A dynamic injection method and apparatus

Abstract

The application provides a dynamic injection method and device applied to the field of network security, wherein the dynamic injection method comprises the following steps: tracking a target process and reading register data of the target process; controlling the target process to enter a soft interrupt state according to the register data, and loading a dynamic library in the soft interrupt state; and executing an execution function in the loaded dynamic library by using an address-independent code (PIC) to achieve the purpose of dynamic injection. In the above scheme, after the dynamic library is loaded in the soft interrupt state, the execution function in the loaded dynamic library is executed by using the PIC according to the PIC calling mode under the MIPS architecture. Different from other architectures, the MIPS architecture cannot complete the execution of the execution function in the dynamic library by adjusting the register value only, and therefore, the above mode can realize the function of running the dynamic library under the dynamic injection in the MIPS architecture.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular, to a dynamic injection method and device. BACKGROUND

[0002] The dynamic injection technology is an important part of the data security technology, and has a wide application market in program hot patch, automatic test and the like. The dynamic injection technology generally completes the correlation analysis, function analysis and redirection between the host program and the target process by using the related data provided by the host program and the related information of the target process. In addition, the dynamic injection technology can also complete the process positioning, process analysis and process recovery by obtaining the related information of the target process. Therefore, by using the dynamic injection technology, the running process can be monitored in real time, so as to effectively control the security data.

[0003] In the prior art, the dynamic injection technology is generally implemented based on the following two methods: loading the LD_PRELOAD environment variable or Linux-Inject. For the domestic operating system, the above two methods are applicable to the Android system and the X86 architecture and the ARM (Advanced RISC Machine) architecture, but not applicable to the MIPS architecture (Microprocessor Without Interlocked Piped Stages Architecture). SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a dynamic injection method and device, so as to solve the technical problem that the dynamic injection method in the prior art is not applicable to the MIPS architecture.

[0005] In the first aspect, the embodiments of the present application provide a dynamic injection method, comprising: tracking a target process and reading register data of the target process; controlling the target process to enter a soft interrupt state according to the register data, and loading a dynamic library in the soft interrupt state; and executing an execution function in the loaded dynamic library by using the address-independent code (PIC), so as to achieve the purpose of dynamic injection. In the above scheme, after loading the dynamic library in the soft interrupt state, the address-independent code (PIC) calling mode under the MIPS architecture is referred to, and the execution function in the loaded dynamic library is executed by using the PIC. Different from other architectures, the MIPS architecture cannot complete the execution of the execution function in the dynamic library by adjusting the register value only, therefore, by using the above method, the function of running the dynamic library under the dynamic injection can be realized under the MIPS architecture.

[0006] In an optional implementation, the execution function in the loaded dynamic library is executed by using the PIC, including: jumping to a breakpoint address by using the PIC, wherein the breakpoint address corresponds to the address of the execution function; adjusting the register data according to the breakpoint address, and executing the execution function by using the adjusted register data. In the above scheme, the PIC can be used to jump to the breakpoint address, and the register data can be adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, by using the above method, the function of running the dynamic library under dynamic injection can be implemented under the MIPS architecture.

[0007] In an optional implementation, the adjusting the register data according to the breakpoint address includes: storing the size of the space occupied by the address of the execution function in a stack register; storing the address of the execution function in a temporary register; and storing the name of the execution function in an EPC register. In the above scheme, after jumping to the breakpoint address by using the PIC, the values of the stack register, the temporary register and the EPC register can be adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, by using the above method, the function of running the dynamic library under dynamic injection can be implemented under the MIPS architecture.

[0008] In an optional implementation, the controlling the target process to enter the soft interrupt state according to the register data includes: obtaining a free memory space of the target process; rewriting the value of a return value register as the address of the memory space; and controlling the target process to enter the soft interrupt state based on the address of the memory space by executing a breakpoint instruction. In the above scheme, the target process can be controlled to enter the soft interrupt state by using a method similar to the GDB breakpoint, that is, rewriting the value of the return value register as the address of the memory space, and controlling the target process to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction. Since the interrupt mechanism of the MIPS architecture is not applicable to process control, by using the above method, the target process can be controlled to enter the soft interrupt state under the MIPS architecture, and the function of running the dynamic library under dynamic injection can be further implemented.

[0009] In an optional implementation, the loading the dynamic library in the soft interrupt state includes: adjusting the register data in the soft interrupt state, and loading the dynamic library based on the adjusted register data. In the above scheme, after the target process enters the soft interrupt state, the loading of the dynamic library can be implemented by adjusting the register data.

[0010] In an optional implementation, the adjusting the register data in the soft interrupt state comprises: adjusting an EPC register value to a kernel function call address; adjusting a return value register value to a kernel symbol of a dlopen function; and adjusting a parameter register value to a dynamic library address loaded by the dlopen function. In the above scheme, the loading of the dynamic library can be implemented by adjusting the values of the EPC register, the return value register and the parameter register.

[0011] In a second aspect, the embodiments of the present application provide a dynamic injection apparatus, comprising: a reading module configured to track a target process and read register data of the target process; a control module configured to control the target process to enter a soft interrupt state according to the register data, and load a dynamic library in the soft interrupt state; and an execution module configured to execute an execution function in the loaded dynamic library by using a position independent code (PIC), so as to achieve a dynamic injection purpose. In the above scheme, after the dynamic library is loaded in the soft interrupt state, the execution function in the loaded dynamic library is executed by using the PIC according to a PIC calling mode under a MIPS architecture. Different from other architectures, the MIPS architecture cannot execute the execution function in the dynamic library only by adjusting register values. Therefore, the above scheme can be used to implement the function of running the dynamic library under the dynamic injection in the MIPS architecture.

[0012] In an optional implementation, the execution module is specifically configured to: jump to a breakpoint address by using the PIC; the breakpoint address corresponds to an address of the execution function; adjust the register data according to the breakpoint address, and execute the execution function by executing the adjusted register data. In the above scheme, the execution function in the loaded dynamic library can be executed by jumping to the breakpoint address by using the PIC, and adjusting the register data based on the breakpoint address. Therefore, the above scheme can be used to implement the function of running the dynamic library under the dynamic injection in the MIPS architecture.

[0013] In an optional implementation, the execution module is further configured to: store a space size occupied by the address of the execution function in a stack register; store the address of the execution function in a temporary register; and store a name of the execution function in an EPC register. In the above scheme, after jumping to the breakpoint address by using the PIC, the values of the stack register, the temporary register and the EPC register can be adjusted based on the breakpoint address, so as to execute the execution function in the loaded dynamic library. Therefore, the above scheme can be used to implement the function of running the dynamic library under the dynamic injection in the MIPS architecture.

[0014] In an optional implementation, the control module is specifically configured to: acquire a memory space idle for the target process; rewrite the value of the return value register as the address of the memory space; and control the target process to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction. In the above scheme, the target process can be caused to enter the soft interrupt state in a manner similar to the GDB breakpoint, that is, the value of the return value register is rewritten as the address of the memory space, and the target process is controlled to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction. Since the interrupt mechanism of the MIPS architecture is not applicable to process control, the target process can be caused to enter the soft interrupt state under the MIPS architecture by using the above manner, and the function of running the dynamic library dynamically injected is further implemented.

[0015] In an optional implementation, the control module is specifically configured to: adjust the register data in the soft interrupt state, and load the dynamic library based on the adjusted register data. In the above scheme, the loading of the dynamic library can be implemented by adjusting the register data after the target process enters the soft interrupt state.

[0016] In an optional implementation, the control module is further configured to: adjust the value of the EPC register to be the address of the kernel function call; adjust the value of the return value register to be the kernel symbol of the dlopen function; and adjust the value of the parameter register to be the address of the dynamic library loaded by the dlopen function. In the above scheme, the loading of the dynamic library can be implemented by adjusting the values of the EPC register, the return value register and the parameter register.

[0017] In a third aspect, an embodiment of the present application provides a computer program product, including computer program instructions, which, when read and executed by a processor, perform the dynamic injection method in the first aspect.

[0018] In a fourth aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory and a bus; the processor and the memory complete mutual communication through the bus; the memory stores computer program instructions executable by the processor, and the processor calling the computer program instructions can perform the dynamic injection method in the first aspect.

[0019] In a fifth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions, when executed by a computer, cause the computer to perform the dynamic injection method in the first aspect.

[0020] In order to make the above objectives, characteristics and advantages of the present application more apparent and easy to understand, the following will specifically describe embodiments of the present application with reference to the accompanying drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a dynamic injection method provided in this application embodiment;

[0023] Figure 2 A structural block diagram of a dynamic injection device provided in an embodiment of this application;

[0024] Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] Currently, dynamic injection technology under the Linux architecture is mainly implemented in two ways: one is by loading the LD_PRELOAD environment variable. Before loading all the dynamic libraries required by a program, the dynamic linker will first load the dynamic library specified by the LD_PRELAOD environment variable. Using this mechanism, methods in the dynamic library can be replaced, thereby changing the program's execution behavior; the other is by using linux-inject to inject code into the running process.

[0026] The first method described above requires a service restart due to the preloading mechanism, therefore it only works for dynamically linked programs and not for statically linked programs. Furthermore, this method needs to differentiate between different processes, as LD_PRELOAD is effective for the entire operating system. Any process starting up will preferentially access the LD_PRELOAD environment variable. Therefore, when writing a monitoring library, this distinction needs to be carefully considered; otherwise, it will affect the operation of other processes.

[0027] Using the second method described above, since the instruction set of the MIPS architecture is different from that of the x86 and ARM architectures, and the register call and search methods of the MIPS architecture are also different from those of the x86 and ARM architectures, this method is applicable to the x86 and ARM architectures, but not to the MIPS architecture.

[0028] Therefore, based on the problems existing in the prior art, this application provides a new dynamic injection method. The technical solutions in this application will be described below with reference to the accompanying drawings.

[0029] Reference is made to Figure 1 , Figure 1 A flow chart of a dynamic injection method provided by an embodiment of the present application can include the following steps:

[0030] Step S101: track a target process and read register data of the target process.

[0031] Step S102: control the target process to enter a soft interrupt state according to the register data, and load a dynamic library in the soft interrupt state.

[0032] Step S103: execute a function in the loaded dynamic library by using the address-independent code PIC to achieve the purpose of dynamic injection.

[0033] Specifically, in the above step S101, the target process is a process that needs to be dynamically injected. For the target process, the target process can be tracked and the register data of the target process can be read. The specific implementation of the register data is not limited in the embodiment of the present application, and the person skilled in the art can make appropriate selection according to the actual situation. For example, the register data can include the value of the stack register, the value of the temporary register, the value of the EPC register, etc.

[0034] As an implementation, the above step S101 can be implemented by using PTRACE. The tracking of the target process can be implemented by using the PTRACE_ATTACH instruction, wherein the tracked target process will become a child process of the current process and enter an abort state (i.e. a pause state); in addition, the reading of the register data of the target process can be implemented by using the PTRACE_GETREGSET instruction.

[0035] It can be understood that the above implementation of the above step S101 by using PTRACE is only an example provided by the embodiment of the present application, and the person skilled in the art can make appropriate adjustment in combination with the actual situation and the prior art.

[0036] In the above step S102, the target process can be controlled to enter a soft interrupt state according to the register data read in the above step S101, and a dynamic library can be loaded in the soft interrupt state. The specific implementation of controlling the target process to enter the soft interrupt state and loading the dynamic library in the soft interrupt state will be described in detail in the subsequent embodiments, which will not be introduced here.

[0037] In step S103, the PIC is used to generate position-independent code, which means that the code can be loaded anywhere to be executed. Generally, the PIC can read the table entries from the GOT table. In the embodiment, the execution function in the loaded dynamic library can be executed by using the PIC to achieve the purpose of dynamic injection.

[0038] In the above scheme, after loading the dynamic library in the soft interrupt state, the execution function in the loaded dynamic library is executed by using the PIC according to the PIC calling mode in the MIPS architecture. Different from other architectures, the MIPS architecture cannot complete the execution of the execution function in the dynamic library by adjusting the register values only. Therefore, the above method can be used to achieve the function of running the dynamic library in the dynamic injection mode in the MIPS architecture.

[0039] Further, based on the above embodiment, step S103 can specifically include the following steps:

[0040] Step 1), jump to the breakpoint address by using the PIC; wherein the breakpoint address corresponds to the address of the execution function.

[0041] Step 2), adjust the register data according to the breakpoint address, and execute the execution function by using the adjusted register data.

[0042] Specifically, by using the PIC function in the MIPS architecture, the breakpoint position can be jumped to, and the adjusted register data can be executed to run the function of the dynamic library.

[0043] The breakpoint position refers to the address of the target process when it enters the soft interrupt state, and corresponds to the address of the execution function. Therefore, based on the breakpoint position, the register data of the target process can be adjusted, so that the execution function can be executed by using the adjusted register data.

[0044] In the above scheme, the PIC can be used to jump to the breakpoint address, and the register data can be adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, by using the above method, the function of running the dynamic library in the dynamic injection mode can be achieved in the MIPS architecture.

[0045] Further, based on the above embodiment, as an implementation manner, the step of adjusting the register data according to the breakpoint address can specifically include the following steps:

[0046] Step 1), store the space size occupied by the address of the execution function in the stack register.

[0047] Step 2), store the address of the execution function in the temporary register.

[0048] Step 3), the name of the execution function is stored in the EPC register.

[0049] Specifically, after the PIC calling mode is used to execute to the breakpoint address, the values of the stack register, the temporary register and the EPC register can be adjusted. For the stack register, the space size occupied by the address of the execution function can be stored in the stack register; for the temporary register, the address of the execution function can be stored in the temporary register; and for the EPC register, the name (or the function symbol) of the execution function can be stored in the EPC register.

[0050] It can be understood that the above steps 1), 2) and 3) do not have a sequence of execution. As an embodiment, the above steps 1), 2) and 3) can be executed simultaneously; as another embodiment, the above steps 1), 2) and 3) can be executed sequentially. The embodiments of the present application do not make specific limitations on this, and those skilled in the art can make appropriate adjustments according to the actual situation.

[0051] In the above scheme, after the PIC is used to jump to the breakpoint address, the values of the stack register, the temporary register and the EPC register can be adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, by using the above method, the function of running the dynamic library under dynamic injection can be realized under the MIPS architecture.

[0052] Further, on the basis of the above embodiment, the step of controlling the target process to enter the soft interrupt state according to the register data in step S102 can specifically include the following steps:

[0053] Step 1), obtaining a piece of free memory space of the target process.

[0054] Step 2), rewriting the value of the return value register as the address of the memory space.

[0055] Step 3), controlling the target process to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction.

[0056] Specifically, in the embodiments of the present application, the process exception interrupt can be realized by using the GDB breakpoint-like method, so that the process enters the soft interrupt state. Wherein, a piece of free memory space of the target process can be obtained, and after the register data of the target process is read, the return value register is rewritten as the address of the memory space, so that the target process executes the breakpoint instruction set in advance to enter the soft interrupt state.

[0057] In the above scheme, the target process can be made to enter the soft interrupt state in a manner similar to the GDB breakpoint, that is, the value of the return value register is rewritten as the address of the memory space, and the target process is controlled to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction. Since the interrupt mechanism of the MIPS architecture is not applicable to process control, the above method can be used to control the target process to enter the soft interrupt state under the MIPS architecture, and further implement the function of running the dynamic library dynamically.

[0058] Further, based on the above embodiment, the step of loading the dynamic library in the soft interrupt state in step S102 can specifically include the following steps:

[0059] Adjusting the register data in the soft interrupt state, and loading the dynamic library based on the adjusted register data.

[0060] Specifically, the step of adjusting the register data in the soft interrupt state can further include the following steps:

[0061] Step 1), adjusting the EPC register value to the kernel function call address.

[0062] Step 2), adjusting the return value register value to the kernel symbol of the dlopen function.

[0063] Step 3), adjusting the parameter register value to the dynamic library address loaded by the dlopen function.

[0064] Wherein, after executing the target process, that is, triggering the breakpoint interrupt, the target process falls into the kernel mode, and then the EPC register value, the return value register value and the parameter register value of the MIPS architecture can be adjusted. For the EPC register value, it can be set to the kernel function call address; for the return value register value, it can be set to the kernel symbol syscall_number of the dlopen function; for the parameter register value, it can be set to the dynamic library address loaded by the dlopen function. Thus, the PTRACE execution running process can load the above dynamic library.

[0065] It can be understood that, similar to the above embodiment, there is no execution order between the above steps 1), 2) and 3). As an implementation, the above steps 1), 2) and 3) can be executed simultaneously; as another implementation, the above steps 1), 2) and 3) can be executed sequentially. The present embodiment does not specifically limit this, and those skilled in the art can make appropriate adjustments according to the actual situation.

[0066] In the above scheme, after the target process enters the soft interrupt state, the register data can be adjusted to load the dynamic library.

[0067] Further, on the basis of the above-mentioned embodiments, the dynamic injection method provided by the embodiments of the present application can realize monitoring the running state of a program process under a MIPS architecture of a domestic operating system, and can also realize real-time monitoring of the data leakage path of specified software in the working process. Therefore, the dynamic injection method provided by the embodiments of the present application fills the dynamic injection method under the MIPS architecture of the domestic operating system, meets the use of the hook mechanism in the process and the diversity of other hot patch use methods under the architecture, provides help and support for the expansion, compatibility and adaptation of the domestic operating system type of a cloud security terminal, and makes the product technology more widely used.

[0068] Please refer to Figure 2 , Figure 2 A structural block diagram of a dynamic injection device provided by the embodiments of the present application is shown in FIG. 2. The dynamic injection device 200 can include: a reading module 201 configured to track a target process and read register data of the target process; a control module 202 configured to control the target process to enter a soft interrupt state according to the register data, and load a dynamic library in the soft interrupt state; and an execution module 203 configured to execute an execution function in the loaded dynamic library by using a position independent code (PIC) to achieve the purpose of dynamic injection.

[0069] In the embodiments of the present application, after loading the dynamic library in the soft interrupt state, the execution function in the loaded dynamic library is executed by using the PIC according to the PIC calling mode under the MIPS architecture. Different from other architectures, the MIPS architecture cannot complete the execution of the execution function in the dynamic library by adjusting the register values only. Therefore, the above-mentioned method can realize the function of running the dynamic library under dynamic injection under the MIPS architecture.

[0070] Further, the execution module 203 is specifically configured to: jump to a breakpoint address by using the PIC; the breakpoint address corresponds to the address of the execution function; adjust the register data according to the breakpoint address, and execute the execution function by executing the adjusted register data.

[0071] In the embodiments of the present application, the PIC can be used to jump to the breakpoint address, and the register data is adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, the above-mentioned method can realize the function of running the dynamic library under dynamic injection under the MIPS architecture.

[0072] Further, the execution module 203 is further configured to: store the space size occupied by the address of the execution function in a stack register; store the address of the execution function in a temporary register; and store the name of the execution function in an EPC register.

[0073] In the embodiments of the present application, after the PIC is used to jump to the breakpoint address, the values of the stack register, the temporary register and the EPC register can be adjusted based on the breakpoint address to execute the execution function in the loaded dynamic library. Therefore, by using the above method, the function of running the dynamic library under dynamic injection can be realized under the MIPS architecture.

[0074] Further, the control module 202 is specifically configured to: obtain a piece of memory space which is idle for the target process; rewrite the value of the return value register as the address of the memory space; and control the target process to enter a soft interrupt state based on the address of the memory space by executing a breakpoint instruction.

[0075] In the embodiments of the present application, the target process can be made to enter the soft interrupt state by using the method similar to the GDB breakpoint, that is, the value of the return value register is rewritten as the address of the memory space, and the target process is controlled to enter the soft interrupt state based on the address of the memory space by executing the breakpoint instruction. Since the interrupt mechanism of the MIPS architecture is not applicable to process control, by using the above method, the target process can be controlled to enter the soft interrupt state under the MIPS architecture, and the function of running the dynamic library under dynamic injection can be further realized.

[0076] Further, the control module 202 is specifically configured to: adjust the register data in the soft interrupt state, and load the dynamic library based on the adjusted register data.

[0077] In the embodiments of the present application, after the target process enters the soft interrupt state, the loading of the dynamic library can be realized by adjusting the register data.

[0078] Further, the control module 202 is further configured to: adjust the value of the EPC register as the address of the kernel function call; adjust the value of the return value register as the kernel symbol of the dlopen function; and adjust the value of the parameter register as the dynamic library address loaded by the dlopen function.

[0079] In the embodiments of the present application, the loading of the dynamic library can be realized by adjusting the values of the EPC register, the return value register and the parameter register.

[0080] Please refer to Figure 3 , Figure 3A structural block diagram of an electronic device is provided in the embodiments of the present application, and the electronic device 300 includes at least one processor 301, at least one communication interface 302, at least one memory 303 and at least one communication bus 304. The communication bus 304 is used to realize direct connection communication among the components, the communication interface 302 is used to communicate signaling or data with other node devices, and the memory 303 stores machine readable instructions executable by the processor 301. When the electronic device 300 is running, the processor 301 communicates with the memory 303 through the communication bus 304, and the machine readable instructions are executed by the processor 301 when invoked.

[0081] For example, the processor 301 of the embodiments of the present application reads a computer program from the memory 303 through the communication bus 304 and executes the computer program to implement the following method: step S101: track a target process and read register data of the target process. Step S102: control the target process to enter a soft interrupt state according to the register data, and load a dynamic library in the soft interrupt state. Step S103: execute a function in the loaded dynamic library by using the address-independent code PIC to achieve the purpose of dynamic injection.

[0082] The processor 301 includes one or more, which can be an integrated circuit chip with signal processing capability. The processor 301 described above can be a general-purpose processor, including a central processing unit (CPU), a micro controller unit (MCU), a network processor (NP) or other conventional processors; or a special-purpose processor, including a neural network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. When the processor 301 is multiple, part of them can be general-purpose processors and the other part can be special-purpose processors.

[0083] The memory 303 includes one or more of a variety of memory units, such as, but not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0084] It can be understood that, Figure 3 The structure shown is merely schematic, and the electronic device 300 can further include more or fewer components than those shown in the figure, or have a different configuration from that shown in the figure. Figure 3 The components shown in the figure can be implemented in hardware, software, or a combination thereof. In the embodiments of the present application, the electronic device 300 can be, but is not limited to, a desktop computer, a notebook computer, a smart phone, a smart wearable device, a vehicle-mounted device, etc. physical device, but also a virtual machine and other virtual devices. In addition, the electronic device 300 is not necessarily a single device, but can also be a combination of multiple devices, such as a server cluster, etc. Figure 3 Figure 3 The components shown in the figure can be implemented in hardware, software, or a combination thereof. In the embodiments of the present application, the electronic device 300 can be, but is not limited to, a desktop computer, a notebook computer, a smart phone, a smart wearable device, a vehicle-mounted device, etc. physical device, but also a virtual machine and other virtual devices. In addition, the electronic device 300 is not necessarily a single device, but can also be a combination of multiple devices, such as a server cluster, etc.

[0085] The embodiments of the present application also provide a computer program product, comprising a computer program stored on a computer readable storage medium, the computer program comprising computer program instructions, when the computer program instructions are executed by a computer, the computer can execute the steps of the dynamic injection method in the above embodiments, for example, comprising: tracking a target process and reading register data of the target process; according to the register data, control the target process to enter a soft interrupt state, and load a dynamic library in the soft interrupt state; and execute a function in the loaded dynamic library by using the address-independent code PIC to achieve the purpose of dynamic injection.

[0086] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic, for example, the division of the units is only a logical functional division, and actual implementation can have another division manner, and for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some communication interface, device or unit, which can be electrical, mechanical or other forms.​

[0087] In addition, the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e., may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0088] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0089] It should be noted that if the function is realized in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, and various program code storage media.

[0090] In this paper, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations.

[0091] The above is only an embodiment of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A dynamic injection method, characterized in that, The method is applied to a MIPS architecture, and comprises: tracking a target process and reading register data of the target process; controlling the target process to enter a soft interrupt state according to the register data, and loading a dynamic library in the soft interrupt state; executing an execution function in the loaded dynamic library by using a position independent code (PIC) for the purpose of dynamic injection; the controlling the target process to enter the soft interrupt state according to the register data comprises: obtaining a piece of free memory space of the target process; rewriting a value of a return value register as an address of the memory space; controlling the target process to enter the soft interrupt state based on the address of the memory space by executing a breakpoint instruction.

2. The dynamic injection method of claim 1, wherein, the executing the execution function in the loaded dynamic library by using the PIC comprises: jumping to a breakpoint address by using the PIC, wherein the breakpoint address corresponds to an address of the execution function; adjusting the register data according to the breakpoint address, and executing the execution function by using the adjusted register data.

3. The dynamic injection method of claim 2, wherein, the adjusting the register data according to the breakpoint address comprises: storing a size of a space occupied by the address of the execution function in a stack register; storing the address of the execution function in a temporary register; and storing a name of the execution function in an EPC register.

4. The dynamic injection method of claim 1, wherein, the loading the dynamic library in the soft interrupt state comprises: adjusting the register data in the soft interrupt state, and loading the dynamic library based on the adjusted register data.

5. The dynamic injection method of claim 4, wherein, the adjusting the register data in the soft interrupt state comprises: adjusting a value of an EPC register as a kernel function call address; adjusting a value of the return value register as a kernel symbol of a dlopen function; and adjusting a value of a parameter register as a dynamic library address loaded by the dlopen function.

6. A dynamic injection device characterized by, The apparatus is used for dynamic injection in a MIPS architecture, and comprises: a reading module configured to track a target process and read register data of the target process; a control module configured to control the target process to enter a soft interrupt state according to the register data, and load a dynamic library in the soft interrupt state; the controlling the target process to enter the soft interrupt state according to the register data comprises: obtaining a piece of free memory space of the target process; rewriting a value of a return value register as an address of the memory space; controlling the target process to enter the soft interrupt state based on the address of the memory space by executing a breakpoint instruction. an execution module configured to execute an execution function in the loaded dynamic library by using a position independent code (PIC) for the purpose of dynamic injection.

7. A computer program product, characterised in that, computer program instructions, which are read and run by a processor, perform the method in any one of claims 1-5.

8. An electronic device, comprising: comprise: a processor, a memory and a bus; the processor and the memory complete communication with each other through the bus; the memory stores computer program instructions executable by the processor, and the processor calling the computer program instructions can perform the method in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, which, when executed by a computer, cause the computer to perform the method of any one of claims 1-5.

Images