A method, apparatus, device and medium for determining an ELF file execution action

Abstract

The application discloses a kind of ELF file execution action determination method, device, equipment and medium, it is related to data processing technical field.The method comprises: obtaining target ELF file, and each section of target ELF file is loaded into memory;Subsection in compressed encryption section is decompressed to memory, and the first search result of detection program is determined in code section;Second search result of shell program is determined in shell section;According to the first search result and the second search result, the execution action of target ELF file is determined.The first search result is determined in code section, the second search result is determined in shell section, and then the execution action of target ELF file is determined, avoid the main program of target ELF file from running away from shell program, and then the difficulty of cracking and tampering to target ELF file is improved, and the security of target ELF file is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, device, and medium for determining the execution action of an ELF file. Background Technology

[0002] To improve application development efficiency and security, some application functions are usually developed using C or C++. These functions exist in ELF (Executable and Linkable Format) file format. ELF files are susceptible to illegal tampering.

[0003] In existing technologies, the main method for protecting ELF files is to compress and pack them. However, this approach has drawbacks, such as the ease with which ELF files can be cracked and their poor security. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for determining the execution actions of an ELF file, thereby increasing the difficulty of cracking the target ELF file and improving its security.

[0005] In a first aspect, the present invention provides a method for determining the execution action of an ELF file, comprising:

[0006] Obtain the target ELF file and load its various sections into memory; the target ELF file's sections include the header section, the shell section, and the compressed and encrypted section.

[0007] The sub-segments in the compressed and encrypted section are decompressed into memory, and the first search result of the detection program is determined in the code segment; wherein, the sub-segments in the compressed and encrypted section include the code segment;

[0008] Determine the second search result of the shell program within the shell section;

[0009] Based on the first and second search results, determine the execution action for the target ELF file.

[0010] Secondly, the present invention also provides an apparatus for determining the execution action of an ELF file, comprising:

[0011] The file loading module is used to obtain the target ELF file and load each section of the target ELF file into memory; the sections of the target ELF file include the header section, the shell section, and the compressed and encrypted section;

[0012] The first result determination module is used to decompress the sub-segments in the compressed and encrypted section into memory and determine the first search result of the detection program in the code segment; wherein, the sub-segments in the compressed and encrypted section include code segment and data segment;

[0013] The second result determination module is used to determine the second search result of the shell program in the shell section;

[0014] The action determination module is used to determine the action to be executed on the target ELF file based on the first search result and the second search result.

[0015] Thirdly, embodiments of the present invention also provide an electronic device, comprising:

[0016] At least one processor; and

[0017] A memory that is communicatively connected to at least one processor; wherein

[0018] The memory stores instructions that can be executed by at least one processor, which enables the at least one processor to perform the method for determining ELF file execution actions provided in any embodiment of the present invention.

[0019] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute a method for determining the execution action of an ELF file according to any embodiment of the present invention.

[0020] This invention provides an embodiment of the method for obtaining a target ELF file and loading its various sections into memory. Each section of the target ELF file includes a header section, a shell section, and a compressed / encrypted section. Sub-sections within the compressed / encrypted section are decompressed into memory, and a first search result for the detection program is determined in the code segment. The sub-sections within the compressed / encrypted section include a code segment and a data segment. A second search result for the shell program is determined in the shell section. Based on the first and second search results, the execution action of the target ELF file is determined. This technical solution, by determining the first search result in the code segment and the second search result in the shell section, thereby determining the execution action of the target ELF file, prevents the main program of the target ELF file from running outside the shell program, thus increasing the difficulty of cracking and tampering with the target ELF file and improving its security.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1A This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 1 of the present invention;

[0024] Figure 1B This is a schematic diagram of a target ELF file segment structure provided in Embodiment 1 of the present invention;

[0025] Figure 1C This is a schematic diagram of a target ELF file after decompressing a compressed and encrypted section according to Embodiment 1 of the present invention;

[0026] Figure 2 This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 2 of the present invention;

[0027] Figure 3A This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 3 of the present invention;

[0028] Figure 3B This is a schematic diagram of a process for determining an execution action according to Embodiment 3 of the present invention;

[0029] Figure 4 This is a structural diagram of an ELF file execution action determination device according to Embodiment 4 of the present invention;

[0030] Figure 5 This is a schematic diagram of an electronic device for determining an ELF file execution action according to Embodiment 5 of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," "target," "original," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Example 1

[0034] Figure 1A This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 1 of the present invention. This embodiment can be applied to the situation of determining the execution result of an ELF file. The method can be executed by a device for determining the execution action of an ELF file. The device for determining the execution action of an ELF file can be implemented in hardware and / or software and specifically configured in an electronic device, such as a digital audio and video playback device.

[0035] like Figure 1A As shown, the method includes:

[0036] S101. Obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes the header section, the shell section, and the compressed encryption section.

[0037] In this embodiment, the target ELF (Executable and Linkable Format) file can be the ELF file currently to be loaded; the memory can be the running memory of the electronic device deploying the method of this embodiment; the header section can be the section in the target ELF file used to store the ELF file header; the shell section can be the section in the target ELF file used to store the shell program code; and the compressed and encrypted section can be the section in the target ELF file used to store compressed and encrypted data. The shell program can be a program that decompresses the compressed and encrypted section. Optionally, Figure 1B This is a schematic diagram of the segment structure of a target ELF file. For example... Figure 1B As shown, the target ELF file includes a header section, a shell section, and a compressed encryption section.

[0038] Specifically, the target ELF file is obtained and loaded into memory using page mapping. In one specific implementation, the target ELF file can be obtained using an ELF loader.

[0039] S102. Decompress the sub-segments in the compressed encrypted section into memory, and determine the first search result of the detection program in the code segment; wherein, the sub-segments in the compressed encrypted section include the code segment.

[0040] In this embodiment, the sub-segment can be a compressed and encrypted segment, and the sub-segment can include, but is not limited to, code segments and data segments. The code segment stores the main program code and detection program code of the target ELF file. The main program code is the executable program code of the target ELF file. The detection program can be a program that searches for the shell program in the shell segment. The first search result can be the search result of the detection program in the code segment.

[0041] In one specific embodiment, the shell program can also be used to determine the first search result of the detection program within the code segment. By executing the shell program in the shell segment, the sub-segments in the compressed and encrypted segment are decompressed into memory, and the detection program is searched within the code segment to determine the first search result. For example, unique identifier information for the detection program can be searched within the code segment. If this identifier information is found, it is determined that the shell program has been found, and the first search result is "existent"; otherwise, the first search result is "not found". The first search result can specifically be in numerical form.

[0042] Optional, Figure 1C This is a diagram illustrating the target ELF file after decompressing a compressed and encrypted section. For example... Figure 1C As shown, the target ELF file includes a header section, data section, code section, shell section, and compressed / encrypted section. The header section, shell section, and compressed / encrypted section are sections already present in the target ELF file before decompression. The data section and code section are sub-sections decompressed from the compressed / encrypted section and placed into memory. By compressing and encrypting the data and code sections within the compressed / encrypted section, protection is achieved for the data and code sections, preventing direct analysis by a decompiler, increasing the difficulty of cracking the target ELF file, and thus enhancing its security.

[0043] S103. Determine the second search result of the shell program in the shell section.

[0044] In this embodiment, the second search result can be the result of searching for a shell program in the shell segment. In a specific embodiment, the second search result is determined by executing a detection program in the code segment to search for a shell program in the shell segment. For example, the unique identifier of the shell program can be searched in the shell segment. If the identifier is found, it is determined that a shell program has been found, and the second search result is "existent"; otherwise, the second search result is "not found".

[0045] S104. Based on the first search result and the second search result, determine the execution action of the target ELF file.

[0046] In this embodiment, the execution action can include, but is not limited to, immediate exit and continued execution of the main program. Immediate exit can mean immediately removing the target ELF file from memory. Specifically, if the first search result and / or the second search result are not found, the execution action for the target ELF file is immediate exit; if both the first and second search results are found, the execution action for the target ELF file is continued execution of the main program.

[0047] This invention provides an embodiment of the method for obtaining a target ELF file and loading its various sections into memory. Each section of the target ELF file includes a header section, a shell section, and a compressed / encrypted section. Sub-sections within the compressed / encrypted section are decompressed into memory, and a first search result for the detection program is determined in the code segment. The sub-sections within the compressed / encrypted section include a code segment and a data segment. A second search result for the shell program is determined in the shell section. Based on the first and second search results, the execution action of the target ELF file is determined. This technical solution, by determining the first search result in the code segment and the second search result in the shell section, and then determining the execution action of the target ELF file, avoids the main program of the target ELF file from running outside the shell program, thereby increasing the difficulty of cracking and tampering with the target ELF file and improving its security.

[0048] Example 2

[0049] Figure 2 This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 2 of the present invention. Based on the technical solution of the above embodiments, the present invention optimizes and improves the determination operation of the first search result and the second search result.

[0050] Furthermore, the step of "determining the first search result of the detection program in the code segment" is refined to "at every first preset time interval, search for the code of the detection program in the code segment; if the number of detection program codes found in the code segment is less than or equal to a preset first quantity threshold, then the first search result is not found", in order to improve the operation of determining the first search result.

[0051] Furthermore, the step of "determining the second search result of the shell program in the shell segment" is refined to "searching for the shell program code in the shell segment every second preset time interval; if the number of shell program codes found in the shell segment is less than or equal to a preset second quantity threshold, then the second search result is not found", in order to improve the operation of determining the second search result.

[0052] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0053] like Figure 2 The method shown includes:

[0054] S201. Obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes the header section, the shell section, and the compressed encryption section.

[0055] S202. Decompress the sub-segments in the compressed and encrypted section into memory, and search for the code of the detection program in the code segment every first preset time interval; wherein, the sub-segments in the compressed and encrypted section include the code segment.

[0056] In this embodiment, the first preset time can be set independently by technicians based on actual needs or practical experience, and this invention does not limit this. Specifically, the shell program is executed to decompress the sub-segments in the compressed and encrypted section into memory and start the first detection thread; through the first detection thread, the code of the detection program is searched in the code segment every first preset time.

[0057] S203. If the number of detection program codes found in the code segment is less than or equal to the preset first quantity threshold, then the first search result is not found.

[0058] In this embodiment, the preset first quantity threshold can be set independently by technicians based on actual needs or practical experience. Specifically, if the number of detection program codes found in the code segment is less than or equal to the preset first quantity threshold, the first search result is "not found"; otherwise, the first search result is "found".

[0059] It is understandable that, by adopting the above technical solution, if the number of detection program codes found in the code segment is less than or equal to the preset first quantity threshold, the first search result is not found. By searching for the code of the detection program in the code segment to determine the first search result, the accuracy of the first search result is improved. By comparing the number of detection program codes with the preset first quantity threshold, the efficiency of determining the first search result is improved.

[0060] S204. Every second preset time interval, search for the shell program code in the shell section.

[0061] In this embodiment, the first preset time can be set independently by technicians based on actual needs or practical experience, and this invention does not limit this. Specifically, a detection program is executed to start the first detection thread; through the first detection thread, the shell program code is searched in the shell segment every second preset time.

[0062] S205. If the number of shell program codes found in the shell section is less than or equal to the preset second quantity threshold, then the second search result is not found.

[0063] In this embodiment, the preset second quantity threshold can be set independently by technicians based on actual needs or practical experience. Specifically, if the number of shell program codes found in the shell segment is less than or equal to the preset second quantity threshold, the second search result is "not found"; otherwise, the second search result is "found".

[0064] It is understandable that, by adopting the above technical solution, if the number of shell program codes found in the shell section is less than or equal to the preset second quantity threshold, the second search result is not found. By searching for shell program codes in the shell section to determine the second search result, the accuracy of the second search result is improved. By comparing the number of shell program codes with the preset second quantity threshold, the efficiency of determining the second search result is improved.

[0065] S206. Based on the first search result and the second search result, determine the execution action of the target ELF file.

[0066] In this embodiment of the invention, a target ELF file is obtained, and its segments are loaded into memory. Sub-segments from the compressed and encrypted segments are decompressed into memory. At first preset time intervals, the code for a detection program is searched in the code segment. If the number of detection program codes found in the code segment is less than or equal to a preset first threshold, the first search result is "not found." At second preset time intervals, the code for a shell program is searched in the shell segment. If the number of shell program codes found in the shell segment is less than or equal to a preset second threshold, the second search result is "not found." Based on the first and second search results, the execution action of the target ELF file is determined. This embodiment of the invention improves the accuracy of the first search result by searching for the detection program code in the code segment; it improves the efficiency of determining the first search result by comparing the number of detection program codes with a preset first threshold; it improves the accuracy of the second search result by searching for the shell program code in the shell segment; and it improves the efficiency of determining the second search result by comparing the number of shell program codes with a preset second threshold.

[0067] Example 3

[0068] Figure 3A This is a flowchart of a method for determining the execution action of an ELF file according to Embodiment 3 of the present invention. Based on the technical solutions of the above embodiments, the present invention optimizes and improves the operation of determining the execution action.

[0069] Furthermore, the step of "determining the execution action of the target ELF file based on the first search result and the second search result" is further refined into "obtaining the original attribute information of the original ELF file associated with the target ELF file; determining the target attribute information of the target ELF file; determining the comparison result between the attribute information of the original ELF file and the attribute information of the target ELF file; and determining the execution action of the target ELF file based on the first search result, the second search result, and the comparison result," in order to improve the operation of determining the execution action.

[0070] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0071] like Figure 3A The method shown includes:

[0072] S301. Obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes the header section, the shell section, and the compressed encryption section.

[0073] S302. Decompress the sub-segments in the compressed and encrypted section into memory, and determine the first search result of the detection program in the code segment; wherein, the sub-segments in the compressed and encrypted section include the code segment.

[0074] S303. Determine the second search result of the shell program in the shell section.

[0075] S304. Obtain the original attribute information of the original ELF file associated with the target ELF file.

[0076] In this embodiment, the original ELF file can be the ELF file after its initial compilation. The original attribute information may include, but is not limited to, at least one of the following: the total data in each target storage space of the original ELF file, the hash value of the original ELF file, and the hash value of each page in the original ELF file.

[0077] The target storage space is a preset fixed-size storage space. The fixed size can be set by technicians based on actual needs or practical experience; this invention does not limit this. In one specific embodiment, the fixed size can be 64 bits. In an optional embodiment, the sum of data in each target storage space of the original ELF file is determined using preset data and algorithms, and this sum of data is stored as original attribute information in a preset first storage space of the target ELF file.

[0078] In one optional embodiment, a first hash value of the original ELF file is determined using a preset first hash algorithm, and this first hash value is stored in a preset second storage space of the target ELF file. In one specific embodiment, the size of the preset second storage space is 256 bits.

[0079] In one optional embodiment, a preset second hash algorithm is used to determine the hash value of each reference page of the original ELF file in memory, and the hash values ​​of each reference page are sequentially stored in the storage space corresponding to each reference page in the target ELF file. The correspondence between each reference page and the storage space can be set by an expert. The reference page can be any page of the original ELF file in memory. In one specific embodiment, the ratio between the size of the original ELF file and the size of a memory page is used as the number of pages in the original ELF file in memory.

[0080] It should be noted that the preset first hash algorithm and the preset second hash algorithm can be the same or different. In one specific implementation, both the preset first hash algorithm and the preset second hash algorithm are the SM3 algorithm (Chinese national cryptographic hash algorithm).

[0081] Specifically, the total data in each target storage space of the original ELF file associated with the target ELF file is obtained from the preset first storage space of the target ELF file; the hash value of the original ELF file associated with the target ELF file is obtained from the preset second storage space of the target ELF file; and the hash value of each page in the original ELF file is obtained from the storage space corresponding to each page in the target ELF file.

[0082] S305. Determine the target attribute information of the target ELF file.

[0083] Optionally, determining the target attribute information of the target ELF file includes at least one of the following: using preset data and algorithms to determine the total amount of data in each target storage space of the target ELF file as the target attribute information of the target ELF file; the target storage space is a preset fixed-size storage space; using a preset first hash algorithm to determine the first hash value of the target ELF file as the target attribute information of the target ELF file; selecting a target page from the candidate pages of the target ELF file in memory, and using a preset second hash algorithm to determine the second hash value of the target page as the target attribute information of the target ELF file.

[0084] Candidate pages can be any pages of the target ELF file in memory.

[0085] Specifically, using preset data and algorithms, the cumulative sum of all data in the target storage space of the target ELF file is taken as the data sum, and the data sum is used as the target attribute information of the target ELF file; a target page is randomly selected from the candidate pages of the target ELF file in memory, and a preset second hash algorithm is used to determine the second hash value of the target page, which is used as the target attribute information of the target ELF file.

[0086] In an optional embodiment, the code segment further includes at least one of the following: first attribute information determination program code, second attribute information determination program code, and third attribute information determination program code. The first attribute information determination program can be used to use preset data and algorithms to sum the cumulative data in all target storage spaces of the target ELF file as a total data sum, and use this total data sum as the target attribute information of the target ELF file. The second attribute information determination program can be used to use a preset first hash algorithm to determine a first hash value of the target ELF file, which is then used as the target attribute information of the target ELF file. The third attribute information determination program can be used to select a target page from candidate pages of the target ELF file in memory, and use a preset second hash algorithm to determine a second hash value of the target page, which is then used as the target attribute information of the target ELF file. Specifically, the target attribute information of the target ELF file is determined by executing at least one of the first, second, and third attribute information determination program codes.

[0087] It is understandable that by adopting the above technical solution, the total amount of data in each target storage space of the target ELF file is determined as the target attribute information; the first hash value of the target ELF file is determined as the target attribute information of the target ELF file; the target page is selected from the candidate pages of the target ELF file in memory, and the second hash value of the target page is determined by a preset second hash algorithm as the target attribute information of the target ELF file, thereby improving the diversity of target attribute information and the flexibility of determining target attribute information.

[0088] S306. Determine the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file.

[0089] In this embodiment, the comparison result is the comparison result between the original attribute information of the original ELF file and the target attribute information of the corresponding target ELF file. In a specific implementation, the comparison result is in numerical form. For example, if the comparison result is inconsistent, the comparison result is the number 90; if the comparison result is consistent, the comparison result is the number 10.

[0090] Optionally, the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file is determined, including at least one of the following:

[0091] The total data in each target storage space of the target ELF file is compared with the total data in each target storage space of the original ELF file. The comparison result is used as the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file.

[0092] The hash value of the target ELF file is compared with the hash value of the original ELF file, and the comparison result is used as the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file.

[0093] The corresponding page of the target page in the target ELF file is determined from each reference page in the original ELF file. The hash value of the corresponding page in the original ELF file is compared with the second hash value of the target page in the target ELF file. The comparison result is used as the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file.

[0094] S307. Based on the first search result, the second search result, and the comparison result, determine the execution action of the target ELF file.

[0095] In this embodiment, the actions also include generating exception alarms, cleaning up the program stack, and exiting at a random time. Exception alarms may include, for example, program heap exceptions and program stack exceptions. Exiting at a random time may involve removing the target ELF file from memory after a random period of time.

[0096] In one optional embodiment, if the first search result and / or the second search result do not exist, the execution action of the target ELF file is to exit immediately; in another optional embodiment, if both the first search result and the second search result exist and the comparison results are consistent, the execution action of the target ELF file is to continue executing the main program.

[0097] In another optional embodiment, if both the first search result and the second search result exist, and there is a comparison result that is inconsistent, then this embodiment further includes an exception lookup function, used to find the inconsistent comparison results and the error codes generated by the target ELF file during runtime; and to construct an error vector array using the found inconsistent comparison results and error codes as array elements; to determine the sum between each array element in the error vector array; and to determine the corresponding execution action based on the sum between each array element, which is used as the execution action for the target ELF file. Optionally, Figure 3B This is a schematic diagram illustrating the defined process of executing an action. For example... Figure 3B As shown in the diagram, the system includes an anomaly lookup function, an error vector array, and a decision module. The anomaly lookup array stores inconsistent comparison results and error codes as array elements in the error vector array. Elements such as 90, 97, 42, and 56 in the error vector array are examples of these array elements. The action determination module determines the corresponding action based on the sum of the elements in the error vector array, which is then used as the execution action for the target ELF file.

[0098] Understandably, by adopting the above technical solution, the detected inconsistent comparison results are used as array elements to construct a comparison result array; based on the sum of each array element, the corresponding execution action is determined as the execution action of the target ELF file. This achieves flexible determination of the execution action and avoids the immediate exit of the ELF file when the comparison result is inconsistent, which is common in existing technologies. This makes the ELF file easy to track and locate, thereby increasing the difficulty of cracking the target ELF file and improving its security.

[0099] This invention provides an embodiment of the invention that obtains a target ELF file and loads its segments into memory; decompresses sub-segments from the compressed and encrypted segments into memory, and determines the first search result of the detection program in the code segment; determines the second search result of the shell program in the shell segment; obtains the original attribute information of the original ELF file associated with the target ELF file; determines the target attribute information of the target ELF file; determines the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file; and determines the execution action of the target ELF file based on the first search result, the second search result, and the comparison result. This technical solution, by determining the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file, and determining the execution action of the target ELF file based on the first search result, the second search result, and the comparison result, achieves flexible determination of the execution action. This avoids the immediate exit from the ELF file when the comparison result is inconsistent, as is common in existing technologies, which makes the ELF file easily tracked and analyzed, thereby increasing the difficulty of cracking the target ELF file and improving its security.

[0100] Example 4

[0101] Figure 4 This is a structural diagram of an apparatus for determining the execution action of an ELF file according to Embodiment 4 of the present invention. This embodiment can be applied to situations where the execution result of an ELF file is determined. The apparatus for determining the execution action of an ELF file can be implemented in hardware and / or software and specifically configured in an electronic device, such as a digital video conversion device.

[0102] like Figure 4 The device for determining the execution action of an ELF file shown includes a file determination module 401, a first result determination module 402, a second result determination module 403, and an execution action determination module 404.

[0103] The file determination module 401 is used to obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes a header section, a shell section, and a compressed and encrypted section;

[0104] The first result determination module 402 is used to decompress the sub-segments in the compressed and encrypted section into memory, and determine the first search result of the detection program in the code segment; wherein, the sub-segments in the compressed and encrypted section include the code segment;

[0105] The second result determination module 403 is used to determine the second search result of the shell program in the shell section;

[0106] The execution action determination module 404 is used to determine the execution action of the target ELF file based on the first search result and the second search result.

[0107] This invention employs a file determination module to obtain a target ELF file and load its various sections into memory. Each section of the target ELF file includes a header section, a shell section, and a compressed / encrypted section. A first result determination module decompresses sub-sections within the compressed / encrypted section into memory and determines the first search result of the detection program in the code segment. The sub-sections within the compressed / encrypted section include a code segment and a data segment. A second result determination module determines the second search result of the shell program in the shell section. Finally, an execution action determination module determines the execution action of the target ELF file based on the first and second search results. This technical solution, by determining the first search result in the code segment and the second search result in the shell section, thereby determining the execution action of the target ELF file, prevents the main program of the target ELF file from running outside the shell program, thus increasing the difficulty of cracking and tampering with the target ELF file and improving its security.

[0108] Optionally, the first result determination module includes:

[0109] The first code search unit is used to search for the code of the detection program in the code segment at first preset time intervals;

[0110] The first result determination unit is used to determine the first search result as non-existent if the number of detection program codes found in the code segment is less than or equal to a preset first quantity threshold.

[0111] Optionally, the second result determination module includes:

[0112] The first code search unit is used to search for the shell program code in the shell segment every second preset time interval;

[0113] The second result determination unit is used to determine the second search result as "not found" if the number of shell program codes found in the shell segment is less than or equal to a preset second quantity threshold.

[0114] Optionally, the action determination module includes:

[0115] The first information acquisition unit is used to acquire the original attribute information of the original ELF file associated with the target ELF file;

[0116] The second information acquisition unit is used to determine the target attribute information of the target ELF file;

[0117] The comparison result determination unit is used to determine the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file.

[0118] The action determination unit is used to determine the action to be executed for the target ELF file based on the first search result, the second search result, and the comparison result.

[0119] Optionally, the second information acquisition unit includes at least one of the following:

[0120] The first information determination subunit is used to determine the total amount of data in each target storage space in the target ELF file using preset data and algorithms, which serves as the target attribute information of the target ELF file; the target storage space is a preset fixed-size storage space;

[0121] The second information determination subunit is used to determine the first hash value of the target ELF file using a preset first hash algorithm, which serves as the target attribute information of the target ELF file.

[0122] The third information determination subunit is used to select the target page from the candidate pages of the target ELF file in memory, and uses a preset second hash algorithm to determine the second hash value of the target page as the target attribute information of the target ELF file.

[0123] The above-mentioned ELF file execution action determination device can execute the ELF file execution action determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the determination method of each ELF file execution action.

[0124] Example 5

[0125] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0126] like Figure 5As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0127] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0128] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the method for determining the execution actions of an ELF file.

[0129] In some embodiments, the method for determining ELF file execution actions can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for determining ELF file execution actions described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method for determining ELF file execution actions by any other suitable means (e.g., by means of firmware).

[0130] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0131] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0132] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0133] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0134] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0135] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0136] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0137] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for determining the execution action of an ELF file, characterized in that, include: Obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes a header section, a shell section, and a compressed and encrypted section; The sub-segments in the compressed and encrypted section are decompressed into memory, and the first search result of the detection program is determined in the code segment by the shell program; wherein, the sub-segments in the compressed and encrypted section include the code segment; the detection program is a program that searches for the shell program in the shell segment; The detection procedure determines the second search result of the shell program in the shell segment; Based on the first search result and the second search result, determine the execution action of the target ELF file; The step of determining the execution action of the target ELF file based on the first search result and the second search result includes: If the first search result and / or the second search result do not exist, the execution action for the target ELF file is determined to be immediate exit; If both the first and second search results exist, the execution action for the target ELF file is determined to be to continue executing the main program.

2. The method according to claim 1, characterized in that, Determining the first search result of the detection program in the code segment includes: Every first preset time interval, the code of the detection program is searched in the code segment; If the number of detection program codes found in the code segment is less than or equal to a preset first quantity threshold, then the first search result is that the code does not exist.

3. The method according to claim 1, characterized in that, The determination of the second search result of the shell program in the shell segment includes: Every second preset time interval, the shell program code is searched in the shell segment; If the number of shell program codes found in the shell segment is less than or equal to a preset second quantity threshold, then the second search result is "not found".

4. The method according to claim 1, characterized in that, The step of determining the execution action of the target ELF file based on the first search result and the second search result includes: Obtain the original attribute information of the original ELF file associated with the target ELF file; Determine the target attribute information of the target ELF file; Determine the comparison result between the original attribute information of the original ELF file and the target attribute information of the target ELF file; Based on the first search result, the second search result, and the comparison result, the execution action of the target ELF file is determined.

5. The method according to claim 4, characterized in that, Determining the target attribute information of the target ELF file includes at least one of the following: Using preset data and algorithms, the total amount of data in each target storage space of the target ELF file is determined, which is used as the target attribute information of the target ELF file; the target storage space is a preset fixed-size storage space; A preset first hash algorithm is used to determine the first hash value of the target ELF file, which is used as the target attribute information of the target ELF file. The target page is selected from the candidate pages in memory of the target ELF file, and the second hash value of the target page is determined by a preset second hash algorithm, which is used as the target attribute information of the target ELF file.

6. A device for determining the execution action of an ELF file, characterized in that, include: The file loading module is used to obtain the target ELF file and load each section of the target ELF file into memory; wherein, each section of the target ELF file includes a header section, a shell section, and a compressed and encrypted section; The first result determination module is used to decompress the sub-segments in the compressed and encrypted section into memory, and determine the first search result of the detection program in the code segment through the shell program; wherein, the sub-segments in the compressed and encrypted section include code segment and data segment; the detection program is a program that searches for the shell program in the shell segment; The second result determination module is used to determine the second search result of the shell program in the shell segment through the detection program; An action determination module is used to determine the action to be executed for the target ELF file based on the first search result and the second search result. The action determination module is specifically used for: If the first search result and / or the second search result are not found, then the execution action for the target ELF file is determined to be immediate exit; If both the first search result and the second search result exist, then the execution action for the target ELF file is determined to be to continue executing the main program.

7. The apparatus according to claim 6, characterized in that, The first result determination module includes: The first code search unit is used to search for the code of the detection program in the code segment at a first preset time interval; The first result determination unit is configured to determine that if the number of detection program codes found in the code segment is less than or equal to a preset first quantity threshold, then the first search result is that the code does not exist.

8. The apparatus according to claim 6, characterized in that, The second result determination module includes: The first code search unit is used to search for the shell program code in the shell segment every second preset time. The second result determination unit is configured to determine that if the number of shell program codes found in the shell segment is less than or equal to a preset second quantity threshold, then the second search result is that the shell does not exist.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method for determining the execution action of the ELF file according to any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the method for determining the execution action of the ELF file as described in any one of claims 1-5.

Images