A method and device for dynamic analysis of RISCV application based on hardware virtualization

Abstract

The application discloses a RISCV application program dynamic analysis method and device based on hardware virtualization, which comprises: an operating system kernel running on a reverse RISCV, obtaining process kernel data structure; simulating a RISCV CPU based on a hardware simulator, and constructing a basic process list of the operating system; using an sptbr register and the process kernel data structure to obtain characteristic information of a new process; screening the characteristic information according to the basic process list to obtain a target process; performing API detection and instruction analysis based on process information and dynamic running process information of the target process to obtain a dynamic analysis result. The application can completely and transparently monitor the whole process of program running on a RISCV CPU, and provides configurable efficient process information acquisition, API calling information acquisition and instruction execution information acquisition; the monitoring process does not depend on a system interface, transparent process monitoring can be realized, and the running process of the monitored target is not affected.

Description

Technical Field

[0001] This invention belongs to the field of computer science and technology, and specifically relates to a method and apparatus for dynamic analysis of RISCCV applications based on hardware virtualization. Background Technology

[0002] Dynamic analysis is a crucial technique for binary program analysis. Currently, research on dynamic analysis of programs on the RISC-V platform is still in its early stages, primarily relying on the Linux debugging library ptrace and the Linux debugger gdb. However, due to advancements in program obfuscation and adversarial techniques, methods based on system debugging libraries and debuggers face platform competition with the analysis target, making them susceptible to interference from adversarial measures. Furthermore, the dynamic analysis process requires intrusion into the target program, affecting its execution process and context, making it difficult to obtain accurate dynamic analysis results.

[0003] Dynamic monitoring techniques for RISC-V are still in their infancy, and the following methods are commonly used:

[0004] 1. Dynamic analysis based on debugger

[0005] Current dynamic analysis of RISC vulnerabilities primarily relies on debuggers, specifically the use of gdb's int3 breakpoint feature and the CPU's single-step execution functionality. However, since gdb and the target program being analyzed operate on the same platform, gdb is easily detected and countered by the target program. Furthermore, when gdb is attached to a process for debugging, it alters the process's memory allocation and stack, affecting the runtime context and interfering with the analysis of vulnerability triggering and exploitation processes, thus presenting significant limitations.

[0006] 2. Dynamic analysis based on the ptrace library

[0007] Currently, some work is also based on the ptrace library to conduct dynamic analysis of RISC-CV programs. Since debugging tools such as gdb are based on the ptrace library, the core of the dynamic analysis process based on the ptrace library is to add int3 breakpoints and single-step execution at the function entry point. It is also easily interfered with by the target code's countermeasures. Furthermore, since it is on the same platform as the target code, it is easy for the target code to detect and circumvent it.

[0008] In summary, the main drawbacks of current methods for dynamic program analysis on RISC-V hardware are: reliance on int3 breakpoints provided by the operating system and single-step execution functionality provided by the hardware; and the analysis program and the analyzed program operating on the same platform, making them vulnerable to detection and countermeasures by the analysis target. Furthermore, in some cases, the analysis program can intrude into the analyzed program, interfering with its execution and hindering information acquisition. Summary of the Invention

[0009] Existing dynamic analysis methods for RISC-V rely on debugging tools and libraries such as gdb and ptrace, which can interfere with the execution of the analyzed target. Furthermore, since the analyzed program and the analyzed target reside on the same platform, they are susceptible to countermeasures. The purpose of this invention is to provide a dynamic analysis method and apparatus for RISC-V applications based on hardware virtualization. This method modifies the hardware emulator to translate and execute RISC-V instructions while simultaneously locating and parsing operating system kernel data structures in physical memory using RISC-V registers as clues. It extracts process, thread, module, API call, and instruction execution information, achieving transparent dynamic monitoring of processes on RISC-V.

[0010] The technical content of this invention includes:

[0011] A method for dynamic analysis of RISC-CV applications based on hardware virtualization, comprising the following steps:

[0012] Reverse engineer the operating system kernel running on RISC to obtain the process kernel data structure;

[0013] Simulate a RISC-CV CPU using a hardware simulator and build a basic process list for the operating system;

[0014] Using the sptbr register and process kernel data structures, the characteristic information of the new process is obtained, and the characteristic information is filtered according to the basic process list to obtain the target process;

[0015] API detection and instruction analysis are performed based on the process information and dynamic running process information of the target process to obtain API call information and instruction information respectively.

[0016] Dynamic analysis results are obtained based on API call information and instruction information.

[0017] Furthermore, the operating system includes either a Linux operating system or a Windows operating system.

[0018] Furthermore, the type of hardware simulator includes: Qemu hardware simulator.

[0019] Furthermore, the characteristic information of the new process is obtained through the following steps:

[0020] 1) Monitor changes in the sptbr register and obtain a new process when a new address appears;

[0021] 2) Then, starting from the physical page pointed to by sptbr, the feature information of the new process is obtained by searching the process kernel data structure by feature.

[0022] Furthermore, the feature information includes: module loading address, length, thread information, and memory information.

[0023] Furthermore, the process information of the target process includes: process structure address, page table physical address, process name, module structure information list, and pointer to the current module structure of the process.

[0024] Further, API call information is obtained through the following steps:

[0025] 1) For the target process, intercept all ecall instructions;

[0026] 2) Based on the process information and dynamic running process information of the target process, the API call information is obtained in the ecall instruction. The API call information is determined to be either system call API call information or user-mode call API call information by detecting whether a privilege level conversion occurred when calling ecall.

[0027] Furthermore, API call information includes: call address, function name, input / output parameters, and return value.

[0028] Further, the instruction information is obtained through the following steps:

[0029] 1) Intercept all instructions for the target process;

[0030] 2) Add callback functions before and after instruction translation to perform analysis, and obtain instruction information based on the process information and dynamic running process information of the target process.

[0031] Furthermore, the instruction information includes: opcode, operand, register, memory address, and memory content.

[0032] A storage medium storing a computer program, wherein the computer program is configured to execute the method described above at runtime.

[0033] An electronic device includes a memory and a processor, wherein the memory stores a program for performing the methods described above.

[0034] Compared with existing technologies, this invention can monitor the entire process of program execution on RISC-V CPU completely and transparently, providing configurable and efficient process information acquisition, API call information acquisition, and instruction execution information acquisition. The monitoring process does not depend on the system interface, and can achieve transparent process monitoring without affecting the operation of the monitored target. Attached Figure Description

[0035] Figure 1This is a flowchart of a RISCCV application dynamic analysis method based on hardware virtualization according to the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0037] The RISC-CV application dynamic analysis method of the present invention includes:

[0038] • Install the operating system on the Qemu hardware emulator;

[0039] • Based on the Qemu hardware simulator, different processes are distinguished by the virtual sptbr register, where sptbr is a RISC-specific register;

[0040] • Based on the Qemu hardware simulator, construct a virtual process kernel data structure register, parse the physical memory contents, and search for process kernel data structures;

[0041] • Based on the Qemu hardware simulator, by modifying the decoding engine, when executing the ecall instruction in user mode, it detects whether a privilege level switch has occurred, so as to obtain information about user mode calls and system calls;

[0042] • Based on the Qemu hardware simulator, by modifying the decoding engine and adding callback functions before and after instruction translation to perform analysis, instruction execution information can be obtained.

[0043] Specifically, such as Figure 1 As shown, the steps of the present invention are described as follows:

[0044] 1) Manually reverse engineer the operating system kernel running on RISC, analyze the kernel data structures. The relevant data structures are mainly used to find the process kernel data structure in physical memory by mutual verification through multi-level pointers (the operating system kernel data structures are connected by a doubly linked list. Whether two values ​​in the kernel data structures point to the associated legal address can be used to detect whether it is a legal kernel data structure). Proceed to step 2).

[0045] 2) Based on the Qemu hardware simulator, simulate a RISC-V CPU and install the Linux operating system. Record the basic processes required to start a general Linux operating system and build a list of basic processes. In the later analysis, do not monitor such processes and proceed to step 3).

[0046] 3) Start the Linux operating system and the target process, build the process kernel data structure register, and proceed to step 4);

[0047] 4) Monitor changes in the sptbr register in the system: When a new address appears, it is considered that a new process has appeared. Then, starting from the physical page pointed to by sptbr, the process kernel data structure is searched by feature to obtain the information of the current process, including module load address, length, thread information, memory information, etc., and it is determined whether the process belongs to the basic process list. If it does, it is ignored. If it does not belong, the process information is recorded, including: process structure address, page table physical address, process name, module structure information list, and pointer to the current module structure of the process, and then proceed to step 5).

[0048] 5) Modify the decoding engine of the target process, that is, add API detection and instruction analysis code to the Qemu decoding mechanism. Specifically, during the actual execution of Qemu, in addition to process information, further extract dynamic runtime information to proceed to step 6);

[0049] 6) For the target process, intercept all ecall instructions and use API detection to obtain the address, function name, input / output parameters, and return value of the API call. At the same time, check whether a privilege level conversion occurred when calling ecall. If a conversion occurred, it is a system call; otherwise, it is a user-mode call. Proceed to step 7).

[0050] 7) For the target process, intercept all instructions, and perform analysis (instruction analysis code) by adding callback functions before and after instruction translation to obtain information such as the instruction's opcode, operands, registers, memory address, and memory content, and then proceed to step 8);

[0051] 8) Determine if the target process has exited. If it has exited, output the dynamic information in a JSON file. If it has not exited, proceed to step 4.

[0052] Furthermore, in step 2), since Windows systems do not yet support RISC-CV CPUs, only Linux systems are currently supported. However, the monitoring process for Windows operating systems is consistent with the monitoring process for Linux systems, and the method of this invention can also support Windows operating systems.

[0053] Furthermore, in step 3), sptbr is the physical address of the page table for each process. Since different processes use different page tables, this page table information can uniquely identify the process. Process information is recorded by building a hash table in memory indexed by the page table address.

[0054] Furthermore, the method for constructing the virtual process kernel data structure register in step 5) is obtained by reverse engineering the operating system, and the entity is implemented by adding simulation functions in Qemu.

[0055] This invention proposes a method for dynamically monitoring the entire system based on a simulated RISC-CV CPU by modifying a hardware emulator. This involves analyzing registers in the virtual CPU and locating and reading key operating system data structures in physical memory. According to user selection, dynamic analysis is performed on specified processes, capturing information such as API calls and executed instructions. This invention can completely and transparently monitor the entire program execution process on a RISC-CV CPU, providing configurable and efficient acquisition of process information, API call information, and instruction execution information. The monitoring process does not rely on system interfaces, achieving transparent process monitoring without affecting the operation of the monitored target.

[0056] Although specific embodiments and accompanying drawings of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments and drawings, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A method for dynamic analysis of RISC-V applications based on hardware virtualization, comprising the following steps: Reverse engineer the operating system kernel running on RISC to obtain the process kernel data structure; Simulate a RISC-CV CPU using a hardware simulator and build a basic process list for the operating system; Using the sptbr register and process kernel data structures, the characteristic information of the new process is obtained, and the characteristic information is filtered according to the basic process list to obtain the target process; the characteristic information of the new process is obtained through the following steps: Monitor changes in the sptbr register and obtain a new process when a new address appears; Starting from the physical page pointed to by sptbr, the feature information of the new process is obtained by searching the process kernel data structure by feature; API detection and instruction analysis are performed based on the process information and dynamic running process information of the target process to obtain API call information and instruction information respectively. Dynamic analysis results are obtained based on API call information and instruction information.

2. The method as described in claim 1, characterized in that, The operating system includes: Linux operating system or Windows operating system; the type of hardware emulator includes: Qemu hardware emulator.

3. The method as described in claim 1, characterized in that, The feature information includes: module loading address, length, thread information, and memory information.

4. The method as described in claim 1, characterized in that, The process information of the target process includes: process structure address, page table physical address, process name, module structure information list, and pointer to the current module structure of the process.

5. The method as described in claim 1, characterized in that, Obtain API call information through the following steps: 1) For the target process, intercept all ecall instructions; 2) Based on the process information and dynamic running process information of the target process, the API call information is obtained in the ecall instruction. The API call information is determined to be either system call API call information or user-mode call API call information by detecting whether a privilege level conversion occurred when calling ecall.

6. The method as described in claim 1, characterized in that, The instruction information is obtained through the following steps: 1) Intercept all instructions for the target process; 2) Add callback functions before and after instruction translation to perform analysis, and obtain instruction information based on the process information and dynamic running process information of the target process.

7. The method as described in claim 1, characterized in that, API call information includes: call address, function name, input / output parameters, and return value; instruction information includes: opcode, operand, register, memory address, and memory content.

8. A storage medium storing a computer program, wherein, The computer program is configured to execute any of the methods described in claims 1-7 at runtime.

9. An electronic device comprising a memory and a processor, the memory storing a computer program, the processor being configured to run the computer program to perform the method as claimed in any one of claims 1-7.

Images