Injection-type tainted data tracking method, device and electronic device based on GO language

Abstract

The present application relates to an injection-type tainted data tracking method, device, electronic device and storage medium based on GO language, wherein the injection-type tainted data tracking method based on GO language includes: obtaining the ELF table of the detected application, obtaining the construction information of the detected application by querying the ELF table, and obtaining the address information of the method function used to construct the detected application from the construction information; according to the address information of the method function, obtaining the input data and output data of the method function when processing tainted data through a preset function structure pre-injected into the detected application; marking the input data and output data of the method function obtained. Through the present application, the problem that the pre-use preparation work of the compiled taint tracking technology in the prior art is cumbersome and troublesome, which affects the user experience, is solved, and a new injection-type tainted data tracking method based on GO language is provided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for tracking injected tainted data based on GO language. Background Art

[0002] The GO language-based taint tracking technology currently available on the market mainly merges the taint tracking code with the user code for compilation, and then runs the compiled program for monitoring. This has the following disadvantages.

[0003] a) First, you need to have the user code to compile and process. If the user only has the executable file but no source code, vulnerability detection will not be possible.

[0004] b) Using the recompilation method means that every online machine of the user needs to be recompiled and deployed, which is very inconvenient and time-consuming for customers with huge machine clusters.

[0005] c) Compiled injection requires a certain amount of modification in the user code, which means that the user needs to delete and modify the added parts of the source code when they do not need to use it, affecting the user experience.

[0006] Therefore, the preparation work before using the current compiled taint tracking technology is cumbersome and troublesome, which affects the user experience.

[0007] With regard to the problem that the preparation work before use of the compiled taint tracking technology in the related art is cumbersome and troublesome, which affects the user experience, no effective solution has been proposed yet. Summary of the invention

[0008] In this embodiment, a GO language-based injection-type taint data tracking method, device, electronic device and storage medium are provided to solve the problem that the pre-use preparation work of the compiled taint tracking technology in the related art is cumbersome and troublesome, which affects the user experience.

[0009] In a first aspect, a method for tracking injected tainted data based on GO language is provided in this embodiment, and the method includes:

[0010] Obtaining an ELF table of the detected application, obtaining construction information of the detected application by querying the ELF table, and obtaining information of a method function used to construct the detected application from the construction information;

[0011] According to the information of the method function, the input data and output data of the method function when processing the tainted data are obtained by pre-injecting a preset function structure into the detected application;

[0012] Marking the acquired input data and output data of the method function;

[0013] The marked input data and output data of each method function are used to form a vulnerability link.

[0014] In some embodiments, obtaining the ELF table of the detected application and obtaining the construction information of the detected application by querying the ELF table includes:

[0015] Converting the process file of the detected application into a character type to generate an ELF file, wherein the ELF file includes the ELF table, and the ELF table includes the construction information of the detected application;

[0016] Obtaining the virtual address and address offset of the process file of the detected application in the memory;

[0017] The specific address space of the construction information in the memory is obtained according to the virtual address, and the construction information of the detected application is obtained in combination with the address offset.

[0018] In some embodiments, obtaining the virtual address and address offset of the process file of the detected application in the memory includes:

[0019] According to the process name of the process file, obtaining the path where the detected application is located;

[0020] Based on the path where the detected application is located, the virtual address and address offset of the process file in the memory are obtained through the file mapping relationship.

[0021] In some of the embodiments, before marking the acquired input data and output data of the method function, the step further includes:

[0022] The method functions are classified; wherein the types of the method functions include: a first type, a second type and a third type; the first type of method function is used to receive externally input tainted data, the second type of method function is used to propagate tainted data, and the third type of method function is used to trigger vulnerabilities.

[0023] In some of the embodiments, the preset function structure includes a data marking function and a data acquisition function, and the information of the method function includes an address of the method function in a memory;

[0024] The obtaining, according to the information of the method function, the input data and output data of the method function when processing the tainted data by pre-injecting a preset function structure into the detected application comprises:

[0025] According to the address of the method function in the memory, a register address replacement operation is performed through a data acquisition function, so that the input data and output data of the method function enter the preset function structure;

[0026] The output data and the input data are marked and stored by the data marking function.

[0027] In some embodiments, the method further comprises:

[0028] Acquire an interface list of interfaces called by the detected application according to the ELF table;

[0029] Wherein, the interface list includes the method function.

[0030] In some embodiments, obtaining the input data and output data of the method function when processing the tainted data by using a preset function structure pre-injected into the detected application includes:

[0031] Determine the method functions that need to be monitored in the detected application by comparing the method functions in the interface list with the method functions in the preset function list; wherein the preset function list includes preset method functions that need to be monitored;

[0032] The input data and output data of the method function to be monitored in the detected application when processing the tainted data are obtained through the preset function structure.

[0033] In a second aspect, an injection-type tainted data tracking device based on GO language is provided in this embodiment, and the device includes: a first acquisition module, a second acquisition module and a data marking module;

[0034] The first acquisition module is used to acquire an ELF table of the detected application, acquire construction information of the detected application by querying the ELF table, and acquire information of a method function used to construct the detected application from the construction information;

[0035] The second acquisition module is used to acquire input data and output data when the method function processes the tainted data through a preset function structure pre-injected into the detected application according to the information of the method function;

[0036] The data marking module is used to mark the acquired input data and output data of the method function;

[0037] The marked input data and output data of each method function are used to form a vulnerability link.

[0038] In the third aspect, an electronic device is provided in this embodiment, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the injected tainted data tracking method based on the GO language described in the first aspect is implemented.

[0039] In a fourth aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the injection-type tainted data tracking method based on GO language described in the first aspect above is implemented.

[0040] Compared with the prior art, the taint tracking technology in this application starts from the perspective of the operating system, obtains the construction information of the detected application through the ELF file, and the construction information contains method function information. On this basis, the corresponding hook technology is used to obtain the input data and output data of the corresponding method function, and finally realizes the taint tracking analysis. Since the method function information is obtained from the perspective of the operating system, the preset function structure injected into the application does not need to be compiled together with the source code of the application, but directly obtains the input and output data of the method function and marks it through the register address replacement operation, so as to determine the propagation link of the taint data. Therefore, the taint data tracking method can act directly on the process file. In the startup phase of the application, through the dynamic injection of the preset function structure, it can obtain the propagation link of the taint data without recompiling and restarting, and report the corresponding vulnerability information. Therefore, it solves the problem that the pre-use preparation work of the compiled taint tracking technology in the prior art is relatively cumbersome and troublesome, which affects the user experience.

[0041] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 This is a hardware structure block diagram of a terminal of an injection-type tainted data tracking method based on GO language in this embodiment.

[0044] Figure 2 This is a flow chart of an injection-type tainted data tracking method based on GO language in this embodiment.

[0045] Figure 3 This is a flow chart of an injection-type tainted data tracking method based on GO language in this preferred embodiment.

[0046] Figure 4 This is a structural block diagram of an injection-type tainted data tracking device based on GO language in this embodiment. DETAILED DESCRIPTION

[0047] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0048] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. Usually, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0049] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 : is a hardware structure block diagram of a terminal of a method for tracing injected tainted data based on GO language in this embodiment. Figure 1 As shown, the terminal may include one or more ( Figure 1 Only one is shown in the figure) processor 102 and memory 104 for storing data, wherein processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1The structure shown is only for illustration and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0050] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the injection-type tainted data tracking method based on the GO language in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The transmission device 106 is used to receive or send data via a network. The above network includes a wireless network provided by the communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0052] In this embodiment, a GO language-based injection-type tainted data tracking method is provided. Figure 2 is a flow chart of an injection-type tainted data tracking method based on GO language in this embodiment, such as Figure 2 As shown, the process includes the following steps:

[0053] Step S210, obtaining the ELF table of the detected application, obtaining the construction information of the detected application by querying the ELF table, and obtaining the information of the method function used to construct the detected application from the construction information.

[0054] Specifically in this step, the detection terminal first obtains the build information of the detected application through the ELF table of the detected application. Since the build information of the application contains information about the method functions of the application, the detection terminal then obtains the method functions used to construct the detected application and the information about the method functions from the build information.

[0055] Among them, obtaining the ELF table of the detected application, and obtaining the build information of the detected application by querying the ELF table includes: converting the process file of the detected application into a character type to generate an ELF file, wherein the ELF file includes an ELF table, and the ELF table contains the build information of the detected application. ELF is a standard file format for binary files, executable files, object codes, shared libraries and core dumps in computer science. Then obtain the virtual address and address offset of the process file of the detected application in the memory; obtain the specific address space of the build information in the memory according to the virtual address, and obtain the build information of the detected application in combination with the address offset. More specifically, first read the file where the process is located into the memory, convert it into a character type, and determine whether it is an ELF file type, and if so, load it. The build information of the application is generally stored in the ELF file, and then the specific address space where the build information is located is searched through the virtual address of the process file in the memory, and finally the build version and specific and detailed build information are obtained through the address offset.

[0056] Exemplarily, the steps of obtaining the virtual address and address offset of the process file of the detected application in the memory are: according to the process name of the process file, obtain the path where the detected application is located; based on the path where the detected application is located, obtain the virtual address and address offset of the process file in the memory through the file mapping relationship. Specifically, the PID (unique identifier of the process) is obtained through the process name, and the full path where the detected application is located is obtained through the PID, and then / proc / {pid} / maps is read according to the full path. This file shows the memory area and access rights mapped by the process, and then the start and end addresses of the virtual address of the process file in the memory, read and write permissions, offset and mapping node number, etc. are obtained from it, and this data is stored in the memory.

[0057] Step S220 , according to the information of the method function, the input data and output data of the method function when processing the tainted data are obtained through a preset function structure pre-injected into the detected application.

[0058] Specifically, in this step, the detection terminal pre-injects a function structure into the detected application, and then the function structure uses the information of the method function to obtain the input data and output data of the method function. In a specific example, when the user starts the code project, a request is triggered, thereby starting the vulnerability detection, and the preset function structure obtains the input data and output data of the method function through which the tainted data passes.

[0059] Step S230, marking the acquired input data and output data of the method function; wherein the marked input data and output data of each method function are used to form a vulnerability link.

[0060] Specifically, in this step, the detection terminal marks the input data and output data of the method function. If the tainted data reaches the vulnerability triggering function, the above data is sorted in the thread to form a complete vulnerability link for reporting. That is, the tainted data originally input from the outside and all the method functions that the tainted data passes through are determined through the marking information.

[0061] In further detail, the preset function structure includes a data marking function and a data acquisition function, and the information of the method function includes the address of the method function in the memory; first, the detection terminal performs a register address replacement operation through the data acquisition function according to the address of the method function in the memory, so that the input data and output data of the method function enter the preset function structure; the output data and input data are marked and stored through the data marking function. Exemplarily, the data acquisition function can be a section of inline assembly code set in the function structure, and its main function is to obtain the corresponding input data and output data through register address operation when executing a certain method function, and then send it to the preset function structure; and the data marking function can be a handle function, which is used to mark and store the input data. Exemplarily, the Hook technology is used in this embodiment to obtain the input and output data of the method function. Specifically, it can be obtained through the register address replacement operation, and the register address replacement operation refers to modifying the index address of the function in the register. For example, the address of the method function to be monitored in the memory is 0x11, and the address of the preset function structure in the memory is 0x22. The index address of the monitored method function in the register is 0x11. At this time, change the index address of the method function in the register to 0x22. In this way, the data information related to the method function will enter the preset function structure through the index address, and then the input and output data of the monitored method function can be obtained.

[0062] Preferably, before marking the input data and output data of the acquired method function, the method function is classified; wherein the types of method functions include: first type, second type and third type; the first type of method function is used to receive external input tainted data, the second type of method function is used to propagate tainted data, and the third type of method function is used to trigger vulnerabilities. Specifically, the initial external input tainted data enters the detected application through the first type of method function, and then propagates in the second type of method function. When it propagates to the third type of method function, it indicates that there is a vulnerability in the detected application, and the method functions through which the tainted data passes need to be sorted out to finally form a vulnerability link.

[0063] It should be noted that this method is applied in the GO language environment. The current taint tracking technology in the GO language environment mainly merges and compiles the taint tracking code with the user code, and then runs the compiled program for monitoring, so there are corresponding usage defects. The taint tracking technology in this embodiment is used for taint tracking analysis of golang applications to solve the defect in the prior art that the taint tracking code needs to be merged and compiled with the user code in the golang language environment, resulting in inconvenience in use.

[0064] In this embodiment, through the above steps, a new method for tracking injected tainted data based on GO language is provided. First, the construction information of the detected application is obtained through the ELF table, and then the method function used to construct the detected application and the address of the method function in the memory are obtained from the construction information. Finally, the preset function structure pre-injected into the detected application is used to obtain the input data and output data of the method function when processing the tainted data through the register address replacement operation, and the corresponding data is marked. These marked data are convenient for subsequent determination of link vulnerabilities. Compared with the prior art, the taint tracking technology in this embodiment starts from the perspective of the operating system, obtains the construction information of the detected application through the ELF file, and the construction information contains method function information. On this basis, the corresponding hook technology is used to obtain the input data and output data of the corresponding method function, and finally realizes the taint tracking analysis. Since the method function information is obtained from the perspective of the operating system, the preset function structure injected into the application does not need to be compiled together with the source code of the application, but directly obtains the input and output data of the method function through the register address replacement operation and marks it, thereby determining the propagation link of the tainted data. Therefore, the tainted data tracking method can be directly applied to the process file. During the startup phase of the application, the preset function structure is dynamically injected to obtain the propagation link of the tainted data and report the corresponding vulnerability information without recompiling and restarting. Therefore, the problem that the preparation work before use of the compiled taint tracking technology in the prior art is cumbersome and troublesome, which affects the user experience is solved.

[0065] In some of the embodiments, the GO language-based injection-type tainted data tracking method further includes: obtaining an interface list of interfaces called by the detected application according to an ELF table; wherein the interface list includes method functions.

[0066] Obtaining the input data and output data of a method function through a preset function structure and marking the input data and output data also includes: determining the method functions that need to be monitored in the detected application by comparing the method functions in the interface list with the method functions in the preset function list; wherein the preset function list contains preset method functions that need to be monitored; obtaining the input data and output data of the method function that needs to be monitored in the detected application through the preset function structure.

[0067] Specifically in this embodiment, the construction information of the detected application also includes an interface list, which is obtained through information in the ELF file, and the interface list includes method functions. By comparing the interface list and the preset function list, the method function that needs to be monitored in the detected application is determined, and the method function that needs to be monitored means that the input and output data of this method function need to be captured. Therefore, through this step, the preset function structure can obtain the input and output data of the method function that needs to be monitored in a targeted manner, thereby reducing unnecessary consumption.

[0068] The present embodiment is described and illustrated below through preferred embodiments.

[0069] Figure 3 FIG. 1 is a flow chart of a GO language-based injection-type tainted data tracking method of this preferred embodiment. Figure 3 As shown, the GO language-based injection-type tainted data tracking method includes the following steps:

[0070] Step S310, obtaining the path where the detected application is located through the process name, and based on the path where the detected application is located, obtaining the virtual address space and address offset occupied by the process in the memory through the file mapping relationship.

[0071] Specifically in this step, the detection terminal obtains the PID (unique identifier of the process) of the process through the process name, and then obtains the complete path of the detected application through the PID, and then reads / proc / {pid} / maps according to the path. The file displays the memory area and access rights mapped by the process, and then obtains the start and end addresses of the virtual address, read and write permissions, offset and mapping node number, etc., and stores this data in the memory.

[0072] Step S320, read the process file of the detected application into the memory, and convert it into a character type, and then determine whether the converted file is an ELF file, and if so, load the ELF file.

[0073] Specifically in this step, the detection terminal needs to load the ELF file in different ways according to the different bit numbers of the storage unit, specifically, load it in different ways according to 32 bits or 64 bits, and generate an ELF header at the same time; during the loading process, the sections and segments in the ELF file are loaded separately.

[0074] Step S330, obtaining the construction information of the detected application through the virtual address and address offset of the process in the memory.

[0075] Specifically in this step, the detection terminal first obtains brief information about the build information, which is generally stored in a section in an ELF file and obtained through traversal search; then the specific address space where the build information is located is obtained through a virtual address search of the process in memory, and finally the build version and specific detailed build information are obtained through the address offset, wherein the build information includes method functions that constitute the detected application.

[0076] Step S340, obtaining an interface list of interfaces called by the detected application, and obtaining a virtual address of each method function in the memory.

[0077] Specifically in this step, the detection terminal needs to use the information in the ELF file to obtain the interface list. Based on the ELF table information, the keyword GO_INTERFACE_TABLE is used to search the global data to obtain the required data. The interface is a collection of some method functions, so the interface list is equivalent to the method function list. According to the interface list, the virtual address of each method function in the memory is obtained.

[0078] Step S350: classify and mark the method functions, and record the input data and output data of each method function when processing the tainted data.

[0079] Specifically, in this step, the function is divided into three stages: pollution source, propagation path, and trigger. The method function in the pollution source stage is used to receive tainted data input from the outside, and the method function in the propagation stage is used to propagate tainted data. When the tainted data reaches the method function in the trigger stage, it indicates that there is a vulnerability in the detected application.

[0080] Step S360, obtaining the input data and output data of the method function through a preset function structure, and marking and storing the input data and output data.

[0081] Specifically in this step, the detection terminal obtains the input data and output data of the method function when processing the tainted data through the preset function structure, as well as the stage of the method function. It should be explained that each preset function structure contains a section of inline assembly code, whose main function is to read the input and output data corresponding to the method function through register address operations when a method function is performed, and input it into the custom preset function structure. There is also a handle function in the preset function structure, which is used to mark and store the input data to prepare for the subsequent formation of the vulnerability link. Exemplarily, in this embodiment, the Hook technology is used to obtain the input and output data of the method function, which is specifically obtained through register address operations. The register address operation refers to modifying the index address of the function in the register. For example, if the address of the method function to be monitored is 0x11 and the address of the preset function structure is 0x22, then the index address of the monitored method function is 0x11. At this time, change the index address of the method function to 0x22. In this way, the data information related to the method function will enter the preset function structure through the index address, and then the input and output data of the monitored method function can be obtained, and then the data can be marked and processed through the handle function.

[0082] Preferably, in this embodiment, the method further includes traversing the custom preset function list according to the information data of the interface list. If there is a method function in the interface list that is the same as the method function in the custom preset function list, it means that the corresponding method function needs to be hooked, that is, the input data and output data of the method function need to be obtained. The custom preset function list contains the preset method functions that need to be hooked. Through this step, unnecessary resource consumption can be reduced, and the input and output data of the method function can be obtained in a targeted manner.

[0083] The above steps constitute a new GO language-based injection-type tainted data tracking method. First, the construction information of the detected application is obtained through the virtual address and address offset of the process in the memory; then the method function used to construct the detected application is obtained from the construction information, and finally the input data and output data of the method function when processing the tainted data are obtained through the preset function structure pre-injected into the detected application through the Hook technology, and the corresponding data are marked. These marked data are convenient for subsequent determination of link vulnerabilities. Compared with the prior art, since the method function for constructing the application is obtained through the construction information, the preset function structure injected into the application does not need to be compiled with the source code of the application. It can obtain the input and output data of the method function and mark it, thereby determining the propagation link of the tainted data. Therefore, the tainted data tracking method can act directly on the process file. In the startup phase of the application, through the dynamic injection of the preset function structure, it can obtain the propagation link of the tainted data without recompiling and restarting, and report the corresponding vulnerability information. Therefore, it solves the problem that the pre-use preparation work of the compiled taint tracking technology in the prior art is cumbersome and troublesome, affecting the user's experience.

[0084] This preferred embodiment also provides a tainted data tracking test method for testing the GO language-based injection tainted data tracking method in this embodiment. The method includes the following steps:

[0085] Step A, inserting a method function in the detected application that sends an http request to the outside. When the detected application sends an http request to the outside through the above method function, the inserting program obtains data of sending the http request to the outside.

[0086] Step B, determining whether there is contaminated data in the data obtained in step A and sent to the outside in the http request; if there is, extracting its coordinates, generating contaminated data coordinate information, and adding the contaminated data coordinate information to the header of the http request sent to the outside with a fixed key value.

[0087] Step C: When another application receives the http request sent in step A, it determines whether the fixed key value in the header of the http request exists. If it exists, its value is extracted to obtain the contaminated data coordinate information.

[0088] Step D, putting the polluted data coordinate information obtained in step C into the cache and tracking it. In the subsequent program execution process, if the data of the http request is extracted, and the data extracted from the cache storing the polluted data coordinate information is pointed to by its coordinates, then the data is set as the pollution source.

[0089] There are many ways to implement that the detected application receives the HTTP request. In this embodiment, Postman is used to simulate the sending request.

[0090] Through the above steps, the injection-type tainted data tracking method based on GO language in this embodiment is tested. By using the Hook technology, the parameters and address of net / http.(*Request).Cookie can be obtained, and the data in the Cookie is marked as a pollution source. After being marked as a propagation process by the fmt.Sprintf function, it is finally marked as a trigger point in os / exec.Command, and the vulnerability is reported at the same time. This shows that the injection-type tainted data tracking method based on GO language in this application is feasible and effective.

[0091] In this embodiment, a GO language-based injection-type tainted data tracking device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. The terms "module", "unit", "sub-unit", etc. used below may implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation in hardware, or a combination of software and hardware, is also possible and conceivable.

[0092] Figure 4 is a structural block diagram of an injection-type tainted data tracking device based on GO language in this embodiment, such as Figure 4 As shown, the device includes: a first acquisition module 410, a second acquisition module 420 and a data marking module 430; the first acquisition module 410 is used to obtain the ELF table of the detected application, obtain the construction information of the detected application by querying the ELF table, and obtain the information of the method function used to construct the detected application from the construction information; the second acquisition module 420 is used to obtain the input data and output data of the method function when processing the tainted data according to the information of the method function through a preset function structure pre-injected into the detected application; the data marking module 430 is used to mark the input data and output data of the obtained method function; wherein the input data and output data of each marked method function are used to form a vulnerability link.

[0093] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0094] In this embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0095] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0096] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0097] Step S210, obtaining the ELF table of the detected application, obtaining the construction information of the detected application by querying the ELF table, and obtaining the address information of the method function used to construct the detected application from the construction information.

[0098] Step S220 , according to the address information of the method function, the input data and output data of the method function when processing the tainted data are obtained through a preset function structure pre-injected into the detected application.

[0099] Step S230, marking the acquired input data and output data of the method function, wherein the marked input data and output data of each method function are used to form a vulnerability link.

[0100] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0101] In addition, in combination with the GO language-based injection-type tainted data tracking method provided in the above embodiments, a storage medium can also be provided in this embodiment to implement the method. The storage medium stores a computer program; when the computer program is executed by a processor, any of the GO language-based injection-type tainted data tracking methods in the above embodiments is implemented.

[0102] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0103] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0104] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various locations in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0105] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for tracking injected tainted data based on GO language, characterized in that: The method comprises: Obtaining an ELF table of the detected application, obtaining construction information of the detected application by querying the ELF table, and obtaining information of a method function used to construct the detected application from the construction information; According to the address of the method function in the memory, a register address replacement operation is performed through a data acquisition function, so that the input data and output data of the method function enter a preset function structure, and the preset function structure includes a data marking function and a data acquisition function; The output data and the input data are marked and stored through the data marking function; wherein the marked input data and output data of each of the method functions are used to form a vulnerability link.

2. The GO language-based injection-type tainted data tracking method according to claim 1 is characterized in that: The step of obtaining the ELF table of the detected application and obtaining the construction information of the detected application by querying the ELF table includes: Converting the process file of the detected application into a character type to generate an ELF file, wherein the ELF file includes the ELF table, and the ELF table includes the construction information of the detected application; Obtaining the virtual address and address offset of the process file of the detected application in the memory; The specific address space of the construction information in the memory is obtained according to the virtual address, and the construction information of the detected application is obtained in combination with the address offset.

3. The GO language-based injection-type tainted data tracking method according to claim 2 is characterized in that: The step of obtaining the virtual address and address offset of the process file of the detected application in the memory includes: According to the process name of the process file, obtaining the path where the detected application is located; Based on the path where the detected application is located, the virtual address and address offset of the process file in the memory are obtained through the file mapping relationship.

4. The GO language-based injection-type tainted data tracking method according to claim 1, characterized in that: Before marking and storing the output data and the input data by the data marking function, the following step is further included: The method functions are classified; wherein the types of the method functions include: a first type, a second type and a third type; the first type of method function is used to receive externally input tainted data, the second type of method function is used to propagate tainted data, and the third type of method function is used to trigger vulnerabilities.

5. The GO language-based injection-type tainted data tracking method according to claim 1, characterized in that: The method further comprises: Acquire an interface list of interfaces called by the detected application according to the ELF table; Wherein, the interface list includes the method function.

6. The GO language-based injection-type tainted data tracking method according to claim 1, characterized in that: According to the address of the method function in the memory, a register address replacement operation is performed through a data acquisition function, so that the input data and output data of the method function enter a preset function structure, and the preset function structure includes a data marking function and a data acquisition function. Determine the method functions that need to be monitored in the detected application by comparing the method functions in the interface list with the method functions in the preset function list; wherein the preset function list includes preset method functions that need to be monitored; The input data and output data of the method function to be monitored in the detected application when processing the tainted data are obtained through the preset function structure.

7. An injection-type tainted data tracking device based on GO language, characterized in that: The device comprises: a first acquisition module, a second acquisition module and a data marking module; The first acquisition module is used to acquire an ELF table of the detected application, acquire construction information of the detected application by querying the ELF table, and acquire information of a method function used to construct the detected application from the construction information; The second acquisition module is used to perform a register address replacement operation through a data acquisition function according to the address of the method function in the memory, so that the input data and output data of the method function enter a preset function structure, and the preset function structure includes a data marking function and a data acquisition function; The data marking module is used to mark and store the output data and the input data through the data marking function; The marked input data and output data of each method function are used to form a vulnerability link.

8. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the GO language-based injection-type tainted data tracking method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the GO language-based injection tainted data tracking method according to any one of claims 1 to 6 are implemented.

Images