A method, system and related device for detecting malicious programs

Abstract

The present application provides a method for detecting malicious programs, including: obtaining a file to be detected; determining a malicious program code segment in the file to be detected; applying for a preset space in the process memory of the malicious program, and copying the malicious program code segment to the preset space; and detecting the malicious program code segment using a hardware breakpoint program in the preset space. The present application can invalidate the CRC check without complicated analysis of the CRC check function code, thereby improving the detection efficiency and analysis efficiency for malicious programs. The present application also provides a malicious program detection system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a malicious program detection method, system and related devices. Background Art

[0002] Currently, in the malware analysis scenario, there is a problem that it is difficult to dynamically analyze malicious programs with CRC checksums. This problem does not solve the problem that analysts cannot specifically analyze the behavior of malicious programs in the scenario where the program is running. They can only reverse the malicious program through static analysis tools or use behavior monitoring tools to observe the impact of the malicious program on the system from the surface when it is running. However, static analysis cannot analyze certain behaviors that can only occur when the malicious program is running, such as the content that interacts during network communication, such as encrypted data can only be tracked to decrypted data when it is running, and behavior monitoring tools can only observe the superficial behavior of the malicious program, and cannot specifically analyze its implementation principle.

[0003] Verification technology is widely used in various software to verify the software itself, software upgrade packages, or files generated by the software. CRC verification is a very common means of verification technology, often used for software integrity verification and file integrity verification. For example, when the software performs self-verification and finds that it does not match the preset verification value, it will remind the user or exit directly to prevent errors during software operation. However, those with ulterior motives use this technology in malicious programs, embedding CRC verification stubs in malicious programs to counter the probes of anti-virus software and the analysis of virus analysts.

[0004] In the process of virus analysis, it is more difficult to dynamically analyze malicious programs with hidden checksums. A common phenomenon is that when a malicious program detects that it is being dynamically analyzed, it switches to silent mode and does not perform malicious operations, making the outside world mistakenly believe that it is not performing malicious activities, or directly shuts down its own program, or even performs strong malicious damage, such as formatting the hard disk, etc. Therefore, it is very necessary for security researchers and analysts to master the method of bypassing the CRC detection of malicious programs. Summary of the invention

[0005] The purpose of this application is to provide a malicious program detection method, a malicious program detection system, a computer-readable storage medium and an electronic device, which can bypass CRC check when detecting malicious programs and improve detection efficiency.

[0006] In order to solve the above technical problems, this application provides a method for detecting malicious programs, and the specific technical solution is as follows:

[0007] Get the file to be tested;

[0008] Determine the malicious program code segment in the file to be detected;

[0009] Applying for a preset space in the process memory of the malicious program, and copying the malicious program code segment to the preset space;

[0010] The malicious program code segment is detected in the preset space using a hardware breakpoint program.

[0011] Optionally, determining the malicious program code segment in the file to be detected includes:

[0012] Determine the malicious program code segment in the file to be detected by using a debugger;

[0013] Wherein, using a debugger to determine the malicious program code segment in the file to be detected includes:

[0014] Loading the file to be detected into the debugger;

[0015] Determining a landmark segment in a memory layout window of the debugger;

[0016] The malicious program code segment is determined according to the iconic character segment.

[0017] Optionally, determining the malicious program code segment in the file to be detected includes:

[0018] Determine the malicious program code segment in the file to be detected by using a PE parsing tool;

[0019] Wherein, the method of using a PE parsing tool to determine the malicious program code segment in the file to be detected includes:

[0020] Determine the option header of the file to be detected by using the PE parsing tool;

[0021] determining an image base address and a segment table in the option header;

[0022] Determine the relative virtual address offset and virtual size of the malicious program code segment according to the segment table;

[0023] The code segment address of the malicious program code segment is determined according to the image base address and the relative virtual address offset, and the code segment size of the malicious program code segment is determined according to the virtual size.

[0024] Optionally, before the preset space uses a hardware breakpoint program to detect the malicious program code segment, the method further includes:

[0025] The hardware breakpoint program is written in a shellcode form or a dll form, and is implanted into the preset space.

[0026] Optionally, implanting the hardware breakpoint program into the preset space includes:

[0027] If the hardware breakpoint program is in the shellcode format, writing the hardware breakpoint program into the memory of the preset space in a memory writing format;

[0028] If the hardware breakpoint program is in the dll format, the hardware breakpoint program is implanted into the preset space through thread injection.

[0029] Optionally, when the hardware breakpoint program is written in the form of shellcode or dll, it also includes:

[0030] Add a VEH exception handling interface and set the breakpoint address to the location of the malicious program code segment.

[0031] Optionally, if the hardware breakpoint program is in dll format, it also includes:

[0032] A memory layout query interface and a process information query interface are configured, and a debugger plug-in is generated based on the memory layout query interface and the process information query interface.

[0033] The present application also provides a malicious program detection system, including:

[0034] An acquisition module is used to acquire files to be detected;

[0035] A code determination module, used to determine the malicious program code segment in the file to be detected;

[0036] A code copy module, used to apply for a preset space in the process memory of the malicious program and copy the malicious program code segment to the preset space;

[0037] The code detection module is used to detect the malicious program code segment using a hardware breakpoint program in the preset space.

[0038] The present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above-mentioned method when executed by a processor.

[0039] The present application also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method when calling the computer program in the memory.

[0040] The present application provides a malicious program detection method, comprising: obtaining a file to be detected; determining a malicious program code segment in the file to be detected; applying for a preset space in the process memory of the malicious program, and copying the malicious program code segment to the preset space; and detecting the malicious program code segment using a hardware breakpoint program in the preset space.

[0041] The present application copies the determined malicious program code segment to a new memory space for execution, retains all functions of the original malicious program code segment, gets rid of the monitoring of the CRC detection thread in the preset space, thereby bypassing the CRC check of the malicious program code, and can make the CRC check invalid without complicated analysis of the CRC check function code, thereby improving the detection efficiency and analysis efficiency of malicious programs.

[0042] The present application also provides a malicious program detection system, a computer-readable storage medium and an electronic device, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0044] Figure 1 A flowchart of a malicious program detection method provided in an embodiment of the present application;

[0045] Figure 2 A schematic diagram of the structure of a malicious program detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] Please refer to Figure 1 , Figure 1 A flowchart of a malicious program detection method provided in an embodiment of the present application, the method comprising:

[0048] S101: Obtain the file to be detected;

[0049] S102: Determine the malicious program code segment in the file to be detected;

[0050] This step is to determine the location of the malicious program code segment in the file to be detected, that is, at least two data among the starting address, the ending address and the length of the code segment. By parsing the binary file structure of the malicious program, the relative offset of the starting address of the code segment and the length of the code segment can be determined. The relative offset and length are substituted into the code base address of the malicious program in the current memory to determine the code segment range. Alternatively, you can directly attach the malicious program with a debugger such as OllyDbg, and you can see the code segment range in the memory layout window.

[0051] This embodiment provides two methods for determining the scope of the malicious program code segment:

[0052] The first method is to use a debugger to determine the malicious program code segment in the file to be detected, which can include the following steps:

[0053] The first step is to load the file to be tested into the debugger;

[0054] Step 2: Determine the landmark segment in the debugger's memory layout window;

[0055] The third step is to determine the malicious program code segment based on the iconic character segment.

[0056] The first method is more convenient. Use the debugger to load the file to be detected containing the malicious program code segment. For example, use OllyDbg to load the malicious program, open the debugger memory layout window, find the ".text" segment, and then you can view the address and size of the segment, that is, find the starting address and size of the malicious program code segment in the memory. However, it should be noted that when the malicious program has an ASLR (address space randomization) mechanism, you can only use tools such as debuggers to observe the memory layout of the malicious program code segment in the memory, otherwise the range of the malicious program code segment obtained may be inaccurate.

[0057] The second method is to use PE parsing tools to determine the malicious program code segments in the file to be detected. The specific process can be as follows:

[0058] The first step is to use the PE parsing tool to determine the option header of the file to be detected;

[0059] Step 2: Determine the image base address and segment table in the option header;

[0060] Step 3: Determine the relative virtual address offset and virtual size of the malicious program code segment according to the segment table;

[0061] Step 4: determine the code segment address of the malicious program code segment according to the image base address and the relative virtual address offset, and determine the code segment size of the malicious program code segment according to the virtual size.

[0062] PE parsing tools can view the PE file structure. PE files are portable executable files, that is, portable and executable files. First, find the optional header, which records various information of the PE file, such as image base address, code base address, data base address, version, etc. Find the image base address (ImageBase) in the optional header, which represents the base address of the program when it is put into memory and run. Secondly, find the section table (Section Headers), which contains various sections of the malicious program, such as code segment, data segment, resource segment, etc. The ".text" segment in the segment table is the code segment of the malicious program. Get the "relative virtual address offset" (Virtual Address) and "virtual size" (Virtual Size) of the code segment, and you can get the base address and range of the code segment: the code segment address in memory = image base address + relative virtual address offset of the code segment, and the code segment size in memory = the virtual size of the code segment after 4K alignment. Note: The virtual size of the code segment will be aligned in 4K in memory. If the virtual size of the code segment is exactly 4K aligned, the size of the code segment in memory is the same as the virtual size of the code segment. If it is not aligned, zeros will be padded at the end of the code segment to 4K alignment.

[0063] Of course, those skilled in the art may also use other methods to determine the malicious code segments in the file to be detected, which are not limited to examples here.

[0064] S103: applying for a preset space in the process memory of the malicious program, and copying the malicious program code segment to the preset space;

[0065] This step is to apply for a preset space for storing the copied data of the malicious program code segment. In order to avoid the monitoring of the CRC detection thread, a preset space is applied in the process memory of the malicious program. Specifically, the preset space can be applied to the process corresponding to the malicious program using the create process memory space API. It is easy to understand that the size of the preset space must be larger than the size of the malicious program code segment determined above, and usually some space needs to be reserved for storing the hardware breakpoint program later.

[0066] Preferably, after determining the malicious program code segment, the size of the preset space can be set to the size of the malicious program code segment plus 4KB, where 4KB is the size of a page of space, which is usually sufficient to meet the requirements of the hardware breakpoint program. Of course, the specific size of the preset space can be set accordingly by those skilled in the art according to the sum of the lengths of the malicious program code segment and the hardware breakpoint program. In addition, the attributes of the preset space need to be set to be readable, writable, and executable, so as to facilitate the subsequent writing of the hardware breakpoint program and the analysis and detection of the malicious program in the preset space.

[0067] S104: Detecting the malicious program code segment using a hardware breakpoint program in the preset space.

[0068] This embodiment assumes that before executing this step, a hardware breakpoint program needs to be written. There is no limitation on how to write the hardware breakpoint program. The hardware breakpoint program can be written in shellcode form or dll form. Shellcode is a piece of code used to exploit software vulnerabilities and execute. Shellcode is a hexadecimal machine code, which is often used to obtain shell files. Shell files usually refer to command parsers. The dll form adopts the form of a dynamic link library. After writing the hardware breakpoint program, it is also necessary to implant the hardware breakpoint program into the preset space. Of course, the implantation process varies depending on the form of the hardware breakpoint program.

[0069] If the hardware breakpoint program is in the form of shellcode, the hardware breakpoint program is written into the memory of the preset space in the form of memory writing; if the hardware breakpoint program is in the form of dll, the hardware breakpoint program is implanted into the preset space through thread injection.

[0070] If it is a hardware breakpoint program in the form of shellcode, it needs to be written into the memory and must be written in the newly applied memory space. It cannot be written in the memory gap of the original code segment because the CRC check may check these memory gaps.

[0071] Take the example of writing a hardware breakpoint program in DLL form. First, set up the VEH exception handling interface, then set the hardware execution breakpoint, and set the breakpoint address to the location of the malicious program code segment. Of course, it can also be set to a place where other programs must run, so that exceptions can be triggered faster. Finally, handle the hardware execution exception in the VEH exception handling callback function. When the malicious program executes to the set hardware execution breakpoint, an exception will occur, and the process will be transferred to the exception handling function corresponding to the VEH exception handling interface, and the current program execution process will be transferred to the preset space. It should be noted that this process is to transfer the program execution process, that is, after the hardware execution breakpoint is executed, the subsequent process is completed by the malicious program code segment in the preset space.

[0072] Since the execution flow of the malicious program has been completely diverted to the copy code in the preset space, and the copy code is completely out of the control of the CRC detection thread, any software breakpoint can be set in this code segment, or any modification can be made to analyze the malicious program.

[0073] The embodiment of the present application copies the determined malicious program code segment to a new memory space for execution, thereby retaining all functions of the original malicious program code segment, getting rid of the monitoring of the CRC detection thread in the preset space, thereby bypassing the CRC check of the malicious program code, and making the CRC check invalid without complicated analysis of the CRC check function code, thereby improving the detection efficiency and analysis efficiency of malicious programs.

[0074] Based on the above embodiment, as a preferred embodiment, if the hardware breakpoint program is in dll format, a memory layout query interface and a process information query interface may also be configured, and a debugger plug-in may be generated based on the memory layout query interface and the process information query interface.

[0075] Since debuggers generally open corresponding plug-in interfaces for users to develop plug-ins to enhance debugger functions, the specific development process of different debugger plug-ins is different. Therefore, the specific plug-in writing process is not discussed here. It is only explained that this plug-in needs to use the interface functions provided by the debugger and the functions to be completed. Debugger plug-ins are usually in the form of dll, and the functions can be encapsulated into the plug-in dll.

[0076] The debugger plug-in needs to include a memory layout query interface to obtain the base address of the code segment of the current debugged program in memory (when ASLR is enabled, the base address of the code segment calculated by the PE file may be wrong) and size. It also needs to include a process information query interface to obtain the process handle of the debugged program.

[0077] Functions that need to be implemented in the debugger plugin:

[0078] 1. Use the process handle of the debugged program to apply for a memory segment in the debugged process. The size of this memory segment should be 4K larger than the code segment of the debugged program.

[0079] 2. Use the memory read and write interface provided by the debugger or the memory read and write API provided by the system to copy the code segment of the current debugged process to the newly applied memory area, and then you have a new code segment.

[0080] 3. Set a hardware breakpoint at the first address of the old code segment of the debugged process. When the debugged program executes here, an exception is triggered and the exception handling system is entered.

[0081] 4.VEH exception function, create an additional dll, implement the function of setting VEH exception in DllMain, and implement the VEH exception handling function in the dll as a separate function. The exception handling function needs to determine whether the triggered exception is a hardware exception and whether the exception address is the first address of the old code segment. If the conditions are met, handle the exception. Set the EIP of the exception context to the first address of the new code segment, and the exception handling function returns the exception handled and continues to run.

[0082] 5. You can place this exception handling dll as a resource in the debugger plug-in dll and release it to disk when you need it.

[0083] 6. In the debugger plug-in dll, use remote thread injection or other methods to inject the exception handling dll into the debugged process.

[0084] As can be seen above, the code segment of the debugged program is copied in the EIP plug-in dll, and then a hardware breakpoint is set at the first address of the old code segment. Then the plug-in DLL injects the exception handling dll into the debugged process. When the plug-in is completed, after the debugger loads the program, the plug-in is used to complete the work with one click, and then the execution of the debugged process is resumed. At this time, any hardware breakpoint under the malicious program code segment in the preset space can be analyzed.

[0085] A malicious program detection system provided in an embodiment of the present application is introduced below. The malicious program detection system described below and the malicious program detection method described above can be referenced to each other.

[0086] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of a malicious program detection system provided in an embodiment of the present application. The present application also provides a malicious program detection system, including:

[0087] The acquisition module 100 is used to acquire the file to be detected;

[0088] A code determination module 200, used to determine a malicious program code segment in the file to be detected;

[0089] The code copy module 300 is used to apply for a preset space in the process memory of the malicious program and copy the malicious program code segment to the preset space;

[0090] The code detection module 400 is used to detect the malicious program code segment using a hardware breakpoint program in the preset space.

[0091] Based on the above embodiments, as a preferred embodiment, the code determination module 200 is a module for determining the malicious program code segment in the file to be detected by using a debugger;

[0092] The code determination module 200 includes:

[0093] A file loading unit, used for loading the file to be detected into the debugger;

[0094] a segment determination unit, configured to determine a landmark character segment in a memory layout window of the debugger;

[0095] The code segment determination unit is used to determine the malicious program code segment according to the iconic character segment.

[0096] Based on the above embodiment, as a preferred embodiment, the code determination module 200 is a module for determining the malicious program code segment in the file to be detected by using a PE parsing tool;

[0097] The code determination module 200 includes:

[0098] A first parsing unit, configured to determine the option header of the file to be detected by using the PE parsing tool;

[0099] a second parsing unit, configured to determine an image base address and a segment table in the option header;

[0100] A third parsing unit, configured to determine a relative virtual address offset and a virtual size of the malicious program code segment according to the segment table;

[0101] The code segment address and size determination unit determines the code segment address of the malicious program code segment according to the image base address and the relative virtual address offset, and determines the code segment size of the malicious program code segment according to the virtual size.

[0102] Based on the above embodiments, as a preferred embodiment, it also includes:

[0103] The program writing and implanting module is used to write the hardware breakpoint program in the form of shellcode or dll, and implant the hardware breakpoint program into the preset space.

[0104] Based on the above embodiment, as a preferred embodiment, the program writing module includes:

[0105] A first implantation unit is used to write the hardware breakpoint program into the memory of the preset space in a memory writing form if the hardware breakpoint program is in the shellcode form;

[0106] The second implantation unit is used to implant the hardware breakpoint program into the preset space through thread injection if the hardware breakpoint program is in the dll format.

[0107] Based on the above embodiments, as a preferred embodiment, it also includes:

[0108] The plug-in generation module is used to configure a memory layout query interface and a process information query interface, and to generate a debugger plug-in based on the memory layout query interface and the process information query interface.

[0109] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0110] The present application also provides an electronic device, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

[0111] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system provided in the embodiment, since it corresponds to the method provided in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0112] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0113] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for detecting malicious programs, characterized in that: include: Get the file to be tested; Determine the malicious program code segment in the file to be detected; Applying for a preset space in the process memory of the malicious program, and copying the malicious program code segment to the preset space; Using a hardware breakpoint program in the preset space to detect the malicious program code segment; Wherein, determining the malicious program code segment in the file to be detected includes: Determine the malicious program code segment in the file to be detected by using a debugger; Wherein, using a debugger to determine the malicious program code segment in the file to be detected includes: Loading the file to be detected into the debugger; Determining a landmark segment in a memory layout window of the debugger; The malicious program code segment is determined according to the iconic character segment.

2. The malicious program detection method according to claim 1, characterized in that: Determining the malicious program code segment in the file to be detected includes: Determine the malicious program code segment in the file to be detected by using a PE parsing tool; Wherein, the method of using a PE parsing tool to determine the malicious program code segment in the file to be detected includes: Determine the option header of the file to be detected by using the PE parsing tool; determining an image base address and a segment table in the option header; Determine the relative virtual address offset and virtual size of the malicious program code segment according to the segment table; The code segment address of the malicious program code segment is determined according to the image base address and the relative virtual address offset, and the code segment size of the malicious program code segment is determined according to the virtual size.

3. The malicious program detection method according to claim 1, characterized in that: Before the preset space uses the hardware breakpoint program to detect the malicious program code segment, it also includes: The hardware breakpoint program is written in a shellcode form or a dll form, and is implanted into the preset space.

4. The malicious program detection method according to claim 3, characterized in that: Implanting the hardware breakpoint program into the preset space includes: If the hardware breakpoint program is in the shellcode format, writing the hardware breakpoint program into the memory of the preset space in a memory writing format; If the hardware breakpoint program is in the dll format, the hardware breakpoint program is implanted into the preset space through thread injection.

5. The malicious program detection method according to claim 3, characterized in that: When the hardware breakpoint program is written in the form of shellcode or dll, it also includes: Add a VEH exception handling interface and set the breakpoint address to the location of the malicious program code segment.

6. The method for detecting malicious programs according to claim 3, characterized in that: If the hardware breakpoint program is in dll format, it also includes: A memory layout query interface and a process information query interface are configured, and a debugger plug-in is generated based on the memory layout query interface and the process information query interface.

7. A malicious program detection system, characterized in that: include: An acquisition module is used to acquire files to be detected; A code determination module, used to determine the malicious program code segment in the file to be detected; A code copy module, used to apply for a preset space in the process memory of the malicious program and copy the malicious program code segment to the preset space; A code detection module, used to detect the malicious program code segment using a hardware breakpoint program in the preset space; The code determination module is a module used to determine the malicious program code segment in the file to be detected by using a debugger; Among them, the code determination module includes: A file loading unit, used for loading the file to be detected into the debugger; a segment determination unit, configured to determine a landmark character segment in a memory layout window of the debugger; The code segment determination unit is used to determine the malicious program code segment according to the iconic character segment.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malicious program detection method according to any one of claims 1 to 6 are implemented.

9. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the malicious program detection method according to any one of claims 1 to 6 are implemented.

Images