Illegal debugging protection system

Abstract

The application relates to an illegal debugging protection system in the technical field of computers, which comprises a kernel layer processing module, the kernel layer processing module is used for: monitoring a debugging behavior in real time through a hook function registered by a kernel layer to obtain debugging information; the debugging information comprises debugging process information, debugging behavior information and debugged process information; obtaining a pre-configured anti-debugging strategy for the debugged process according to the debugged process information, if the anti-debugging strategy is obtained, judging the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy; the anti-debugging strategy comprises a combination of at least one protection behavior, and the protection behavior comprises an inhibited debugging behavior; if the debugging behavior is illegal debugging, obtaining a pre-configured illegal debugging disposal strategy; if the pre-configured illegal debugging disposal strategy is obtained, executing the illegal debugging disposal strategy. The illegal debugging protection system provided by the application realizes the consideration of safety and convenience.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an illegal debugging protection system. Background Technology

[0002] In Linux systems, process debugging is a crucial tool for software development and maintenance troubleshooting. However, unauthorized debugging activities (such as malicious debugging, reverse engineering, and memory tampering) also pose a serious threat to system security and the privacy of core business data. In particular, unauthorized debugging of core business processes can lead to the leakage of core algorithms, the theft of business data, and the alteration of program logic, potentially resulting in business interruptions and economic losses. Therefore, unauthorized debugging protection technology has become a core component of Linux system security protection systems.

[0003] Existing methods for preventing unauthorized debugging often employ fixed protection models, either completely prohibiting all debugging activities or allowing them entirely. In real-world business scenarios, legitimate debugging needs exist (such as maintenance personnel troubleshooting and developers optimizing programs). Completely prohibiting all debugging activities would hinder legitimate debugging and impact business maintainability; conversely, allowing all debugging activities would fail to intercept unauthorized debugging, posing security risks. Therefore, existing methods for preventing unauthorized debugging struggle to balance security and convenience. Summary of the Invention

[0004] Based on the above analysis, the present invention aims to provide an illegal debugging protection system to solve the problem that existing illegal debugging protection systems cannot balance security and convenience.

[0005] On one hand, embodiments of the present invention provide an illegal debugging protection system, which includes a kernel-level processing module. The kernel-level processing module is used to: monitor debugging behavior in real time through hook functions registered in the kernel layer and obtain debugging information; wherein the debugging information includes debugging process information, debugging behavior information, and information of the process being debugged; obtain a pre-configured anti-debugging strategy for the process being debugged based on the information of the process being debugged; in response to obtaining the anti-debugging strategy, determine the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy; wherein the anti-debugging strategy includes a combination of at least one protective behavior, the protective behavior including prohibited debugging behavior; in response to the debugging behavior being illegal debugging, obtain a pre-configured illegal debugging handling strategy; and in response to obtaining the pre-configured illegal debugging handling strategy, execute the illegal debugging handling strategy.

[0006] Based on further improvements to the above system, the step of determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy includes: if there is an intersection between the debugging behavior information and any of the debugging behaviors prohibited by the protection behaviors in the anti-debugging strategy, then the debugging behavior is confirmed to be illegal debugging; if there is no intersection between the debugging behavior information and any of the debugging behaviors prohibited by the protection behaviors in the anti-debugging strategy, then the debugging behavior is confirmed to be legal debugging.

[0007] Based on a further improvement to the above system, the anti-debugging strategy is written in the extended attributes of the program file corresponding to the debugged process and stored in association with the inode node information of the program file; the step of obtaining the pre-configured anti-debugging strategy for the debugged process according to the debugged process information includes: obtaining the inode node information of the program file corresponding to the debugged process according to the debugged process information; and obtaining the anti-debugging strategy in the associated stored extended attributes according to the inode node information.

[0008] Based on further improvements to the above system, after determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy, the kernel layer processing module is further configured to: in response to the debugging behavior being legal debugging, obtain and execute a pre-configured legal debugging handling strategy.

[0009] Based on further improvements to the above system, the system also includes a user-level processing module, which is used to pre-configure the anti-debugging strategy and the handling strategy; before the kernel-level processing module monitors debugging behavior in real time through the hook function registered in the kernel layer and obtains debugging information, the user-level processing module is also used to: use a user-mode daemon to transmit the handling strategy to the kernel-level processing module through the Netlink communication channel; wherein, the handling strategy includes the illegal debugging handling strategy and the legal debugging handling strategy.

[0010] Based on further improvements to the above system, after the user-mode daemon transmits the handling policy to the kernel-level processing module via the Netlink communication channel, the user-mode processing module is further configured to: use the user-mode daemon to monitor the update status of the handling policy; in response to the detection that the handling policy has been updated, send the updated handling policy to the kernel-level processing module for the kernel-level processing module to update the handling policy; and use the user-mode daemon to monitor the reloading status of the kernel-level processing module; in response to the detection that the kernel-level processing module has been reloaded, retransmit the handling policy to the kernel-level processing module via the Netlink communication channel.

[0011] Based on further improvements to the above system, after obtaining the anti-debugging policy pre-configured for the process being debugged according to the information of the process being debugged, the kernel layer processing module is further configured to: allow the debugging behavior if the anti-debugging policy is not obtained.

[0012] Based on further improvements to the above system, after the illegal debugging handling policy is executed, the kernel layer processing module is further configured to: in response to the illegal debugging handling policy not including the forced termination of the debugged process, read the read-only memory data of the debugged process, calculate the hash value of the read-only memory data, and perform memory integrity verification by comparing the hash value with a benchmark value.

[0013] Based on further improvements to the above system, before determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy, the kernel layer processing module is further configured to: remove debugging behavior information that is irrelevant to the determination of debugging legality from the debugging behavior information, and remove information on protective behaviors in the anti-debugging strategy that meet preset removal conditions.

[0014] Based on further improvements to the above system, the kernel layer processing module is also used to: record relevant information during the illegal debugging protection process and generate log data.

[0015] The illegal debugging protection system provided by this invention protects the process being debugged from illegal debugging by using an anti-debugging strategy that is pre-configured according to the process being debugged and includes a combination of at least one protective behavior. This avoids a one-size-fits-all approach of completely prohibiting or allowing all debugging behaviors, thus achieving a balance between security and convenience.

[0016] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0017] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 This is one of the structural schematic diagrams of the illegal debugging protection system provided by the present invention.

[0018] Figure 2 This is the second schematic diagram of the illegal debugging protection system provided by the present invention. Detailed Implementation

[0019] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0020] Figure 1 This is one of the structural schematic diagrams of the illegal debugging protection system provided by this invention. For example... Figure 1 As shown, the system includes a kernel-level processing module 10, which is used to: monitor debugging behavior in real time through hook functions registered in the kernel layer and obtain debugging information; wherein the debugging information includes debugging process information, debugging behavior information, and information of the process being debugged; obtain a pre-configured anti-debugging strategy for the process being debugged based on the information of the process being debugged; in response to obtaining the anti-debugging strategy, determine the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy; wherein the anti-debugging strategy is a combination of at least one protective behavior, the protective behavior including prohibited debugging behavior; in response to the debugging behavior being illegal debugging, obtain a pre-configured illegal debugging handling strategy; and in response to obtaining the pre-configured illegal debugging handling strategy, execute the illegal debugging handling strategy.

[0021] The kernel-level processing module 10 monitors debugging behavior in real time and obtains debugging information through hook functions registered in the kernel layer. These hook functions are deployed in the kernel layer and directly monitor system calls, unrestricted by application-level permissions. Even debugging processes with root privileges can have their operations accurately captured. Since current Linux system debugging primarily utilizes the ptrace system call, this method is the core technical path for illegal debugging and the primary target of existing anti-debugging technologies. Therefore, after initialization, the kernel-level processing module 10 registers hooks in the LSM (Linux Security Module), adds instrumentation to the ptrace system call, and completes the registration of hook functions to monitor debugging behavior based on the ptrace system call in real time and obtain debugging information.

[0022] Debugging information includes debugging process information, debugging behavior information, and information about the process being debugged. Debugging process information includes the process identifier, process name, path to the corresponding program file, and inode information of the process being debugged. Debugging behavior information includes the type of debugging operation (tracing, memory read, memory write, register read, instruction interception, process termination, process stop, continue execution, etc.), debugging trigger time, and operation path. Information about the process being debugged includes the process identifier, process name, path to the corresponding program file, and inode information of the process being debugged. Inode information is a mandatory attribute for the program file corresponding to a process, representing the unique identity of a program file in the file system.

[0023] Pre-configure anti-debugging policies for the process being debugged. Since anti-debugging policies are used to protect processes from debugging, and processes are created after the program file starts, configuring anti-debugging policies for the process being debugged is achieved by configuring the corresponding program file. The pre-configured anti-debugging policies are obtained based on the information of the process being debugged. If the anti-debugging policies are obtained, the legitimacy of the debugging behavior is determined by matching the debugging behavior information with the anti-debugging policies.

[0024] An anti-debugging strategy is a combination of at least one protective behavior, which includes prohibited debugging behaviors. A set of protective behaviors can be pre-defined. For different program files corresponding to the processes being debugged, depending on the business scenario, some or all of these protective behaviors can be selected to form an anti-debugging strategy. Each protective behavior includes prohibited debugging behaviors. The fact that an anti-debugging strategy is a combination of at least one protective behavior means that the anti-debugging strategy prohibits all debugging behaviors prohibited by the at least one of its included protective behaviors. When matching debugging behavior information with anti-debugging strategies, the debugging operation type in the debugging behavior information can be matched with the prohibited debugging behaviors of each protective behavior in the anti-debugging strategy.

[0025] For example, an anti-debugging strategy might combine four protective behaviors: process memory is unreadable, process memory is unwritable, process register information is unreadable, and process behavior is untraceable. This strategy would prohibit read operations on process memory, write operations on process memory, read operations on process register information, and tracing operations on process behavior. Anti-debugging strategies for the process being debugged can be pre-configured according to actual business scenarios and needs, and can be dynamically adjusted as required. This invention further subdivides disallowed debugging behaviors and combines them into anti-debugging strategies. It allows for both single protection and multiple combinations of protection. The detailed decomposition of anti-debugging strategies allows for precise control of process debugging behavior, avoiding a one-size-fits-all approach. Different anti-debugging strategies can be configured for different business processes.

[0026] After determining the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, if the debugging behavior is determined to be illegal, a pre-configured illegal debugging handling policy is obtained. If a pre-configured illegal debugging handling policy is obtained, it is executed. The illegal debugging handling policy can be pre-configured as needed, and may include intercepting the debugging process, forcibly terminating the debugged business program, issuing audit alarms, etc.

[0027] If a pre-configured illegal debugging handling policy is not obtained, the default illegal debugging handling policy will be used. This default policy may include suspending debugging or generating an audit alert. The default illegal debugging handling policy can be hard-coded into the code of the kernel-level processing module 10.

[0028] The illegal debugging protection system provided by this invention protects the process being debugged from illegal debugging by using an anti-debugging strategy that is pre-configured according to the process being debugged and includes a combination of at least one protective behavior. This avoids a one-size-fits-all approach of completely prohibiting or allowing all debugging behaviors, thus achieving a balance between security and convenience.

[0029] According to an illegal debugging protection system provided by the present invention, the step of determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy includes: in response to the existence of an intersection between the debugging behavior information and any debugging behavior prohibited by any of the protection behaviors in the anti-debugging strategy, the debugging behavior is confirmed to be illegal debugging; in response to the existence of no intersection between the debugging behavior information and any of the debugging behaviors prohibited by the protection behaviors in the anti-debugging strategy, the debugging behavior is confirmed to be legal debugging.

[0030] When the kernel layer processing module 10 determines the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, if it determines that the debugging behavior information overlaps with any of the debugging behaviors prohibited by any of the protection behaviors in the anti-debugging policies—that is, the debugging behavior information conforms to or partially conforms to the debugging behaviors prohibited by at least one of the protection behaviors in the anti-debugging policies—then the debugging behavior is confirmed as illegal debugging. Partial conformity is because the debugging behaviors prohibited by the protection behaviors can be a category of behaviors, not necessarily unique; if the debugging behavior information partially conforms to the debugging behaviors prohibited by the protection behaviors, the debugging behavior is still prohibited. If the debugging behavior information does not overlap with any of the debugging behaviors prohibited by any of the protection behaviors in the anti-debugging policies—that is, the debugging behavior is confirmed as legal debugging.

[0031] The illegal debugging protection system provided by this invention improves the accuracy of judging the legality of debugging behavior by determining whether there is an overlap between the debugging behavior information and the debugging behavior prohibited by the protection behavior in the anti-debugging strategy.

[0032] According to an illegal debugging protection system provided by the present invention, the anti-debugging strategy is written in the extended attributes of the program file corresponding to the debugged process and stored in association with the inode node information of the program file; the step of obtaining the pre-configured anti-debugging strategy for the debugged process based on the debugged process information includes: obtaining the inode node information of the program file corresponding to the debugged process based on the debugged process information; and obtaining the anti-debugging strategy in the associated stored extended attributes based on the inode node information.

[0033] Anti-debugging strategies are written in the extended attributes of the program file corresponding to the debugged process and stored in association with the inode information of the program file. The debugged process includes inode information, which records which program file it is using. The inode information can be obtained through the program file information. In addition, the program file information also includes the program file path, which is mainly used for subsequent auditing.

[0034] When retrieving the pre-configured anti-debugging strategy for the process being debugged based on the process information, the inode information of the corresponding program file is obtained, and the anti-debugging strategy in the associated storage's extended attributes is retrieved based on the inode information. The user-level anti-debugging strategy is directly marked on the extended attributes of the program file, enhancing the real-time performance of configuration updates. Furthermore, since the anti-debugging strategy is directly configured on the extended attributes of the program file, there is no need to create or maintain any additional configuration files, and the kernel-level processing module 10 does not need to pre-load the anti-debugging strategies of all program files. The anti-debugging strategy of the corresponding program file is only retrieved in real-time when the process is being debugged, significantly reducing kernel resource consumption. The anti-debugging strategy of the program file is also the anti-debugging strategy of the process generated after the program file starts.

[0035] The illegal debugging protection system provided by this invention improves the convenience of configuring the anti-debugging strategy and saves system resources by writing the anti-debugging strategy into the extended attributes of the program file corresponding to the debugged process and storing it in association with the inode node information of the program file. After confirming that illegal debugging has occurred, the anti-debugging strategy in the associated extended attributes is obtained according to the inode node information.

[0036] According to the illegal debugging protection system provided by the present invention, after determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy, the kernel layer processing module 10 is further configured to: in response to the debugging behavior being legal debugging, obtain and execute a pre-configured legal debugging handling strategy.

[0037] After determining the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, the kernel layer processing module 10, if it determines that the debugging information belongs to legitimate debugging, obtains the pre-configured legitimate debugging handling policy and executes it. The legitimate debugging handling policy does not include blocking debugging behavior, i.e., it allows debugging behavior. The legitimate debugging handling policy may include relevant log information for allowing debugging behavior.

[0038] The illegal debugging protection system provided by this invention obtains and executes a pre-configured legal debugging handling strategy when it is determined that the debugging behavior is legal, which facilitates the statistical analysis of the debugging monitoring results in the later stage.

[0039] Figure 2 This is the second structural schematic diagram of the illegal debugging protection system provided by this invention. (See diagram below.) Figure 2 As shown, the system further includes a user-level processing module 20, which is used to pre-configure the anti-debugging strategy and the handling strategy. Before the kernel-level processing module 10 monitors the debugging behavior in real time through the hook function registered in the kernel layer and obtains the debugging information, the user-level processing module 20 is also used to: use a user-mode daemon to transmit the handling strategy to the kernel-level processing module 10 through the Netlink communication channel; wherein, the handling strategy includes the illegal debugging handling strategy and the legal debugging handling strategy.

[0040] User-layer processing module 20 pre-configures anti-debugging policies and handling policies. The handling policies include policies for handling illegal debugging and policies for handling legitimate debugging. User-layer processing module 20 can configure these policies through an anti-debugging policy configuration tool or command line. User-layer processing module 20 can simultaneously configure dedicated anti-debugging policies for multiple program files using the same tool or command line, and can also delete the anti-debugging policy for a specific program file, thus ceasing monitoring of debugging behavior of processes generated after the program file starts. User-layer processing module 20 can directly modify, add, or delete anti-debugging policies for program files according to actual business needs through the anti-debugging policy configuration tool or command line, without modifying any additional configuration files. After modification, there is no need to execute the reload operation of kernel-layer processing module 10. When the process corresponding to the program file is subsequently debugged, kernel-layer processing module 10 will obtain the updated anti-debugging policy in real time, and the new anti-debugging policy will take effect immediately. Subsequent captured debugging behavior will be judged for legality based on the updated anti-debugging policy.

[0041] After establishing a connection and completing identity verification with the kernel-level processing module 10 via the Netlink communication channel, the user-mode processing module 20 uses a user-space daemon to transmit the handling policy to the kernel-level processing module 10 through the Netlink communication channel. The user-space daemon establishes an efficient, asynchronous communication channel between user space and the kernel layer via the Netlink communication channel, preventing unauthorized processes from forging the handling policy. Its security is reflected in two aspects: First, the kernel-level processing module 10 registers its own Netlink family during initialization; during communication, the family information of this Netlink family must be specified for information transmission to be realized. Second, the transmitted handling policy must meet a pre-agreed communication format. If it is an unauthorized Netlink, it neither knows the Netlink family nor the communication format of the handling policy, thus preventing unauthorized processes from forging the handling policy and improving communication security.

[0042] After receiving the handling policy, the kernel layer processing module 10 parses the policy and verifies its format. If the policy is valid (correct format, correct sender identity information, and policy content conforms to preset values), the kernel layer processing module 10 stores the policy in its memory. The kernel layer processing module 10 then returns confirmation information to the user layer processing module 20, records the policy transmission log, and enters debug monitoring mode.

[0043] Furthermore, since the illegal debugging handling policy and the legal debugging handling policy are configured for handling illegal debugging and legal debugging respectively, rather than for a specific process, the illegal debugging handling policy and the legal debugging handling policy are transmitted to the kernel layer in advance. This makes it easier to quickly execute the corresponding handling policy after the legality of the debugging behavior is determined, which improves the handling efficiency and further enhances security.

[0044] After determining the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, if the debugging behavior is determined to be illegal debugging, but no pre-configured illegal debugging handling policy is obtained, the default illegal debugging handling policy is executed. The handling policy sent by the user-mode daemon to the kernel layer processing module 10 through the Netlink communication channel may also include the aforementioned default illegal debugging handling policy. Furthermore, the kernel layer processing module 10 can simultaneously pre-configure the aforementioned default illegal debugging handling policy in the code in a hard-coded manner, and use it as an authentication condition for authenticating the user-mode daemon.

[0045] The illegal debugging protection system provided by this invention improves processing efficiency and security by using a user-mode daemon to transmit the handling strategy to the kernel-level processing module through the Netlink communication channel.

[0046] According to the illegal debugging protection system provided by the present invention, after the user-mode daemon process transmits the handling policy to the kernel-level processing module 10 through the Netlink communication channel, the user-mode processing module 20 is further configured to: use the user-mode daemon process to monitor the update status of the handling policy; in response to the acquisition that the handling policy has been updated, send the updated handling policy to the kernel-level processing module 10 for the kernel-level processing module 10 to update the handling policy; and use the user-mode daemon process to monitor the reloading status of the kernel-level processing module 10; in response to the acquisition of the reloading information of the kernel-level processing module 10, retransmit the handling policy to the kernel-level processing module 10 through the Netlink communication channel.

[0047] Since the handling strategy is configuration information, it can be adjusted in real time. After the user-level processing module 20 transmits the handling strategy to the kernel-level processing module 10 through the Netlink communication channel using the user-mode daemon, the user-level processing module 20 also uses the user-mode daemon to monitor the update status of the handling strategy. If an update is detected, the updated handling strategy is sent to the kernel-level processing module 10 for updating, thereby ensuring that unauthorized debugging protection is performed with the latest handling strategy.

[0048] User-level processing module 20 modifies the handling policies corresponding to legal / illegal debugging (such as adding an emergency handling mode or modifying the alarm method) via command line or by editing the user-mode handling policy configuration file. After modification, the user-mode daemon automatically loads the updated handling policy and redistributes it to kernel-level processing module 10 through the established Netlink communication channel. After receiving the new handling policy, kernel-level processing module 10 confirms that the new handling policy is legal and valid, and then uses the new handling policy to overwrite the old handling policy. The new handling policy takes effect immediately without restarting kernel-level processing module 10 or the system. Subsequent debugging behavior handling adopts the updated handling policy.

[0049] If kernel-level processing module 10 is reloaded, the handling policy needs to be retransmitted. After user-level processing module 20 transmits the handling policy to kernel-level processing module 10 via the Netlink communication channel using a user-mode daemon, user-level processing module 20 also uses the user-mode daemon to monitor the reloading status of kernel-level processing module 10. If it obtains information that kernel-level processing module 10 has reloaded, it uses the user-mode daemon to retransmit the handling policy to kernel-level processing module 10 via the Netlink communication channel, ensuring the reliability of illegal debugging handling. Specifically, if kernel-level processing module 10 is unloaded, its Netlink communication channel with the user-mode daemon will be disconnected. Therefore, the user-mode daemon will obtain information that kernel-level processing module 10 has been unloaded. After obtaining information that kernel-level processing module 10 has been unloaded, the user-mode daemon will continuously attempt to re-establish the Netlink communication channel with kernel-level processing module 10. After the Netlink communication channel is successfully re-established, the user-mode daemon determines that kernel-level processing module 10 has been reloaded.

[0050] The illegal debugging protection system provided by this invention updates the handling policies stored in the kernel layer processing module in a timely manner according to the update status of the handling policies, and retransmits the handling policies in a timely manner after detecting that the kernel layer processing module has been reloaded, thereby ensuring the timely update of the handling policies of the kernel layer processing module and the reliable acquisition of the handling policies after reloading, thus improving the reliability of illegal debugging protection.

[0051] According to the illegal debugging protection system provided by the present invention, after obtaining the anti-debugging policy pre-configured for the debugged process based on the debugged process information, the kernel layer processing module 10 is further configured to: allow the debugging behavior in response to not obtaining the anti-debugging policy.

[0052] In practical applications, the configuration of anti-debugging policies can be temporarily disabled or the protective behaviors within the anti-debugging policies can be adjusted according to actual application needs. After obtaining the pre-configured anti-debugging policies for the process being debugged based on the information of the process being debugged, if no anti-debugging policy is obtained, it is determined that no relevant anti-debugging policy is configured, and debugging behavior is allowed.

[0053] The illegal debugging protection system provided by this invention improves the flexibility of debugging behavior protection by allowing debugging behavior when no anti-debugging strategy is obtained.

[0054] According to an illegal debugging protection system provided by the present invention, after the illegal debugging handling strategy is executed, the kernel layer processing module 10 is further configured to: in response to the illegal debugging handling strategy not including the forced termination of the debugged process, read the read-only memory data of the debugged process, calculate the hash value of the read-only memory data, and perform memory integrity verification by comparing the hash value with a benchmark value.

[0055] If the illegal debugging handling policy includes the forced termination of the debugged process, the memory allocated to the debugged process will be reclaimed by the operating system after the policy is executed. If the illegal debugging handling policy does not include the forced termination of the debugged process, the memory allocated to the debugged process will still exist after the policy is executed, and memory integrity verification can then be performed. Memory integrity verification is performed immediately after the illegal debugging handling policy is executed, without requiring user-space instructions, ensuring timely verification.

[0056] Read-only memory (ROM) data includes read-only data segments and read-only code segments. Modification of either a ROM or ROM indicates external tampering. During memory integrity verification, the ROM data of the process being debugged is read, along with a pre-stored baseline value in the kernel's secure storage area. The hash value of the ROM data is calculated (e.g., using the SM3 cryptographic hash function). Memory integrity is verified by comparing the hash value of the ROM data with the baseline value. If the hash value matches the baseline value, the memory has not been tampered with; if they do not match, the memory has been tampered with, and an audit process can be initiated immediately.

[0057] The illegal debugging protection system provided by this invention reads the read-only memory data of the process being debugged, calculates the hash value of the read-only memory data, and performs memory integrity verification by comparing the hash value with a base value, thereby realizing the determination of memory integrity and facilitating timely processing.

[0058] According to the illegal debugging protection system provided by the present invention, before determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy, the kernel layer processing module 10 is further configured to: remove debugging behavior information that is irrelevant to the determination of debugging legality from the debugging behavior information, and remove information of protection behavior that meets the preset removal conditions from the anti-debugging strategy.

[0059] The kernel-level processing module 10 monitors debugging behavior in real time and obtains debugging information through hook functions registered in the kernel layer. The debugging behavior information in the debugging information can include various debugging details, some of which are not directly related to the determination of the legality of the debugging information, such as information indicating the start or end of debugging. Therefore, before determining the legality of the debugging behavior by matching the debugging behavior information with anti-debugging strategies, the kernel-level processing module 10 also analyzes the debugging behavior information and removes debugging behavior information that is irrelevant to the determination of debugging legality.

[0060] Anti-debugging strategies include a combination of at least one protective behavior. One or more of these behaviors may be incorrectly configured, such as with incorrect formatting, preventing parsing and execution. Therefore, these behaviors are not considered during non-debugging protection. Furthermore, if the entire anti-debugging strategy is incorrectly configured, it will also fail to parse and execute. In this case, the anti-debugging strategy is disregarded. Therefore, before determining the legality of debugging behavior by matching debugging behavior information with the anti-debugging strategy, the kernel layer processing module 10 also analyzes the anti-debugging strategy and removes information on protective behaviors that meet preset removal conditions, such as information on incorrectly formatted protective behaviors. In some cases, the entire anti-debugging strategy may be removed, meaning it is considered that no anti-debugging strategy is configured. Additionally, after discovering information on protective behaviors that meet preset removal conditions, the kernel layer processing module 10 can send a relevant reminder message to the user layer processing module 20 for investigation and modification.

[0061] The illegal debugging protection system provided by this invention improves processing efficiency and reliability by removing debugging behavior information that is irrelevant to the determination of debugging legality and information on protective behaviors that meet preset removal conditions from the anti-debugging strategy before matching debugging behavior information with anti-debugging strategies to determine the legality of debugging behavior.

[0062] According to the illegal debugging protection system provided by the present invention, the kernel layer processing module 10 is further configured to: record relevant information during the illegal debugging protection process and generate log data.

[0063] The kernel layer processing module 10 is used to execute the illegal debugging protection process of the illegal debugging protection system. The kernel layer processing module 10 is also used to record relevant information during the illegal debugging protection process and generate log data.

[0064] Specifically, after determining the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, the kernel layer processing module 10 records a check log. The check log may include debugging process information, debugged process information, debugging behavior information, anti-debugging policies, the matching results between debugging behavior information and anti-debugging policies, and the legality determination results.

[0065] After determining the legality of debugging behavior by matching the debugging behavior information with the anti-debugging policy, if the debugging behavior is legal, the kernel layer processing module 10 does not perform any interception operation, allows the debugging behavior to be processed normally by the kernel native process, and records the release log in accordance with the legal debugging handling policy.

[0066] After determining the legality of debugging behavior by matching debugging behavior information with anti-debugging policies, if the debugging behavior is illegal, the kernel layer processing module 10 immediately obtains and executes the illegal debugging handling policy. For example, for illegal debugging behavior, it performs the corresponding interception operation, terminates the debugging behavior execution process, returns the "insufficient privileges" (EPERM) error code to the debugging process, and after the interception operation is completed, it performs subsequent emergency handling measures in accordance with the illegal debugging handling policy, such as forcibly terminating the debugged business program, continuously intercepting all debugging operations of the debugging process, and issuing audit alarms.

[0067] After the handling strategy is executed, the kernel layer processing module 10 records the handling log (including the content of the handling strategy, the execution result of the handling strategy, debugging process information, the information of the process being debugged, anti-debugging strategy, interception / allowing details, and legality judgment result). The handling log is stored in the preset audit log path for easy auditing and tracing.

[0068] After performing a memory integrity check, if the hash value of the read-only memory data matches the baseline value, the check passes, indicating that the memory has not been tampered with. A memory check log is recorded, completing the closed loop for handling this debugging behavior. If the hash value of the read-only memory data does not match the baseline value, the check fails, indicating that the memory has been tampered with. An audit process is immediately initiated, recording the memory tampering time (which could be the completion time of the memory integrity check) and related debugging traces (such as debugging process information, information of the process being debugged, anti-debugging strategies, interception / allowing details, and legality judgment results), providing complete evidence for security tracing and risk handling.

[0069] The illegal debugging protection system provided by this invention generates log data by recording relevant information during the illegal debugging protection process, which facilitates subsequent auditing.

[0070] This invention proposes a dynamically configurable illegal debugging protection system based on the collaboration of the kernel layer and application layer under Linux. It combines the real-time debugging behavior monitoring, interception, and risk handling capabilities of the operating system kernel with flexible and customizable anti-debugging strategy configuration to form a collaborative protection system. This system enables multi-dimensional monitoring of debugging behavior, dynamic and flexible configuration of anti-debugging strategies, emergency handling after illegal debugging, and memory integrity verification, while not affecting the execution of legitimate debugging behavior, thereby improving the security and stability of core business processes.

[0071] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0072] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0074] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. An illegal debugging protection system, characterized in that, Includes a kernel layer processing module, which is used for: Debugging behavior is monitored in real time by hook functions registered in the kernel layer to obtain debugging information; wherein, the debugging information includes debugging process information, debugging behavior information and information of the process being debugged; Based on the information of the process being debugged, a pre-configured anti-debugging strategy is obtained for the process being debugged. In response to obtaining the anti-debugging strategy, the legality of the debugging behavior is determined by matching the debugging behavior information with the anti-debugging strategy. The anti-debugging strategy includes a combination of at least one protective behavior, the protective behavior includes prohibited debugging behavior, and the prohibited debugging behavior includes at least one type of prohibited debugging behavior. In response to the debugging behavior being deemed illegal debugging, a pre-configured illegal debugging handling strategy is obtained; In response to obtaining a pre-configured illegal debugging handling policy, the illegal debugging handling policy is executed; The step of determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy includes: If the debugging behavior information overlaps with any of the debugging behaviors prohibited by the protection behavior in the anti-debugging strategy, then the debugging behavior is confirmed to be illegal debugging. If there is no overlap between the debugging behavior information and the debugging behaviors prohibited by each of the protection behaviors in the anti-debugging strategy, then the debugging behavior is confirmed to be legitimate debugging. The anti-debugging strategy is written in the extended attributes of the program file corresponding to the debugged process and stored in association with the inode node information of the program file; the step of obtaining the pre-configured anti-debugging strategy for the debugged process based on the debugged process information includes: Based on the information of the process being debugged, obtain the inode node information of the program file corresponding to the process being debugged; The anti-debugging strategy in the extended attributes of the associated storage is obtained based on the inode node information.

2. The illegal debugging protection system according to claim 1, characterized in that, After determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging strategy, the kernel layer processing module is further configured to: In response to the debugging behavior being deemed legitimate, a pre-configured legitimate debugging handling strategy is obtained and executed.

3. The illegal debugging protection system according to claim 2, characterized in that, The system also includes a user-layer processing module, which is used to pre-configure the anti-debugging strategy and the handling strategy. Before the kernel-level processing module monitors debugging behavior in real time and obtains debugging information through the hook functions registered in the kernel layer, the user-level processing module is also used for: The handling strategy is transmitted to the kernel layer processing module via the Netlink communication channel using a user-mode daemon; wherein the handling strategy includes the illegal debugging handling strategy and the legal debugging handling strategy.

4. The illegal debugging protection system according to claim 3, characterized in that, After the user-space daemon transmits the handling policy to the kernel-level processing module via the Netlink communication channel, the user-level processing module is further configured to: The user-mode daemon monitors the update status of the handling policy. In response to the detection that the handling policy has been updated, the updated handling policy is sent to the kernel layer processing module for the kernel layer processing module to update the handling policy. Furthermore, the user-mode daemon process monitors the reloading status of the kernel-level processing module, and in response to obtaining information about the reloading of the kernel-level processing module, the handling strategy is retransmitted to the kernel-level processing module through the Netlink communication channel.

5. The illegal debugging protection system according to claim 1, characterized in that, After obtaining the pre-configured anti-debugging strategy for the debugged process based on the debugged process information, the kernel layer processing module is further configured to: If the anti-debugging policy is not obtained, the debugging behavior is allowed.

6. The illegal debugging protection system according to claim 1, characterized in that, After executing the illegal debugging handling strategy, the kernel layer processing module is further configured to: In response to the illegal debugging handling strategy not including the forced termination of the debugged process, the read-only memory data of the debugged process is read, the hash value of the read-only memory data is calculated, and memory integrity is verified by comparing the hash value with a benchmark value.

7. The illegal debugging protection system according to claim 1, characterized in that, Before determining the legality of the debugging behavior by matching the debugging behavior information with the anti-debugging policy, the kernel layer processing module is further configured to: Remove debugging behavior information that is irrelevant to the determination of debugging legality from the debugging behavior information, and remove information on protective behaviors in the anti-debugging strategy that meet the preset removal conditions.

8. The illegal debugging protection system according to claim 1, characterized in that, The kernel layer processing module is also used for: Record relevant information during the unauthorized debugging protection process and generate log data.

Images