A software protection method, device and equipment based on process replacement

Abstract

The present disclosure relates to a software protection method, device and equipment based on process replacement, the method comprising: creating an original process in a suspended manner; obtaining the image information of the original process; wherein the image information comprises: the original process image base address and the original process main thread context structure; uninstalling the original process image based on the original process image base address; mapping the code file to be protected to the original process image to obtain a new process after the original process is replaced; and running the new process. The present disclosure can improve the software protection and anti-killing effects.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a software protection method, device and equipment based on process replacement. Background Art

[0002] As an important basic software of modern information industry, operating system provides key basic services for the entire information industry. As a node and processing unit of information connectivity, it plays an important role in user interface. System security is an important part of information security, and together with network security, it constitutes the two major components of modern information security. At present, the main way to improve the system security level is to add malicious behavior detection devices to the host.

[0003] At present, the main host detection technology is static host file detection, and a common technology to bypass static file detection is process replacement operation technology. However, the lack of relevant files for process replacement operation technology can make static file detection technology ineffective, and to a certain extent, it can only rely on process behavior detection technology for detection. Therefore, the detection capability for system security, especially WindowsX64 system security, needs to be further improved. Summary of the invention

[0004] In order to solve the above technical problem or at least partially solve the above technical problem, the present disclosure provides a software protection method, apparatus and device based on process replacement.

[0005] The present disclosure provides a software protection method based on process replacement, comprising:

[0006] Create an original process in a suspended manner; obtain image information of the original process; wherein the image information includes: the original process image base address and the original process main thread context structure; uninstall the original process image based on the original process image base address; map the code file to be protected to the original process image to obtain a new process after the original process is replaced; and run the new process.

[0007] Optionally, the creating the original process in a suspended manner includes:

[0008] Execute the CREATE_SUSPENDED attribute to create the original process in a suspended manner, so that the original process stops running before running the code; and, when creating the original process, use the system executable file or the executable file with a legal digital signature as the image file created by the original process.

[0009] Optionally, the obtaining the image information of the original process includes:

[0010] The main thread context structure of the original process is obtained by obtaining the API function related to the thread context; and the image base address of the original process is obtained according to the system structure related field stored in the offset address of the preset register under the current process state of the original process.

[0011] Optionally, uninstalling the process image of the original process based on the original process image base address includes:

[0012] The original process image base address and the pid value of the original process are used as uninstallation parameters, and the uninstallation section related function in the system bottom layer module is used as the uninstallation function; the process image of the original process is uninstalled according to the uninstallation parameters and the uninstallation function.

[0013] Optionally, mapping the code file to be protected to the original process image includes:

[0014] The application size is obtained by parsing the PE file header of the code file to be protected; memory is applied for according to the application size and preset memory attributes, and a new process image is written based on the applied memory; wherein the new process image includes the file header image content and file section image data that are automatically loaded when the code file to be protected is created; and memory adjustment is performed on the new process image.

[0015] Optionally, the writing of the new process image includes:

[0016] Write the file header mirror content, the file header mirror content includes: the disk operating system DOS file header, the new technology file system NT file header and the section table of the code file to be protected; write the file section mirror data based on the section table; wherein the file section mirror data includes multiple file sections.

[0017] Optionally, writing the file section mirror data based on the section table includes:

[0018] The write base addresses of the current file sections are calculated one by one according to the content of the section table, and the current file sections are written according to the write base addresses until all the file sections are processed.

[0019] Optionally, the performing memory adjustment on the new process image includes:

[0020] The base address of the new process image is adjusted through the PEB structure of the new process image; and the PE file code entry point address of the new process image is adjusted through the main thread context structure of the new process.

[0021] The present disclosure provides a software protection device based on process replacement, comprising:

[0022] Create a module to create the original process in a suspended manner;

[0023] An information acquisition module, used to acquire the image information of the original process; wherein the image information includes: the original process image base address and the original process main thread context structure;

[0024] An uninstallation module, used for uninstalling the original process image based on the original process image base address;

[0025] A replacement module, used for mapping the code file to be protected to the original process image, to obtain a new process after the original process is replaced;

[0026] A running module is used to run the new process.

[0027] The present disclosure provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the above-mentioned software protection method based on process replacement.

[0028] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0029] The software protection method, device and equipment based on process replacement provided by the disclosed embodiment include: creating an original process, obtaining the image information of the original process; then before the original process runs, uninstalling the original process image based on the image information, and mapping the code file to be protected to the original process image, obtaining a new process after the original process is replaced; and finally running the new process. The disclosed embodiment can improve the software protection and anti-killing effect, and increase the design and anti-killing difficulty of security software. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0032] Figure 1 This is a flow chart of the software protection method based on process replacement according to an embodiment of the present disclosure;

[0033] Figure 2 A flow chart of a method for writing a new process image according to an embodiment of the present disclosure;

[0034] Figure 3 This is a structural block diagram of a software protection device based on process replacement according to an embodiment of the present disclosure;

[0035] Figure 4 It is a schematic diagram of the structure of the electronic device described in the embodiment of the present disclosure. DETAILED DESCRIPTION

[0036] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0037] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0038] At present, the detection capability for the security of Windows X64 system needs to be further improved. The disclosed embodiment takes into account the advantages of strong versatility and good compatibility of process replacement technology, and compared with Windows X86 system, the process replacement technology for Windows X64 system has more advantages. Based on this, a solution for process replacement of Windows X64 is proposed. One of them is a method for injecting and executing a new thread after modifying the code running after the Windows X64 process memory. This code injection method uses X64 ShellCode code, that is, the assembly code that obtains the required Windows API function address by itself after the code runs, and then uses the method of creating a new thread in the injection process to run the injected code. This code injection method must use X64 ShellCode assembly code, and more processing is required for parameter passing and exception handling. It has high requirements for coding ability, requires more time for coding and debugging, and must be run in the way of creating a new remote thread, which is easy to be discovered and alarmed by security software behavior detection. In addition, when using the code injection method, the protection code process with the injected code must obtain relevant permissions, otherwise most processes cannot be injected successfully. The operation of the injected code is prone to problems because the current memory data of the injected process is unknown.

[0039] In order to solve the problem caused by the code injection into part of the process memory, another Windows x86 process replacement method is proposed. This method uses a self-created process, and then replaces the entire memory space of the process content before the process runs, so as to realize the memory operation of the file content. However, the existing host system security detection technology has a relatively mature detection method for X86 process replacement, and it is difficult to avoid killing.

[0040] It can be seen that there is currently a lack of a better Windows X64 system process replacement technology that can improve system security detection capabilities. In response to at least one of the above problems, the present disclosure embodiment considers that compared with the Windows X86 system, the process replacement technology for the Windows X64 system has more advantages, and based on this, provides a software protection method, device and equipment based on process replacement; wherein the above advantages are such as the following points:

[0041] First, the software protection and anti-killing technology based on process replacement in Windows X86 system was born in the Windows XP system era, with a relatively long timeline and mature detection methods. Most system security defense software on the market can basically detect X86 process replacement. Second, the X64 assembly code compiled by the Windows X64 system itself is more difficult to analyze manually and automatically than X86, which also increases the difficulty of memory analysis. This is determined by the code structure of the Windows X64 executable file itself. Third, the initialization process used by the Windows X64 system when creating an X64 process is different from the initialization process used by the X86 system when creating a process, resulting in the inability to use a simple transplant of the X86 monitoring code to monitor the process replacement of the X64 system. Fourth, all the structures and hardware facilities such as registers used by the Windows X64 process itself are different from those of Windows X86, which also leads to major modifications in the compatibility and monitoring capabilities of the X64 monitoring code.

[0042] In this case, the embodiment of the present disclosure first describes the software protection method based on process replacement. Figure 1 As shown, the method comprises the following steps:

[0043] Step S101, creating an original process in a suspended manner, wherein the original process is a Windows X64 process to be replaced, which is a legitimate process, that is, a process that will not be warned by security software after running, and its files are legitimate files.

[0044] The purpose of creating the original process in this embodiment is to use its process space to run other code files to be protected. Therefore, when creating the original process, the CREATE_SUSPENDED attribute can be executed to create the original process in a suspended manner, so that the original process stops running before running the code, providing an operation opportunity for executing subsequent image replacement and recovery steps. In addition, in the actual operation of creating the original process, the system executable file or the executable file with a legal digital signature can be used as the image file created by the original process.

[0045] Step S102, obtaining the image information of the original process, wherein the image information includes: the image base address of the original process and the main thread context structure of the original process.

[0046] The specific acquisition method includes: obtaining the main thread context structure of the original process by obtaining the thread context-related API (Application Programming Interface) function; obtaining the original process image base address according to the system structure related field stored in the offset address of the preset register under the current process state of the original process.

[0047] The original process image base address thus obtained can be used as an uninstallation parameter for the uninstallation process of the original process image, and the original process main thread context structure is used to restore the structure used by the thread context.

[0048] Step S103: uninstall the original process image based on the original process image base address.

[0049] In the specific implementation, the original process image base address and the pid value of the original process are used as uninstallation parameters, and the uninstallation section related functions in the system bottom module are used as uninstallation functions; the process image of the original process is uninstalled according to the uninstallation parameters and uninstallation functions. For the above uninstallation function, since the functions in the system bottom module cannot be imported in actual programming, they are dynamically obtained in the code.

[0050] Step S104, mapping the code file to be protected to the original process image to obtain a new process after the original process is replaced.

[0051] The implementation process of mapping the code file to be protected to the original process image mainly includes the steps of applying for new image memory, writing new image data and adjusting new image memory.

[0052] The main parameters involved in memory application are application size and memory attributes; among them, the size of memory application depends on the image size after the code file to be protected is loaded into the memory. The application size can be obtained from the code file to be protected. Specifically, the application size can be obtained by parsing the PE (Portable Executable) file header of the code file to be protected.

[0053] After that, memory is requested according to the requested size and preset memory attributes, and a new process image is written based on the requested memory; that is, after the original process image is uninstalled and memory is requested for the new process image, the step of writing the new image data is executed. Among them, the new process image contains the image content that is automatically loaded when the code file to be protected is created, such as: file header image content and file section image data. The specific process of writing the new image data includes:

[0054] First, write the file header image content, which includes: DOS (Disk Operating System) file header, NT (New Technology File System) file header and section table of the code file to be protected. The size of the file header image content is identified by a field in the PE file header structure. The size of the file header image content is obtained by obtaining the value of this field. The write base address of the file header image content is the application memory base address.

[0055] Then, the file section mirror data is written based on the section table; wherein, the file section mirror data includes multiple file sections, and each file section can be mapped one by one according to the content of the PE file header section table, specifically: the write base address of the current file section is calculated one by one according to the content of the section table, and the current file section is written according to the write base address, until all file sections are processed.

[0056] The above-provided embodiment of mapping the code file to be protected to the original process image encrypts the code file to be protected and stores it as a data file in a place where the main loader can read it. It is decrypted when used instead of writing it to the disk. This can prevent the program from being directly reverse engineered and weaken the file detection and killing effect of the security software.

[0057] Based on the above, this embodiment provides a method for writing a new process image, such as Figure 2 As shown, the following steps are included:

[0058] Step S201, write the file header image content;

[0059] Step S202, taking the various file sections included in the file section mirror data as current file sections one by one;

[0060] Step S203, calculating the write base address of the current file section according to the content of the section table, and writing the current file section according to the write base address;

[0061] Step S204, determine whether the current file section is the last file section; if not, execute the following step S205; if yes, execute the following step S206;

[0062] Step S205, taking the next file section as the new current file section;

[0063] Step S206, after determining that all file sections have been processed, memory adjustment is performed on the new process image.

[0064] After all the file sections are processed in the above manner, that is, after the original process image is replaced by the new process image, the memory of the new process image is adjusted. The process replacement steps of WinX64 and WinX86 are quite different. If an error occurs, it will directly lead to parameter errors in the process initialization running environment, and indirectly lead to errors and crashes after running. In order to avoid the above problems, this embodiment includes: adjusting the base address of the new process image and adjusting the address of the entry point of the new image PE file code when adjusting the memory of the new process image, that is:

[0065] (1) The base address of the new process image is adjusted through the PEB (Process Environment Block) structure of the new process image. PEB is the process environment control structure. When each Windows process is created, the system will create a unique PEB structure for it to manage the new process. The field at offset 0x10 of the PEB structure is used to save the base address when the executable file is loaded into the memory. A large number of relative address operations of the process rely on this address. Based on this, the base address adjustment of the new process image in this embodiment can be adjusted through the PEB structure of the new process.

[0066] (2) The PE file code entry point address of the new process image is adjusted through the main thread context structure of the new process. A process can have multiple threads, but there is only one main thread, and each thread has a unique thread context (Context) structure to manage it. The Context structure contains the state values ​​of all CPU registers and the registers when the process is initially running. The initial entry address of the process code is stored in one of the registers. When performing the original process creation step, the register is used to save the main thread context structure and value of the original process. Then, when the image memory is adjusted, the initial entry address of the process code is modified, and other addresses remain unchanged. Finally, the modified main thread context structure and value are used as the thread context of the new process, and the thread context is set to the corresponding context structure of the new process, so that the new process can be correctly initialized and meet its own running conditions.

[0067] Step S105, running a new process.

[0068] In this embodiment, when the original process image and related context are all modified correctly, the new process is started and run in the following manner: the operation of the main thread is resumed, and the execution of the main thread is resumed, that is, the new process starts running at the code starting point set by the image code. At the beginning of each process creation, the system will create a main thread for it, and this main thread will start running from the code starting point, which is the starting point of the process code execution.

[0069] In summary, the software protection method based on process replacement provided by the embodiment of the present disclosure includes: creating an original process and obtaining the image information of the original process; then before the original process runs, uninstalling the original process image based on the image information, and mapping the code file to be protected to the original process image to obtain a new process after the original process is replaced; finally, running the new process, thereby achieving software protection and anti-killing effects.

[0070] The above technical solution uses the legitimate original process as a puppet process, forcing the security software to use memory detection and killing, and use the code file to be protected in the memory to replace the process content of the legitimate original process, thereby converting it into a real malicious and protected new process, thereby realizing fileless operation of the protection code, and ultimately achieving software protection and anti-killing effects; in addition, using the WindowsX64 process as the original process to be replaced further increases the design and detection difficulty of the security software.

[0071] The above technical solution is not only beneficial to the self-protection of WindowsX64 software, but can also be used as host security software to improve the memory detection and process behavior detection capabilities of WindowsX64 system.

[0072] Reference Figure 3 The present disclosure provides a software protection device based on process replacement, the device comprising:

[0073] A creation module 301 is used to create an original process in a suspended manner;

[0074] The information acquisition module 302 is used to acquire the image information of the original process; wherein the image information includes: the image base address of the original process and the main thread context structure of the original process;

[0075] An uninstallation module 303 is used to uninstall the original process image based on the original process image base address;

[0076] A replacement module 304 is used to map the code file to be protected to the original process image to obtain a new process after the original process is replaced;

[0077] The running module 305 is used to run the new process.

[0078] The implementation principle and technical effects of the device provided in this embodiment are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0079] Figure 4 The structure diagram of an electronic device provided by the embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the electronic device 400 includes one or more processors 401 and a memory 402 .

[0080] The processor 401 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 400 to perform desired functions.

[0081] The memory 402 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 401 may run the program instructions to implement the software protection method based on process replacement of the embodiment of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0082] In one example, the electronic device 400 may further include: an input device 403 and an output device 404, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0083] In addition, the input device 403 may also include, for example, a keyboard, a mouse, and the like.

[0084] The output device 404 can output various information to the outside, including the determined distance information, direction information, etc. The output device 404 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0085] Of course, to simplify, Figure 4 Only some of the components related to the present disclosure in the electronic device 400 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 400 may also include any other appropriate components.

[0086] Furthermore, this embodiment also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the above-mentioned software protection method based on process replacement.

[0087] A computer program product of a software protection method, device, electronic device and medium based on process replacement provided in the embodiments of the present disclosure includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiments. The specific implementation can be found in the method embodiments, which will not be repeated here.

[0088] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0089] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A software protection method based on process replacement, characterized in that: include: Creating an original process in a suspended manner; wherein the original process is a WindowsX64 process to be replaced; Obtaining the image information of the original process; wherein the image information includes: the original process image base address and the original process main thread context structure; Uninstalling the original process image based on the original process image base address; Mapping the code file to be protected to the original process image to obtain a new process after the original process is replaced; running the new process; The creating the original process in a suspended manner includes: Execute the CREATE_SUSPENDED attribute to create the original process in a suspended manner, so that the original process stops running before running the code; And, when creating the original process, the system executable file or the executable file with a legal digital signature is used as the image file created by the original process; The step of uninstalling the process image of the original process based on the original process image base address includes: The original process image base address and the pid value of the original process are used as uninstallation parameters, and the uninstallation section related function in the system bottom layer module is used as the uninstallation function; wherein the uninstallation function is dynamically obtained in the code; Uninstall the process image of the original process according to the uninstall parameter and the uninstall function.

2. The method according to claim 1, characterized in that The obtaining of the image information of the original process includes: Obtain the main thread context structure of the original process by obtaining the thread context-related API function; The original process image base address is obtained according to the system structure related field stored in the offset address of the preset register under the current process state of the original process.

3. The method according to claim 1, characterized in that The step of mapping the code file to be protected to the original process image includes: Obtain the application size by parsing the PE file header of the code file to be protected; Applying for memory according to the application size and preset memory attributes, and writing a new process image based on the applied memory; wherein the new process image includes the file header image content and file section image data of the code file to be protected that are automatically loaded when the process is created; Memory adjustment is performed on the new process image.

4. The method according to claim 3, characterized in that The writing of the new process image comprises: Writing the file header image content, wherein the file header image content includes: the disk operating system DOS file header, the new technology file system NT file header and the section table of the code file to be protected; The file section mirror data is written based on the section table; wherein the file section mirror data includes multiple file sections.

5. The method according to claim 4, characterized in that The writing of file section mirror data based on the section table includes: The write base addresses of the current file sections are calculated one by one according to the content of the section table, and the current file sections are written according to the write base addresses until all the file sections are processed.

6. The method according to claim 3, characterized in that The memory adjustment of the new process image includes: Adjusting the base address of the new process image through the PEB structure of the new process image; The PE file code entry point address of the new process image is adjusted through the main thread context structure of the new process.

7. A software protection device based on process replacement, characterized in that: include: A creation module, used to create an original process in a suspended manner; wherein the original process is a WindowsX64 process to be replaced; An information acquisition module, used to acquire the image information of the original process; wherein the image information includes: the original process image base address and the original process main thread context structure; An uninstallation module, used for uninstalling the original process image based on the original process image base address; A replacement module, used for mapping the code file to be protected to the original process image, to obtain a new process after the original process is replaced; A running module, used for running the new process; The creation module includes: Execute the CREATE_SUSPENDED attribute to create the original process in a suspended manner, so that the original process stops running before running the code; And, when creating the original process, the system executable file or the executable file with a legal digital signature is used as the image file created by the original process; The uninstall module includes: The original process image base address and the pid value of the original process are used as uninstallation parameters, and the uninstallation section related function in the system bottom layer module is used as the uninstallation function; wherein the uninstallation function is dynamically obtained in the code; Uninstall the process image of the original process according to the uninstall parameter and the uninstall function.

8. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the software protection method based on process replacement as described in any one of claims 1 to 6.

Images