Unmanned system embedded processor hidden instruction defense method

Abstract

The application discloses a kind of unmanned system embedded processor hidden instruction defense method, it is related to the field as hardware security field, for the embedded processor used in unmanned system, the code instruction is detected.The application detects and defends the hidden instruction existing in embedded processor, to improve the security of embedded processor in unmanned system.First, the hidden instruction mining work is carried out to specific model embedded processor, records hidden instruction as information base and is saved, then the user design content of off-chip memory on target board is extracted, and the program code instruction part is obtained by processing, finally, whether there is hidden instruction in instruction is detected, and the corresponding result is output.

Description

Technical Field

[0001] This invention relates to the field of hardware security, and specifically to embedded processors used in unmanned systems. It proposes a hidden instruction defense framework to detect the code instructions of these embedded processors, providing a reliable technical means for subsequent security analysis of embedded processors. Background Technology

[0002] Disassembly techniques are divided into two types: static disassembly and dynamic disassembly. However, based on information about known disassembly tools, static disassembly remains the dominant technique. This is because static disassembly can disassemble target code without executing the code, making it applicable to a wider range of scenarios. In addition to traditional static disassembly algorithms, researchers have proposed many improvements to enhance disassembly coverage and accuracy, as well as to address different situations.

[0003] Schwarz B et al. revisited the disassembly of executable code, improving two traditional static disassembly algorithms and combining them to produce mutually verifiable disassembly code, ultimately forming optimal disassembly code with the support of a preferred algorithm. Ma et al. used stack pointers to divide the program into blocks and pattern matching to distinguish between program and data; however, pattern matching is only effective in specific situations and lacks flexibility. Wu et al. introduced the concept of function block partitioning at the assembly instruction level and used confidence evaluation to filter function blocks, attempting to solve the problem of difficult indirect jump resolution. Kinder J et al. designed a disassembly framework based on abstract interpretation, using dynamic abstraction fields to approximate branch targets to solve the problem of jump accuracy in branch instructions. However, current disassembly tools have some problems, such as difficulty in extracting the code instruction portion of the target firmware. This invention describes a solution to this problem in the disassembly tool designed in this paper.

[0004] Based on the above research, a clear approach has been developed for implementing a disassembler tool for embedded processors: First, a database is established based on the processor's instruction set. For a specific machine instruction, the database is used for disassembly to obtain its corresponding assembly instructions. After obtaining a disassembler tool for a specific embedded processor model, hidden instructions can be discovered. Hidden instructions are defined as instructions that can be recognized and executed by the processor but are not included in the processor manufacturer's documentation. Therefore, an instruction search space needs to be established. This space is then tested using a pre-designed disassembler tool to identify machine code that has no disassembly results, and the machine code instructions that can be recognized and executed by the processor are recorded, forming a hidden instruction information library specific to a particular processor model. Because hidden instructions do not exist in the embedded processor's instruction set documentation, and no processor manufacturer provides corresponding instructions for use, they are highly likely to pose certain security vulnerabilities to the processor. A 2017 Black Hat report analyzed the hidden instructions of the AMD Geode NX1500 and found that attackers could use hidden instructions to generate #UD exceptions, which would interrupt normal processes. In 2018, Domas stated at the DEF CON 26 security conference that VIA C3 x86 CPUs could allow attackers to escalate malicious code execution from user mode to the OS kernel by using a hidden instruction (.byte 0x0f, 0x3f). These cases illustrate the necessity of building processor defense frameworks based on hidden instructions.

[0005] In summary, the hidden instruction defense framework is based on a hidden instruction information library of a specific embedded processor, which is obtained after mining hidden instructions from the embedded processor. This defense framework provides basic technical means for embedded processor security analysis and offers insights for subsequent security analysis of embedded processors. Summary of the Invention

[0006] This invention proposes a method for defending against hidden instructions in embedded processors of unmanned systems. This method primarily targets hidden instructions present in embedded processors. It only requires firmware parsing of existing embedded processor devices to obtain their program code, followed by the detection and processing of hidden instructions. This defense framework only requires access to the embedded processor's JTAG interface, eliminating the need for other complex equipment and instruments, thus solving the problem of existing security analyses lacking specific capabilities for hidden instructions in embedded processors.

[0007] This invention aims to construct a hidden instruction defense framework for embedded processors, and to analyze and test the functionality of the defense framework for a given embedded processor. First, hidden instruction mining is performed on the selected embedded processor model. For most embedded processors, the processor supports instruction formats with different bit widths, so hidden instruction mining should be performed separately, and the obtained hidden instruction information is recorded in a database, known as a hidden instruction information library. Second, to construct the defense framework for the device's firmware and user code, the contents of the non-volatile memory on the embedded device need to be obtained. Third, the obtained memory data is analyzed to obtain the contents of the program code segments, i.e., the instructions executed after the processor powers on, and instructions with different bit widths are distinguished for separate hidden instruction detection. Finally, the hidden instruction information library is used to detect the instructions, checking for hidden instructions that may pose security risks. If a hidden instruction is detected, it is replaced with a NOP instruction, resulting in the processed program code. This is the entire workflow of the embedded processor hidden instruction defense framework.

[0008] Therefore, the technical solution of this invention is a method for defending against hidden instructions in an embedded processor of an unmanned system, the method comprising:

[0009] Step 1: Hidden Command Discovery

[0010] Hidden instructions refer to instructions that can be recognized and executed by the processor, but are not included in the instruction set documentation declared by the processor manufacturer. Let E represent the set of instructions that the processor can execute, and D represent the set of instructions declared in the instruction set documentation corresponding to the processor. Then the hidden instruction set U can be expressed as Equation (1).

[0011]

[0012] Therefore, the essence of hidden instruction mining is to find the instruction set U in the instruction space;

[0013] First, a specific embedded processor model needs to be selected, and an instruction search space I needs to be generated. S I S (i) is the instruction search space I S The i-th instruction; secondly, according to the disassembler, I should be sequentially... S (i) Perform disassembly, and denote the set of instructions for which there is no disassembly result as the set of instructions to be tested, R. T R T (j) is R T The j-th instruction; the next step is to process R in the corresponding processor. T(j) Perform runtime testing, and denote the instructions that the processor can execute as hidden instructions H(k), where H is the set of hidden instructions; finally, complete the opcode, operands, and other information of H, and save it to the hidden instruction information database H. D middle;

[0014] Step 2: Read the user design from the embedded device

[0015] First, we need to select the type of object to be extracted, that is, the type of non-volatile storage device F is Flash and EEPROM; in non-volatile storage device F, data writing and reading are performed in blocks. Let the number of bytes in a page be page_size, the number of pages in a sector be page_number, and the number of sectors in a block be sector_number. Then the number of bytes in a block can be expressed as equation (2).

[0016] block_bytes=page_size*page_number*sector_number (2)

[0017] Therefore, when reading memory, after all the bytes of a block have been read, they are stored in the address space pointed to by the previously set pointer, and then the next block is read; thus, the data file File obtained after reading is all the byte contents stored in the non-volatile storage device F.

[0018] Step 3: Data Analysis and Processing

[0019] After obtaining File, the next step is to analyze and process the data in File to obtain the content of the program code; the data content of the executable file adopts a segmented management method, which is represented by Equation (3);

[0020] File = {Header, S1, S2, ... S} i ...S N} (3)

[0021] Where Header represents the file header information of File, S i This represents the i-th section in the data. The important sections include: text, data, and bss. text represents the instruction part used to store the program execution, data represents the memory area used to store the initialized global variables in the program, and bss represents the memory area used to store the uninitialized global variables in the program. Next, we need to combine the File's header information to get the content of text, denoted as T.

[0022] The Header is a structure containing 14 variables of varying data types. These variables include essential information for parsing the File data. The variables have the following data types: Elf32_Addr, Elf32_Half, Elf32_Off, Elf32_Word, and unsigned char. e_shoff is of data type Elf32_Off and is 4 bytes in size; e_shentsize, e_shnum, and e_shstrndx are of data type Elf32_Half and are 2 bytes in size. After obtaining the specific data of each variable based on its index in the structure, the File is first initially extracted based on e_shoff to obtain the content of the Section Table. Next, the Section Table is divided based on e_shentsize and e_shnum to obtain the information table for each Section. Finally, the name of each Section is obtained based on e_shstrndx. The Section with the name .text is located, and its offset and size are obtained from its corresponding information table. Then, the extraction of T is completed in F.

[0023] Where e_shoff represents the offset of the Section Table, e_shentsize represents the size of a single item in the Section Table (each item in the table is the same size), e_shnum represents the number of items in the Section Table, and these parameters can be used to find the specific content of each Section Table in the File; e_shstrndx represents the index of the String Table containing the section name in the Section Table, and this parameter can be used to obtain the name of each Section.

[0024] Step 4: Hidden Command Detection

[0025] After obtaining T, it is tested and judged.

[0026] First, distinguish between instructions of different bit lengths; use I 32 Indicates 32-bit instructions, I 16 Indicates 16-bit instructions, I O Instructions for other bit lengths; then T can be represented by equation (4);

[0027] T = {I 32 ,I 16 ,I o} (4)

[0028] Based on the instruction extraction methods of different embedded processors, T is differentiated into instructions of different bit widths to obtain I. 32 I 16 and I O ;

[0029] Since the hidden instruction database has already been built, we only need to match each instruction one by one to see if a corresponding entry can be found in the database. If a hidden instruction is detected, we first output its detailed information, including its machine code structure and effect description. Then, we replace the original hidden instruction with a NOP instruction to prevent it from having unpredictable effects on the original program, thus achieving a defensive effect.

[0030] This invention proposes a method for defending against hidden instructions in embedded processors of unmanned systems. This invention detects and defends against hidden instructions present in embedded processors, thereby improving the security of embedded processors in unmanned systems. First, hidden instructions are mined from specific embedded processor models, and these hidden instructions are recorded and stored as an information database. Then, the user-designed content of the off-chip memory on the target board is extracted and processed to obtain the program code instruction portion. Finally, the presence of hidden instructions is detected, and the corresponding results are output. Attached Figure Description

[0031] Figure 1 Workflow diagram for an embedded processor instruction hiding defense framework;

[0032] Figure 2 Flowchart for uncovering hidden instructions;

[0033] Figure 3 This is a flowchart of the file data processing process;

[0034] Figure 4 Flowchart for hidden instruction detection. Detailed Implementation

[0035] Step 1: Hidden Command Discovery

[0036] First, a specific embedded processor model needs to be selected, and an instruction search space I needs to be generated. S I S (i) is the instruction search space I S The i-th instruction; secondly, according to the disassembler, I should be sequentially... S (i) Perform disassembly, and denote the set of instructions for which there is no disassembly result as the set of instructions to be tested, R. T R T (j) is R T The j-th instruction; the next step is to process R in the corresponding processor. T(j) Perform runtime testing, and denote the instructions that the processor can execute as hidden instructions H(k), where H is the set of hidden instructions; finally, complete the opcode, operands, and other information of H, and save it to the hidden instruction information database H. D middle;

[0037] Step 2: Read the user design from the embedded device

[0038] The target of the hidden instruction defense framework is the program code C that runs normally in the embedded device. C includes the user design stored in the embedded device. In unmanned systems, in order to ensure the normal operation of the system, the user design is usually embedded in the non-volatile storage device F of the embedded device. Therefore, step 2 is to extract the contents of the non-volatile storage device F and record the resulting data file as File.

[0039] Step 3: Data Analysis and Processing

[0040] The header contains basic file information, such as the file type, the program's virtual entry point address, and the file's data format. The parameters related to the Section table are crucial for processing file data. `e_shoff` represents the offset of the Section Table, `e_shentsize` represents the size of a single item in the Section Table (each item in the table is the same size), and `e_shnum` represents the number of items in the Section Table. These parameters allow you to find the specific content of each Section Table in the file. `e_shstrndx` represents the index of the String table containing the section name within the Section Table. This parameter allows you to obtain the name of each Section. The purpose of this step is to obtain the text content; therefore, we only need to find the section named `.text`, obtain the position and size of the text based on its Section Table, and then save the content of the text segment, denoted as `T`.

[0041] Step 4: Hidden Command Detection

[0042] Since the hidden instruction database has already been built, we only need to match each instruction one by one to see if a corresponding entry can be found in the database. Because this operation is just a simple line-by-line detection process, comparing the instruction with the hidden instruction database, it only requires a few judgment operations. Therefore, the entire hidden instruction detection process can yield results very quickly.

[0043] This invention utilizes the TI-provided TMDXEVM6678LE board, whose processor is a TMS320C6678, the development environment is CCS, and the selected off-chip memory is the Nor Flash N25Q128 on the development board. First, hidden instruction mining was performed, and the contents of the hidden instruction information database are shown in Table 1. To verify the functionality of the hidden instruction defense framework, a comparative experiment was conducted, testing firmware data with and without hidden instructions, as shown in Table 2.

[0044] Table 1 Hidden Command Information Database

[0045] Instruction bit Hidden instruction database size 32-bit 12 hidden commands 16-bit 2 hidden commands

[0046] Table 2 Test Results

[0047] Experimental subjects Firmware data size (in bytes) Output content No hidden commands 27122 No hidden commands Carry hidden commands 27122 Hidden instructions and their details

Claims

1. A method for defending against hidden instructions in an embedded processor of an unmanned system, the method comprising: Step 1: Hidden Command Discovery; Hidden instructions refer to instructions that can be recognized and executed by the processor, but are not included in the instruction set documentation declared by the processor manufacturer. Let E represent the set of instructions that the processor can execute, and D represent the set of instructions declared in the instruction set documentation corresponding to the processor. Then the set of hidden instructions U is represented by equation (1). （1）； Therefore, the essence of hidden instruction mining is to find the instruction set U in the instruction space; First, a specific embedded processor model needs to be selected, and an instruction search space I needs to be generated. S I S (i) is the instruction search space I S The i-th instruction; secondly, according to the disassembler, I should be sequentially... S (i) Perform disassembly, and denote the set of instructions for which there is no disassembly result as the set of instructions to be tested, R. T R T (j) is R T The j-th instruction; the next step is to process R in the corresponding processor. T (j) Perform runtime testing, and denote the instructions that the processor can execute as hidden instructions H(k), where H is the set of hidden instructions; finally, complete the opcode and operands of H and save them to the hidden instruction information database H. D middle; Step 2: Read the user design from the embedded device; First, you need to select the type of object to be extracted, that is, the type of non-volatile storage device F is Flash and EEPROM; In a non-volatile storage device F, data writing and reading are performed in blocks. Let the number of bytes in a page be page_size, the number of pages in a sector be page_number, and the number of sectors in a block be sector_number. Then the number of bytes in a block is expressed as equation (2). （2）； Therefore, when reading memory, after all the bytes of a block have been read, they are stored in the address space pointed to by the previously set pointer, and then the next block is read; thus, the data file File obtained after reading is all the byte contents stored in the non-volatile storage device F. Step 3: Data analysis and processing; After obtaining File, the next step is to analyze and process the data in File to obtain the content of the program code; the data content of the executable file adopts a segmented management method, which is represented by Equation (3); （3）； Where Header represents the file header information of File, S i This represents the i-th section in the data, where important sections include: text, data, and bss; text represents the instruction set used to store program execution, data represents the memory area used to store initialized global variables in the program, and bss represents the memory area used to store uninitialized global variables in the program. Next, we need to combine the File's header information to obtain the content of text, denoted as T. The Header is a structure containing 14 variables of varying data types. These variables include essential information for parsing the File data. The variables have the following data types: Elf32_Addr, Elf32_Half, Elf32_Off, Elf32_Word, and unsigned char. e_shoff is of data type Elf32_Off and is 4 bytes in size; e_shentsize, e_shnum, and e_shstrndx are of data type Elf32_Half and are 2 bytes in size. After obtaining the specific data of each variable based on its index in the structure, the File is first initially extracted based on e_shoff to obtain the content of the Section Table. Next, the Section Table is divided based on e_shentsize and e_shnum to obtain the information table for each Section. Finally, the name of each Section is obtained based on e_shstrndx. The Section with the name .text is located, and its offset and size are obtained from its corresponding information table. Then, the extraction of T is completed in F. Where e_shoff represents the offset of the Section Table, e_shentsize represents the size of a single item in the Section Table (each item in the table has the same size), e_shnum represents the number of items in the Section Table, and these parameters are used to find the specific content of each Section Table in the File; e_shstrndx represents the index of the String Table containing the section name in the Section Table, and this parameter is used to obtain the name of each Section. Step 4: Hidden command detection; After obtaining T, perform a test and evaluation on it; First, distinguish between instructions of different bit lengths; use I 32 Indicates 32-bit instructions, I 16 Indicates 16-bit instructions, I O Instructions for other bit lengths; then T is represented by equation (4); （4）； Based on the instruction extraction methods of different embedded processors, T is differentiated into instructions of different bit widths to obtain I. 32 I 16 and I O ; Since the hidden instruction database has already been built, we only need to match each instruction one by one to see if a corresponding entry can be found in the database. If a hidden instruction is detected, we first output its detailed information, including its machine code structure and effect description. Then, we replace the original hidden instruction with a NOP instruction to prevent it from having unpredictable effects on the original program, thus achieving a defensive effect.

Images