A RISCV memory access violation detection method and device based on hardware virtualization

Abstract

The present invention discloses a RISC-V memory access violation detection method and device based on hardware virtualization, comprising: reverse engineering the operating system kernel running on the RISC-V to obtain the process kernel data structure; simulating the RISC-V CPU based on a hardware simulator; constructing a basic process list of the operating system; using the sptbr register and the process kernel data structure to obtain feature information of a new process; filtering the feature information based on the basic process list to obtain a target process; performing API detection and instruction analysis based on the process information of the target process and dynamic running process information, comparing the obtained memory access data with the memory access permission list to obtain a violation detection result. The present invention can completely and transparently monitor the entire process of program execution on the RISC-V CPU, provides a configurable memory access violation configuration interface, and the monitoring process does not rely on system-provided functions or interfaces. It can achieve transparent process monitoring and memory access violation detection, thereby improving the memory access violation detection capability and accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of computer science and technology, and in particular relates to a RISC-V memory access violation detection method and device based on hardware virtualization. Background Art

[0002] A memory access violation occurs when the purpose of an access differs from the intended design, such as a write operation to read-only memory or a dynamic update of a static variable. Currently, the primary method for detecting memory access violations is dynamic analysis. However, due to the new hardware platform RISCV, relatively little research has been conducted on dynamic program analysis on it. Memory access violations primarily rely on manual analysis or embedded detection code within the source code. Manual analysis is time-consuming and labor-intensive, requiring analysts to have a strong technical foundation. Source code-based methods have indeed improved memory access violation detection capabilities to a certain extent, but many current software products do not provide source code. Therefore, source code-based analysis methods have significant limitations and are difficult to analyze binary application software.

[0003] Currently, memory access violation detection on the RISC-V platform usually uses the following methods:

[0004] 1. Debugger-based access violation detection

[0005] Code access violations are a type of programming error that is difficult to detect and analyze. In most cases, they don't cause program or system crashes, but rather cause unexpected changes in the values of certain variables during program execution. This makes locating and troubleshooting code access violations challenging. Currently, the main approach to detecting code access violations is for developers to analyze program logic errors using debugging tools like gdb. However, due to the inherent nature of code access violations, the analysis process is time-consuming and labor-intensive, resulting in significant limitations.

[0006] 2. Compiler-based access violation detection

[0007] Some current work leverages compiler code optimization capabilities. During the optimization phase, handwritten access violation detection code is embedded into the target program. During runtime, dynamic analysis is performed on RISC-compatible programs to detect memory access violations. This approach can improve code access violation detection capabilities to a certain extent, but since most software is distributed in binary form and source code is unavailable, source code-based access violation detection has significant limitations.

[0008] In summary, the main drawback of current methods for dynamic program analysis on RISC-V hardware is that, because violations typically do not cause program or system crashes but rather cause changes in certain program variables, they are difficult for analysts to locate and debug. Existing analysis methods based on debugging tools have significant limitations. Although some work has used compiler optimization techniques to insert analysis code into the source code, using this inserted code to detect memory access violations, the source code of many software programs is difficult to obtain, and source code-based approaches also have significant limitations. Summary of the Invention

[0009] To address the existing problems of program memory access violation detection on RISCV CPUs, which rely on manual analysis or source code implementation, requiring a large amount of manpower and material resources, high time complexity, and significant limitations, the present invention aims to provide a RISCV memory access violation detection method and device based on hardware virtualization. This method, by modifying a hardware simulator, extracts and calibrates memory access permissions in the process while translating and executing RISCV instructions, monitors RISCV instruction load and store instructions, and detects memory access violations.

[0010] The technical contents of the present invention include:

[0011] A RISC-V memory access violation detection method based on hardware virtualization comprises the following steps:

[0012] Reverse engineer the operating system kernel running on RISCV and obtain the process kernel data structure;

[0013] Simulate RISC-V CPU based on hardware simulator and build basic process list of operating system;

[0014] Use the sptbr register and process kernel data structure to obtain the characteristic information of the new process, and get the target process based on the basic process list and characteristic information;

[0015] Perform API detection and instruction analysis based on the target process's process information and dynamic running process information, obtain the memory access permission list through API detection, and obtain the target process's memory access data through instruction analysis;

[0016] Compare the memory access data with the memory access permission list to obtain the access violation detection result.

[0017] Furthermore, the operating system includes: a Linux operating system or a Windows operating system.

[0018] Furthermore, the types of the hardware simulator include: Qemu hardware simulator.

[0019] Furthermore, the characteristic information of the new process is obtained through the following steps:

[0020] 1) Monitor the changes of the sptbr register and get the new process when a new address appears;

[0021] 2) Then, starting from the physical page pointed to by sptbr, the feature information of the new process is obtained by searching the process kernel data structure through features.

[0022] Furthermore, the characteristic information includes: module loading address, length, thread information and memory information.

[0023] Furthermore, the process information of the target process includes: process structure address, page table physical address, process name, module structure information list and process current module structure pointer.

[0024] Furthermore, the memory access permission list is obtained through the following steps:

[0025] 1) Intercept all ecall instructions and obtain the API call address, function name, input / output parameters and return value;

[0026] 2) Based on the API call information, determine whether the corresponding function of the API call address is a memory allocation / release / permission operation function:

[0027] If so, update the existing memory access permission list using the configuration process name, the starting address of the memory region, the length of the memory region, and the access permission of the memory region input by the user, and use the updated memory access permission list as the memory access permission list;

[0028] If not, the existing memory access permission list is used as the memory access permission list.

[0029] Furthermore, the memory access data is obtained by the following steps:

[0030] 1) Intercept all LOAD and STORE instructions;

[0031] 2) Based on the LOAD and STORE instructions, obtain the instruction's opcode, operand, register, memory address, and memory contents;

[0032] 3) Based on the address and register read by the LOAD instruction and the address and register written by the STORE instruction, the memory access data is obtained.

[0033] A storage medium stores a computer program, wherein the computer program is configured to execute the above method when running.

[0034] An electronic device includes a memory and a processor, wherein the memory stores a program for executing the above method.

[0035] The advantages and positive effects of the present invention are as follows:

[0036] The present invention can completely and transparently monitor the entire process of program execution on the RISC-V CPU, provides a configurable memory access violation configuration interface, and the monitoring process does not rely on the functions or interfaces provided by the system. It can realize transparent process monitoring and memory access violation detection, effectively improving the memory access violation detection capability and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flow chart of a RISC-V memory access violation detection method based on hardware virtualization of the present invention. DETAILED DESCRIPTION

[0038] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0039] The RISCV memory access violation detection method of the present invention comprises:

[0040] Install the operating system on the Qemu hardware emulator;

[0041] Based on the Qemu hardware simulator, it uses the virtual sptbr register as a clue to distinguish different processes;

[0042] Based on the Qemu hardware simulator, build virtual process kernel data structure registers, parse physical memory contents, and search process kernel data structures;

[0043] Based on the Qemu hardware simulator, by modifying the decoding engine, when executing the ecall instruction in user mode, it detects whether memory allocation / release / permission update operations are implemented, and calibrates the access rights and access rules of the memory area;

[0044] Based on the Qemu hardware simulator, it provides a user-mode interface, allowing users to define access rights and access rules for memory areas.

[0045] Based on the Qemu hardware simulator, by modifying the decoding engine, callback functions are added before and after the LOAD and STORE instructions to perform analysis, and memory access violations are detected based on memory region access rules.

[0046] Output memory access violation detection results in JSON file format.

[0047] Specifically, if Figure 1As shown, the steps included are described as follows:

[0048] 1) Manually reverse engineer the operating system kernel running on RISC-V and parse the kernel data structure. The relevant data structures are mainly used in physical memory. The process kernel data structure is found through multi-level pointer mutual verification (the operating system kernel data structures are connected using a bidirectional linked list. Whether the two values in the kernel data structure point to the associated legal address can be detected to determine whether it is a legal kernel data structure). Then proceed to step 2);

[0049] 2) Based on the RISC-V CPU simulated by the Qemu hardware simulator and the Linux operating system, record the basic processes that need to be started by a general Linux operating system and build a basic process list. In the subsequent analysis, these processes are not monitored and go to step 3);

[0050] 3) Start the Linux operating system and the target process, build the process kernel data structure register, and proceed to step 4);

[0051] 4) Monitor changes in the sptbr register in the system: When a new address appears, it is considered that a new process has appeared. Then, starting from the physical page pointed to by sptbr, the process kernel data structure is searched through features to obtain the characteristic information of the current process, including module load address, length, thread information, memory information, etc. Based on this characteristic information, it is determined whether the process belongs to the basic process list. If it does, it is ignored. If not, the process information is recorded, which includes: process structure address, page table physical address, process name, module structure information list, and the process current module structure pointer, and then proceed to step 5);

[0052] 5) Modify the decoding engine for the target process and add API detection and instruction analysis code to Qemu's decoding mechanism. When Qemu is actually executed, in addition to process information, further extract dynamic running process information and proceed to step 6);

[0053] 6) For the target process, intercept all ecall instructions, obtain the API call address, function name, input / output parameters, and return value, and determine whether the corresponding function of the call address is a memory request / release / permission operation function: if so, update the memory access permission list and proceed to step 7); if not, proceed to step 8);

[0054] 7) The user enters a command line through the provided interface to configure information such as the process name, the starting address of the memory area, the length of the memory area, and the access rights of the memory area to add, delete, modify, and query memory access rules. Proceed to step 8);

[0055] 8) For the target process, intercept all LOAD and STORE instructions, obtain the instruction's opcode, operand, register, memory address, and memory content, and compare the address and register read by the LOAD instruction and the address and register written by the STORE instruction with the memory access permission table to determine whether there is a memory access violation. If so, output the access violation detection result and proceed to step 9);

[0056] 9) Determine whether the target process has exited. If so, output the dynamic information in the form of a JSON file. If not, proceed to step 4).

[0057] Furthermore, the operating system is installed on the Qemu hardware simulator. Since Windows does not yet support RISC-V CPUs, it is currently only supported on Linux systems. However, the monitoring process for Windows operating systems is consistent with the monitoring process for Linux systems, and the present invention can also support Windows operating systems.

[0058] Furthermore, the Qemu hardware simulator uses the virtual sptbr register as a clue to distinguish different processes, where sptbr is the physical address of the page table of each process. Since different processes use different page tables, the page table information can uniquely identify the process. The process information is recorded by constructing a HASH table indexed by the page table address in the memory.

[0059] Furthermore, the Qemu hardware simulator is based on virtual kernel data structure registers, and a linked list is traversed in the physical memory to search for the kernel process data structure to extract process information.

[0060] Furthermore, the Qemu hardware simulator, by modifying the decoding engine, detects whether the target address of the instruction is a function of memory allocation / release / memory permission setting when the program executes the instruction ecall, and records the memory area and the corresponding access rights.

[0061] Furthermore, the Qemu hardware simulator adds a user interface to allow the user to define the access rights of the target process memory area by inputting commands.

[0062] Furthermore, the Qemu hardware simulator modifies the decoding engine and adds callback functions before and after the LOAD and STORE instructions to implement analysis, thereby realizing analysis of the instruction read and write memory address and length, and determining whether the operation is an illegal operation based on predefined memory access rights.

[0063] This invention proposes a method for detecting memory access violations occurring during the execution of a RISC-V CPU by modifying a hardware simulator. This method analyzes registers in the virtual CPU, locates and reads key operating system data structures in physical memory, identifies processes, intercepts function calls and executed instructions in the processes, and detects memory access violations occurring during the execution of the processes. This method can fully and transparently monitor the entire execution process of a program on a RISC-V CPU, providing a configurable memory access violation configuration interface. The monitoring process is independent of system-provided functions or interfaces, enabling transparent process monitoring and memory access violation detection, effectively improving the capability and accuracy of memory access violation detection.

[0064] Although the specific embodiments and drawings of the present invention are disclosed for illustrative purposes and are intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the preferred embodiments and the drawings, and the scope of protection claimed by the present invention shall be determined by the scope defined in the claims.

Claims

1. A RISC-V memory access violation detection method based on hardware virtualization, comprising the following steps: Reverse engineer the operating system kernel running on RISCV and obtain the process kernel data structure; Simulate RISC-V CPU based on hardware simulator and build basic process list of operating system; Use the sptbr register and process kernel data structure to obtain the characteristic information of the new process, and get the target process based on the basic process list and characteristic information; Perform API detection and instruction analysis based on the target process's process information and dynamic running process information, obtain the memory access permission list through API detection, and obtain the target process's memory access data through instruction analysis; Compare the memory access data with the memory access permission list to obtain the access violation detection result.

2. The method according to claim 1, wherein The operating system includes: Linux operating system or Windows operating system.

3. The method according to claim 1, wherein The types of the hardware simulator include: Qemu hardware simulator.

4. The method according to claim 1, wherein Obtain the characteristics of the new process by following these steps: 1) Monitor the changes of the sptbr register and get the new process when a new address appears; 2) Then, starting from the physical page pointed to by sptbr, the feature information of the new process is obtained by searching the process kernel data structure through features.

5. The method according to claim 1, wherein The characteristic information includes: module loading address, length, thread information and memory information.

6. The method according to claim 1, wherein The process information of the target process includes: process structure address, page table physical address, process name, module structure information list and process current module structure pointer.

7. The method according to claim 1, wherein Get the memory access permission list by following the steps below: 1) Intercept all ecall instructions and obtain the API call address, function name, input / output parameters and return value; 2) Based on the API call information, determine whether the corresponding function of the API call address is a memory allocation / release / permission operation function: If so, update the existing memory access permission list using the configuration process name, the starting address of the memory region, the length of the memory region, and the access permission of the memory region input by the user, and use the updated memory access permission list as the memory access permission list; If not, the existing memory access permission list is used as the memory access permission list.

8. The method according to claim 1, wherein Get the memory access data by following the steps below: 1) Intercept all LOAD and STORE instructions; 2) Based on the LOAD and STORE instructions, obtain the instruction's opcode, operand, register, memory address, and memory contents; 3) Based on the address and register read by the LOAD instruction and the address and register written by the STORE instruction, the memory access data is obtained.

9. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 8 when executed.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 8.

Images