A method, device, equipment and medium for updating a sandbox engine of a virtual machine

Abstract

The present invention discloses a sandbox engine update method, device, equipment and medium for a virtual machine. Since the method can update the sandbox engine by updating the global data pointer and the detection function after the virtual machine is restored to the state corresponding to the snapshot file, there is no need to re-produce the snapshot file and the sandbox environment. The update package required to update the sandbox engine is small, and the update efficiency is high.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method, device, equipment and medium for updating a sandbox engine of a virtual machine. Background Art

[0002] In recent years, various types of malware have emerged in an endless stream. In order to detect malware, the existing technology uses sandbox detection technology to determine whether the software is malware by running the software in a virtual machine and observing the software behavior. Specifically, based on the driver running under the virtual machine kernel in the sandbox engine, the system sensitive functions are hooked based on the hook technology, so that malicious software behavior can be captured when the malware is running.

[0003] The existing sandboxes that run software in virtual machines all use a snapshot file restoration method when detecting malware. They restore various pre-customized sandbox environments and execute different malware in different sandbox environments, so that the malware can be detected quickly.

[0004] However, if a problem occurs in the sandbox engine, in the prior art, when the sandbox engine is updated and upgraded, the sandbox engine is recompiled, and the sandbox environment and snapshot files are remade, resulting in a larger update package and lower update efficiency. Summary of the invention

[0005] The present invention provides a method, device, equipment and medium for updating a sandbox engine of a virtual machine, which are used to solve the problems of large update packages and low update efficiency in the prior art.

[0006] The present invention provides a method for updating a sandbox engine of a virtual machine, the method comprising:

[0007] Restoring the virtual machine to a state corresponding to the snapshot file according to the pre-saved snapshot file, and performing polling detection on a predetermined update code area based on an update thread of the first driver code in the virtual machine;

[0008] Receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function;

[0009] If it is detected that the second driver code in the update code area is valid, the export table of the second driver code is parsed to obtain the exported update function, the update function is called to determine the first global data pointer in the first driver code, and the second global data pointer in the second driver code is replaced, and the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer is determined according to the first global data pointer and the identification information, and the first detection function is replaced by the second detection function.

[0010] Further, writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine includes:

[0011] Determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area;

[0012] According to the physical address of the update code area, the pre-compiled second driver code carried in the update package is written into the update code area.

[0013] Further, after writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, before detecting that the second driver code in the update code area is valid, the method further includes:

[0014] Importing the application programming interface API of other modules into the written second driver code according to the import table in the second driver code;

[0015] The written second driver code is relocated according to the relocation table in the second driver code.

[0016] Further, the polling detection of a predetermined update code area based on the update thread of the first driver code in the virtual machine includes:

[0017] Based on the update thread of the first driver code in the virtual machine, obtaining a first flag value of the update code area in the current time period, and determining whether the first flag value is the same as a pre-saved target flag value, wherein the first flag value is used to indicate whether a preset operation has been performed in the update code area, wherein the preset operation includes code writing, API importing, and relocation;

[0018] If not, obtaining the first flag value of the update code area in the next time period, and continuing to perform the step of determining whether the first flag value is the same as the pre-saved target flag value;

[0019] If so, it is determined that the second driving code in the update code area is detected to be valid.

[0020] Further, the calling the update function to determine the first global data pointer in the first driver code includes:

[0021] Based on the update thread of the first driver code, the update function of the second driver code is called to determine the first global data pointer of the first driver code passed as a parameter.

[0022] Accordingly, the present invention provides a sandbox engine update device for a virtual machine, the device comprising:

[0023] A detection module, configured to restore the virtual machine to a state corresponding to the snapshot file according to a pre-saved snapshot file, and perform polling detection on a predetermined update code area based on an update thread of a first driver code in the virtual machine;

[0024] A processing module, configured to receive an update package of a sandbox engine, and write a pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function, and corresponding identification information, and the export table includes an update function;

[0025] An update module is used to parse the export table of the second driver code to obtain the exported update function if it is detected that the second driver code in the update code area is valid, call the update function to determine the first global data pointer in the first driver code, and replace the second global data pointer in the second driver code, determine the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer according to the first global data pointer and the identification information, and replace the first detection function with the second detection function.

[0026] Furthermore, the processing module is specifically used to determine the physical address of the host memory space corresponding to the virtual address based on the pre-saved virtual address of the client memory space of the update code area; and write the pre-compiled second driver code carried in the update package into the update code area based on the physical address of the update code area.

[0027] Furthermore, the processing module is also used to write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, and then import the application programming interface API of other modules to the written second driver code according to the import table in the second driver code; and relocate the written second driver code according to the relocation table in the second driver code.

[0028] Furthermore, the detection module is specifically used to obtain the first flag bit value of the update code area in the current time period based on the update thread of the first driver code in the virtual machine; determine whether the first flag bit value is the same as a pre-saved target flag bit value, wherein the first flag bit value is used to indicate whether a preset operation has been executed in the update code area, wherein the preset operation includes code writing, API import and relocation; if the first flag bit value is different from the pre-saved target flag bit value, obtain the first flag bit value of the update code area in the next time period, and trigger the judgment module to continue to execute the step of determining whether the first flag bit value is the same as the pre-saved target flag bit value; if the first flag bit value is the same as the pre-saved target flag bit value, determine that the second driver code detected in the update code area is valid.

[0029] Furthermore, the update module is specifically configured to call the update function of the second driver code based on the update thread of the first driver code, and determine the first global data pointer of the first driver code passed as a parameter.

[0030] Accordingly, the present invention provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; a computer program is stored in the memory, and when the program is executed by the processor, the processor executes the steps of any one of the methods described in the above-mentioned virtual machine sandbox engine update method.

[0031] Accordingly, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the methods described in the above-mentioned method for updating a sandbox engine of a virtual machine.

[0032] The present invention provides a sandbox engine update method, device, equipment and medium for a virtual machine. In this method, a virtual machine is restored to a state corresponding to a snapshot file according to a pre-saved snapshot file, and a predetermined update code area is polled and detected based on an update thread of a first driver code in the virtual machine; an update package of a sandbox engine is received, and a pre-compiled second driver code carried in the update package is written into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function; if it is detected that the second driver code in the update code area is valid, the export table of the second driver code is parsed to obtain the exported update function, the update function is called to determine the first global data pointer in the first driver code, and the second global data pointer in the second driver code is replaced; according to the first global data pointer and the identification information, a first detection function identified by the identification information in the detection function table pointed to by the first global data pointer is determined, and the first detection function is replaced by the second detection function. After the virtual machine is restored to the state corresponding to the snapshot file, the sandbox engine can be updated by updating the global data pointer and the detection function. Therefore, there is no need to re-create the snapshot file and the sandbox environment. The update package required to update the sandbox engine is smaller and the update efficiency is high. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 A schematic diagram of a process of updating a sandbox engine of a virtual machine provided by an embodiment of the present invention;

[0035] Figure 2 A schematic diagram provided for an embodiment of the present invention;

[0036] Figure 3 A schematic diagram of the structure of a sandbox engine update device for a virtual machine provided by an embodiment of the present invention;

[0037] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] In order to improve the updating efficiency of a virtual machine sandbox engine, an embodiment of the present invention provides a method, apparatus, device and medium for updating a virtual machine sandbox engine.

[0040] Embodiment 1:

[0041] Figure 1 A process diagram of a method for updating a sandbox engine of a virtual machine provided by an embodiment of the present invention includes the following steps:

[0042] S101: restoring a virtual machine to a state corresponding to a pre-saved snapshot file according to the pre-saved snapshot file, and performing polling detection on a predetermined update code area based on an update thread of a first driver code in the virtual machine.

[0043] A sandbox engine update method for a virtual machine provided by an embodiment of the present invention is applied to an electronic device, wherein the electronic device may be a PC, a tablet computer, a smart terminal, a server, etc., and the server may be a local server or a cloud server.

[0044] In order to improve the update efficiency of the sandbox engine, in an embodiment of the present invention, the electronic device pre-stores a snapshot file, and the virtual machine Guest in the electronic device can be restored to the state corresponding to the snapshot file according to the snapshot file. The method of restoring the virtual machine to the state corresponding to the snapshot file according to the snapshot file belongs to the prior art, and the embodiment of the present invention will not be described in detail.

[0045] Based on the update thread of the first driver code in the virtual machine, a predetermined update code area is polled for detection, that is, the update code area is detected according to a determined time period to detect whether there is code in the update code area and whether the code is valid. The update code area is a fixed size and relatively large area applied for when the driver is initialized, and the update code area is used to store the second driver code written by the host.

[0046] S102: Receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function.

[0047] In order to improve the update efficiency of the virtual machine sandbox engine, in an embodiment of the present invention, the electronic device receives an update package of the sandbox engine, which is pre-made. After receiving the update package, the electronic device starts to update the sandbox engine.

[0048] Specifically, the host of the electronic device receives the update package and obtains the second driving code from the update package.

[0049] In order to update the virtual machine sandbox engine, the update package carries a pre-compiled second driver code, wherein the second driver code is the code of the new driver program of the sandbox engine. Based on the second driver code, some functions of the sandbox engine with problems can be corrected.

[0050] The second driving code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function for exporting the update function for use by the electronic device.

[0051] The second global data pointer is used to access all global data. The area where the global data is located is dynamically applied for according to the size of all data when the driver is initialized, and the global data includes a global function table where the detection function is located.

[0052] The second detection function is used to detect malicious behavior when malware is running. The identification information corresponding to the second detection function can be the serial number corresponding to the second detection function in the global function table, where the second detection function is stored in the global function table. The second detection function corresponding to each serial number is fixed. For the second detection function whose function header is hooked, it can directly jump to the corresponding second detection function in the global function table.

[0053] After the virtual machine is restored to the state corresponding to the snapshot file, the host end of the electronic device writes the acquired second driver code into a predetermined update code area in the guest end.

[0054] S103: If it is detected that the second driver code in the update code area is valid, parse the export table of the second driver code to obtain the exported update function, call the update function to determine the first global data pointer in the first driver code, and replace the second global data pointer in the second driver code, determine the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer according to the first global data pointer and the identification information, and use the second detection function to replace the first detection function.

[0055] In order to update the sandbox engine, in an embodiment of the present invention, since some functions of the old driver in the sandbox engine have problems while other functions are normal, there is no need to delete the first driver code of the old driver. It is only necessary to detect that the second driver code in the update code area is valid, and then, according to the second driver code written in the update code area, after running the second driver code, the function of the old driver with problems can be replaced.

[0056] In order to replace the problematic functions of the old driver based on the second driver code, in an embodiment of the present invention, the export table in the second driver code is parsed to obtain an update function in the exported export table, and the update function is called to determine the first global data pointer in the first driver code.

[0057] After the first global data pointer is acquired, the first global data pointer is used to replace the second global data pointer in the second driver code, so that when the second driver code is running, the detection function table in the global function can be determined based on the first global data pointer.

[0058] The detection function table in the Guest end is determined according to the first global data pointer, and the first detection function identified by the identification information in the detection function table is determined according to the identification information corresponding to the second detection function in the received second driver code, wherein the first detection function is the cause of problems with certain functions of the old driver program, and therefore the electronic device uses the second detection function to replace the first detection function with the same identification information.

[0059] In the embodiment of the present invention, after the virtual machine is restored to the state corresponding to the snapshot file, the sandbox engine can be updated by updating the global data pointer and the detection function. Therefore, there is no need to re-produce the snapshot file and the sandbox environment. The update package required to update the sandbox engine is smaller and the update efficiency is high.

[0060] Embodiment 2:

[0061] In order to write the second driver code into the update code area, based on the above embodiment, in an embodiment of the present invention, writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine includes:

[0062] Determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area;

[0063] According to the physical address of the update code area, the pre-compiled second driver code carried in the update package is written into the update code area.

[0064] In order to write the second driving code into the update code area, in the embodiment of the present invention, the electronic device first determines the physical address of the update code area.

[0065] The electronic device pre-stores a virtual address of the client memory space of the update code area, and the virtual address is the address of the update code area in the memory space of the virtual machine.

[0066] According to the pre-saved virtual address, the physical address of the host memory space corresponding to the virtual address is determined, wherein the physical address is an address in the real physical space, so the electronic device writes the second driver code into the update code area according to the physical address.

[0067] Specifically, the Guest end of the electronic device stores the virtual address of the update code area, and sends the virtual address to the Host end of the electronic device through the virtual machine internal and external communication technology, so as to determine the physical address on the Host end according to the virtual address, and write the second driver code into the update code area according to the physical address.

[0068] Embodiment 3:

[0069] In order to realize the subsequent operation of the second driver code, on the basis of the above embodiments, in an embodiment of the present invention, after writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, before detecting that the second driver code in the update code area is valid, the method further includes:

[0070] Importing the application programming interface API of other modules into the written second driver code according to the import table in the second driver code;

[0071] The written second driver code is relocated according to the relocation table in the second driver code.

[0072] In order to realize the subsequent operation of the second driver code, in the embodiment of the present invention, after the second driver code is written into the update code area of ​​the virtual machine, the second driver code is also imported and relocated through the Application Programming Interface (API).

[0073] Specifically, the second driver code also includes an import table, wherein the import table includes identification information of API interfaces of other modules to be imported, and the API is imported into the written second driver code according to the identification information of API interfaces of other modules in the import table.

[0074] The second driver code also includes a relocation table, wherein the relocation table includes a corrected memory address. The function of the relocation table is to correct the memory address when the second driver code is loaded into the memory.

[0075] According to the corrected memory address in the relocation table, the second driver code is relocated to achieve correction of the memory address.

[0076] Embodiment 4:

[0077] In order to timely determine whether the written first driver code is valid, based on the above embodiments, in an embodiment of the present invention, the update thread based on the first driver code in the virtual machine performs polling detection on a predetermined update code area, including:

[0078] Based on the update thread of the first driver code in the virtual machine, obtaining a first flag value of the update code area in the current time period, and determining whether the first flag value is the same as a pre-saved target flag value, wherein the first flag value is used to indicate whether a preset operation has been performed in the update code area, wherein the preset operation includes code writing, API importing, and relocation;

[0079] If not, obtaining the first flag value of the update code area in the next time period, and continuing to perform the step of determining whether the first flag value is the same as the pre-saved target flag value;

[0080] If so, it is determined that the second driving code in the update code area is detected to be valid.

[0081] In order to determine in time whether the written second driver code is already valid, in an embodiment of the present invention, based on the update thread of the first driver code in the virtual machine, the second driver code in the update code area is polled and detected, and the duration of each polling is the same fixed time period, which is pre-set. If you want to improve the timeliness of determining whether the second driver code is valid, you can set the time period to be smaller. If you want to reduce resource consumption, you can set the time period to be larger.

[0082] Get the first flag bit value of the update code area in the current time period, where the first flag bit value is used to indicate whether preset operations such as code writing, API import and relocation have been completed in the update code area. If the preset operations have been completed in the update code area, the second driver code in the update code area is valid; if the preset operations have not been completed in the update code area, the second driver code in the update code area is invalid.

[0083] In order to determine whether the second driving code is valid, the electronic device pre-stores a target flag value, which is the flag value after the preset operation has been executed in the update code area. After obtaining the first flag value of the current time period, it is determined whether the first flag value is the same as the target flag value.

[0084] If the first flag bit value is different from the target flag bit value, it means that the preset operation has not been completed in the update code area. Therefore, continue to obtain the first flag bit value of the update code area in the next time period and compare it with the target flag bit value until the obtained first flag bit value is the same as the target flag bit value. If the first flag bit value is the same as the target flag bit value, it means that the preset operation has been completed in the update code area, and the second driving code in the update code area is valid.

[0085] Embodiment 5:

[0086] In order to enable the second driver code to determine the first global data pointer of the first driver code, based on the above embodiments, in an embodiment of the present invention, calling the update function to determine the first global data pointer in the first driver code includes:

[0087] Based on the update thread of the first driver code, the update function of the second driver code is called to determine the first global data pointer of the first driver code passed as a parameter.

[0088] In order to enable the second driver code to determine the first global data pointer of the first driver code, in an embodiment of the present invention, the original first driver code of the virtual machine of the electronic device includes an update thread and a first global data pointer.

[0089] The electronic device calls the update function of the second driver code based on the update thread of the first driver code. When calling the update function, the first global data pointer of the first driver code is obtained and saved in the update function as a parameter for passing, thereby determining the first global data pointer in the update function.

[0090] Embodiment 6:

[0091] The following is a description of the sandbox engine update method of the virtual machine of the embodiment of the present invention through a specific embodiment. Figure 2 A schematic diagram provided for an embodiment of the present invention, such as Figure 2 As shown:

[0092] There are a host end and a guest end in the electronic device. The host end of the electronic device writes a second driving code to the guest end, and the guest end includes a global data pointer, a detection function table and an update code area.

[0093] The guest end of the electronic device is first initialized, including initialization of a global data pointer, initialization of a detection function table, and application for updating a code area.

[0094] The host end of the electronic device restores the guest end to a state corresponding to the snapshot file according to the pre-saved snapshot file, and the guest end of the electronic device performs polling detection on a predetermined update code area based on an update thread of the first drive code.

[0095] Receive an update package for the sandbox engine in the Guest, obtain the pre-compiled second driver code carried in the update package, determine the physical address of the Host according to the virtual address of the update code area sent by the Guest, and write the second driver code according to the physical address. The Host of the electronic device also imports and relocates the API interface of the second driver code in the update code area according to the kernel information when the Guest is running.

[0096] The Guest end of the electronic device obtains the first flag bit value of the update code area in the current time period, and determines whether the first flag bit value is the same as the pre-saved target flag bit value, wherein the first flag bit value is used to indicate whether a preset operation has been executed in the update code area, wherein the preset operation includes code writing, API importing and relocation; if not, obtain the first flag bit value of the update code area in the next time period, and continue to execute the step of determining whether the first flag bit value is the same as the pre-saved target flag bit value; if so, determine that the first driver code in the update code area is valid, and parse the export table of the first driver code to obtain the exported update function.

[0097] The guest end of the electronic device calls the update function, determines the first global data pointer of the first driver code passed as a parameter, replaces the second global data pointer in the second driver code, determines the detection function table according to the first global data pointer, determines the first detection function identified by the identification information in the detection function table according to the identification information in the second driver code, and replaces the first detection function with the second detection function. The second driver code is the code of the patch driver program, which is used to correct some problematic functions of the sandbox engine. The first driver code is the code of the detection driver program, which is used to detect malware behavior.

[0098] Embodiment 7:

[0099] Figure 3The present invention provides a schematic diagram of the structure of a sandbox engine update device for a virtual machine according to an embodiment of the present invention. Based on the above embodiments, the present invention also provides a sandbox engine update device for a virtual machine, the device comprising:

[0100] The detection module 301 is used to restore the virtual machine to the state corresponding to the snapshot file according to the pre-saved snapshot file, and perform polling detection on the predetermined update code area based on the update thread of the first driver code in the virtual machine;

[0101] The processing module 302 is used to receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function;

[0102] The update module 303 is used to parse the export table of the second driver code to obtain the exported update function if it is detected that the second driver code in the update code area is valid, call the update function to determine the first global data pointer in the first driver code, and replace the second global data pointer in the second driver code, determine the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer according to the first global data pointer and the identification information, and replace the first detection function with the second detection function.

[0103] Furthermore, the processing module is specifically used to determine the physical address of the host memory space corresponding to the virtual address based on the pre-saved virtual address of the client memory space of the update code area; and write the pre-compiled second driver code carried in the update package into the update code area based on the physical address of the update code area.

[0104] Furthermore, the processing module is also used to write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, and then import the application programming interface API of other modules to the written second driver code according to the import table in the second driver code; and relocate the written second driver code according to the relocation table in the second driver code.

[0105] Furthermore, the detection module is specifically used to obtain the first flag bit value of the update code area in the current time period based on the update thread of the first driver code in the virtual machine; determine whether the first flag bit value is the same as a pre-saved target flag bit value, wherein the first flag bit value is used to indicate whether a preset operation has been executed in the update code area, wherein the preset operation includes code writing, API import and relocation; if the first flag bit value is different from the pre-saved target flag bit value, obtain the first flag bit value of the update code area in the next time period, and trigger the judgment module to continue to execute the step of determining whether the first flag bit value is the same as the pre-saved target flag bit value; if the first flag bit value is the same as the pre-saved target flag bit value, determine that the second driver code detected in the update code area is valid.

[0106] Furthermore, the update module is specifically configured to call the update function of the second driver code based on the update thread of the first driver code, and determine the first global data pointer of the first driver code passed as a parameter.

[0107] Embodiment 8:

[0108] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. On the basis of the above embodiments, an electronic device is further provided in an embodiment of the present invention, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404;

[0109] The memory 403 stores a computer program. When the program is executed by the processor 401, the processor 401 performs the following steps:

[0110] Restoring the virtual machine to a state corresponding to the snapshot file according to the pre-saved snapshot file, and performing polling detection on a predetermined update code area based on an update thread of the first driver code in the virtual machine;

[0111] Receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function;

[0112] If it is detected that the second driver code in the update code area is valid, the export table of the second driver code is parsed to obtain the exported update function, the update function is called to determine the first global data pointer in the first driver code, and the second global data pointer in the second driver code is replaced, and the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer is determined according to the first global data pointer and the identification information, and the first detection function is replaced by the second detection function.

[0113] Further, the processor 401 is specifically configured to write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, including:

[0114] Determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area;

[0115] According to the physical address of the update code area, the pre-compiled second driver code carried in the update package is written into the update code area.

[0116] Further, the processor 401 is further configured to, after writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, if it is detected that the second driver code in the update code area is valid, the method further includes:

[0117] Importing the application programming interface API of other modules into the written second driver code according to the import table in the second driver code;

[0118] The written second driver code is relocated according to the relocation table in the second driver code.

[0119] Further, the processor 401 is specifically used for the update thread based on the first driver code in the virtual machine to perform polling detection on the predetermined update code area, including:

[0120] Based on the update thread of the first driver code in the virtual machine, obtaining a first flag value of the update code area in the current time period, and determining whether the first flag value is the same as a pre-saved target flag value, wherein the first flag value is used to indicate whether a preset operation has been performed in the update code area, wherein the preset operation includes code writing, API importing, and relocation;

[0121] If not, obtaining the first flag value of the update code area in the next time period, and continuing to perform the step of determining whether the first flag value is the same as the pre-saved target flag value;

[0122] If so, it is determined that the second driving code in the update code area is detected to be valid.

[0123] Further, the processor 401 is specifically configured to call the update function to determine the first global data pointer in the first driver code, including:

[0124] Based on the update thread of the first driver code, the update function of the second driver code is called to determine the first global data pointer of the first driver code passed as a parameter.

[0125] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0126] The communication interface 402 is used for communication between the electronic device and other devices.

[0127] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0128] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0129] Embodiment 9:

[0130] On the basis of the above embodiments, an embodiment of the present invention further provides a computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to perform the following steps:

[0131] Restoring the virtual machine to a state corresponding to the snapshot file according to the pre-saved snapshot file, and performing polling detection on a predetermined update code area based on an update thread of the first driver code in the virtual machine;

[0132] Receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function;

[0133] If it is detected that the second driver code in the update code area is valid, the export table of the second driver code is parsed to obtain the exported update function, the update function is called to determine the first global data pointer in the first driver code, and the second global data pointer in the second driver code is replaced, and the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer is determined according to the first global data pointer and the identification information, and the first detection function is replaced by the second detection function.

[0134] Further, writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine includes:

[0135] Determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area;

[0136] According to the physical address of the update code area, the pre-compiled second driver code carried in the update package is written into the update code area.

[0137] Further, after writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, before detecting that the second driver code in the update code area is valid, the method further includes:

[0138] Importing the application programming interface API of other modules into the written second driver code according to the import table in the second driver code;

[0139] The written second driver code is relocated according to the relocation table in the second driver code.

[0140] Further, the polling detection of a predetermined update code area based on the update thread of the first driver code in the virtual machine includes:

[0141] Based on the update thread of the first driver code in the virtual machine, obtaining a first flag value of the update code area in the current time period, and determining whether the first flag value is the same as a pre-saved target flag value, wherein the first flag value is used to indicate whether a preset operation has been performed in the update code area, wherein the preset operation includes code writing, API importing, and relocation;

[0142] If not, obtaining the first flag value of the update code area in the next time period, and continuing to perform the step of determining whether the first flag value is the same as the pre-saved target flag value;

[0143] If so, it is determined that the second driving code in the update code area is detected to be valid.

[0144] Further, the calling the update function to determine the first global data pointer in the first driver code includes:

[0145] Based on the update thread of the first driver code, the update function of the second driver code is called to determine the first global data pointer of the first driver code passed as a parameter.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0150] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for updating a sandbox engine of a virtual machine, characterized in that: The method comprises: Restoring the virtual machine to a state corresponding to the snapshot file according to the pre-saved snapshot file, and performing polling detection on a predetermined update code area based on an update thread of the first driver code in the virtual machine; Receive an update package of the sandbox engine, and write the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function and corresponding identification information, and the export table includes an update function; If it is detected that the second driver code in the update code area is valid, the export table of the second driver code is parsed to obtain the exported update function, the update function is called to determine the first global data pointer in the first driver code, and the second global data pointer in the second driver code is replaced, and according to the first global data pointer and the identification information, the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer is determined, and the first detection function is replaced by the second detection function; The step of performing polling detection on a predetermined update code area based on the update thread of the first driver code in the virtual machine includes: Based on the update thread of the first driver code in the virtual machine, obtaining a first flag value of the update code area in the current time period, and determining whether the first flag value is the same as a pre-saved target flag value, wherein the first flag value is used to indicate whether a preset operation has been performed in the update code area, wherein the preset operation includes code writing, API importing, and relocation; If not, obtaining the first flag value of the update code area in the next time period, and continuing to perform the step of determining whether the first flag value is the same as the pre-saved target flag value; If so, it is determined that the second driving code in the update code area is detected to be valid.

2. The method according to claim 1, characterized in that Writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine includes: Determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area; According to the physical address of the update code area, the pre-compiled second driver code carried in the update package is written into the update code area.

3. The method according to claim 1, characterized in that After writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, and before detecting that the second driver code in the update code area is valid, the method further includes: Importing the application programming interface API of other modules into the written second driver code according to the import table in the second driver code; The written second driver code is relocated according to the relocation table in the second driver code.

4. The method according to claim 1, characterized in that The calling of the update function to determine the first global data pointer in the first driver code comprises: Based on the update thread of the first driver code, the update function of the second driver code is called to determine the first global data pointer of the first driver code passed as a parameter.

5. A sandbox engine update device for a virtual machine, characterized in that: The device comprises: A detection module, configured to restore the virtual machine to a state corresponding to the snapshot file according to a pre-saved snapshot file, and perform polling detection on a predetermined update code area based on an update thread of a first driver code in the virtual machine; A processing module, configured to receive an update package of a sandbox engine, and write a pre-compiled second driver code carried in the update package into the update code area in the virtual machine, wherein the second driver code includes an export table, a second global data pointer, a second detection function, and corresponding identification information, and the export table includes an update function; an update module, for, if it is detected that the second driver code in the update code area is valid, parsing the export table of the second driver code to obtain the exported update function, calling the update function to determine the first global data pointer in the first driver code, and replacing the second global data pointer in the second driver code, determining the first detection function identified by the identification information in the detection function table pointed to by the first global data pointer according to the first global data pointer and the identification information, and replacing the first detection function with the second detection function; Among them, the detection module is specifically used to obtain the first flag bit value of the update code area in the current time period based on the update thread of the first driver code in the virtual machine; determine whether the first flag bit value is the same as the pre-saved target flag bit value, wherein the first flag bit value is used to indicate whether the preset operation has been executed in the update code area, wherein the preset operation includes code writing, API import and relocation; if the first flag bit value is different from the pre-saved target flag bit value, obtain the first flag bit value of the update code area in the next time period, and trigger the judgment module to continue to execute the step of determining whether the first flag bit value is the same as the pre-saved target flag bit value; if the first flag bit value is the same as the pre-saved target flag bit value, it is determined that the second driver code detected in the update code area is valid.

6. The device according to claim 5, characterized in that The processing module is specifically used to determine the physical address of the host memory space corresponding to the virtual address according to the pre-saved virtual address of the client memory space of the update code area; and write the pre-compiled second driver code carried in the update package into the update code area according to the physical address of the update code area.

7. The device according to claim 5, characterized in that The processing module is further configured to, after writing the pre-compiled second driver code carried in the update package into the update code area in the virtual machine, import the application programming interface API of other modules into the written second driver code according to the import table in the second driver code; The written second driver code is relocated according to the relocation table in the second driver code.

8. An electronic device, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; A computer program is stored in the memory, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 4.

9. A computer-readable storage medium, characterized in that: The computer program executable by a processor is stored therein, and when the program runs on the processor, the processor is enabled to execute the method according to any one of claims 1 to 4.

Images