instructions; the data to be saved includes: parameter registers a0-a7, save registers s0-s8, frame pointer fp, and return address ra;

[0045] The input parameter information of the hooked function is configured into the current CPU register;

[0046] Execution function is set by pre-defined unified hook logic:

[0047] The `invocation(FunctionContext* func_ctx, CpuContext * cpu_ctx)` method passes the input parameter information to the user-defined function.

[0048] Among them, func_ctx contains information about user-defined functions and the hooked functions, and cpu_ctx contains the current register information of the hooked functions, including the input parameter information of the hooked functions.

[0049] In one implementation of this application, after executing the user-defined function, the process jumps back to the second-level jump board, restores the execution context, jumps to the repaired assembly instruction code, jumps to the offset 6 bytes from the beginning of the hooked function, and executes the process tracer of the hooked function, specifically including:

[0050] After executing the user-defined function, jump back to the second-level jump board and restore the parameter registers a0-a7, save registers s0-s8, frame pointer fp and return address ra that were previously saved to the stack;

[0051] Jump to the assembly instruction code after the hook module is repaired, jump to the execution of the hooked function at an offset of 6 bytes from the beginning, and trace the process of the hooked function.

[0052] Secondly, this application provides a non-volatile computer storage medium storing computer instructions, which, when executed, implement a user-space program Inlinehook method based on the Loongarch architecture as described above.

[0053] As can be seen from the above technical solutions, this application has the following advantages:

[0054] I. It has achieved comprehensive hooking capabilities for both application-specific functions and static library functions:

[0055] Traditional solutions are limited by the interception range of dynamic link library functions, while this technology uses ptrace's process control mechanism and mmap memory injection technology to directly modify the instruction stream of the target process dynamically. Specifically, it is manifested in the following ways: (1) After obtaining the address of the mmap function of the process tracer using the tracer process, ptrace can allocate preset memory at any location in its memory space and inject the hook module, breaking through the limitation of the fixed address of static library functions; (2) By backing up and replacing the instructions at the beginning of the original function, both internal functions of the application and static link library functions can be accurately intercepted, solving the limitation of traditional solutions that can only hook dynamic library functions. This deep control capability provides more granular analysis tools for software debugging, security monitoring and other fields.

[0056] Second, it eliminates the strong dependency on the system kernel version:

[0057] Existing technologies typically rely on specific kernel modules or system call interfaces, while this application adopts a pure user-space implementation: by configuring Loongarch registers and using assembly instruction repair techniques (such as dynamic relocation of relative addressing instructions), the hook process runs entirely in user space. Its advantages are: (1) It avoids compatibility issues caused by kernel version differences by not modifying kernel code or loading kernel modules; (2) It implements process control through the ptrace standard interface, ensuring universality across different system versions of the Loongarch architecture; (3) Memory injection and instruction repair are both completed in user space, reducing the risk of system crashes.

[0058] Third, a non-intrusive function behavior monitoring system was constructed:

[0059] The technical solution achieves transparent interception of ordinary library function calls through a three-stage mechanism of "backup-replacement-jump" (backing up the original instruction → jumping to the user-defined function → executing the original instruction and returning). Its core features are: (1) dynamic writing of the jump address allows the monitoring process to be performed without modifying the source code of the hooked program; (2) the integrity of the execution logic of the hooked process is ensured through register state preservation and instruction stream recovery mechanisms; and (3) the flexible insertion of user-defined execution functions provides a standardized interface for scenarios such as performance analysis and vulnerability detection. This design provides a programmable monitoring framework for function-level behavior analysis while ensuring system stability. Attached Figure Description

[0060] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart of an Inlinehook method for a user-space program based on the Loongarch architecture, provided in an embodiment of this application. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0064] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0065] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0066] The embodiment provides a user-space program inlinehook method based on the Loongarch architecture, such as Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps:

[0067] Step 110: The control program's own process tracer uses the attach operation of ptrace to hijack the preset controlled process tracee; ​​after the attach operation is successfully hijacked, the current registers of process tracee are obtained and cached; using the libc library loading address and mmap function address of process tracer and the library loading address of process tracee, the mmap function address of process tracee is obtained.

[0068] In some embodiments, the control program's own process, tracer, uses the attach operation of ptrace to hijack the preset controlled process, tracee, specifically including:

[0069] Based on the process ID (PID) of the preset control process tracee, use the ptrace attach operation to the process with the process ID PID;

[0070] Waiting for the process to enter the STOPPED state, the current registers of the process tracer are retrieved and cached.

[0071] It should be noted that after using ptrace's attach operation to hijack the default control process tracee, it can obtain the process's current registers for caching, so that it can be restored after the injection is completed.

[0072] Specifically, the address of the mmap function in the process tracer is obtained by using the libc library load address and mmap function address of the process tracer, and the library load address of the process tracee. This includes:

[0073] Use dlsym to obtain the address of the mmap function in the tracer process;

[0074] Use the Linux system's / proc / pid / maps to obtain the address of the tracer process and the libc library function of the tracee process;

[0075] The relative offset is calculated based on the offset of the mmap function address of the tracer process relative to the address of its own libc library function.

[0076] Add a relative offset to the address of the libc library function of process tracee to obtain the address of the mmap function of process tracee.

[0077] Based on the above description, those skilled in the art will understand that this step achieves precise operation on the target process through the process control mechanism of ptrace. Its beneficial effects are reflected in three aspects: First, by hijacking the target process and caching the register state through the attach operation, it ensures the stability of the execution environment for subsequent injection operations and provides a basic guarantee for process state recovery. This non-destructive process control method avoids the risk of process crashes that may occur in traditional solutions. Second, by dynamically calculating the mmap function address and comparing the offset of the tracer with the libc library base address of the process tracer, it effectively solves the function location problem caused by address space randomization (ASLR) between different processes. This method does not depend on a specific kernel version or debugging symbols and has better system compatibility. Finally, the entire process is completed entirely in user space, requiring no kernel module support or special permission configuration. It obtains necessary information through the standard ptrace interface and the / proc file system, meeting the needs of security monitoring scenarios while reducing the intrusion into the system's operating environment.

[0078] Step 120: Configure the register configuration related to the mmap function in the process tracer through the process tracer, run the mmap function of the process tracer, allocate a preset memory in the process tracer, obtain the return address of the mmap function of the process tracer, and inject the hook module into the preset memory.

[0079] Specifically, the process involves configuring the registers related to the mmap function within the tracer process, running the mmap function of the tracer process, allocating a pre-defined memory segment within the tracer process, and obtaining the return address of the mmap function of the tracer process. This includes:

[0080] According to the Loongarch register defaults, the tracer process uses ptrace PTRACE_SETREGSET to set the six parameters of the tracer process's mmap function address to the tracer process's r4-r9 registers, set the tracer process's r1 register to an invalid address, and set the tracer process's pc register to the mmap function address.

[0081] The tracer process uses ptrace PTRACE_CONT to resume execution of the tracee process. The tracee process executes the mmap function, allocating a pre-defined memory segment specified by the mmap function within the tracee process.

[0082] It should be noted that when the tracee process executes the mmap function, it allocates a pre-defined memory segment specified by the mmap function. The tracer process uses waitpid to wait for the tracee's SIGSEGV signal. Because an invalid return address is set, tracee will encounter an invalid return address and generate a segmentation fault after executing mmap, thus returning control to tracer.

[0083] Specifically, injecting the hook module into the preset memory includes:

[0084] Read the hook module binary file into initial memory;

[0085] Use ptrace PTRACE_POKEDATA to write the initial memory into the preset memory allocated by the tracee process.

[0086] Based on the above description, those skilled in the art will understand that this step achieves a safe and controllable memory injection operation through register control and inter-process cooperation mechanisms. Its beneficial effects are as follows: First, based on the Loongarch architecture's pre-defined register conventions (r4-r9 parameters, r1 setting an illegal address, pc pointing to mmap), precise control over the target process's function calls is achieved. This architecture-specific parameter passing method ensures the accuracy of cross-platform operations. Second, by setting an illegal return address to trigger the SIGSEGV signal, a reliable execution flow control method is constructed. This ensures that the mmap function can completely perform memory allocation and that control can be safely returned to the tracer process, avoiding the process control issues that may occur in traditional solutions. Finally, the use of PTRACE_POKEDATA for memory writing achieves binary-level precise injection of the hook module. This method does not rely on the dynamic linker or symbol resolution and can directly manipulate raw memory data, effectively avoiding the location difficulties caused by address randomization. The entire process is completed through the standard ptrace interface, maintaining the stability of the target process while providing a reliable memory foundation for subsequent hook operations.

[0087] Step 130: Back up the first 5 bytes of assembly instruction code of the function to be hooked by the tracee process to the allocated preset memory; repair the address jump instruction of the backed-up first 5 bytes of assembly instruction code to obtain the repaired assembly instruction code; replace the first 5 bytes of the function to be hooked with the preset first-level jump board assembly code, and convert the function to be hooked into the hooked function; after the replacement is completed, terminate the hijacking process tracee.

[0088] The backup process tracee hooks the first 5 bytes of assembly instructions of a function into a pre-allocated memory location; it then performs address jump instruction repair on the first 5 bytes of the backed-up assembly instructions to obtain the repaired assembly instructions, specifically including:

[0089] Use ptrace PTRACE_SETREGSET to set the r1 register of process tracee to an illegal address and set the pc register to the preset memory start address allocated by process tracee.

[0090] Use ptrace PTRACE_CONT to resume execution of the tracee process and execute the injected function of the hook module;

[0091] By injecting the function into the preset memory, the first 5 bytes of assembly code of the function to be hooked are copied into the preset memory.

[0092] The address jump instruction is repaired by injecting a function to fix the first 5 bytes of copied assembly instructions:

[0093] Repair branch jump instructions relative to the PC register and determine the instruction type of the branch jump instructions that need to be repaired; among them, the instruction type includes non-logical judgment instructions and logical judgment instructions;

[0094] When it is a non-logical conditional instruction, obtain the PC address and relative offset of the non-logical conditional instruction, according to the formula:

[0095] Absolute address = PC address + sign_extend64(off, 28),

[0096] Calculate the absolute address of the jump; where sign_extend64 is the unsigned extension defined by Loongarch; transfer the calculated absolute address to the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d; then use the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d together with the jirl instruction as the repaired assembly instruction code;

[0097] When it is a logical judgment instruction, the value and offset of the PC register are obtained according to the formula:

[0098] Absolute address = value of PC register + offset value

[0099] Calculate the absolute address of the jump, and replace the branch jump instruction with the instruction that is logically opposite to the branch jump instruction, as the repaired assembly instruction code.

[0100] As an example, a non-logical condition instruction: for example, b offs26:

[0101] Calculate the absolute address of the jump based on the instruction's PC address and relative offset:

[0102] The absolute address imm = PC address + sign_extend64(off, 28);

[0103] Where sign_extend64 is the implementation of the unsigned extension defined by Loongarch:

[0104] static long sign_extend64(long off, int bits){return ((off<<(64 -bits))>>(64 - bits));

[0105] };

[0106] Assign the calculated address imm to the temporary register t5, and use the jirl instruction to jump;

[0107] lu12i.w $t5,imm[31:12];

[0108] ori$t5,imm[11:0];

[0109] lu32i.d $t5,imm[51:32];

[0110] lu52i.d $t5,imm[63:52];

[0111] jirl$r0,$t5,0;

[0112] The four assembly instructions lu12i.w ori lu32i.d lu52i.d write the address imm into register t5, and the jirl instruction jumps to the address stored in t5 to start executing the function call.

[0113] As a second example, logical judgment instructions, such as beq rj,rd,offs16, have the following meanings:

[0114] The values ​​of general purpose registers rj and rd are compared. If they are equal, execution jumps to the target address. Otherwise, execution does not jump. The target address is the current value of the pc register plus the offset value.

[0115] The replacement solution is as follows: First, calculate the absolute jump address imm based on the pc and offs16 of the beq instruction:

[0116] imm = pc + offs16;

[0117] Then, the functionality is achieved using the opposite logical condition, bne:

[0118] bne $rj,$rd,24;

[0119] lu12i.w $t5,imm[31:12];

[0120] ori$t5,imm[11:0];

[0121] lu32i.d $t5,imm[51:32];

[0122] lu52i.d $t5,imm[63:52];

[0123] jirl$r0,$t5,0;

[0124] The `bne` instruction means that if the `rj` and `rd` registers are not equal, it jumps to the target address for execution. Here, the target address is `pc+24`, meaning it skips the following five instructions: `lu12i.w ori lu32i.d lu52i.d jirl`. The `24` represents the total of six instructions (6 instructions in total, including the five `lu12i.w ori lu32i.d lu52i.d jirl`). Since each Loongarch instruction occupies 4 bytes, the total is 6 * 4 = 24 bytes. If the `rj` and `rd` registers are equal, it doesn't jump and continues executing the following instructions: `lu12i.w ori lu32i.d lu52i.d jirl`. This means it jumps to the relative address of the original `beq` jump.

[0125] Based on the above description, those skilled in the art will understand that this step achieves secure backup and redirection of the hook function through instruction-level operations. Its beneficial effects are as follows: First, for the instruction format unique to the Loongarch architecture (such as the sign extension of 28-bit offsets), two processing paths are designed: one for non-logical judgment instructions and one for logical judgment instructions. By calculating the PC address and offset value, the accuracy of address translation during instruction backup is ensured, avoiding jump errors caused by differences in instruction types. Second, a temporary register t5 is used as a transfer station for the jump address, combined with the jirl instruction to achieve control flow transfer. This architecture-specific implementation not only conforms to the Loongarch ABI specification but also ensures the complete preservation of the original instruction semantics. Finally, by distinguishing the address calculation logic for different instruction types (using sign_extend64 extension for non-logical instructions and directly calculating offsets for logical instructions), the compatibility problem of relative address translation in a mixed instruction environment is solved, providing a reliable foundation for subsequent instruction recovery execution. This fine-grained instruction processing mechanism, while ensuring the stability of the hook function, significantly reduces the risk of process crashes due to incomplete instruction backups.

[0126] After the replacement is complete, terminate the hijacking process tracee, specifically including:

[0127] Once the injection function of the hook module injected into the process tracee has completed replacing the first 5 bytes of the function to be hooked with the preset first-level jumper assembly code,

[0128] Use ptrace PTRACE_SETREGS to set the registers to the register values ​​cached when the attach operation was successfully hijacked, restoring the initial register state of the process tracee when it was hijacked;

[0129] Calling ptrace PTRACE_DETACH releases the hijacking of the tracee process, allowing the tracee process to resume normal execution.

[0130] Step 140: The process tracee resumes normal operation. When the process tracee executes the hooked function, it executes the preset first-level jump board assembly code and jumps to the second-level jump board of the hook module through the preset first-level jump board assembly code. The second-level jump board saves the current execution context, obtains the input parameter information of the hooked function, and then jumps to the preset unified hook logic execution function for execution.

[0131] It should be noted that the default unified hook logic execution function is used to extend user-defined functions.

[0132] In step 140: the tracee process is restored to normal execution, which can be specifically:

[0133] When the process tracee finishes executing the injection function of the hook module, a SIGSEGV signal will be generated because the r1 register is set to an illegal address.

[0134] The tracer process uses waitpid to wait for the SIGSEGV signal from the tracee process;

[0135] Using ptrace PTRACE_SETREGS, the register values ​​are set to the register values ​​cached at the time of the initial attach, thereby restoring the initial register state of the process tracer when it was hijacked.

[0136] Calling ptrace PTRACE_DETACH releases the hijacking of the tracee process, allowing the tracee process to resume normal execution.

[0137] In step 140: the jump to the second-level jump of the hook module is initiated through the preset first-level jump board assembly code. Specifically, this can be:

[0138] The code at the beginning of the hook function jumps to the secondary jump address to execute the hook logic:

[0139] lu12i.w $t5,imm[31:12];

[0140] ori$t5,imm[11:0];

[0141] lu32i.d $t5,imm[51:32];

[0142] lu52i.d $t5,imm[63:52];

[0143] jirl$r0,$t5,0;

[0144] The four instructions lu12i.w ori lu32i.d lu52i.d implement the storage of the secondary jump board address imm into the t5 register, and jirl implements the unconditional jump to the t5 register to start the execution of the function.

[0145] Specifically, the current execution context is saved through a secondary jump table, the input parameter information of the hooked function is obtained, and then execution is performed by jumping to a preset unified hook logic execution function. This includes:

[0146] The hook module's secondary stepping board saves the execution context of the currently hooked function; specifically, it saves the values ​​of the current CPU registers to the stack using assembly instructions; the data to be saved includes: parameter registers a0-a7, save registers s0-s8, frame pointer fp, and return address ra;

[0147] The input parameter information of the hooked function is configured into the current CPU register;

[0148] Execution function is set by pre-defined unified hook logic:

[0149] The `invocation(FunctionContext* func_ctx, CpuContext * cpu_ctx)` method passes the input parameter information to the user-defined function.

[0150] Among them, func_ctx contains information about user-defined functions and the hooked functions, and cpu_ctx contains the current register information of the hooked functions, including the input parameter information of the hooked functions.

[0151] It should be noted that in step 140 above, after the injection process is completed, the tracee process resumes normal operation. The tracee process execution flow can be specifically as follows:

[0152] When the program executes the hooked function: it executes 5 bytes of first-level jump board assembly code, jumps to the second-level jump board of the hook module, saves the current execution context, obtains the input parameters of the hooked function, and jumps to the preset unified hook logic execution function (third-level jump board) for execution. This function will call the user-defined function, pass the parameter information of the hooked function, and realize the hooked function tracing and analysis function.

[0153] Step 150: Call the user-defined function through the preset unified hook logic execution function and pass the input parameters to the user-defined function; after the user-defined function is executed, jump back to the second-level jump board, restore the execution context, jump to the repaired assembly instruction code, jump to the beginning of the hooked function offset by 6 bytes, and execute the process tracee of the hooked function.

[0154] After executing the user-defined function, the process jumps back to the second-level jump board, restores the execution context, jumps to the repaired assembly instruction code, jumps to the beginning of the hooked function at an offset of 6 bytes, and executes the process tracer of the hooked function, specifically including:

[0155] After executing the user-defined function, jump back to the second-level jump board and restore the parameter registers a0-a7, save registers s0-s8, frame pointer fp and return address ra that were previously saved to the stack;

[0156] Jump to the assembly instruction code after the hook module is repaired, jump to the execution of the hooked function at an offset of 6 bytes from the beginning, and trace the process of the hooked function.

[0157] It should be noted that in step 150 above, the second-level jump board of the hook module saves the value of the current CPU register to the stack through assembly instructions; the following need to be saved: parameter registers a0-a7, save registers s0-s8, frame pointer fp and return address ra, and the parameter information passed by the hook function is configured into the current CPU register, and the third-level jump board function (pre-defined unified hook logic execution function) is called.

[0158] The `invocation(FunctionContext* func_ctx, CpuContext * cpu_ctx)` method passes parameter information to a user-defined function.

[0159] It should be noted that during execution, this application needs to save the value of func_ctx to register a0 and the value of cpu_ctx to register a1 according to the Loongarch ABI definition. According to the Loongarch instruction set definition, the structure address (64-bit) is split into 4 bytes from high to low and called separately.

[0160] lu12i.w$a0,imm[31:12];

[0161] ori$a0, $a0,imm[11:0];

[0162] lu32i.d$a0,imm[51:32];

[0163] lu52i.d$a0, $a0,imm[63:52];

[0164] The meanings of the above assembly instructions are as follows:

[0165] The meaning of the assembly instruction lu12i.w is: to connect the lower 20 bits of the immediate value to 12 bits of 0 and write it into a general-purpose register;

[0166] The assembly instruction lu32i.d means: connect the lower 20 bits of the immediate value to bits [31:0] of the general-purpose register a0 and write it into register a0;

[0167] The assembly instruction lu52i.d means: connect the lower 20 bits of the immediate value to bits [51:0] of the general-purpose register a0 and write it into register a0;

[0168] `ori` performs a bitwise logical OR operation between the number in register a0 and the lower 12 bits of the immediate value, and then writes the result back to register a0.

[0169] Jump to a third-level function: Use temporary register t5 to store the function address, and use the jirl instruction to jump.

[0170] lu12i.w $t5,imm[31:12];

[0171] ori$t5,imm[11:0];

[0172] lu32i.d $t5,imm[51:32];

[0173] lu52i.d $t5,imm[63:52];

[0174] jirl$r0,$t5,0;

[0175] The jirl instruction is an unconditional jump instruction. jirl $r0,$t5,0 means unconditionally jumping to the address stored in register t5.

[0176] In addition, embodiments of this application also provide a non-volatile computer storage medium storing executable instructions, which, when executed, implement the user-space program Inlinehook method based on the Loongarch architecture as described above.

[0177] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A user-space program inlinehook method based on the Loongarch architecture, characterized in that, The method includes: The control program itself, tracer, uses ptrace's attach operation to hijack the preset controlled process tracee. After the attach operation is successfully hijacked, the current registers of the process tracer are obtained and cached. By using the libc library loading address and mmap function address of process tracer and the library loading address of process tracee, the mmap function address of process tracee can be obtained. Configure the registers related to the mmap function in the tracer process, run the mmap function of the tracer process, allocate a preset memory in the tracer process, obtain the return address of the mmap function of the tracer process, and inject the hook module into the preset memory. The backup process tracee hooks the first 5 bytes of assembly instructions of a function into the allocated preset memory; it then repairs the first 5 bytes of the backup assembly instructions by performing address jump instructions to obtain the repaired assembly instructions. Replace the first 5 bytes of the function to be hooked with the preset first-level jump board assembly code, and convert the function to be hooked into the function to be hooked; after the replacement is completed, terminate the hijacking process tracee; Once the process tracee resumes normal operation, when it reaches the hooked function, it executes the preset first-level jump board assembly code, which then jumps to the second-level jump board of the hook module. The second-level jump board saves the current execution context, retrieves the input parameter information of the hooked function, and then jumps to the preset unified hook logic execution function for execution. The preset unified hook logic execution function is used to extend user-defined functions. The user-defined function is called by a pre-defined unified hook logic execution function, and the input parameters are passed to the user-defined function. After the user-defined function is executed, the process jumps back to the second-level jump board, restores the execution context, jumps to the repaired assembly instruction code, jumps to the beginning of the hooked function at an offset of 6 bytes, and executes the process trace of the hooked function.

2. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, The attach operation of ptrace is used to hijack the default control process tracee, specifically including: Based on the process ID (PID) of the preset control process tracee, use the ptrace attach operation to the process with the process ID PID; Waiting for the process to enter the STOPPED state, the current registers of the process tracer are retrieved and cached.

3. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, By using the libc library load address and mmap function address of process tracer, and the library load address of process tracee, the address of the mmap function of process tracee is obtained, specifically including: Use dlsym to obtain the address of the mmap function in the tracer process; Use the Linux system's / proc / pid / maps to obtain the address of the tracer process and the libc library function of the tracee process; The relative offset is calculated based on the offset of the mmap function address of the tracer process relative to the address of its own libc library function. Add a relative offset to the address of the libc library function of process tracee to obtain the address of the mmap function of process tracee.

4. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, The tracer process modifies the register configuration of the tracee process, which in turn calls the tracee process's mmap function. The mmap function allocates a predefined memory segment within the tracee process, specifically including: According to the Loongarch register defaults, the tracer process uses ptrace PTRACE_SETREGSET to set the six parameters of the tracer process's mmap function address to the tracer process's r4-r9 registers, set the tracer process's r1 register to an invalid address, and set the tracer process's pc register to the mmap function address. The tracer process uses ptrace PTRACE_CONT to resume execution of the tracee process. The tracee process executes the mmap function, allocating a pre-defined memory segment specified by the mmap function within the tracee process.

5. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, Injecting hook modules into the preset memory includes: The hook module binary file is read into the tracer process's memory, and then the ptrace PTRACE_POKEDATA is used to write the hook module into the preset memory allocated by the tracer process.

6. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, The backup process tracee needs to hook the first 5 bytes of assembly instructions of the function into the allocated preset memory; The first 5 bytes of the backup assembly instruction code are repaired by performing address jump instruction repair, resulting in the repaired assembly instruction code, which specifically includes: Use ptrace PTRACE_SETREGSET to set the r1 register of process tracee to an illegal address and set the pc register to the preset memory start address allocated by process tracee. Use ptrace PTRACE_CONT to resume execution of the tracee process and execute the injected function of the hook module; By injecting the function into the preset memory, the first 5 bytes of assembly code of the function to be hooked are copied into the preset memory. The address jump instruction is repaired by injecting a function to fix the first 5 bytes of copied assembly instructions: Repair branch jump instructions relative to the PC register and determine the instruction type of the branch jump instructions that need to be repaired; among them, the instruction type includes non-logical judgment instructions and logical judgment instructions; When it is a non-logical condition instruction, obtain the PC address and relative offset of the non-logical condition instruction, according to the formula: Absolute address = PC address + sign_extend64(off, 28), Calculate the absolute address of the jump; where sign_extend64 is the unsigned extension defined by Loongarch; transfer the calculated absolute address to the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d; then use the four assembly instructions lu12i.w, ori, lu32i.d, and lu52i.d together with the jirl instruction as the repaired assembly instruction code; When it is a logical judgment instruction, the value and offset of the PC register are obtained according to the formula: Absolute address = value of PC register + offset value Calculate the absolute address of the jump, and replace the branch jump instruction with the instruction that is logically opposite to the branch jump instruction, as the repaired assembly instruction code.

7. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, After the replacement is complete, terminate the hijacking process tracee, specifically including: Once the injection function of the hook module injected into the process tracee has completed replacing the first 5 bytes of the function to be hooked with the preset first-level jumper assembly code, Use ptrace PTRACE_SETREGS to set the registers to the register values ​​cached when the attach operation was successfully hijacked, restoring the initial register state of the process tracee when it was hijacked; Calling ptrace PTRACE_DETACH releases the hijacking of the tracee process, allowing the tracee process to resume normal execution.

8. The user-space program inlinehook method based on the Loongarch architecture according to claim 1, characterized in that, The current execution context is saved through a secondary jump table, the input parameter information of the hooked function is obtained, and then execution is performed by jumping to a preset unified hook logic execution function. Specifically, this includes: The hook module's secondary stepping board saves the execution context of the currently hooked function; specifically, it saves the values ​​of the current CPU registers to the stack using assembly instructions; the data to be saved includes: parameter registers a0-a7, save registers s0-s8, frame pointer fp, and return address ra; The input parameter information of the hooked function is configured into the current CPU register; Execution function is set by pre-defined unified hook logic: The `invocation(FunctionContext* func_ctx, CpuContext * cpu_ctx)` method passes the input parameter information to the user-defined function. Among them, func_ctx contains information about user-defined functions and the hooked functions, and cpu_ctx contains the current register information of the hooked functions, including the input parameter information of the hooked functions.

9. The user-space program inlinehook method based on the Loongarch architecture according to claim 8, characterized in that, After executing the user-defined function, the process jumps back to the second-level jump board, restores the execution context, jumps to the repaired assembly instruction code, jumps to the beginning of the hooked function at an offset of 6 bytes, and executes the process tracer of the hooked function, specifically including: After executing the user-defined function, jump back to the second-level jump board and restore the parameter registers a0-a7, save registers s0-s8, frame pointer fp and return address ra that were previously saved to the stack; Jump to the assembly instruction code after the hook module is repaired, jump to the execution of the hooked function at an offset of 6 bytes from the beginning, and trace the process of the hooked function.

10. A non-volatile computer storage medium, characterized in that, It stores computer instructions that, when executed, implement a user-space program Inlinehook method based on the Loongarch architecture as described in any one of claims 1-9.

Images