Memory detection method, device, equipment and storage medium

Abstract

A memory detection method, apparatus, device, and storage medium are disclosed. The memory detection apparatus is loaded into the kernel of the system under test and includes: requesting a memory group from the system under test; dividing the memory group into multiple types of regions, each type of region having different read / write protection settings; allocating memory blocks in the memory group to the application in response to receiving a memory request from an application; and determining the target object causing the abnormal access based on the accessed memory address when the memory group is abnormally accessed. This memory detection method can capture the first scene of a system crash caused by abnormal access to memory by an application and can determine the type of abnormal access and call stack without restarting the computer.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of computer technology, and more particularly to a memory detection method, apparatus, device, and storage medium. Background Technology

[0002] A system crash is triggered when an application accesses an illegal memory address in the operating system. However, since the information obtained is usually not the first scene of the incident, it is difficult to investigate the cause of the abnormal access and the specific type of abnormal access.

[0003] Current memory testing tools typically detect illegal memory access by saving a memory snapshot when a system crashes, which requires restarting the computer and cannot capture the immediate scene of the crash. Summary of the Invention

[0004] In view of the above, one or more embodiments of this specification provide a memory detection method, apparatus, device, and storage medium. To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions.

[0005] According to a first aspect of one or more embodiments of this specification, a memory detection method is provided, the method being applied to a memory detection device, the memory detection device being loaded in the kernel of a system to be detected, the method comprising:

[0006] Request a memory group from the system under test;

[0007] The memory group is divided into multiple types of regions, each with different read / write protection settings;

[0008] In response to receiving a memory request from an application, a memory block in the memory group is allocated to the application;

[0009] In the event of abnormal access to the memory group, the target object causing the abnormal access is determined based on the accessed memory address.

[0010] In some embodiments, the memory detection device is loaded into the kernel of the system to be detected as a loadable kernel module.

[0011] In some embodiments, the memory group includes multiple memory blocks, and dividing the memory group into multiple types of regions includes:

[0012] Multiple first protection regions are spaced apart in the memory block, wherein the first protection regions are inaccessible regions;

[0013] A second protection region and an effective memory region are set between the two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

[0014] In some embodiments, allocating memory blocks from the memory group to the application in response to receiving a memory request from the application includes:

[0015] Hook operations are performed on the memory allocation interface in the kernel of the system under test;

[0016] When the application calls the memory allocation interface, a custom function enables the application to allocate memory to the memory group.

[0017] In some embodiments, determining the target application and the type of abnormal access based on the location within the accessed memory group includes:

[0018] Determine the memory block accessed by the abnormal access;

[0019] The application to which the memory block is allocated is identified as the target application for abnormal access.

[0020] In some embodiments, determining the target application and the type of abnormal access based on the location within the accessed memory group includes:

[0021] Determine the region accessed by the abnormal access;

[0022] The type of abnormal access and the call stack are determined based on the read / write protection type of the accessed area.

[0023] According to a second aspect of one or more embodiments of this specification, a memory detection apparatus is provided, the apparatus being loaded in the kernel of a system to be detected, the apparatus comprising:

[0024] A memory allocation module is used to request a memory group from the system under test.

[0025] The memory protection module is used to divide the memory group into multiple types of regions, each type of region having different read and write protection settings;

[0026] A memory allocation module is used to allocate memory blocks in the memory group to the application in response to receiving a memory request from the application;

[0027] An anomaly detection module is used to determine the target object causing the abnormal access based on the accessed memory address when the memory group is subjected to abnormal access.

[0028] In some embodiments, the apparatus is loaded into the kernel of the system under test as a loadable kernel module.

[0029] In some embodiments, the memory group includes multiple memory blocks, and the memory protection module is specifically used for:

[0030] Multiple first protection regions are spaced apart in the memory block, wherein the first protection regions are inaccessible regions;

[0031] A second protection region and an effective memory region are set between the two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

[0032] In some embodiments, the memory allocation module is specifically used for:

[0033] Hook operations are performed on the memory allocation interface in the kernel of the system under test;

[0034] When the application calls the memory allocation interface, a custom function enables the application to allocate memory to the memory group.

[0035] In some embodiments, the anomaly detection module is specifically used for:

[0036] Determine the memory block accessed by the abnormal access;

[0037] The application to which the memory block is allocated is identified as the target application for abnormal access.

[0038] In some embodiments, the anomaly detection module is specifically used for:

[0039] Determine the region accessed by the abnormal access;

[0040] The type of abnormal access and the call stack are determined based on the read / write protection type of the accessed area.

[0041] According to a third aspect of one or more embodiments of this specification, a computing device is provided, comprising:

[0042] processor;

[0043] Memory used to store processor-executable instructions;

[0044] The processor executes the executable instructions to implement the method described in any embodiment.

[0045] According to a fourth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided, having stored thereon computer instructions that, when executed by a processor, implement the method described in any embodiment. In this application, a memory detection device is loaded into the kernel of the system under test. By requesting a memory group from the system under test, the memory group is divided into multiple types of regions, each type having different read / write protection settings. In response to receiving a memory request from an application, memory blocks in the memory group are allocated to the application. In the event of abnormal access to the memory group, the target application and the type of abnormal access are determined based on the location within the accessed memory group. This allows for the capture of the initial scene of a system crash caused by abnormal memory access by an application, determining the type of abnormal access and the call stack without restarting the computer. Attached Figure Description

[0046] Figure 1 This is a flowchart of an anomaly detection method provided in an exemplary embodiment.

[0047] Figure 2 This is a schematic diagram of a memory block protection setting provided in an exemplary embodiment.

[0048] Figure 3 This is a block diagram of an anomaly detection device provided in an exemplary embodiment.

[0049] Figure 4 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Detailed Implementation

[0050] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0051] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0052] When an application accesses an illegal memory address of the operating system, it can cause a system crash. However, since the information obtained is usually not the first scene, it is difficult to find out the cause of the abnormal access and the specific type of abnormal access.

[0053] Current memory testing tools typically detect illegal memory access by saving a memory snapshot when a system crashes, which requires restarting the computer and cannot capture the immediate scene of the crash.

[0054] In view of this, this application provides a memory detection method for detecting the specific reasons and abnormal access types of illegal memory address access in the operating system. This abnormal detection method can be executed by a memory detection device installed in the operating system kernel.

[0055] See Figure 1 , Figure 1 This is a flowchart of an anomaly detection method provided in an exemplary embodiment, the method comprising:

[0056] Step 101: Request a memory group from the system to be tested.

[0057] In this step, the kernel management device of the system under test can receive memory requests through the memory request interface and allocate the requested memory group to the memory detection device. The allocated memory group typically comprises multiple memory blocks.

[0058] In this embodiment of the disclosure, memory groups can be requested in batches from the system to be tested for use in subsequent steps.

[0059] Step 102: Divide the memory group into multiple types of regions, each type of region having different read / write protection settings.

[0060] Specifically, each memory block of the memory group can be divided into multiple types of regions, each with different read / write protection settings. For example, one type can be set to be non-readable and non-writable, causing a hardware interrupt when the application accesses that region; another type can be set to be readable and writable, i.e., a memory region that can be accessed normally; other types of read / write protection can also be set so that different results occur when the application accesses different regions. Those skilled in the art should understand that the read / write protection types of different regions can be specifically set according to actual needs, and this disclosure does not limit this.

[0061] Step 103: In response to receiving a memory request from an application, allocate memory blocks in the memory group to the application.

[0062] By allocating one or more memory blocks from memory that are protected by the memory detection device to the application, the application can access the protected memory blocks at runtime.

[0063] Step 104: In the event of abnormal access to the memory group, determine the target object of the abnormal access based on the accessed memory address. The target object includes at least one of the target application that caused the abnormal access, the type of abnormal access, and the call stack of the abnormal access.

[0064] In the event of a hardware interruption caused by abnormal access to a memory group, an investigation into the cause of the interruption is triggered. Since memory blocks within the memory group are allocated to different applications, the application and call stack that caused the abnormal access can be identified based on the accessed memory block. Furthermore, because different types of read / write protection are implemented within the memory blocks, the type of abnormal access and call stack can be determined based on the regions within the accessed memory blocks, eliminating the need to restart the operating system and then rely on memory snapshots to investigate the specific cause of the hardware interruption.

[0065] This application requests a memory group from the system under test by means of a memory detection device loaded in the kernel of the system under test. The memory group is divided into multiple types of regions, each with different read and write protection settings. In response to receiving a memory request from an application, the memory blocks in the memory group are allocated to the application. In the event of abnormal access to the memory group, the target object of the abnormal access is determined according to the accessed memory address. This allows for the capture of the first scene of a system crash caused by abnormal memory access by an application, and the type of abnormal access and call stack can be determined without restarting the computer.

[0066] After introducing the basic implementation process of this application, the anomaly detection method provided by this application will be further explained below with reference to several optional embodiments.

[0067] In related technologies, memory testing tools built into the operating system kernel are often used for memory testing. However, these memory testing tools consume a lot of operating system resources, so they are disabled during operation in the official release version. If you want to use the kernel's built-in memory testing function, you need to use a debug version and restart the machine to reproduce the problem.

[0068] To address the aforementioned issues, this embodiment of the disclosure loads the memory detection device into the kernel of the system under test in a loadable kernel module manner.

[0069] Loadable kernel modules can be dynamically loaded into memory without recompiling the kernel or restarting the machine to capture crashed versions. Furthermore, compared to the kernel's built-in memory testing tools, loadable kernel modules do not forcibly insert testing instructions, resulting in lower performance overhead on the operating system. They are also compatible with various kernel versions and can be directly used for online environment problem detection, overcoming the bottleneck of memory troubleshooting within the operating system.

[0070] In some embodiments, memory blocks in a memory group can be protected by: setting multiple first protection regions at intervals in the memory blocks, wherein the first protection regions are inaccessible regions; setting a second protection region and an effective memory region between two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

[0071] Figure 2 This is a schematic diagram illustrating a memory block protection setting provided in an exemplary embodiment. For example... Figure 2 As shown, first protection regions can be set at both ends and the middle part of the memory block. That is, multiple first protection regions are set at intervals in the memory block, and each first protection region is set to be inaccessible. When the first protection region is accessed by the application, a hardware interrupt will be triggered, which will determine the abnormal access type.

[0072] A second protection region and an effective memory region are set between the two first protection regions. The second protection region is filled with a set value, which can also be called a sentinel value. Changing this set value in the second protection region will trigger a hardware interrupt, initiating a check for abnormal access types.

[0073] When the effective memory region is allocated to an application (i.e., in the allocated state), it can be accessed normally by the application. However, if the effective memory region is in the released state and is accessed by the application, it will cause a hardware interrupt.

[0074] In some embodiments, the second protection region and the effective memory region between the two first protection regions can be randomly arranged. This means that the address of the effective memory region may change in the memory addresses allocated by an application in two memory requests. This makes it easier to detect abnormal access by the application.

[0075] Those skilled in the art should understand that Figure 2 The number of first protection zones shown is for illustrative purposes only; other numbers of first protection zones can be set according to actual needs.

[0076] In this embodiment, by setting interval read / write protection for each memory block on the memory group, and randomly setting regions and valid memory regions filled with preset values ​​between the read / write protection regions, a hardware interrupt is triggered when an application illegally accesses these regions, thereby triggering a judgment on the abnormal access type. This eliminates the need to reproduce the problem after restarting the operating system to diagnose the abnormal access type.

[0077] In some embodiments, memory blocks in the memory group can be allocated to the application by: performing a hook operation on the memory allocation interface in the kernel of the system to be detected, i.e., hijacking the memory allocation interface; and, when the application calls the memory allocation interface, using a custom function to make the application allocate memory to the memory group.

[0078] By allocating memory blocks with the read-write protection settings proposed in the embodiments of this disclosure to applications that request memory, abnormal access to memory by applications can be detected without causing performance loss to the operating system.

[0079] In some embodiments, the target application performing the abnormal access can be determined based on its location within the accessed memory group.

[0080] Specifically, the memory block accessed by the abnormal access is first determined. Since the memory blocks in the memory group are allocated to different applications, once the memory block pointed to by the abnormal address is determined, the target application performing the abnormal access can be identified. In other words, the application allocated to the memory block can be identified as the target application performing the abnormal access.

[0081] In some embodiments, the type of abnormal access can be determined based on the location within the accessed memory group.

[0082] Specifically, the region accessed by the abnormal access is first determined. Since different read / write protection types are set for regions within the memory block, the abnormal access is caused by illegal access to these regions by the application. Therefore, based on the read / write protection type of the accessed region, the type of abnormal access and the call stack can be determined.

[0083] For example, if the address accessed by the abnormal access is within the first protected area, then the abnormal access type can be determined to be a memory out-of-bounds fault. A memory out-of-bounds fault occurs when an application, after requesting memory, uses memory beyond the legally allocated range.

[0084] If the address accessed by the abnormal access is within the second protected area, it can also be determined that the abnormal access type is a memory out-of-bounds fault.

[0085] Once it is determined that the accessed address is a valid memory region in a freed state, the type of abnormal access can be identified as a use-after-free (UAF) vulnerability.

[0086] In some embodiments, for each region within a memory block, the region may also be marked as being in an allocated or freed state. If the value in the accessed memory region indicates a value in a freed state, then the type of abnormal access can be determined to be a duplicate free of memory.

[0087] The above examples of abnormal access type judgment are merely illustrative. Other abnormal access types can also be judged based on the different states of each zone and the combination of read / write protection types. This disclosure does not impose any restrictions on this.

[0088] After determining the call stack of the abnormal access based on the read / write protection type of the accessed area, the path of the abnormal access can be clearly identified, which is helpful in tracing the root cause of the abnormal access.

[0089] In some embodiments, after determining the target application and the type of abnormal access, the operating system is restarted, and the abnormal access is displayed after the restart.

[0090] Corresponding to the embodiments of the foregoing methods, this specification also provides embodiments of a memory detection device. See [link to documentation]. Figure 3 , Figure 3 This is a block diagram of an anomaly detection device provided in an exemplary embodiment. The device is loaded into the kernel of the system to be detected, and the device includes:

[0091] The memory allocation module 301 is used to request memory groups from the system under test. The memory allocation module 301 can also be used for batch allocation, release, and fast / random allocation of memory.

[0092] The memory protection module 302 is used to divide the memory group into multiple types of regions, each type of region having different read and write protection settings.

[0093] Specifically, each memory block of the memory group can be divided into multiple types of regions, each with different read / write protection settings. For example, one type can be set to be non-readable and non-writable, causing a hardware interrupt when the application accesses that region; another type can be set to be readable and writable, i.e., a memory region that can be accessed normally; other types of read / write protection can also be set so that different results occur when the application accesses different regions. Those skilled in the art should understand that the read / write protection types of different regions can be specifically set according to actual needs, and this disclosure does not limit this.

[0094] The memory allocation module 303 is used to allocate memory blocks in the memory group to the application in response to receiving a memory request from the application.

[0095] By allocating one or more memory blocks in the memory that are protected by the memory protection module 302 to the application, the application can access the protected memory blocks at runtime.

[0096] The anomaly detection module 304 is used to determine the target object of the abnormal access based on the accessed memory address when the memory group is subjected to abnormal access. The target object includes at least one of the target application that caused the abnormal access, the type of the abnormal access, and the call stack of the abnormal access.

[0097] In the event of a hardware interruption caused by abnormal access to a memory group, an investigation into the cause of the interruption is triggered. Since memory blocks within the memory group are allocated to different applications, the application and call stack that caused the abnormal access can be identified based on the accessed memory block. Furthermore, because different types of read / write protection are implemented within the memory blocks, the type of abnormal access and call stack can be determined based on the regions within the accessed memory blocks, eliminating the need to restart the operating system and then rely on memory snapshots to investigate the specific cause of the hardware interruption.

[0098] In some embodiments, the apparatus is loaded into the kernel of the system under test as a loadable kernel module.

[0099] Loadable kernel modules can be dynamically loaded into memory without recompiling the kernel or restarting the machine to capture crashed versions. Furthermore, compared to the kernel's built-in memory testing tools, loadable kernel modules do not forcibly insert testing instructions, resulting in lower performance overhead on the operating system. They are also compatible with various kernel versions and can be directly used for online environment problem detection, overcoming the bottleneck of memory troubleshooting within the operating system.

[0100] In some embodiments, the memory group includes multiple memory blocks, and the memory protection module is specifically used for:

[0101] Multiple first protection regions are spaced apart in the memory block, wherein the first protection regions are inaccessible regions;

[0102] A second protection region and an effective memory region are set between the two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

[0103] In this embodiment, by setting interval read / write protection for each memory block on the memory group, and randomly setting regions and valid memory regions filled with preset values ​​between the read / write protection regions, a hardware interrupt is triggered when an application illegally accesses these regions, thereby triggering a judgment on the abnormal access type. This eliminates the need to reproduce the problem after restarting the operating system to diagnose the abnormal access type.

[0104] In some embodiments, the device further includes a hook template 305 for:

[0105] Hooking operations are performed on the memory allocation interface in the kernel of the system under test, that is, hijacking the memory allocation interface;

[0106] When the application calls the memory allocation interface, a custom function enables the application to allocate memory to the memory group.

[0107] By allocating memory blocks with the read-write protection settings proposed in the embodiments of this disclosure to applications that request memory, abnormal access to memory by applications can be detected without causing performance loss to the operating system.

[0108] In some embodiments, the anomaly detection module is specifically used for:

[0109] Determine the memory block accessed by the abnormal access;

[0110] The application to which the memory block is allocated is identified as the target application for abnormal access.

[0111] In some embodiments, the anomaly detection module is specifically used for:

[0112] Determine the region accessed by the abnormal access;

[0113] The type of abnormal access and the call stack are determined based on the read / write protection type of the accessed area.

[0114] For example, if the address accessed by the abnormal access is within the first protected area, then the abnormal access type can be determined to be a memory out-of-bounds fault. A memory out-of-bounds fault occurs when an application, after requesting memory, uses memory beyond the legally allocated range.

[0115] If the address accessed by the abnormal access is within the second protected area, it can also be determined that the abnormal access type is a memory out-of-bounds fault.

[0116] Once it is determined that the accessed address is a valid memory region in a freed state, the type of abnormal access can be identified as a use-after-free (UAF) vulnerability.

[0117] In some embodiments, for each region within a memory block, the region may also be marked as being in an allocated or freed state. If the value in the accessed memory region indicates a value in a freed state, then the type of abnormal access can be determined to be a duplicate free of memory.

[0118] The above examples of abnormal access type judgment are merely illustrative. Other abnormal access types can also be judged based on the different states of each zone and the combination of read / write protection types. This disclosure does not impose any restrictions on this.

[0119] After determining the call stack of the abnormal access based on the read / write protection type of the accessed area, the path of the abnormal access can be clearly identified, which is helpful in tracing the root cause of the abnormal access.

[0120] In some embodiments, after determining the target application and the type of abnormal access, the operating system is restarted, and the abnormal access is displayed after the restart.

[0121] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0122] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0123] Figure 4 This is a schematic structural diagram of a device provided in an exemplary embodiment. Please refer to... Figure 4 At the hardware level, the device includes a processor 702, an internal bus 404, a network interface 406, memory 408, and non-volatile memory 410, and may also include other hardware required for business operations. One or more embodiments of this specification can be implemented in software, such as the processor 402 reading the corresponding computer program from the non-volatile memory 410 into memory 408 and then running it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0124] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0125] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0126] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0127] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0129] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0130] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0131] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0132] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the scope of protection of one or more embodiments of this specification.

Claims

1. A memory detection method, characterized in that, The method is applied to a memory detection device, which is loaded into the kernel of the system to be detected. The method includes: Request a memory group from the system under test; Each memory block of the memory group is divided into multiple types of regions, and each type of region has different read and write protection settings; In response to receiving a memory request from an application, a memory block in the memory group is allocated to the application; In the event of abnormal access to the memory group, the target object causing the abnormal access is determined based on the accessed memory address; The method of dividing each memory block of the memory group into multiple types of regions includes: Multiple first protection regions are spaced apart in the memory block, wherein the first protection regions are inaccessible regions; A second protection region and an effective memory region are set between the two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

2. The method according to claim 1, characterized in that, The memory detection device is loaded into the kernel of the system to be detected as a loadable kernel module.

3. The method according to claim 1, characterized in that, The step of allocating memory blocks from the memory group to the application in response to receiving a memory request from the application includes: Hook operations are performed on the memory allocation interface in the kernel of the system under test; When the application calls the memory allocation interface, a custom function enables the application to allocate memory to the memory group.

4. The method according to any one of claims 1 to 3, characterized in that, The step of determining the target application and the type of abnormal access based on the location in the accessed memory group includes: Determine the memory block accessed by the abnormal access; The application to which the memory block is allocated is identified as the target application for abnormal access.

5. The method according to any one of claims 1 to 3, characterized in that, The step of determining the target application and the type of abnormal access based on the location in the accessed memory group includes: Determine the region accessed by the abnormal access; The type of abnormal access and the call stack are determined based on the read / write protection type of the accessed area.

6. A memory detection device, characterized in that, The device is loaded into the kernel of the system under test, and the device includes: A memory allocation module is used to request a memory group from the system under test. The memory protection module is used to divide each memory block of the memory group into multiple types of regions, each type of region having different read and write protection settings; A memory allocation module is used to allocate memory blocks in the memory group to the application in response to receiving a memory request from the application; An anomaly detection module is used to determine the target object causing the abnormal access based on the accessed memory address when the memory group is accessed abnormally. The method of dividing each memory block of the memory group into multiple types of regions includes: Multiple first protection regions are spaced apart in the memory block, wherein the first protection regions are inaccessible regions; A second protection region and an effective memory region are set between the two first protection regions, wherein the second protection region is filled with a set value, and the second protection region and the effective memory region are randomly arranged.

7. The apparatus according to claim 6, characterized in that, The anomaly detection module is specifically used for: Determine the memory block accessed by the abnormal access; The application to which the memory block is allocated is identified as the target application for abnormal access.

8. The apparatus according to claim 6, characterized in that, The anomaly detection module is specifically used for: Determine the region accessed by the abnormal access; The type of abnormal access and the call stack are determined based on the read / write protection type of the accessed area.

9. A computing device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1 to 5 by executing the executable instructions.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in any one of claims 1 to 5.

Images