Program protection method, detector, electronic device, and storage medium

Abstract

The application provides a program protection method, a detector, an electronic device and a computer readable storage medium; the method comprises the following steps: loading a plurality of instructions to be executed of a program from a memory, identifying non-branch instructions and branch instructions from the plurality of instructions, and acquiring an address carried by the branch instructions; reading an address recorded in advance for the branch instructions from an index table in the detector, and comparing the address with the address carried by the branch instructions; taking the non-branch instructions and the branch instructions consistent with the comparison as legal instructions, and storing the legal instructions into a waiting chain table in the detector; connecting the legal instructions in the waiting chain table according to corresponding execution sequences, and sending the legal instructions to a processor for execution. Through the application, code attacks on the program can be effectively prevented on the basis of reducing the implementation cost.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method for protecting a program, a detector, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Electronic devices may be vulnerable to code reuse attacks during program execution. Code reuse attacks achieve malicious purposes by hijacking the control flow of program execution, posing a significant threat to the security of electronic devices.

[0003] Related technologies can be broadly categorized into hardware-based and software-based defense technologies. However, both types can only defend against a limited number of code reuse attacks and have their own limitations. For example, software-based defense methods require modifications to the program compiler, resulting in high performance overhead and high deployment costs on actual electronic devices. Hardware-based defense methods often require extensions to the instruction set architecture and compiler modifications, increasing implementation complexity and stability. Therefore, the relevant technical solutions for defending against code reuse attacks are costly to implement and have relatively low efficiency and stability. Summary of the Invention

[0004] This application provides a method, detector, electronic device, and computer-readable storage medium for protecting a program, which can effectively protect against various code attacks during program execution while reducing implementation costs.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a method for protecting a program. The method is applied to a detector, which is electrically connected to both memory and a processor. The method includes:

[0007] Load multiple instructions to be executed from the memory, identify non-branch instructions and branch instructions from the multiple instructions, and obtain the address carried by the branch instructions;

[0008] The address pre-recorded for the branch instruction is read from the index table in the detector and compared with the address carried by the branch instruction;

[0009] The non-branch instructions and the branch instructions that match the comparison are taken as valid instructions, and the valid instructions are stored in the waiting list in the detector;

[0010] The valid instructions in the waiting list are linked together in the corresponding execution order and sent to the processor for execution.

[0011] This application embodiment provides a detector, which is electrically connected to both a memory and a processor; the detector includes:

[0012] The index table module is used to load multiple instructions to be executed from memory, identify non-branch instructions and branch instructions from the multiple instructions, and obtain the address carried by the branch instructions; read the address pre-recorded for the branch instructions from the index table in the detector, and compare it with the address carried by the branch instructions; and store the non-branch instructions and the branch instructions that match the comparison as valid instructions in the waiting list in the detector.

[0013] The wait list module is used to connect the valid instructions in the wait list according to their corresponding execution order and send them to the processor for execution.

[0014] This application provides an electronic device, including:

[0015] Processor, memory, and detectors; among which,

[0016] The detector is electrically connected to both the memory and the processor, and is used to implement the program protection method provided in this application embodiment.

[0017] This application provides a computer-readable storage medium storing executable instructions, which, when executed, implement the program protection method provided in this application.

[0018] The embodiments of this application have the following beneficial effects:

[0019] The detector checks the legitimacy of branch instructions through its own index table, thereby efficiently preventing the execution of various illegal instructions, such as code reuse attacks, without modifying the compiler and instruction set of the electronic device. By storing legal instructions in the detector's wait list and connecting them in the order of execution, it can provide buffer time, reduce the risk of program execution errors, and improve the stability of program execution. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the architecture of an electronic device provided in an embodiment of this application;

[0021] Figure 2 This is yet another architectural schematic diagram of the electronic device provided in the embodiments of this application;

[0022] Figure 3 This is a flowchart illustrating a method for protecting a program provided in an embodiment of this application;

[0023] Figures 4A-4B This is a schematic diagram of the index table style provided in the embodiments of this application;

[0024] Figure 5 This is a flowchart illustrating a branch instruction address comparison method provided in an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of the structure of the waiting list provided in an embodiment of this application;

[0026] Figure 7 This is a schematic diagram illustrating the state changes of each chain in the waiting linked list for storage instructions, provided in an embodiment of this application.

[0027] Figure 8 This is a flowchart illustrating the method for creating an index table provided in an embodiment of this application;

[0028] Figure 9 This is a schematic diagram of a process for writing branch instructions into an index table according to an embodiment of this application;

[0029] Figure 10 This is a flowchart illustrating a group capacity setting method provided in an embodiment of this application;

[0030] Figure 11 This is a schematic diagram of group number setting provided in an embodiment of this application;

[0031] Figure 12 This is a flowchart illustrating a method for protecting a program provided in an embodiment of this application;

[0032] Figure 13 This is a schematic diagram of the detector architecture provided in an embodiment of this application;

[0033] Figure 14 This is a schematic diagram of a waiting list provided in an embodiment of this application;

[0034] Figure 15 This is a schematic diagram of the code reuse attack detection experimental device provided in the embodiments of this application;

[0035] Figure 16 This is a schematic diagram showing the time overhead of the detector provided in the embodiments of this application. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0037] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0038] If the application documents contain similar descriptions such as "first / second", the following explanation shall be added: In the following description, the terms "first / second / third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0040] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0041] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0042] 1) Code Reuse Attack (CRA): This technique utilizes existing code snippets of a program, reorders them into chains with specific functions, and then uses them to attack malicious targets.

[0043] 2) Control-flow Integrity (CFI): By restricting control transfers during program execution, the execution of program instructions is always kept within the scope defined by the control flow graph of the original program design.

[0044] 3) Instruction Set Architecture (ISA): Also known as the instruction set or instruction set system, it is the part of computer architecture related to programming, including basic data types, instruction sets, registers, addressing modes, memory system, interrupts, exception handling, and external input / output (I / O). The instruction set architecture includes a series of opcodes and basic commands executed by a specific processor.

[0045] 4) Instruction: An instruction is a command that directs the computer to perform a certain operation. Instructions are stored in memory in binary code form; that is, an instruction is a fixed-length sequence of 0s and 1s. An instruction typically consists of two parts: the opcode and the address code. The opcode indicates the type or nature of the operation to be performed, such as fetching data, performing addition, or outputting data. The address code indicates the content of the operand or the address of its storage location (e.g., memory).

[0046] Furthermore, the program execution is completed through the sequential execution of instructions. The instruction execution process is explained as follows: First, instructions are fetched and analyzed. Following the order specified in the program, the currently executing instruction is fetched from memory and sent to the processor's instruction register. The fetched instruction is then analyzed, that is, the operation to be performed is determined based on the opcode in the instruction. Next, the instruction is executed. Based on the instruction analysis results, the processor issues a series of control voltages required to complete the operation, instructing the relevant components of the electronic device to complete this operation. Simultaneously, it prepares for fetching the next instruction.

[0047] 5) Field-Programmable Gate Array (FPGA): A semi-custom circuit within application-specific integrated circuits (ASICs), it is a programmable logic array that effectively addresses the issue of limited gate counts in traditional devices. The basic structure of an FPGA includes programmable input / output units, configurable logic blocks, a digital clock management module, embedded random access memory (RAM), routing resources, embedded dedicated hard cores, and low-level embedded functional units.

[0048] Related technologies employ both software-assisted and hardware-assisted methods to protect programs. Software-assisted program protection methods require modification of the program's source code to prevent code reuse attacks; therefore, this approach typically incurs high performance overhead and high deployment costs. While hardware-assisted program protection methods can effectively reduce performance overhead, they still require extensions to the instruction set architecture and compiler modifications, resulting in poor stability. Furthermore, most related program protection methods (or code reuse attack defense methods) share a common problem: they can only defend against specific types of code reuse attacks.

[0049] Based on this, embodiments of this application provide a program protection method, a detector, an electronic device, and a computer-readable storage medium, which can monitor branch instructions in real time through an index table in the detector, ensuring that the processor of the electronic device can only execute legal instructions, thereby preventing the execution of various types of attack instructions and effectively protecting the program from attacks.

[0050] First, the electronic device provided in the embodiments of this application will be described, see [link to relevant documentation]. Figure 1 , Figure 1 This is a schematic diagram of the architecture of an electronic device provided in an embodiment of this application. The electronic device 100 includes a memory 200, a detector 300, and a processor 400. The detector 300 is connected to the memory 200 and the processor 400 by electrical connection.

[0051] In some embodiments, the processor can be a variety of general-purpose processors such as a central processing unit (CPU) or a microprocessor (MCU); the memory can be a variety of random access memory (RAM), such as DRAM or SRAM; the detector can be implemented using a dedicated processor, such as an ASIC, DSP, a programmable logic device (PLD), a complex programmable logic device (CPLD), or an FPGA.

[0052] In some embodiments, the detector may use various read-only memories (ROMs), RAMs, or a combination of both to store necessary data such as double wait links (DWLs) and index tables. The ROM or RAM may be integrated into the detector or may be a memory independent of the detector but integrated on the same system-on-a-chip (SoC), such as flash memory. Using ROM to store the index table allows for power-free storage.

[0053] In some embodiments, the electronic device may be a terminal device or a server. The terminal device may be a laptop, tablet, desktop computer, smartphone, dedicated messaging device, portable gaming device, smart speaker, smartwatch, etc., but is not limited to these. The server may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0054] Memory 200 is used to receive load instruction requests sent from processor 400 and to store multiple instructions to be executed by the program.

[0055] Detector 300 is used to load multiple instructions to be executed from memory 200, identify non-branch instructions and branch instructions from the multiple instructions, and obtain the address carried by the branch instructions; read the address pre-recorded for the branch instructions from the detector's index table and compare it with the address carried by the branch instructions; treat non-branch instructions and branch instructions that match the comparison as legal instructions, store the legal instructions in the waiting list in the detector; connect the legal instructions in the waiting list according to the corresponding execution order and send them to processor 400 for execution.

[0056] The processor 400 is used to receive legitimate instructions sent by the detector 300 through the waiting list, and to execute the legitimate instructions obtained from the detector in the normal program execution order.

[0057] The detector 300 is also used to interrupt program execution and send an interrupt request to the processor 400 when it detects an illegal instruction among the multiple instructions to be executed of the program loaded from memory 200.

[0058] Taking an electronic device as an example of a terminal device, the electronic device provided in the embodiments of this application will continue to be described. See [link to relevant documentation]. Figure 2 ,based on Figure 1 , Figure 2 This is another schematic diagram of the architecture of the electronic device provided in the embodiments of this application. Figure 1 Based on the illustrated electronic device 100, it may further include: at least one processor 400, memory 200, detector 300, at least one network interface 500, and user interface 600. The various components in the electronic device 100 are coupled together via a bus system 700. It is understood that the bus system 700 is used to implement communication between these components. In addition to a data bus, the bus system 700 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 2 The general labeled all buses as Bus System 700.

[0059] Processor 400 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0060] User interface 600 includes one or more output devices 601 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 600 also includes one or more input devices 602, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0061] Memory 200 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. Memory 200 may optionally include one or more storage devices physically located away from processor 400.

[0062] Memory 200 may include volatile memory or non-volatile memory, or both. Non-volatile memory may be read-only memory (ROM), and volatile memory may be random access memory (RAM). The memory 200 described in this application embodiment is intended to include any suitable type of memory.

[0063] In some embodiments, memory 200 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0064] Operating system 201 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0065] The network communication module 202 is used to reach other computing devices via one or more (wired or wireless) network interfaces 500, such as Bluetooth, WiFi, and Universal Serial Bus (USB).

[0066] Presentation module 203 enables the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 601 associated with user interface 600 (e.g., a display screen, a speaker, etc.).

[0067] The input processing module 204 is used to detect and translate one or more user inputs or interactions from one or more input devices 602.

[0068] The detector 300 may be removable. In some embodiments, the detector can perform legality checks on branch instructions and also store data. It includes the following modules: an index table module 301 and a wait list module 302. These modules can be logically divided into different logical function modules or different hardware function modules divided at the hardware level, and therefore can be arbitrarily combined or further split according to the implemented functions. The functions of each module will be described below.

[0069] The following describes the program protection method provided in the embodiments of this application. In some embodiments, the program protection method provided in the embodiments of this application is implemented by a detector in an electronic device. See also Figure 3 , Figure 3 This is a flowchart illustrating a method for protecting a program provided in an embodiment of this application, combined with... Figure 3 The steps shown are explained.

[0070] In step 101, the detector loads multiple instructions to be executed from memory, identifies non-branch instructions and branch instructions from the multiple instructions, and obtains the address carried by the branch instructions.

[0071] For example, branch instructions can change the execution flow of a program or call subroutines. Branch instructions allow a program to use subroutines, if-then-else structures, and loops. The change in execution flow forces the processor's program counter to point to a new address. Common types of branch instructions include jumps, calls, and returns.

[0072] In practice, before a program is executed by the processor, it is compiled into an executable file, which includes a collection of instructions and data. When the program starts, the processor loads the instructions from the executable file into memory. Then, the detector loads the program's multiple instructions to be executed from memory, identifies branch instructions and non-branch instructions, and continues to perform subsequent detection operations based on the address information carried by the branch instructions. Instructions that pass the detection are sent to the processor as valid instructions for execution, for example, by sending them to the processor cache, where the processor reads and executes them.

[0073] The pattern of instructions loaded from memory by the detector is described. Based on the program protection method provided in this application, the pattern of instructions loaded from memory by the detector is related to the pattern of the index table in the detector. In some embodiments, when the index table in the detector does not include group numbers, the instructions loaded from memory are the initial instructions after program compilation. In some embodiments, when the index table includes group numbers, the multiple instructions to be executed in the program loaded from memory by the detector are no longer the initial instructions after program compilation, but rather the updated instructions by the detector. All branch instructions in the instructions carry group numbers, which are added during the index table creation stage. The specific process of creating the index table will be described in detail in subsequent steps.

[0074] In step 102, the address pre-recorded for the branch instruction is read from the index table in the detector and compared with the address carried by the branch instruction.

[0075] For example, the index table in the detector is pre-generated, and the index table stores the addresses pre-recorded for branch instructions. The index table also records the addresses included in the branch instructions, where the address types include storage addresses and target addresses.

[0076] The index table, also known as the Branch Instruction Index (BID), is a two-dimensional index table. Figures 4A-4B This is a schematic diagram of the index table style provided in an embodiment of this application. See also... Figure 4A The index table consists of multiple rows, each containing the target address of a branch instruction and at least one current address, also known as the current address. The first column of the index table stores the target address corresponding to the branch instruction, which can be denoted as ADDR. Ti Where i is the index of the row containing the target address, and when i is 1, ADDR Ti Specifically, ADDR T1 This represents the target address of line 1. The other columns of each target address's row are used to store the memory address corresponding to the branch instruction, which can be denoted as ADDR. Ti-Cj Where j is an integer, and when j is 1, ADDR Ti-Cj Specifically, ADDR T1-C1 , which represents the first memory address corresponding to the target address in the first line.

[0077] In some embodiments, see Figure 4B The style of the index table shown is similar to... Figure 4AThe difference between the index table in the original and the current one is that the index table is divided into multiple groups, each containing multiple rows. When the detector checks a branch instruction carrying a group number, it uses that group number as an index to search for the group containing the branch instruction in the index table. This method of searching the index table by group number effectively reduces the time overhead during the inspection process.

[0078] For example, Figure 4B In this model, the detector's index table is divided into n groups (n is an integer greater than or equal to 1), each group containing i rows (i is an integer greater than or equal to 1). i is also called the group capacity. The first group contains rows 1 to i, the second group contains rows i+1 to 2i, and so on, with the nth group containing rows n*i+1 to (n+1)*i. The method for setting the group capacity i will be explained in detail below.

[0079] In some embodiments, based on Figure 4A The illustrated index table format explains the address comparison method. The detector obtains the target address carried by the branch instruction as an index and compares it with the target addresses included in each row of the index table, that is, with the target address in the first column of each row. If a match is found, the row containing the target address is obtained, and then the comparison continues with the memory address carried by the branch instruction and the memory address in the row containing the target address. For example, the address type includes memory address and target address. The index table includes multiple rows, each row including the target address pre-recorded for a branch instruction in the program and at least one memory address; using the target address carried by the branch instruction as an index, it is compared with the target addresses included in each row of the index table, and the row containing the target address of the branch instruction is taken as the target row; the memory address carried by the branch instruction is compared with each memory address in the target row.

[0080] In other embodiments, based on Figure 4B The illustrated index table format explains the address comparison method. In this case, the detector's index table is divided into multiple groups, each containing multiple rows (the number of rows equals the group capacity), and each group has a corresponding group number. When the detector detects a branch instruction loaded from memory that carries a group number, it uses the group number carried by the branch instruction as an index to find the group containing the branch instruction in the index table, and then finds the row containing the branch instruction based on the target address carried by the branch instruction.

[0081] For example, see Figure 5 , Figure 5 This is a flowchart illustrating a branch instruction address comparison method provided in an embodiment of this application, combined with... Figure 5 The steps shown are explained.

[0082] Step 1021: The detector obtains the group number carried by the branch instruction.

[0083] For example, the group number carried by a branch instruction is generally located in the instruction header (the header position), and the length of the group number is related to the instruction set architecture of the current electronic device. Specific details regarding the group number will be provided during the index table creation phase.

[0084] Step 1022: The detector determines the group corresponding to the group number from the detector's index table based on the group number, and takes the group corresponding to the group number as the target group.

[0085] For example, the group number can be used as an index and compared with the group numbers in the index table. If they match, the group corresponding to the group number is determined.

[0086] Step 1023: The detector reads the target address pre-recorded for the branch instruction from the target group and compares it with the target address carried by the branch instruction. The line in the target group where the target address carried by the branch instruction is located is taken as the target line.

[0087] For example, based on the target group determined in step 1022, the target line is determined by searching the rows in the target group using the target address of the branch instruction as the index.

[0088] Step 1024: The detector compares the memory address carried by the branch instruction with at least one memory address in the target line.

[0089] For example, the memory address carried by the branch instruction is compared with the memory addresses in all columns of the target row except the first column, and the validity of the branch instruction is determined based on the comparison result. When the comparison result matches, it means that the relevant address information of the currently detected branch instruction exists in the index table, and the detector determines that the current branch instruction is a valid instruction.

[0090] Repeat steps 1021 to 1024 until all branch instructions carrying group numbers have been detected. During the loop execution, if any branch instruction carrying a group number is detected as an illegal instruction, the execution process immediately terminates.

[0091] It should be noted that the detector uses the group number carried by the branch instruction as an index. Figure 4B Searching in the index table shown can effectively reduce the time overhead during the inspection process and improve the efficiency of branch instruction detection.

[0092] The following explains how group-number-based lookup reduces the time overhead of the inspection process from a time complexity perspective. The inspector's inspection of branch instructions can be viewed as two lookups: the first lookup finds the target address of the branch instruction in the index table, and the second lookup finds the current address of the branch instruction. Adding group numbers optimizes the first lookup. Assuming there are N target addresses in the index table, directly searching for the branch instruction's target address requires N searches, averaging N / 2 searches, resulting in a complexity of O(N). Using a grouping approach, the N target addresses are divided into u (number of groups) * v (number of items in each group) = N, where u and v are integers greater than or equal to 1. This reduces the average search time to (u + v) / 2 searches, resulting in a complexity of O(N). Therefore, dividing the detector's index table into multiple groups and obtaining branch instructions carrying group numbers through the detector's index table, and then using the group number carried by the branch instructions as an index to search in the index table, can effectively reduce the time overhead during the inspection process.

[0093] In some embodiments, the address carried by the branch instruction in the program is compared using the address comparison process in step 102 to obtain the comparison result. When the comparison result is inconsistent, that is, when the detector does not find an address matching the current branch instruction in the address pre-recorded for the branch instruction in the index table, the current branch instruction is determined to be an illegal instruction (or an attack instruction). For example, inconsistencies include two situations: one is that the target address is inconsistent; the other is that the target address is consistent, but the storage address is inconsistent. It should be noted that once the detector detects an illegal instruction, it will directly interrupt the execution of the program for the sake of electronic device security. For example, when the comparison is inconsistent, the inconsistent branch instruction is determined to be an illegal instruction, and the execution of the program is interrupted.

[0094] It should be noted that attack instructions are generated by reordering and recompiling existing code segments of the currently executing program. These instructions have specific functions and can maliciously attack electronic devices. The regenerated instructions overwrite legitimate instructions. Once the processor executes these attack instructions, the program execution flow will be redirected to the address desired by the attacker, posing a significant threat to the security of electronic devices. The index table provided in this application detects branch instructions through comparison. Only when the branch instruction to be detected has pre-recorded information in the index table is it considered a legitimate instruction. Consequently, attack instructions cannot find corresponding pre-recorded information in the index table and will inevitably differ from the information in the index table; therefore, attack instructions cannot pass the index table's verification. Thus, various attacks can be detected through the detector's index table.

[0095] In step 103, non-branch instructions and matching branch instructions are treated as valid instructions, and the valid instructions are stored in the waiting list in the detector.

[0096] For example, valid instructions include non-branch instructions in the program's executable instructions, as well as branch instructions that have passed the detection in step 102.

[0097] First, the structure of the waiting list is explained. The waiting list consists of at least one chain, and each chain contains at least one block. Each block stores a one-to-one correspondence of multiple valid instructions with consecutive sequence numbers. See also... Figure 6 , Figure 6 This is a schematic diagram of a waiting list provided in an embodiment of this application. In some embodiments, the waiting list can be a two-dimensional doubly linked list matrix composed of multiple doubly linked lists (or simply chains). The waiting list includes p (p is an integer greater than or equal to 1) chains, each chain has q blocks (i.e., the chain capacity is q, where q is an integer greater than or equal to 1), and each block in each chain is used to store one valid instruction. These chains work independently of each other to help reduce time overhead.

[0098] To handle different instruction loading methods (such as parallel loading and serial loading), the detector performs different preprocessing steps on valid instructions when storing them in the wait list. In some embodiments, when the hardware configuration of the electronic device can support parallel instruction loading, in order to reduce the time overhead of detecting branch instructions, in step 101, the detector can load instructions from memory into its own memory for detection using a parallel loading method. Since detecting branch instructions is a relatively time-consuming process, non-branch instructions that were originally scheduled to execute later may be stored in the detector's wait list earlier than branch instructions that were originally scheduled to execute earlier, disrupting the normal execution order of the program. To ensure the normal execution order of the program control flow, the detector performs preprocessing operations on valid instructions. The main preprocessing operations include adding sequence numbers to valid instructions, where the sequence number is used to represent the execution order of valid instructions in the program. For example, adding sequence numbers to valid instructions to represent their execution order in the program; and storing valid instructions in the detector's wait list according to their corresponding sequence numbers.

[0099] In practice, when the detector loads program instructions in parallel, it adds a sequence number to each instruction (without distinguishing between branch and non-branch instructions). The length of the sequence number is related to the instruction set architecture of the operating system running the electronic device and the actual situation.

[0100] For example, the current instruction set architecture of x86-64 (a 64-bit operating system) uses only 48 bits (48 bits out of 64 bits) for data storage, leaving 16 bits available for the header. When the instruction header does not include other information, the maximum length of the sequence number cannot exceed 16 bits; when the instruction header includes other information, the length of all information in the instruction header must not exceed 16 bits.

[0101] In other embodiments, when the hardware configuration of the electronic device cannot meet the requirements of parallel loading of instructions, the detector will use a serial loading method to load instructions from memory into the detector's memory for detection. The loading order of instructions is consistent with the actual execution order. In this case, it is not necessary to add a sequence number when storing the legitimate instructions in the detector's waiting list.

[0102] Continuing with the explanation of scenarios where instruction loading is performed in parallel, this involves preprocessing legitimate instructions based on a waiting list (i.e., adding sequence numbers to legitimate instructions). In some embodiments, when the branch instruction loaded by the detector from memory carries a group number, the group number is used to characterize the order of the group containing the branch instruction among the multiple groups included in the index table. It should be noted that the form of the index table in this case is as follows: Figure 4B The index table is divided into multiple groups. When a valid instruction is a branch instruction carrying a group number, the detector removes the group number carried by the branch instruction and adds a corresponding sequence number to the branch instruction to ensure that the total instruction length does not exceed the standard length specified in the operating system's instruction set architecture when storing the branch instruction in the wait list. When a valid instruction is a non-branch instruction without a group number, the detector directly adds a sequence number to the valid instruction. For example, when a valid instruction is a branch instruction loaded into memory, the detector removes the group number carried by the valid instruction and adds a sequence number to the valid instruction to represent the execution order of the branch instruction in the program; when a valid instruction is a non-branch instruction loaded into memory, the detector adds a sequence number to the non-branch instruction to represent the execution order of the non-branch instruction in the program.

[0103] It should be noted that if the instruction set architecture of the current electronic device's operating system specifies a standard length that can store both the group number and the sequence number, the detector can store a valid instruction in the wait list without performing a group number deletion operation. The deletion operation will only occur when the detector sends the valid instruction stored in the wait list to the CPU, at which point the detector will carry the group number and sequence number with the branch instruction. This reduces computational load and improves efficiency.

[0104] The specific implementation of the detector storing legitimate instructions in the waiting list is described below. In some embodiments, when all chains in the waiting list are empty, the detector writes legitimate instructions sequentially according to the chain order. In other cases, the detector first selects chains whose capacity has not reached a preset chain capacity from the chains in the waiting list as candidate chains. Then, based on the relationship between the sequence number carried by the current legitimate instruction and the sequence numbers carried by the legitimate instructions stored in the candidate chains, the detector selects the corresponding block from the appropriate chain. For example, for each legitimate instruction to be stored in the waiting list as a first legitimate instruction, the detector performs the following processing: selects a chain in the waiting list that has not reached the preset chain capacity as a candidate chain; for any block of any candidate chain storing a second legitimate instruction, if the first sequence number of the first legitimate instruction and the second sequence number of the second legitimate instruction are consecutive, the first legitimate instruction is stored in a block adjacent to the first block, where the second legitimate instruction is any legitimate instruction stored in any block.

[0105] For example, see Figure 6 The waiting list shown assumes a chain capacity of q = 20. Chain 1 currently stores 17 instructions, and chain 2 stores 1 instruction. Both chains are not full (i.e., the preset chain capacity has not been reached). When the detector needs to store the valid instruction with sequence number 3 into the waiting list, the process is as follows: Obtain chains in the waiting list whose chain capacity has not reached 20, such as chain 1 and chain 2. Use chain 1 and chain 2 as candidate chains. Obtain the sequence number of the valid instruction stored in each block of chain 1 and chain 2 as the second sequence number. Compare these second sequence numbers with the first sequence number (sequence number 3) carried by the instruction to be stored. The comparison result shows that there are second sequence numbers (sequence number 2 and sequence number 4) in chain 1 that are consecutive to sequence number 3. At this time, the detector can directly store the valid instruction with sequence number 3 into the adjacent block of the block containing the valid instruction with sequence number 2.

[0106] The method for determining the target block of a valid instruction to be stored is described. In some embodiments, when there is no sequence number in the selected target chain that is consecutive to the sequence number carried by the valid instruction to be stored, the block corresponding to the valid instruction to be stored is determined based on the sequence number of the current instruction to be stored. For example, for each valid instruction to be stored in the waiting list of the detector as a first valid instruction, the following processing is performed: a chain that has not reached the preset chain capacity is selected from the waiting list of the detector as a candidate chain; for any block of any candidate chain storing a second valid instruction, when the second sequence number of the second valid instruction is not consecutive to the first sequence number, the sequence number interval of each candidate chain is determined; the sequence number interval where the first sequence number of the first valid instruction is located is taken as the target sequence number interval; the candidate chain corresponding to the target sequence number interval is taken as the target chain; a third valid instruction and a fourth valid instruction are determined in the target chain, wherein the first sequence number of the first valid instruction is between the third sequence number of the third valid instruction and the fourth sequence number of the fourth valid instruction, and the block in the target chain used to store the third valid instruction and the block used to store the fourth valid instruction are empty blocks.

[0107] In actual implementation, see Figure 6 The waiting list consists of p chains, each with q blocks. The sequence number interval for each chain can be determined; for example, chain 1's interval is [1, q], chain 2's is [q+1, 2q], chain 3's is [2q+1, 3q], and so on. Based on the sequence number intervals of each chain, the sequence number interval corresponding to the sequence number carried by the current valid instruction in the waiting list is determined, thus determining the target chain where the current valid instruction should be stored. From the target chain, the valid instruction whose sequence number stored in each block is less than the sequence number carried by the valid instruction to be stored, with the smallest sequence number difference, and the valid instruction whose sequence number stored in each block is greater than the sequence number carried by the valid instruction to be stored, with the smallest sequence number difference, are selected.

[0108] For example, suppose the waiting list includes 3 chains, each containing 6 blocks. The sequence number range for chain 1 is [1, 6], for chain 2 it's [7, 12], and for chain 3 it's [13, 18]. The sequence number of the currently stored valid instruction is 10. Therefore, the corresponding sequence number range for the valid instruction is [7, 12], and chain 2 is determined as the target chain for storing the valid instruction. The valid instructions already stored in each block of chain 2 correspond to sequence numbers 7, 11, and 12. The valid instruction corresponding to sequence number 11 (greater than 10) and the valid instruction corresponding to sequence number 7 (less than 10) in chain 2 are obtained. The block storing the valid instruction with sequence number 7 and the block storing the valid instruction with sequence number 12 are empty blocks. The target block for the valid instruction is determined based on the storage status of each block in chain 2.

[0109] Continuing with the explanation of how the detector determines the target block of the instruction to be stored in the waiting list when the sequence numbers of the legal instructions stored in each block of the target chain are not consecutive with the sequence numbers carried by the legal instructions to be stored, in some embodiments, the sequence number of the instruction to be stored is first determined as the first sequence number, and the third and fourth legal instructions are determined in the target chain. The first sequence number is between the third sequence number of the third legal instruction and the fourth sequence number of the fourth legal instruction. Then, the difference e (e is an integer greater than or equal to 1) between the first and third sequence numbers, and the difference f (f is an integer greater than or equal to 1) between the first and fourth sequence numbers are obtained. The two differences e and f are compared. When e is less than f, it indicates that the third sequence number of the third legal instruction is closer to the first sequence number, meaning the target block is an empty block adjacent to the block storing the third instruction. When e is greater than f, it indicates that the fourth sequence number of the fourth legal instruction is closer to the first sequence number, meaning the target block is an empty block adjacent to the block storing the fourth instruction. For example, a first difference between the first sequence number and the third sequence number, and a second difference between the first sequence number and the fourth sequence number are determined; when the first difference is less than the second difference, the first valid instruction is stored in the first empty block, wherein the first empty block is located between the block used to store the third valid instruction and the block used to store the fourth valid instruction, and is adjacent to the block used to store the third valid instruction; when the first difference is greater than the second difference, the first valid instruction is stored in the second empty block, wherein the second empty block is located between the block used to store the third valid instruction and the block used to store the fourth valid instruction, and is adjacent to the block used to store the fourth valid instruction.

[0110] For example, see Figure 6 The waiting list shown is assumed to have 3 chains and a chain capacity of 20. The sequence number interval of chain 1 is [1, 20]. The detector sends the valid instruction to be stored with sequence number 13 to this waiting list. First, it is determined that sequence number 13 falls within the sequence number interval [1, 20]. Then, chain 1 is determined to be the target storage chain (target chain) for the valid instruction to be stored. There is no sequence number in chain 1 that is consecutive to sequence number 13. The two sequences in chain 1 with the smallest sequence number difference from sequence number 13 are obtained, and sequence number 13 is located between these two sequences. The sequences in chain 1 that meet the condition are sequence number 10 and sequence number 15. Since the difference between sequence number 10 and sequence number 13 is 3 and the difference between sequence number 13 and sequence number 15 is 2, the empty block between the block storing the valid instruction with sequence number 10 and the block storing the valid instruction with sequence number 15, and which is closest to the block storing the valid instruction with sequence number 15, will be selected as the target block for the instruction to be stored.

[0111] The following continues to explain the method for determining the target block of a valid instruction to be stored. In some embodiments, based on the valid instructions stored in each chain of the current waiting list, it is determined whether an empty block with the same sequence number as the instruction to be stored needs to be created as the target block of the instruction to be stored, and whether an empty block corresponding to the adjacent sequence number of the sequence number carried by the instruction to be stored needs to be created. For example, the detector takes each valid instruction to be stored in the detector's waiting list as the first valid instruction and performs the following processing: selects a chain that has not reached the preset chain capacity from the detector's waiting list as a candidate chain, and searches for a target block with the same first sequence number as the first valid instruction in any candidate chain; when a target block exists, the first valid instruction is stored in the target block; when no target block exists and the adjacent sequence number of the first sequence number does not have a corresponding empty block, a target block corresponding to the first sequence number and an empty block corresponding to the adjacent sequence number are created, and the first valid instruction is stored in the target block.

[0112] For example, see Figure 7 , Figure 7This is a schematic diagram illustrating the state changes of each chain in the waiting linked list for storing instructions, provided in an embodiment of this application. Taking chain 1 (the first chain) as an example, the initial state of chain 1 contains only header information. When the sequence number of the instruction to be stored is 1 (when storing instruction number 1), the detector needs to create an empty block with sequence number 1 and an empty block with sequence number 2, and use the empty block with sequence number 1 as the target block for storing instruction number 1. Currently, at least one empty block is the empty block with sequence number 2. Then, when the sequence number of the instruction to be stored is 2 (when storing instruction number 2...), the detector needs to create an empty block with sequence number 1 and an empty block with sequence number 2, and use the empty block with sequence number 1 as the target block for storing instruction number 1. When the instruction is executed, the detector originally needs to create empty blocks with sequence number 1, 2, and 3. However, since there is already an empty block with sequence number 1 in chain 1, and an empty block with sequence number 2 that matches the sequence number of instruction 2 (the instruction to be stored with sequence number 2), only the empty block with sequence number 3 needs to be created, and instruction 2 is stored in the empty block with sequence number 2. At least one empty block is currently an empty block with sequence number 3. Then, when the sequence number of the instruction to be stored is 5 (when storing instruction 5), the existing empty block with sequence number 3 matches the sequence number of the instruction to be stored. If the sequence number of the stored instruction is 5, the detector will create empty blocks with sequence numbers 4, 5, and 6. The empty block with sequence number 5 will be used as the target block to store the instruction with sequence number 5. Currently, at least one empty block is an empty block with sequence numbers 3, 4, or 6. Next, when the sequence number of the instruction to be stored is 10 (when storing instruction number 10), since the sequence numbers of at least one empty block (3, 4, 6) do not match sequence number 10, the detector will create an empty block with sequence number 10 to store instruction number 10. There is an empty block with number 9 and an empty block with number 11. The current at least one empty block has numbers 3, 4, 6, 9, and 11. Then, when the number of the instruction to be stored is 16 (when storing instruction number 16), since the numbers of the current at least one empty block (3, 4, 6, 9, and 11) do not match the number 16, the detector creates an empty block with number 16 to store instruction number 16, an empty block with number 15 and an empty block with number 17. The current at least one empty block has numbers 3, 4, 6, 9, 11, 15, and 17.

[0113] In step 104, the valid instructions in the waiting list are linked together in the corresponding execution order and sent to the processor for execution.

[0114] For example, execution order refers to the normal execution order corresponding to the program control flow.

[0115] In some embodiments, when the branch instructions loaded from memory by the detector carry group numbers, the specific implementation method of the detector connecting the legal instructions in the waiting list according to the corresponding execution order is described. When there is a full chain in the waiting list, that is, when the number of legal instructions stored in the chain reaches the preset chain capacity, the detector connects the legal instructions in the full chain sequentially according to the sequence numbers they carry, and determines the corresponding execution order. For example, the following process is performed for each chain in the waiting list: when the number of legal instructions stored in the chain reaches the preset chain capacity, the detector deletes the sequence numbers carried by multiple legal instructions, and connects the legal instructions stored in each block of the chain sequentially according to the sequence numbers carried by the legal instructions.

[0116] It should be noted that the detector sends valid instructions to the processor only when the chain in the waiting list reaches a preset capacity. This method, which requires waiting for the chain in the waiting list to reach the preset capacity before sending instructions to the processor, provides some buffer time to reduce the risk of program execution errors. It also helps the detector reorder instructions in the waiting list according to the normal execution order of program control flow, thus preventing execution errors.

[0117] In some embodiments, see Figure 8 , Figure 8 This is a flowchart illustrating the method for creating an index table according to an embodiment of this application. Based on Figure 3 Before step 101, the detector can also perform the operation of creating the index table, combined with... Figure 8 The steps shown illustrate the process of creating an index table.

[0118] Step 201: The detector obtains the address carried by the branch instruction, wherein the address type includes storage address and target address.

[0119] For example, branch instructions can be categorized into jump, call, or return. Correspondingly, the target address can be understood as the address to which the branch instruction redirects after execution, such as the address to which a jump instruction jumps, the address to which a call instruction invokes, or the address to which a return instruction returns.

[0120] Step 202: The detector writes the target address carried by the branch instruction into the first column of the index table.

[0121] For example, when the index table is empty, the detector directly writes the target address carried by the first branch instruction into the first row and first column of the index table. When the index table is not empty, before writing the target address of the branch instruction into the index table, the detector needs to check whether the first column of the index table contains the target address carried by the current branch instruction. Only when the target address carried by the current branch instruction does not exist is the target address written into the first column of the index table. For example, step 202 can be implemented through steps 2021 to 2022, writing the target address carried by the branch instruction into the first column of the index table.

[0122] In step 2021, the detector compares the target address carried by the branch instruction with each target address stored in the first column of the index table.

[0123] Step 2022: When the comparison is inconsistent, the detector adds the target address carried by the branch instruction to the first column.

[0124] Step 203: The detector writes the memory address carried by the branch instruction into the line where the target address is located.

[0125] For example, the storage address (current address) of the branch instruction is written to all columns except the first column in the same row as the target address.

[0126] Repeat steps 201 to 203 until the detector writes all the branch instructions, including the target address and storage address, of the multiple instructions to be executed in the program into the index table, and then the index table creation process ends.

[0127] In some embodiments, to accelerate the efficiency of the instruction detection phase in steps 101 to 104, during the index table creation phase, the detector typically groups the index table according to the group size (i.e., the index table includes multiple groups, and each group includes multiple rows), and adds a group number to each pre-recorded branch instruction in the index table. This allows for a fast search in the index table during the branch instruction detection phase, using the group number carried by the branch instruction as an index, thereby improving the search speed in the index table. For example, see... Figure 9 , Figure 9 This is a flowchart illustrating the process of writing branch instructions into an index table, as provided in an embodiment of this application. Figure 9 The steps shown are explained.

[0128] Step 301: The detector compares the target address carried by the branch instruction with each target address stored in the first column of the index table, and takes the row corresponding to the target address carried by the branch instruction obtained from the comparison as the target row.

[0129] For example, using the target address carried by the branch instruction as an index, the search is performed on the existing target address in the index table to determine the row corresponding to the target address.

[0130] Step 302: The detector determines the group corresponding to the target row based on the target row and the group size, and takes the group corresponding to the target row as the target group.

[0131] For example, group capacity is used to characterize the maximum number of target addresses that each group in an index table can store, and can also be understood as the number of rows included in each group.

[0132] For example, let's first explain how to set the group capacity. The group capacity setting is closely related to hardware resources and the time overhead of the executed program. In some embodiments, the group capacity can be set based on the time overhead and hardware resources. For example, see... Figure 10 , Figure 10 This is a flowchart illustrating a group capacity setting method provided in an embodiment of this application, combined with... Figure 10 The steps shown illustrate how to set the group capacity.

[0133] Step 401: The detector determines the first value range corresponding to the group capacity of each group in the index table based on the hardware resources allocated to the detector.

[0134] For example, the minimum group capacity is determined based on the amount of hardware resources required to ensure normal operation of the electronic device and to detect instructions serially (when the amount of hardware resources is at its minimum). The maximum group capacity is determined based on the amount of hardware resources required to ensure normal operation of the electronic device and to detect instructions in parallel (when the amount of hardware resources is at its maximum). The amount of hardware resources is positively correlated with the group capacity. The first value range corresponding to the group capacity is determined based on the minimum and maximum group capacity.

[0135] Step 402: The detector determines the second value range corresponding to the group capacity of each group in the index table based on the time cost of the execution program.

[0136] For example, the group size can be determined based on the execution time cost. When the group size is at its maximum, the index table contains the fewest groups. With only one group, it's equivalent to performing a full table search on the index table; the greater the time cost to locate the target row, the greater the execution time cost. Conversely, when the group size is at its minimum, the index table contains more groups, and each group contains fewer rows. Directly locating the target group based on the group number, and then locating the target row, significantly reduces the time cost, resulting in a smaller execution time cost.

[0137] Step 403: The detector determines the intersection interval of the first value interval and the second value interval, and selects the group capacity in the intersection value interval.

[0138] Through steps 401 to 403 above, it is possible to set a group capacity that satisfies both hardware performance and program execution time overhead.

[0139] Step 303: The detector adds the group number corresponding to the target group to the branch instruction, thus obtaining the branch instruction carrying the group number.

[0140] The group number represents the order of the group among the multiple groups included in the index table. The group number is usually set at the header position corresponding to the branch instruction. The length of the group number is related to the architecture of the instruction set in which the current detector is located. Different instruction set architectures have different lengths available for the header (instruction header). For example, in the current instruction set of x86-64 (64-bit operating system), each instruction is 64 bits long, of which only 48 bits are used for data storage. Therefore, 16 bits are available for the header, that is, the maximum length of the header cannot be 16.

[0141] Step 304: The detector replaces the corresponding branch instruction in memory that does not carry a group number with the branch instruction that carries the group number.

[0142] For example, the detector resends the branch instruction carrying the group number back to memory, waiting to execute the instruction detection operations from steps 101 to 104. It should be noted that the instructions stored in memory at this point are no longer the initial instructions after program compilation, but rather instructions processed by the detector. The main difference is that the branch instructions in memory now carry the corresponding group number.

[0143] For example, see Figure 11 , Figure 11 This is a schematic diagram of group number setting provided in an embodiment of this application. In stage ①, the detector loads instructions from memory into the index table. The loaded instructions are at least 8 instructions stored in memory, as shown on the left side of the figure. Then, the information of the branch instructions (let's assume that the instructions corresponding to 0, 2, 4, 6, and 7 are branch instructions) is pre-recorded in the index table. At this time, the index table looks like this. Figure 4B The diagram shows multiple groups. In stage ②, the detector resends the branch instructions carrying the group number back to memory. Based on the preset group capacity (assuming each group has 10 lines), the detector records all the above branch instructions (the branch instructions corresponding to 0, 2, 4, 6, and 7) in the first group of the index table, and sets the group number corresponding to the first group to 011. The detector adds the corresponding group number 011 to the pre-recorded branch instructions in the index table and resends the branch instructions carrying the group number back to memory. At this time, the instruction pattern stored in memory is as shown on the right side of the diagram, that is, each branch instruction (the branch instructions corresponding to 0, 2, 4, 6, and 7) carries the group number 011.

[0144] It should be noted that, in order to improve the calculation speed, the detector can use a non-volatile storage medium such as ROM. Taking advantage of the fact that ROM does not lose power, the index table for the same program can be generated only once, avoiding multiple regenerations of the index table for the same program, thereby improving the detection efficiency when the program is running repeatedly.

[0145] Through the instruction detection method described in steps 101 to 104 above, when any branch instruction of the program's pending instructions is detected as an illegal instruction, the program's execution will be directly interrupted. If the program can execute normally, it means that all branch instructions in the program's pending instructions are legal instructions. Therefore, it can ensure that the electronic device can only execute legal instructions, thereby preventing the execution of illegal instructions and improving the security performance of the electronic device.

[0146] In some embodiments, the detailed process of the program protection method provided in this application embodiment is described in conjunction with the above steps. See also Figure 12 , Figure 12 This is a flowchart illustrating a method for protecting a program provided in an embodiment of this application, combined with... Figure 12 The steps shown are explained.

[0147] Step 501: The detector loads multiple instructions to be executed from memory.

[0148] For example, when multiple instructions are acquired, the detector performs steps 502 to 514 for each instruction.

[0149] Step 502: Determine whether the instruction is a branch instruction. If it is a branch instruction, proceed to step 503; otherwise, proceed to step 510.

[0150] Step 503: Obtain the memory address and target address carried by the branch instruction.

[0151] Step 504: Use the target address carried by the branch instruction as an index and compare it with the target address included in each row of the index table.

[0152] Step 505: Determine the comparison result. If the comparison matches, proceed to step 506. If the comparison does not match, proceed to step 514.

[0153] Step 506: The line containing the target address carried by the branch instruction obtained from the comparison is taken as the target line.

[0154] Step 507: Compare the memory address carried by the branch instruction with each memory address in the target line.

[0155] Step 508: Determine the comparison result. If the comparison matches, proceed to step 509. If the comparison does not match, proceed to step 514.

[0156] Step 509: Determine if the branch instruction is a valid instruction.

[0157] Step 510: Determine if the non-branch instruction is a valid instruction.

[0158] Step 511: Add a sequence number to the valid instructions to represent the execution order of the branch instructions in the program.

[0159] For example, valid instructions include valid branch instructions determined in step 509 and non-branch instructions determined in step 510.

[0160] Step 512: Store the valid instructions into the waiting list in the detector according to their corresponding sequence numbers.

[0161] Step 513: Connect the valid instructions in the waiting list according to their corresponding execution order and send them to the processor for execution.

[0162] Step 514: Identify the branch instructions that do not match as illegal instructions and interrupt the execution of the program.

[0163] This application embodiment sets up a detector between the electronic device's memory and processor via an electrical connection. The detector then loads multiple instructions to be executed from memory and identifies non-branch instructions and branch instructions from these instructions. Furthermore, it obtains the address carried by the branch instructions, ensuring that the detector's index table only checks branch instructions, effectively reducing the hardware overhead of the electronic device. Next, it reads the pre-recorded address for the branch instruction from the detector's index table and compares it with the address carried by the branch instruction. Branch instructions that match the comparison are determined to be legitimate instructions and stored in the detector's wait list. This ensures that only the address carried by the branch instruction is compared with the address in the index table, and that all instructions stored in the wait list are legitimate. Finally, the legitimate instructions in the wait list are linked according to their corresponding execution order and sent to the processor for execution. This ensures that only legitimate instructions are executed, preventing the execution of illegal instructions and effectively protecting against attacks targeting the program.

[0164] The following describes an exemplary application of the embodiments of this application in a real-world code reuse attack detection scenario. Specifically, a detector is deployed on an FPGA to detect branch instructions.

[0165] Based on the limitations of the aforementioned related technologies, the program protection method (also known as a code reuse attack defense method) provided in this application can achieve hardware-based instruction-level code reuse attack detection and can effectively combine methods from multiple disciplines such as software security, circuit design, and computer architecture. The main problems addressed by this application include:

[0166] 1) Implement an efficient data structure in hardware to represent the program control flow graph. This structure should be optimized to the maximum extent possible to improve the lookup speed.

[0167] 2) It can be applied to various types of code reuse attacks, such as return-oriented programming and jump-oriented programming, and has reasonable performance overhead.

[0168] Furthermore, the applicant discovered that a common characteristic of instruction-level code reuse attacks is that they hijack the control flow of the executing program by modifying the target address of branch instructions. Therefore, if the program's control flow is monitored during its execution, potential modifications to branch instructions can be detected, thus eliminating code reuse attacks. Based on this, embodiments of this application propose using an index table in a detector to monitor the program's control flow in real time. Before program execution, the detector records the current and target addresses of all branch instructions. During program execution, each branch instruction is checked against this index table. In this way, it can be ensured that the electronic device can only execute legitimate branch instructions, thereby preventing the execution of code reuse attack instructions. In addition, the proposed index table can be stored in trusted memory inaccessible to the electronic device's operating system, enhancing security.

[0169] In practical implementation, the detector is installed on the electronic device (terminal or server) to be protected in the form of an FPGA (i.e., using FPGA hardware assistance). The processor in the electronic device acts as the main controller, used to receive and send the necessary information, including compiled instructions and break commands. All functions involved in the detector run entirely on the FPGA. After installing the corresponding driver, the device corresponding to the detector can provide protection for the host against possible code reuse attacks.

[0170] See Figure 13 , Figure 13 This is a schematic diagram of the detector architecture provided in an embodiment of this application, combined with... Figure 13 In detail, the detector bridges the communication between the CPU cache and memory. Simply put, the detector's main tasks include: ① loading instructions from memory; ② verifying the addresses of branch instructions; ③ sending legitimate instructions to the CPU cache for execution. To achieve the proposed functionality, the detector provided in this embodiment consists of two main components: a two-dimensional index table for branch instructions (i.e., the index table mentioned above) and a two-dimensional doubly linked wait list (i.e., the wait list mentioned above). The code reuse attack detection method provided in this embodiment, based on the index table and the wait list, mainly includes two stages: the index table construction stage and the detection stage performed by the detector based on the index table.

[0171] First, before the program is executed by the CPU, the detector loads the compiled instructions from memory and constructs an index table of all branch instructions based on the opcodes and address codes included in the instructions. This index table is then stored in a storage device for verifying the instructions in the program. As mentioned earlier, this storage device can be integrated into the detector or integrated into the same on-chip system; it can be RAM, ROM, or a combination of both. For example, ROM can be used to store the index table of high-frequency programs (i.e., programs whose execution frequency exceeds a certain threshold), thereby saving time and hardware resource overhead associated with repeated generation.

[0172] Secondly, during program execution, instructions are loaded into the detector for testing. Only instructions that pass the detector's test (i.e., meet one of the following conditions: not a branch instruction; or a branch instruction whose integrity is checked by the index table) are stored in the wait list for execution (instructions not classified as branches are directly stored in the wait list). Otherwise, for security reasons, the detector will interrupt program execution and send a warning message to the user that the currently executing program has been compromised. To adapt to the pipelined structure of program execution in the CPU, the entire detector design adopts a wait list pipeline approach to ensure the integrity of the control flow is not corrupted by the index table and to provide buffer time.

[0173] The following section provides a detailed explanation of index tables. An index table is a two-dimensional table that includes the target address and current address of all branch instructions. Specifically, as... Figure 4A As shown, ADDR T The first column represents the target address of the branch instruction, while ADDR T-C The remaining columns represent the current address of the branch instruction. The ADDR is mapped to the same row address. T2 and ADDR T2 Cj For example, assuming the branch instruction is a jump instruction, the assembly code for this instruction is jmp ADDR. T2 Its current memory address is ADDR T2 Cj Compared to directly recording all address pairs, this design records the same target address only once, reducing the number of times the target address is repeatedly recorded, thus significantly reducing the required storage space. For example, to illustrate the method of directly recording all address pairs, consider address pairs... <ADDR T ADDR C1 >、 <ADDR T ADDR C2 >、……、 <ADDR TADDR Cj > etc., among which, ADDR T For the target address, ADDR C1 ADDR C2 , ..., ADDR Cj This represents the current address, where T stands for Target and C stands for Current.

[0174] To reduce the traversal time of the inspection process, the index table can often be further divided into different groups. Within each group, the maximum number of target addresses that can be stored, k (defined as the group capacity, where k is an integer greater than or equal to 1), can be adjusted.

[0175] Reducing the group capacity k helps reduce time overhead, but it also increases the number of groups, thus increasing hardware overhead. Therefore, the group capacity parameter determines the trade-off between hardware and time overhead. In practice, the group capacity k can be adjusted to suit the needs of electronic devices and high-performance requirements.

[0176] Next, the process of generating the index table provided in the embodiments of this application will be described. The pseudocode for the process of generating the index table provided in the embodiments of this application is shown below:

[0177] Start { Iterate through each instruction I} a a = 1, 2, ...

[0178] Execution: Load instruction I from memory a

[0179] If instruction I a It is a jump, call, or return instruction.

[0180] Then read instruction I a Target address ADDR Ta and current address ADDR Ta-Ca

[0181] If ADDR Ta Exists in the first column of BID

[0182] Then add ADDR Ta-Ca To ADDR Ta The line

[0183] otherwise

[0184] Add ADDR Ta First column to BID

[0185] Add ADDR Ta-Ca To ADDR Ta The line

[0186] Generate a 12-bit header (group number) based on the stored groups.

[0187] Add the generated 12-bit header to instruction I. a

[0188] Save command I a to memory

[0189] }Finish

[0190] In some embodiments, after the detector loads the instruction to be detected from memory, it first checks whether it is a branch instruction based on the instruction's opcode. When the instruction to be detected is not a branch instruction (i.e., a non-branch instruction), the detector directly sends the instruction back to memory (when generating the index table, if the instruction is not a branch instruction, the relevant information is not recorded in the index table), and then continues to load the next instruction from memory. When the instruction to be detected is a branch instruction (such as a jump, call, or return instruction), the detector reads the target address recorded in the branch instruction address code and checks whether the target address is included in the first column of the index table.

[0191] When the target address of the branch instruction to be detected does not exist in the first column of the index table, the detector writes this new target address below the last element of the current group. If the current group is full, it is written to the first element of the new group. See, for an example... Figure 4B If the last element of group 1 is ADDR T2 The new target address will then be written to ADDR. T3 The position. If the current last element of group 1 is ADDR Ti The new target address will then be written to the ADDR of group 2. Ti+1 Location. Then, the current address of the instruction will be written to the same line as the target address. The target address is ADDR. T2 The current addresses of all instructions will be written to ADDR in the order they occurred. T2 Cj .

[0192] When the target address of the branch instruction to be detected exists in the first column of the index table, the current address of the instruction to be detected will be written directly after the target address in the same row.

[0193] To reduce the time overhead during the inspection process and speed up instruction lookup, a 12-bit group number (header) is added to each branch instruction based on the target address stored in the index table (branch instructions belonging to the same group have the same group number). For example, the instruction header (group number) stored in group 7 is 111000000000, and the instruction header stored in group 44 is 001101000000. Note that the current x86-64 architecture only uses 48 bits (in 64-bit architecture) for data storage; therefore, 16 bits are available for the header.

[0194] Finally, the checked instructions are written back to memory by the detector, and then the next unchecked instruction is loaded. The detector will repeat this loop until all instructions have been loaded and the index table has been generated.

[0195] Next, the detection process provided in the embodiments of this application will be described. The pseudocode of the code reuse attack detection process provided in the embodiments of this application is shown below:

[0196] Start { Iterate through each instruction to be executed I} r r=1,2,3,……

[0197] Execution: Load instruction I from memory r

[0198] Add a 12-bit sequence number to instruction I r

[0199] If instruction I r These are branch instructions such as jumps, calls, or returns.

[0200] Then read instruction I r The 12-digit group number locates the storage group.

[0201] From instruction I r Remove the 12-digit group number from the group.

[0202] Read instruction I r Target address and current address ADDR Tr-Cr

[0203] In instruction I r Search for the target address ADDR in the group Tr

[0204] If the target address ADDR exists Tr

[0205] Then at the target address ADDR Tr Search for the current address ADDR in the current line. Tr-Cr

[0206] If the current address ADDR does not existTr-Cr

[0207] Then the program execution will be interrupted.

[0208] otherwise

[0209] Interrupt execution program

[0210] Send to the waiting list DWL

[0211] }Finish

[0212] It's important to note that the process of checking a branch instruction is far more complex than that of checking a non-branch instruction. Therefore, when checking instructions, the time required to check branch instructions is significantly longer than that required to check non-branch instructions. It's also worth noting that the checking process is challenging; when the detector loads instructions from memory in parallel, there's a possibility that while the branch instructions loaded earlier are still being checked, the non-branch instructions loaded later might be preferentially stored in the wait list.

[0213] Therefore, there are cases where the order of instructions in the wait list differs from the order in which they are loaded in the detector. This will disrupt the integrity of the instruction flow and lead to execution errors or performance degradation. To address this issue, the following steps are performed during the detection process: the detector adds a new 12-bit sequence number to each instruction loaded from memory, representing the loading order of these instructions. This can be understood as preprocessing all instructions (i.e., adding sequence numbers) to ensure the correct instruction execution order can be retrieved from the wait list based on the sequence numbers. After adding the sequence numbers, the detector checks whether the loaded instructions are branch instructions, such as jump, call, or return instructions.

[0214] If the detector identifies the current instruction as not a branch instruction (i.e., a non-branch instruction), it directly stores the instruction in the waiting list.

[0215] If the detector identifies the current instruction as a branch instruction, it will read the branch instruction's group number, target address, and memory address (current address), and check if a valid address pair exists in the specific group. For example, it will verify if the target address is in the BID. If the target address is in the BID, it will continue to verify if the current address exists in the line containing the current target address. Simultaneously, the detector will remove the 12-bit group number carried by the instruction to ensure that the total header length does not exceed 16 bits.

[0216] The two different headers used in the detector (sequence number and group number) are explained below. The sequence number is added to all instructions. The detector adds a sequence number to each instruction during instruction detection. Then, when storing the valid instructions into the wait list, the sequence number used to record the order in which the instructions entered the detector is deleted. The group number is only added to branch instructions. During the index table generation stage, the detector pre-records the address information of the branch instructions in the index table and adds a group number to each branch instruction. Depending on the current instruction set architecture, the group number carried by the instruction can be deleted when the detector stores the valid instruction into the wait list, or it can be deleted when the detector sends the valid instruction to the processor.

[0217] When the instruction to be detected is an illegal instruction (illegal instruction or attack instruction), the execution of the instruction to be detected will be rejected, and the detector will interrupt the entire program.

[0218] When the instruction to be detected is a valid instruction, the detector will store the checked instruction in the waiting list, and take further operations in the waiting list to reorder the instructions, and load the new instruction when the CPU cache sends the next request.

[0219] Then, the above operation is repeated until all branch instructions have been detected by the detector, at which point the detection process ends. Based on this inspection process, any modifications to the instructions will be detected by the detector, thus eliminating code reuse attacks.

[0220] For an explanation of the waiting list, see [link to documentation]. Figure 14 , Figure 14 This is a schematic diagram of a waiting linked list provided in an embodiment of this application, wherein the main component of the waiting linked list is a two-dimensional doubly linked list matrix composed of multiple doubly linked lists. Each chain has q blocks (the number of blocks is defined as the chain capacity), and these chains work independently of each other to help reduce time overhead. In a single chain, each block stores one checked valid instruction. Similar to the group capacity discussed later, reducing the chain capacity q also helps to save traversal time in a single chain, thereby reducing time overhead.

[0221] If two valid instructions have consecutive sequence numbers, the detector will directly connect these two instructions in the waiting list. For any two valid instructions with non-consecutive sequence numbers, the detector searches for the corresponding sequence numbers of blocks in each chain of the waiting list and records the sequence number closest to these two instructions as an edge.

[0222] For example, in Figure 14In the example of storing instructions in chain 1, when storing instruction number 3, since the adjacent numbers before and after instruction number 3 are 2 and 4, the detector originally needs to create an empty block with number 2 and an empty block with number 3. However, since there are already blocks with number 2 and number 4 in chain 1, instruction number 3 can be directly stored in the block with number 3 between blocks with number 2 and blocks with number 4. Next, when storing the instruction with sequence number 4, since there is a block with sequence number 3 and a block with sequence number 7 in chain 1, but the block with sequence number 7 is not adjacent to the block with sequence number 4, the detection table will create an empty block with sequence number 5 and store the instruction with sequence number 4 in the block with sequence number 4. Similarly, when storing the instruction with sequence number 5, it is originally necessary to create an empty block with sequence number 4 and an empty block with sequence number 6. Since the existing block corresponding to sequence number 7 is not adjacent to the block corresponding to sequence number 5, the detection table will create an empty block corresponding to sequence number 6 and store the instruction with sequence number 5 in the block with sequence number 5. Similarly, when storing the instruction with sequence number 8, there is a block with sequence number 7 in chain 1, but no block with sequence number 9. The block with sequence number 11 is not adjacent to the block with sequence number 8. The detector creates an empty block with sequence number 9 and stores the instruction with sequence number 8 in the block with sequence number 8. The process of storing other legal instructions in the waiting chain is similar to the above process, and will not be described again in the embodiments of this application.

[0223] Once an instruction passes the detector's verification, it is considered a valid instruction. The detector then removes the serial number of the valid instruction and compares the instruction portion of the valid instruction with all existing edges in the chain.

[0224] If the sequence number carried by the instruction to be stored matches an edge recorded in the waiting list (that is, a sequence number that is consecutive to the sequence numbers of two valid instructions whose sequence numbers are not consecutive), the instruction to be stored will be directly connected to the chain. For example, see Figure 14 When storing the instruction with sequence number 2 in chain 1, since there is a block with sequence number 2 in the current chain 1 (that is, the sequence number of the instruction to be stored matches the sequence number of the block successfully) and sequence number 2 is recorded as an edge, the instruction to be stored is directly stored in the empty block corresponding to sequence number 2 in chain 1.

[0225] If the sequence number carried by the instruction to be stored does not match the recorded edge in the waiting list (i.e., the sequence number corresponding to the established block in each chain), the instruction will be stored in an empty block between the two nearest sequence numbers of the instruction. Then, the detector will delete the sequence number of the block corresponding to the instruction to be stored in the waiting list. This is because the waiting list provided in this application deletes the original sequence number of the block and the sequence number carried by the instruction after the instruction to be stored is stored in a block with the same sequence number as itself. Additionally, it determines whether to add an empty block corresponding to the sequence numbers adjacent to the instruction's sequence number. For example, an instruction with sequence number 5 arrives... Figure 14In the first chain, the detector originally needed to create blocks with sequence number 4 and sequence number 6 in chain 1. However, assuming blocks with sequence numbers 4, 6, and 5 already exist, the detector directly stores the instruction in block number 5 and connects it to block number 4, eliminating the need to create blocks with sequence numbers 4 and 6. For example, another instruction with sequence number 13 (i.e., instruction number 13) arrives... Figure 14 In the first chain, assuming that edge number 13 has not been recorded for chain 1, but there are blocks with index 12 and index 14. The detector only needs to create an empty block with index 13 between blocks with index 12 and index 14 to store instruction number 13, without needing to re-record the edges with indexes 12 and 14.

[0226] The process of storing legal instructions described above is repeated until the first chain reaches its preset capacity (i.e., the chain is full). The detector then sends legal instructions from chains in the waiting list that have reached their preset capacity (full chains) to the CPU. This rule (that the detector will only send legal instructions from full chains to the processor after the chain in the waiting list reaches its preset capacity) provides a buffer time to reduce the risk of program execution errors. In this way, the waiting list helps to reorder instructions according to the normal execution order of program control flow, preventing execution errors.

[0227] Based on the detailed explanation of the code reuse attack detection implementation process described above, a hardware-assisted CRA detector, CRAlert, is provided in practical implementation. CRAlert can detect different CRAs without modifying the compiler and instruction set. Experimental results from the FPGA implementation demonstrate the feasibility and low performance overhead of CRAlert.

[0228] To verify the feasibility and performance of the proposed solution, the CRAlert framework was prototyped using the ML605 FPGA evaluation toolkit, which utilizes a Virtex-6 FPGA. As a proof of concept, the Intel Core i7-9700 processor was controlled and communicated with via the PCIe interface on the FPGA board. The FPGA and the PC host were bridged using the open-source PCIe driver RIFFA.

[0229] See Figure 15 , Figure 15 This is a schematic diagram of the code reuse attack detection experimental device provided in an embodiment of this application. Figure 15 Eleven benchmark tests were used to verify the time overhead of using CRAlert. The experimental results can be found in [link to relevant documentation]. Figure 16 , Figure 16 This is a schematic diagram showing the time overhead of the detector provided in the embodiments of this application.

[0230] Depend on Figure 16 The information indicates that the average time overhead (performance loss) is 0.363%. Compared with the four existing defense methods, the program protection method provided in this application can defend against both Jump-Oriented Programming (JOP) and Return-Oriented Programming (ROP) attacks, and further improves design performance. Furthermore, the program protection architecture provided in this application can detect more types of CRAs with minimal time overhead.

[0231] The hardware-assisted code reuse attack detection method provided in this application can be implemented on FPGA boards, on-chip systems, or integrated into RICS-V coprocessors, fundamentally mitigating code reuse attacks. Fine-grained CRA detection of program execution is achieved through a comprehensive instruction index table. Furthermore, it is compatible with current software / hardware (SW / HW, Software / Hardware) environments, requiring no modification to existing instruction set architectures and compilers.

[0232] The exemplary structure of the detector 300 provided in the embodiments of this application will be further described below. In some embodiments, such as Figure 2 As shown, the detector 300 module may include: an index table module 301, used to load multiple instructions to be executed from memory, identify branch instructions among the multiple instructions, and obtain the address carried by the branch instructions; read the address pre-recorded for the branch instructions from the index table in the detector, and compare it with the address carried by the branch instructions; determine the branch instructions that match the comparison as legal instructions, and store the legal instructions in the wait list in the detector; and a wait list module 302, used to connect the legal instructions in the wait list according to the corresponding execution order and send them to the processor for execution.

[0233] In some embodiments, the type of the address includes a storage address and a target address, the index table includes multiple rows, each row including a target address pre-recorded for a branch instruction in the program and at least one storage address; the index table module is further configured to use the target address carried by the branch instruction as an index to compare with the target addresses included in each row of the index table, and take the row where the target address carried by the branch instruction is located as the target row; and compare the storage address carried by the branch instruction with each storage address in the target row.

[0234] In some embodiments, the branch instruction loaded from the memory carries a group number, which represents the order of the group in which the branch instruction is located within the multiple groups included in the index table. Each group includes multiple rows, and each row includes the address of one of the branch instructions in the program. The address includes the target address corresponding to the branch instruction and at least one storage address. The index table module is further configured to: obtain the group number carried by the branch instruction; determine the group corresponding to the group number from the index table in the detector according to the group number, and take the group corresponding to the group number as the target group; read the pre-recorded target address for the branch instruction from the target group and compare it with the target address carried by the branch instruction, taking the row in the target group where the target address carried by the branch instruction is located as the target row; and compare the storage address carried by the branch instruction with the at least one storage address in the target row.

[0235] In some embodiments, the index table module is used to determine the branch instruction with the mismatch as an illegal instruction and interrupt the execution of the program when the comparison is inconsistent.

[0236] In some embodiments, the index table module is further configured to add a sequence number to the legal instruction to characterize the execution order of the legal instruction in the program; and store the legal instruction in the waiting list in the detector according to the corresponding sequence number, wherein the waiting list includes at least one chain, each chain includes at least one block, and the at least one block is used to store a plurality of legal instructions with consecutive sequence numbers in a one-to-one correspondence.

[0237] In some embodiments, the branch instruction loaded from the memory carries a group number, which represents the order of the group in which the branch instruction is located among the multiple groups included in the index table. The index table module is further configured to, when the legal instruction is the branch instruction loaded into memory, delete the group number carried by the legal instruction and add a sequence number to the legal instruction to represent the execution order of the branch instruction in the program; when the legal instruction is the non-branch instruction loaded into memory, add a sequence number to the non-branch instruction to represent the execution order of the non-branch instruction in the program.

[0238] In some embodiments, the waiting list module is further configured to perform the following processing for each chain in the waiting list: when the number of the legal instructions stored in the chain reaches a preset chain capacity, delete the sequence numbers carried by multiple legal instructions, and connect the legal instructions stored in each block of the chain sequentially according to the sequence numbers carried by the legal instructions.

[0239] In some embodiments, the waiting list module is further configured to perform the following processing for each valid instruction to be stored in the detector's waiting list as a first valid instruction: selecting a chain that has not reached a preset chain capacity from the detector's waiting list as a candidate chain; for any block of any candidate chain storing a second valid instruction, when the first sequence number of the first valid instruction and the second sequence number of the second valid instruction are consecutive, storing the first valid instruction in a block adjacent to the second valid instruction, wherein the second valid instruction is any valid instruction stored in the second valid instruction.

[0240] In some embodiments, the waiting list module is further configured to perform the following processing for each valid instruction to be stored in the detector's waiting list as a first valid instruction: selecting a chain from the detector's waiting list that has not reached a preset chain capacity as a candidate chain; for any block of any candidate chain storing a second valid instruction, when the second sequence number of the second valid instruction is not continuous with the first sequence number, determining the sequence number interval of each candidate chain, taking the sequence number interval where the first sequence number of the first valid instruction is located as a target sequence number interval, and taking the candidate chain corresponding to the target sequence number interval as a target chain; determining a third valid instruction and a fourth valid instruction in the target chain, wherein the first sequence number of the first valid instruction is between the third sequence number of the third valid instruction and the fourth sequence number of the fourth valid instruction, and the block in the target chain used to store the third valid instruction and the block used to store the fourth valid instruction are empty blocks; storing the first valid instruction in the empty block between the block used to store the third valid instruction and the block used to store the fourth valid instruction.

[0241] In some embodiments, the waiting list module is further configured to determine a first difference between the first sequence number and the third sequence number, and a second difference between the first sequence number and the fourth sequence number; when the first difference is less than the second difference, the first valid instruction is stored in a first empty block, wherein the first empty block is located between the block used to store the third valid instruction and the block used to store the fourth valid instruction, and is adjacent to the block used to store the third valid instruction; when the first difference is greater than the second difference, the first valid instruction is stored in a second empty block, wherein the second empty block is located between the block used to store the third valid instruction and the block used to store the fourth valid instruction, and is adjacent to the block used to store the fourth valid instruction.

[0242] In some embodiments, the waiting list module is further configured to take the legal instruction of each waiting list to be stored in the detector as a first legal instruction, and perform the following processing: select a chain that has not reached a preset chain capacity from the waiting list of the detector as a candidate chain; when a target block corresponding to the first sequence number of the first legal instruction is found in any candidate chain, store the first legal instruction in the target block; when no target block corresponding to the first sequence number of the first legal instruction is found in any candidate chain, and there is no empty block corresponding to the adjacent sequence number of the first sequence number, create a target block corresponding to the first sequence number and an empty block corresponding to the adjacent sequence number, and store the first legal instruction in the target block.

[0243] In some embodiments, the index table module is used to create the index table by: identifying branch instructions among a plurality of instructions to be executed by the program; for each branch instruction, performing the following processing: obtaining the address carried by the branch instruction, the type of the address including a storage address and a target address; writing the target address carried by the branch instruction into the first column of the index table, and writing the storage address carried by the branch instruction into the row where the target address is located.

[0244] In some embodiments, the index table module is further configured to compare the target address carried by the branch instruction with each target address stored in the first column of the index table; when the comparison is inconsistent, the target address carried by the branch instruction is added to the first column.

[0245] In some embodiments, the index table includes multiple groups, each group including multiple rows. The index table module is further configured to compare the target address carried by the branch instruction with each target address stored in the first column of the index table, and take the row corresponding to the target address carried by the branch instruction as the target row; determine the group corresponding to the target row according to the target row and the group capacity, and take the group corresponding to the target row as the target group; wherein, the group capacity is used to characterize the maximum number of target addresses that each group in the index table can store; add the group number corresponding to the target group to the branch instruction to obtain a branch instruction carrying the group number; and replace the corresponding branch instruction in memory that does not carry the group number based on the branch instruction carrying the group number.

[0246] In some embodiments, the index table module is further configured to determine the group capacity by: determining a first value range corresponding to the group capacity of each group in the index table based on the hardware resources allocated to the detector; determining a second value range corresponding to the group capacity of each group in the index table based on the time overhead of executing the program; determining the intersection range of the first value range and the second value range, and selecting the group capacity in the intersection value range.

[0247] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a detector, a protection method for the program provided in this application is executed. For example, ... Figure 3 The program protection method is shown.

[0248] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0249] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0250] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0251] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0252] In summary, the hardware-assisted program protection method provided in this application provides real-time monitoring of program execution instructions through an index table, effectively detecting illegal instructions and ensuring that the system executes only legal instructions in the normal order, thus preventing the execution of illegal instructions and effectively avoiding program execution errors. Furthermore, this application does not require modification of existing instruction set architectures or compilers, making it applicable to code reuse attack defense on various instruction set architecture platforms, with low performance overhead and easy deployment in real-world environments.

[0253] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for protecting a program, characterized in that, Applied to a detector, wherein the detector is electrically connected to both a memory and a processor, the method includes: Load multiple instructions to be executed from the memory, identify non-branch instructions and branch instructions from the multiple instructions, and obtain the address carried by the branch instructions; Read the address pre-recorded for the branch instruction from the detector's index table and compare it with the address carried by the branch instruction; The non-branch instructions and the branch instructions that match the comparison are taken as legal instructions, and a sequence number is added to the legal instructions to represent the execution order of the legal instructions in the program; The legal instructions are stored in the waiting list in the detector according to their corresponding sequence numbers. The waiting list includes at least one chain, and each chain includes at least one block. The at least one block is used to store multiple legal instructions with consecutive sequence numbers in a one-to-one correspondence. The valid instructions in the waiting list are linked together in the corresponding execution order and sent to the processor for execution.

2. The method according to claim 1, characterized in that, The address type includes storage address and target address, and the index table includes multiple rows, each row including a target address pre-recorded for a branch instruction in the program and at least one storage address; The step of reading the address pre-recorded for the branch instruction from the detector's index table and comparing it with the address carried by the branch instruction includes: Using the target address carried by the branch instruction as an index, compare it with the target address included in each row of the index table, and take the row where the target address carried by the branch instruction is located as the target row. The storage address carried by the branch instruction is compared with each storage address in the target line.

3. The method according to claim 1, characterized in that, The branch instruction loaded from the memory carries a group number, which indicates the order of the group in which the branch instruction is located among the multiple groups included in the index table. Each group includes multiple rows, and each row includes the address of a branch instruction in the program. The address includes the target address corresponding to the branch instruction and at least one memory address. The step of reading the address pre-recorded for the branch instruction from the detector's index table and comparing it with the address carried by the branch instruction includes: Obtain the group number carried by the branch instruction; Based on the group number, determine the group corresponding to the group number from the index table in the detector, and take the group corresponding to the group number as the target group; Read the target address pre-recorded for the branch instruction from the target group, and compare it with the target address carried by the branch instruction. The row in the target group where the target address carried by the branch instruction is located is taken as the target row. The storage address carried by the branch instruction is compared with at least one storage address in the target line.

4. The method according to claim 1, characterized in that, The method further includes: When the comparison is inconsistent, the branch instruction with the inconsistent comparison is identified as an illegal instruction, and the execution of the program is interrupted.

5. The method according to claim 1, characterized in that, The branch instruction loaded from the memory carries a group number, which indicates the order of the group in which the branch instruction is located among the multiple groups included in the index table; Adding a sequence number to the legal instructions to characterize the execution order of the legal instructions in the program includes: When the legal instruction is the branch instruction loaded into memory, the group number carried by the legal instruction is deleted, and a sequence number representing the execution order of the branch instruction in the program is added to the legal instruction; When the legal instruction is a non-branch instruction loaded into memory, an index is added to the non-branch instruction to represent the execution order of the non-branch instruction in the program.

6. The method according to claim 5, characterized in that, The step of connecting the valid instructions in the waiting list according to their corresponding execution order includes: Perform the following processing for each chain in the waiting list: When the number of valid instructions stored in the chain reaches the preset chain capacity, the sequence numbers carried by multiple valid instructions are deleted, and the valid instructions stored in each block of the chain are sequentially connected according to the sequence numbers carried by the valid instructions.

7. The method according to claim 1, characterized in that, The step of storing the legal instructions into the waiting list in the detector according to their corresponding sequence numbers includes: For each valid instruction to be stored in the detector's waiting list, treated as a first valid instruction, the following processing is performed: Select a chain that has not reached the preset chain capacity from the waiting list of the detector as a candidate chain. For any block of any candidate chain storing a second legal instruction, when the second sequence number of the second legal instruction is not continuous with the first sequence number of the first legal instruction, determine the sequence number interval of each candidate chain, take the sequence number interval where the first sequence number of the first legal instruction is located as the target sequence number interval, and take the candidate chain corresponding to the target sequence number interval as the target chain. In the target chain, a third valid instruction and a fourth valid instruction are determined, wherein the first sequence number is between the third sequence number of the third valid instruction and the fourth sequence number of the fourth valid instruction, and the block in the target chain used to store the third valid instruction and the block used to store the fourth valid instruction are empty blocks; Store the first valid instruction in the empty block between the block used to store the third valid instruction and the block used to store the fourth valid instruction.

8. The method according to claim 1, characterized in that, The step of storing the legal instructions into the waiting list in the detector according to their corresponding sequence numbers includes: Each valid instruction to be stored in the detector's waiting list is taken as the first valid instruction, and the following processing is performed: Select a candidate chain from the waiting list of the detector that has not reached the preset chain capacity; When a target block corresponding to the first sequence number of the first legal instruction is found in any of the candidate chains, the first legal instruction is stored in the target block; When no target block corresponding to the first sequence number of the first valid instruction is found in any of the candidate chains, and no empty block corresponding to the adjacent sequence number of the first sequence number exists, a target block corresponding to the first sequence number and an empty block corresponding to the adjacent sequence number are created, and the first valid instruction is stored in the target block.

9. The method according to claim 1, characterized in that, Before loading the executable instructions of the program from the memory, the method further includes: The index table is created in the following manner: Identify branch instructions among the multiple instructions to be executed in the program; For each of the aforementioned branch instructions, perform the following processing: Obtain the address carried by the branch instruction, wherein the address type includes a storage address and a target address; Write the target address carried by the branch instruction into the first column of the index table, and write the storage address carried by the branch instruction into the row where the target address is located.

10. The method according to claim 9, characterized in that, The step of writing the target address carried by the branch instruction into the first column of the index table includes: The target address carried by the branch instruction is compared with each target address stored in the first column of the index table; When a mismatch is found, the target address carried by the branch instruction is added to the first column.

11. The method according to claim 9, characterized in that, The index table comprises multiple groups, each group comprising multiple rows, and the method further comprises: The target address carried by the branch instruction is compared with each target address stored in the first column of the index table, and the row corresponding to the target address carried by the branch instruction obtained by comparison is taken as the target row. Based on the target row and the group capacity, determine the group corresponding to the target row, and take the group corresponding to the target row as the target group. The group capacity is used to characterize the maximum number of target addresses that each group in the index table can store. Add the group number corresponding to the target group to the branch instruction to obtain a branch instruction carrying the group number; Replace the corresponding branch instruction in memory that does not carry the group number with the branch instruction that carries the group number.

12. A detector, characterized in that, The detector includes: The index table module is used to load multiple instructions to be executed from memory, identify non-branch instructions and branch instructions from the multiple instructions, and obtain the address carried by the branch instructions; read the address pre-recorded for the branch instructions from the index table in the detector, and compare it with the address carried by the branch instructions; identify the non-branch instructions and the branch instructions that match the comparison as valid instructions, and add a sequence number to the valid instructions to represent the execution order of the valid instructions in the program; The legal instructions are stored in the waiting list in the detector according to their corresponding sequence numbers. The waiting list includes at least one chain, and each chain includes at least one block. The at least one block is used to store multiple legal instructions with consecutive sequence numbers in a one-to-one correspondence. The wait list module is used to connect the valid instructions in the wait list according to their corresponding execution order and send them to the processor for execution.

13. The detector according to claim 12, characterized in that, The address type includes storage address and target address, and the index table includes multiple rows, each row including a target address pre-recorded for a branch instruction in the program and at least one storage address; The index table module is further configured to use the target address carried by the branch instruction as an index to compare with the target address included in each row of the index table, and take the row where the target address carried by the branch instruction is located as the target row. The storage address carried by the branch instruction is compared with each storage address in the target line.

14. The detector according to claim 12, characterized in that, The branch instruction loaded from the memory carries a group number, which indicates the order of the group in which the branch instruction is located among the multiple groups included in the index table. Each group includes multiple rows, and each row includes the address of a branch instruction in the program. The address includes the target address corresponding to the branch instruction and at least one memory address. The index table module is also used to obtain the group number carried by the branch instruction; Based on the group number, determine the group corresponding to the group number from the index table in the detector, and take the group corresponding to the group number as the target group; Read the target address pre-recorded for the branch instruction from the target group, and compare it with the target address carried by the branch instruction. The row in the target group where the target address carried by the branch instruction is located is taken as the target row. The storage address carried by the branch instruction is compared with at least one storage address in the target line.

15. The detector according to claim 12, characterized in that, The index table module is also used to determine the branch instruction with the mismatch as an illegal instruction and interrupt the execution of the program when the comparison is inconsistent.

16. The detector according to claim 12, characterized in that, The branch instruction loaded from the memory carries a group number, which indicates the order of the group in which the branch instruction is located among the multiple groups included in the index table; The index table module is further configured to, when the legal instruction is the branch instruction loaded into memory, delete the group number carried by the legal instruction and add a sequence number to the legal instruction to characterize the execution order of the branch instruction in the program; When the legal instruction is a non-branch instruction loaded into memory, an index is added to the non-branch instruction to represent the execution order of the non-branch instruction in the program.

17. The detector according to claim 16, characterized in that, The waiting list module is also configured to perform the following processing for each chain in the waiting list: When the number of valid instructions stored in the chain reaches the preset chain capacity, the sequence numbers carried by multiple valid instructions are deleted, and the valid instructions stored in each block of the chain are sequentially connected according to the sequence numbers carried by the valid instructions.

18. The detector according to claim 12, characterized in that, The waiting list module is further configured to perform the following processing on each valid instruction to be stored in the detector's waiting list as a first valid instruction: Select a chain that has not reached the preset chain capacity from the waiting list of the detector as a candidate chain. For any block of any candidate chain storing a second legal instruction, when the second sequence number of the second legal instruction is not continuous with the first sequence number of the first legal instruction, determine the sequence number interval of each candidate chain, take the sequence number interval where the first sequence number of the first legal instruction is located as the target sequence number interval, and take the candidate chain corresponding to the target sequence number interval as the target chain. In the target chain, a third valid instruction and a fourth valid instruction are determined, wherein the first sequence number is between the third sequence number of the third valid instruction and the fourth sequence number of the fourth valid instruction, and the block in the target chain used to store the third valid instruction and the block used to store the fourth valid instruction are empty blocks; Store the first valid instruction in the empty block between the block used to store the third valid instruction and the block used to store the fourth valid instruction.

19. The detector according to claim 12, characterized in that, The waiting list module is further configured to take the valid instruction of each waiting list to be stored in the detector as the first valid instruction, and perform the following processing: Select a candidate chain from the waiting list of the detector that has not reached the preset chain capacity; When a target block corresponding to the first sequence number of the first legal instruction is found in any of the candidate chains, the first legal instruction is stored in the target block; When no target block corresponding to the first sequence number of the first valid instruction is found in any of the candidate chains, and no empty block corresponding to the adjacent sequence number of the first sequence number exists, a target block corresponding to the first sequence number and an empty block corresponding to the adjacent sequence number are created, and the first valid instruction is stored in the target block.

20. The detector according to claim 12, characterized in that, The index table module is also used to create the index table in the following ways: Identify branch instructions among the multiple instructions to be executed in the program; For each of the aforementioned branch instructions, perform the following processing: Obtain the address carried by the branch instruction, wherein the address type includes a storage address and a target address; Write the target address carried by the branch instruction into the first column of the index table, and write the storage address carried by the branch instruction into the row where the target address is located.

21. The detector according to claim 20, characterized in that, The index table module is also used to compare the target address carried by the branch instruction with each target address stored in the first column of the index table; When a mismatch is found, the target address carried by the branch instruction is added to the first column.

22. The detector according to claim 20, characterized in that, The index table includes multiple groups, and each group includes multiple rows; The index table module is further configured to compare the target address carried by the branch instruction with each target address stored in the first column of the index table, and take the row corresponding to the target address carried by the branch instruction obtained by comparison as the target row; Based on the target row and the group capacity, determine the group corresponding to the target row, and take the group corresponding to the target row as the target group. The group capacity is used to characterize the maximum number of target addresses that each group in the index table can store. Add the group number corresponding to the target group to the branch instruction to obtain a branch instruction carrying the group number; Replace the corresponding branch instruction in memory that does not carry the group number with the branch instruction that carries the group number.

23. An electronic device, characterized in that, include: Processor, memory, and detectors; among which, The detector is electrically connected to both the memory and the processor, and is used to implement the program protection method according to any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that, The method of protecting the program according to any one of claims 1 to 11 is stored in executable instructions for use when executed.

Images