Memory data protection method and terminal

Abstract

The application provides a memory data protection method and a terminal. Target data in original memory pointed by a target process in a base address register is copied; a new copy memory is created in the base address register, the target data is written into the copy memory, and the target data in the original memory is deleted; and access exception is set for the original memory. In the base address register, the target data in the original memory has been transferred, and in the base address register, the target process only points to the original memory and does not point to the copy memory, so that the position of the copy memory cannot be acquired by the outside, thereby realizing protection of the data, and for the inside, the target data required can be continuously acquired through the copy memory, so that the normal memory access process required is not affected; thus, defense against static analysis and dynamic analysis is realized, and the data in the memory is prevented from being acquired by the outside.

Description

Technical Field

[0001] This invention relates to the field of memory processing, and more particularly to a memory data protection method and terminal. Background Technology

[0002] To prevent resource tampering, related technologies typically employ the following methods to handle data: Method 1: Hiding pointers and encrypting data; Method 2: Using debugging tools to detect abnormal memory values; Method 3: Developing real-time memory protection using the Windows kernel. Method 1, being based on the program itself, is relatively easy to develop but more vulnerable to brute-force attacks, resulting in lower security. Method 2 uses detection tools to prevent data analysis, achieving pointer hiding; however, both Method 1 and Method 2 have low resistance to static analysis tools, which can obtain critical data by sharing the program without even starting it. Method 3 can protect the target program by modifying / adding system monitoring objects through Windows kernel development, but this method is more complex to develop. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a memory data protection method and terminal to prevent memory data from being obtained externally.

[0004] In related technologies, in game development, through A memory data protection method, the method comprising: Copy the target data from the original memory pointed to by the target process in the base address register; Create a new copy memory in the base address register, write the target data into the copy memory, and delete the target data from the original memory; Set an access exception for the original memory.

[0005] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A memory data protection terminal includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it performs the following steps: Copy the target data from the original memory pointed to by the target process in the base address register; Create a new copy memory in the base address register, write the target data into the copy memory, and delete the target data from the original memory; Set an access exception for the original memory.

[0006] The beneficial effects of this invention are as follows: the target data in the original memory pointed to by the target process in the base address register is copied to a new copy memory created in the base address register. After the copy is completed, the target data in the original memory is deleted and an access exception is set for the original memory. In this way, if the target process is called externally, its target data in the original memory in the base address register has been transferred. In the base address register, the target process only points to the original memory and not to the copy memory. Therefore, the external source cannot obtain the location of the copy memory, thereby protecting the data. Internally, it can continue to obtain the required target data through the copy memory, thus not affecting the normal memory access process. This achieves defense against static and dynamic analysis and prevents the data in memory from being obtained externally. Attached Figure Description

[0007] Figure 1 A flowchart illustrating the steps of a memory data protection method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the CR3 configuration process in a memory data protection method provided in an embodiment of the present invention; Figure 3 A flowchart illustrating the construction of an exception callback capture device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of a transmission object creation process provided in an embodiment of the present invention; Figure 5 This is a flowchart illustrating another step of a memory data protection method provided in an embodiment of the present invention. Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of the present invention; Label Explanation: 1. A memory data protection terminal; 2. A processor; 3. A memory. Detailed Implementation

[0008] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0009] In related technologies, the base address register (CR3) is the "key" or "map index" for the central processing unit (CPU) to translate virtual addresses into physical addresses. The CPU needs to use the base address register to find the correct page table to translate the virtual addresses used by the program into actual physical addresses in memory. CR3 is like the "identity card" of the address space. Modern CPUs (such as x86 / x64 architecture) cannot directly access physical memory using virtual addresses. They must first perform a process called address translation to convert virtual addresses into physical addresses. This process relies on a data structure called a page table. CR3 is a crucial control register in the CPU, storing the physical address of the current process's page directory. The page directory can be understood as the "root directory" or "master index" of the page table. Each process has its own independent set of page tables, and therefore its own independent page directory. When the operating system switches processes, a core task is to load the physical address of the new process's page directory into CR3. This can be understood as each process being memory-isolated from the others; the key factor in this isolation is the process's CR3 address. It is by setting different CR3 addresses for each process that the operating system achieves strong inter-process memory isolation. Process A cannot access the memory of process B because when it is running, CR3 points to A's page table, and the memory mapping of B cannot be found in A's page table.

[0010] The memory data protection method and terminal described above are applicable to the protection of data in memory, especially to the protection of data stored in memory under static and dynamic attacks, and to prevent data leakage. The following is a description of specific implementation methods.

[0011] Please refer to Figure 1 A memory data protection method includes steps 110 to 130.

[0012] Step 110: Copy the target data from the original memory pointed to by the target process in the base address register.

[0013] Step 120: Create a new copy memory in the base address register, write the target data into the copy memory, and delete the target data in the original memory.

[0014] Step 130: Set an access exception for the original memory.

[0015] In this way, the target data in the original memory pointed to by the target process in the base address register is copied to the copied memory, and the target data in the original memory is deleted. When an external system calls the target process, the base address register accesses the original memory, but since the target data in the original memory has been deleted, it cannot obtain the specific content of the target data, thus preventing the stored data from being retrieved by calling the target process. Simultaneously, an access exception is set in the original memory, which the system can catch internally. This allows the system to access the copied memory according to permissions to retrieve the target data and perform normal operations, ensuring that the normal execution of the internal system processes is not affected.

[0016] In an alternative implementation, step 130 is followed by steps 140 to 160.

[0017] Step 140: Create a worker thread under system privileges and set up an exception callback capture device for the worker thread.

[0018] Step 150: When a pending thread requests access to the original memory, obtain the process identifier of the pending process corresponding to the pending thread through the thread identifier of the pending thread.

[0019] Step 160: Determine whether the pending process is the target process based on the process identifier. If so, receive the callback information or exception of the pending thread through the exception callback capture device.

[0020] As described above, when a worker thread is created with system privileges, it possesses system-level permissions, enabling it to access data from other threads or processes. Setting up an exception callback catcher for the worker thread allows it to catch exceptions thrown by other threads or processes. If the pending process is the target process itself, it is assumed to have permission to access the target data. The exception callback catcher receives the callback information or exception from the pending thread to access the copied memory and retrieve the target data normally. This prevents processes without access permissions from obtaining the target data while ensuring that processes with access permissions can obtain the target data normally.

[0021] In an alternative implementation, step 140 includes: skipping exception handling if setting the exception callback capture device fails.

[0022] As described above, if the exception callback capture device is not set up properly, it means that the system cannot handle the thrown exception. The system may have been compromised or other problems may have occurred. In this case, skipping the exception handling will prevent the copied memory from being accessed and the target data in the copied memory from being obtained, thus ensuring the security of the target data.

[0023] In an optional implementation, step 160 further includes: if the pending process is not the target process, then skip the exception handling process.

[0024] As described above, if the pending process is not the target process, it means that the pending process does not have permission to access the target data corresponding to the target process. Therefore, the exception handling process will not be performed, and the copied memory will not be accessed, thus preventing the leakage of the target data.

[0025] In an alternative implementation, step 150 is followed by step 151.

[0026] Step 151: Determine whether the pending thread is the main thread of the pending process. If so, do not execute the exception; otherwise, the pending thread throws an exception.

[0027] As described above, if the pending thread is not the main thread of the pending process, the exception will not be executed directly, thus preventing external parties from gaining access permissions by adding a child thread in the pending process when the pending process has the necessary permissions.

[0028] In an alternative implementation, steps 210 to 230 are further included after step 130.

[0029] Step 210: Create a first structure object, the first address of which is the original address corresponding to the original memory.

[0030] Step 220: When an access request from a pending thread to the target original memory is obtained, determine whether the thread identifier of the pending thread belongs to a preset object. If so, access the original memory in the base address register through the first address to trigger an exception, and create a second structure object. Set the second address of the second structure object to the copy address of the copy memory corresponding to the original memory. Specifically, the access request from the pending thread to the target original memory is obtained in step 150.

[0031] Step 230: Store the exception address of the exception in the second structure object. If the exception address belongs to the worker thread, access the copied memory according to the second address.

[0032] As described above, a first structure object is created, with its first address storing the original address corresponding to the original memory. When a pending thread requests access to the target original memory, if the thread identifier of the pending thread belongs to the preset object (i.e., it has access rights), it accesses the original memory through the first address to trigger an exception, thus performing the first interception. Whether the subsequently thrown exception is handled constitutes the second interception in step 160, ensuring the security of memory access. After an exception is triggered, a second structure object is constructed, with its second address being the copy address of the copied memory corresponding to the original memory. If the exception address belongs to a worker thread, it indicates that the exception was caught by the worker thread. In this case, the pending thread has access rights and obtains the second address to access the copied memory.

[0033] In an optional implementation, storing the exception address of the exception in the second structure object in step 230 further includes step 231.

[0034] Step 231: If the abnormal address does not belong to the worker thread, then other memory operations are performed normally.

[0035] As described above, if the exception address does not belong to the worker thread, it means that the exception was not thrown by the worker thread and does not belong to the exception that needs to be pointed to the copied memory. Therefore, the exception is not handled and other memory operations are performed normally to protect the target data. That is, only exceptions thrown by the worker thread with system privileges will be located in the copied memory.

[0036] In an optional implementation, steps 310 to 320 are also included.

[0037] In step 310, when creating the first structure object, the address of the first member of the first structure object is set to be equal to the first address of the first structure object.

[0038] In step 320, if the thread identifier of the pending thread belongs to a preset object, then verify whether the first address of the first structure object is equal to the address of the first member. If so, access the original memory through the first address to trigger an exception; otherwise, re-receive the first structure object.

[0039] As described above, the first address is stored in the first member address of the first structure object. Before accessing the object based on this first address, it is first determined whether the first member address is the same as the first address of the first structure object. If they are the same, the access process is executed based on the first address, thus preventing the first address from being tampered with. If the first address is inconsistent with the address stored in the first member, the first structure object is received again. Therefore, address consistency verification is performed to ensure that the accessed address is correct.

[0040] In an alternative implementation, step 120, which involves creating a new copy memory in the base address register, further includes step 121.

[0041] Step 121: Add an exception point to the original memory in the copied memory.

[0042] As described above, after creating the copied memory, an exception point pointing to the original memory is added in the copied memory. This way, after accessing the copied memory, it is possible to jump back to the original memory from the copied memory to continue executing other memory operations, thus protecting the target data and preventing process execution errors.

[0043] Applying the above-mentioned memory data protection method to a real-world scenario includes steps 11 to 12.

[0044] Please refer to Figure 2 The configuration process includes steps 11 to 17.

[0045] Step 11: Copy the target data stored in the original memory corresponding to the base address register of the target process.

[0046] Step 12: Reallocate copy memory for the target process in the base address register.

[0047] Step 13: Write the target data into the copied memory.

[0048] Step 14: Determine if the memory exception was set successfully. If yes, proceed to Step 15; otherwise, clear the target data in the original memory and return to Step 12. Clearing the original memory indicates a weak memory exception setting failure, which means the entire process needs to be restarted. The memory is then recreated based on the newly allocated CR3 address, and the original memory is reset for easier management.

[0049] Step 15: Wait for an exception to be triggered. If an exception is triggered, send the exception thread information.

[0050] Step 16: Determine if a thread is detected for memory copying. If so, jump to the thread executing the memory copy. Otherwise, return to step 15.

[0051] Step 17: Execute the next exception point copied from memory and return to the original memory. For example, if the address where the target data is cleared is 0x1000 and the target data is 0, and there is an identical target data 0 in the copied memory, but the copy address in the copied memory is different from the original address in the original memory (copy address is 0x1300), the corresponding stored data is also the target data 0. After executing the configuration steps 11 to 17, the ACR3 exception jumps to BCR3 via communication to execute the switched data. To jump back to the data in ACR3 and continue execution, a memory exception needs to be set in B as well.

[0052] Reference Figure 2 The communication process includes steps 21 to 26.

[0053] Step 21: Create a worker thread under system privileges, specifically within the SYSTEM domain. For example, in the Windows operating system, there is a type of thread that does not require manual creation; it is a task that is directly inserted into an existing thread in the Windows system for execution. This type of thread is called a worker thread and has a higher priority.

[0054] Step 22: Determine whether the exception callback capture device has been successfully set. If yes, proceed to step 23; otherwise, skip the exception handling process.

[0055] Step 23: Obtain the thread identifier (ID). This involves obtaining the thread identifier of the thread accessing the raw memory. The thread identifier can be obtained through system API functions; this is a function already in the technology and will not be elaborated upon here.

[0056] Step 24: Obtain the process ID (PID) of the process corresponding to the thread using the thread ID. While the process API (interface) contains functions that can directly obtain the PID using the thread ID, the process of obtaining the PID and then calling the associated thread ID is more complex. Therefore, this step uses the method of obtaining the thread ID first and then obtaining the PID.

[0057] Step 25: Determine if the callback condition is met. If yes, proceed to step 26; otherwise, skip the exception handling process. If the process corresponding to the thread identifier obtained in step 23 is the target process, it means that it has the permission to access the copied memory, meets the callback condition, and can execute the exception to access the copied memory. Otherwise, it means that the thread does not meet the callback condition, does not have the permission to access the copied memory, and skips the exception handling process.

[0058] Step 26: Receive thread callback information and exceptions. This is accomplished using the exception callback capture device of the worker thread created in SYSTEM in step 22.

[0059] Please refer to Figure 4 The process of processing data through a data structure includes steps 31 to 35.

[0060] Step 31: Create the first structure object as the transfer object.

[0061] Step 32: Set the member address of the first structure object to the original address of the original memory.

[0062] Step 33: Use the MAC address as the structure key for the first structure object. Because the MAC address is a physically unique identifier and is different for each computer, using it as the structure key for the first structure object ensures uniqueness. That is, to improve the security of the original and copied addresses during transmission, the MAC address can be added as the structure key for accessing both the first and second structure objects. This way, only authorized hardware can access the first and second structure objects to obtain the corresponding memory addresses (first address and second address), while unauthorized hardware attempting to access either the first or second structure object will be unable to decrypt the access results.

[0063] Step 34: Generate a second structure object as the receiving object. The member objects in the second structure object store address exceptions and the thread identifiers corresponding to those exceptions.

[0064] Step 35: If the thread identifier in the second structure object is equal to the process identifier of the process corresponding to that thread, skip the exception execution; otherwise, execute the exception. If the thread ID does not belong to its own process, it means that this thread is accessed by another process and does not have the necessary access rights. If the thread ID matches the process PID, it will be further determined whether the process PID corresponds to a target process with access rights; only if so will access to the copied memory be allowed. The exception here is not one that can be caught by the worker thread, but rather an exception output when a process is accessed by a thread other than itself. The exception caught by the worker thread is an exception generated during memory execution, referring to a memory exception generated by a thread that is not on the "whitelist": an exception thrown when memory execution is reached.

[0065] Furthermore, the original address can be stored in the first member object of the first structure object, and the copy address can be stored in the first member object of the second structure object. In this way, the first member object of the structure address points to the address of the structure, such as aa=a, where the member 'a' of structure a points to structure a. This is done to verify whether the address is correct, thus serving a verification purpose.

[0066] Please refer to Figure 5 The complete process of communication, data transmission and data processing includes steps 401 to 4.

[0067] Step 401: The client creates the first structure object. The first address of the first structure object corresponds to the original address, i.e., steps 31 to 33 above.

[0068] Step 402: The client creates an exception callback catcher. This corresponds to steps 21 to 26 above. A worker thread is created in SYSTEM, and an exception callback catcher is set up within the thread. When the client executes an exception, it will be caught by the worker thread. The worker thread determines whether the exception was thrown by a PID in the list or whether it was thrown by the worker thread itself. For example, if PID 3324 is set as the primary PID and PID 8410 as the secondary PID, only exceptions thrown by PID 3324 and PID 8410 will be handled by the worker thread, allowing access to copied memory. Exceptions thrown by other processes or threads will not be handled by the worker thread.

[0069] Step 403: When the client receives the process execution request, it performs memory operations normally.

[0070] Step 404: The system in the client determines whether an execution exception has been caught. If so, proceed to step 45; otherwise, return to step 403.

[0071] Step 405: Determine whether the thread identifier that captured the execution exception belongs to the client that needs to be processed. If yes, proceed to step 406; otherwise, return to step 403. It can be seen that the determination of whether a thread belongs to the client that needs to be processed is based on the whitelist configured in the worker thread during steps 21 to 26.

[0072] Step 406: Receive the first structure object and determine if its first address is the same as the address stored in the first member of the first structure object. If so, proceed to step 407. Otherwise, do not process and re-receive the first structure object. The purpose of this verification is to ensure the correctness, integrity, and availability of the structure address. If they are different, it indicates an address error, and the object needs to be received again.

[0073] Step 407: Access the original memory corresponding to CR3 based on the first address to trigger an exception.

[0074] Step 408: Create a second structure object to store the exception address that triggered the exception in step 407. That is, steps 34 to 35 above.

[0075] Step 409: Determine if the exception address is the address of a worker thread, i.e., whether it belongs to the SYSTEM thread and has SYSTEM privileges; if so, proceed to step 410; otherwise, return to step 403. It can be seen that through the configuration in steps 21 to 26, if the worker thread catches an exception and considers the callback condition met, it will receive the callback information and the exception, meaning the exception address will be the address of the worker thread.

[0076] Step 410: Receive the second address of the second structure object and access the copied memory corresponding to CR3 according to the second address to obtain the target data and trigger an exception. After triggering the exception, the address in CR3 is restored to the original address of the original memory. For example, setting the exception point to 0x13000 offset:0x30 or 0x14000 offset:0x30 is equivalent to data jumps from different addresses (0x13000 and 0x14000) relative to the same offset address 0x30.

[0077] Please refer to Figure 6 A memory data protection method and terminal 1 include a memory 3, a processor 2, and a computer program stored on the memory 3 and running on the processor 2. When the processor 2 executes the computer program, it implements the various steps of the memory data protection method described above.

[0078] In summary, the memory data protection method and terminal provided by this invention achieves free switching of data by transferring critical, protected target data from the original memory (CR3, base address register) to copied memory, while the target thread capable of accessing the target data remains associated with the original memory. This ensures that the original address of the original memory obtained by external tools does not store the corresponding target data, and external tools cannot access the copied memory, leading to data acquisition errors or anomalies, thus resisting static attacks. A discrete, controlled event is established, and switching between the original and copied memory is achieved by capturing exceptions. The original and copied memory are isolated using the CR3 mechanism, allowing execution to resume from the original memory after switching due to page faults, achieving strong data hiding protection. Furthermore, the CR3 mechanism enables secure communication across permission levels, requiring third-party intervention at a higher cost, thereby improving the security of the target data. As for dynamic tool analysis, its reading and scanning are all based on the current process, and it cannot obtain the event of switching to page B when process A encounters an error, thus protecting the target data and preventing the target data from being obtained.

[0079] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for protecting memory data, characterized in that, include: Copy the target data from the original memory pointed to by the target process in the base address register; Create a new copy memory in the base address register, write the target data into the copy memory, and delete the target data from the original memory; Set an access exception for the original memory.

2. The memory data protection method according to claim 1, characterized in that, After setting an access exception for the original memory, the process also includes: Create a worker thread with system privileges and set up an exception callback capture device for the worker thread; When a pending thread requests access to the raw memory, the process identifier of the pending process corresponding to the pending thread is obtained through the thread identifier of the pending thread. Based on the process identifier, determine whether the pending process is the target process. If so, receive the callback information or exception of the pending thread through the exception callback capture device.

3. The memory data protection method according to claim 2, characterized in that, The step of creating a worker thread under system privileges and setting up an exception callback capture mechanism for the worker thread includes: If setting the exception callback catch-up mechanism fails, exception handling is skipped.

4. A memory data protection method according to claim 2, characterized in that, The step of determining whether the pending process is the target process based on the process identifier includes: If the pending process is not the target process, the exception handling process is skipped.

5. A memory data protection method according to claim 2, characterized in that, Upon receiving a request for access to the raw memory from a pending thread, after obtaining the process identifier of the pending process corresponding to the pending thread through the thread identifier of the pending thread, the process further includes: Determine whether the pending thread is the main thread of the pending process. If it is, do not execute the exception; otherwise, the pending thread throws an exception.

6. A memory data protection method according to claim 2, characterized in that, After setting an access exception for the original memory, the process also includes: Create a first structure object, the first address of the first structure object being the original address corresponding to the original memory; When a pending thread requests access to the target's original memory, it is determined whether the thread identifier of the pending thread belongs to a preset object. If so, the original memory of the base address register is accessed through the first address to trigger an exception, and a second structure object is created, and the second address of the second structure object is set to the copy address of the copy memory corresponding to the original memory; The exception address is stored in the second structure object. If the exception address belongs to the worker thread, the copied memory is accessed based on the second address.

7. A memory data protection method according to claim 6, characterized in that, The step of storing the exception address of the exception into the second structure object further includes: If the abnormal address does not belong to the worker thread, other memory operations will be performed normally.

8. A memory data protection method according to claim 6, characterized in that, Also includes: When the first structure object is created, the address of the first member of the first structure object is set to be equal to the first address of the first structure object; If the thread identifier of the pending thread belongs to a preset object, then verify whether the first address of the first structure object is equal to the address of the first member. If so, access the original memory of CR3 through the first address to trigger an exception; otherwise, re-receive the first structure object.

9. A memory data protection method according to claim 6, characterized in that, The step of creating a new copied memory in the base address register also includes: An exception point pointing to the original memory is added to the copied memory.

10. A memory data protection terminal, characterized in that, The device includes a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor, when executing the computer program, implements a memory data protection method according to any one of claims 1 to 9.

Images