A method and device for mimetic evolution of an ARM single-chip microcomputer

Abstract

The application belongs to the technical field of network security, and discloses a quasi-state compiling method and device for an ARM single-chip microcomputer, which comprises the following steps: customizing a linking file required by a cross-compiling tool chain to complete memory layout of an executable program; for a master controller of an ARM architecture and a Cortex series kernel, based on a cross-compiling technology, using the linking file required by the cross-compiling tool chain, realizing a heterogeneous execution body with offset of a read-only data segment and a stack area loading base address under the architecture and the kernel through compiling and linking; the heterogeneous execution body processes external input data, if the external input data is a normal data packet, the outputs of the heterogeneous execution bodies are the same, and if the external input data includes an attack data packet, the outputs of the heterogeneous execution bodies are different. The application is guided by the quasi-state defense theory, and through construction of an address redundancy heterogeneous execution body with variable loading base address, the attack threat of a buffer vulnerability can be reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a mimicry compilation method and apparatus for ARM microcontrollers. Background Technology

[0002] Existing technologies increase the redundancy of embedded systems through code backup in memory, or by modifying linker files to insert obfuscated code. However, these technologies lack protection for stack data, leaving the device vulnerable to buffer overflow attacks where the attack payload is placed in the stack area. Summary of the Invention

[0003] Because exploit code is usually binary code, and the addresses of each segment are fixed after the program image is burned into the memory, there is a risk of attacks such as buffer overflow after the device is connected to the network. In response to the above problems, this invention proposes a mimicry compilation method and device for ARM microcontrollers. Based on the mimicry defense theory, this invention can resist this type of attack by constructing an address-redundant heterogeneous execution body with a variable load base address.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] This invention proposes a mimicry compilation method for ARM microcontrollers, comprising:

[0006] Customize the linker files required for the cross-compilation toolchain to complete the memory layout of the executable program;

[0007] For ARM architecture and Cortex series core main controllers, based on cross-compilation technology, using the linker files required by the customized cross-compilation toolchain, a heterogeneous executable with offset read-only data segments and stack loading base addresses under this architecture and kernel is implemented through compilation and linking.

[0008] Furthermore, after compiling and implementing the heterogeneous executable, it also includes:

[0009] Heterogeneous executors process externally input data. If the externally input data is a normal data packet, the output of each heterogeneous executor is the same. If the externally input data includes attack data packets, the output of each heterogeneous executor is different.

[0010] Furthermore, the customization of the linker files required for the cross-compilation toolchain includes:

[0011] In the linker file of the cross-compilation toolchain, the load base address of the stack area and the read-only data segment is set.

[0012] Furthermore, it also includes:

[0013] Customize the stack size of the executable program's startup header file.

[0014] Furthermore, the cross-compilation toolchain includes fromelf and arm-linux-gcc.

[0015] Furthermore, when using fromelf, the startup header file and the linker files required by the cross-compilation toolchain should be customized as follows:

[0016] First, set the stack and heap size in bytes in the startup header file start.s. Second, customize LR_IROM1, ER_IROM1, and RW_IRAM1 in the link file link.sct.

[0017] Furthermore, the customization of the link file link.sct specifically includes:

[0018] First, the ROM region is divided into two parts, LR__IROM1 and LR__IROM2. Second, the RAM region is also divided into two parts, RW_IRAM1 and RW_IRAM2. The contents of LR__IROM1 represent the data required for initialization operations. LR__IROM2 represents the base address of the read-only data segment in the main function code. RW_IRAM1 represents the base address for reading and writing data and zero data loading required for initialization. In addition to reading and writing data and zero data, stack data is also loaded into RW_IRAM2.

[0019] Another aspect of the present invention proposes a mimicry compilation device for ARM microcontrollers, comprising:

[0020] The linker customization module is used to customize the linker files required by the cross-compilation toolchain to complete the memory layout of the executable program; the heterogeneous executable module is used for ARM architecture and Cortex series core main controllers. Based on cross-compilation technology, it uses the linker files required by the customized cross-compilation toolchain to compile and link to implement a heterogeneous executable with offset read-only data segments and stack loading base addresses under this architecture and kernel.

[0021] Furthermore, it also includes:

[0022] The heterogeneous execution module is used by heterogeneous executors to process externally input data. If the externally input data is a normal data packet, the output of each heterogeneous executor is the same. If the externally input data includes attack data packets, the output of each heterogeneous executor is different.

[0023] Furthermore, the customization of the linker files required for the cross-compilation toolchain includes:

[0024] In the linker file of the cross-compilation toolchain, the load base address of the stack area and the read-only data segment is set.

[0025] Furthermore, it also includes:

[0026] The startup header file customization module is used to customize the stack size of the executable program's startup header file.

[0027] Furthermore, the cross-compilation toolchain includes fromelf and arm-linux-gcc.

[0028] Furthermore, when using fromelf, the startup header file and the linker files required by the cross-compilation toolchain should be customized as follows:

[0029] First, set the stack and heap size in bytes in the startup header file start.s. Second, customize LR_IROM1, ER_IROM1, and RW_IRAM1 in the link file link.sct.

[0030] Furthermore, the customization of the link file link.sct specifically includes:

[0031] First, the ROM region is divided into two parts, LR__IROM1 and LR__IROM2. Second, the RAM region is also divided into two parts, RW_IRAM1 and RW_IRAM2. The contents of LR__IROM1 represent the data required for initialization operations. LR__IROM2 represents the base address of the read-only data segment in the main function code. RW_IRAM1 represents the base address for reading and writing data and zero data loading required for initialization. In addition to reading and writing data and zero data, stack data is also loaded into RW_IRAM2.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] Compared to hardware-based security defense systems, this invention offers advantages in resisting buffer overflow attacks due to lower storage and computational overhead. The method of constructing heterogeneous redundant execution entities with variable addresses further reduces the threat of buffer overflow vulnerabilities.

[0034] Because microcontroller control systems have limited resources, it is difficult to deploy PC-side security measures. This invention utilizes a scheme of modifying the linker file to achieve secure deployment of a microcontroller control system with a variable loading address. Attached Figure Description

[0035] Figure 1This is a flowchart illustrating a mimicry compilation method for ARM microcontrollers according to an embodiment of the present invention;

[0036] Figure 2 This is one of the structural schematic diagrams of a mimicry compilation device for ARM microcontrollers according to an embodiment of the present invention;

[0037] Figure 3 This is the second schematic diagram of a mimicry compilation device for ARM microcontrollers according to an embodiment of the present invention. Detailed Implementation

[0038] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0039] like Figure 1 As shown, a mimicry compilation method for ARM microcontrollers includes:

[0040] This tool compiles executable programs under any operating system, such as Windows and Linux. Based on the user code and the memory addresses of the desired heterogeneous executables, it generates semantically equivalent redundant heterogeneous executables for the ARM architecture and its corresponding kernel. During actual device execution, each executable produces the same effect. For example, an STM32F103x with an ARM architecture, Cortex-M3 core, and external Flash memory and RAM.

[0041] Furthermore, the method includes:

[0042] For ARM architecture and Cortex series core controllers, based on cross-compilation technology and utilizing a customized cross-compilation toolchain, a heterogeneous executable with offset read-only data segments and stack load base addresses under this architecture and kernel is compiled and linked. For example, custom toolchains such as fromelf and arm-linux-gcc are implemented.

[0043] The linker file of the cross-compilation toolchain is used to customize the load base address for the stack area and read-only data segment. The startup header file of the executable program is used to customize the stack size. This is the key to generating heterogeneous executables.

[0044] When the firmware receives external data, it enters the heterogeneous execution body for execution. If it is a normal data packet, the execution process (output) of multiple heterogeneous execution bodies is the same; if there is an attack data packet, the heterogeneous execution bodies will output different execution results.

[0045] In summary, to construct redundant heterogeneous executables, users need to specify the code segment addresses and stack addresses in the linker file according to the linker file writing specifications and the chip's memory alignment method. This simultaneously protects the read-only data segment and stack data. It is worth noting that this invention can implement multiple heterogeneous executables with a lightweight number of devices while maintaining the same CPU load during operation.

[0046] As one possible implementation method, when the cross-compilation toolchain used is fromelf, the method specifically includes:

[0047] First, after writing the C code, the linker file `link.sct` is customized (different compilation toolchains require different linker files; the rules and syntax for writing linker scripts are specific to the linker. For example, arm-linux-gcc requires a `.lds` file). The original linker file content is as follows:

[0048]

[0049] The above code represents: the link address of the read-only data segment is LR_IROM1 = 0x08000000, with an address range of 0x00008000; the execution address is ER_IROM1 = 0x08000000, with an address range of 0x00008000. In STM32, these two are usually the same. The memory load base address is RW_IRAM1 = 0x20000000, with an address range of 0x00008000. When compiled using a custom cross-compilation toolchain, the executable program, after being burned to memory, has an address of 0x20000000, and its runtime memory base address is 0x20000000.

[0050] Secondly, constructing the heterogeneous executable is crucial. Since STM32 is 4-byte aligned, address offsets must be multiples of 4 bytes. The construction method for the heterogeneous executable with code segment and stack address offsets is as follows: First, customize the byte size of the stack and heap in the startup header file `start.s`. Second, customize `LR_IROM1`, `ER_IROM1`, and `RW_IRAM1` in the linker file `link.sct`. Assuming the main functional code in the C language is in the `bsp_led.c` file, and the user mainly completes the heterogeneous construction of this part, we need to customize the startup file and linker file as follows:

[0051]

[0052] The code above completes the customization of link.sct. First, it divides the ROM region into two parts, LR__IROM1 and LR__IROM2. Second, it also divides the RAM region into two parts, RW_IRAM1 and RW_IRAM2. The contents of each part are explained as follows: LR__IROM1 contains the data needed for initialization operations; LR__IROM2 represents the base address of the read-only data segment in the main functional code; RW_IRAM1 represents the base address for loading read / write data and zero data required for initialization; in addition to read / write data and zero data, stack data is also loaded into RW_IRAM2.

[0053] Therefore, by customizing the startup header file start.s and the linker file link.sct, a heterogeneous executable with variable base addresses for data segments and stack areas can be constructed on a lightweight number of ARM architecture microcontrollers. The table below shows the runtime addresses of each executable.

[0054] Read-only data segment load base address 0x08000000 0x08040000 0x08050000 0x080xxxxx Stack area load base address 0x20000000 0x20006000 0x20005000 0x2000xxxx

[0055] As one possible implementation, this invention also employs a customized arm-linux-gcc toolchain to generate a heterogeneous executable for the Cortex-A7 core's I.MX6ULL. This also requires corresponding initialization configuration in the startup file. The linker file required under this toolchain is a .lds file, which differs from the file required by the fromelf toolchain in its format. For heterogeneous executable generation, the file is customized according to the general .lds file format, as follows:

[0056]

[0057] As needed, simply set the code segment load base address and data segment address in the linker file. Then, link using the `-T` parameter in `arm-linux-gcc`, for example, by entering the command: `arm-linux-gcc-Tlink.lds*.co.des`. This will generate heterogeneous executables with multiple address offsets based on the address adjustments made each time.

[0058] Furthermore, the microcontroller device can receive external data using a serial port or other data receiving module. Upon receiving external data, it enters a heterogeneous execution unit for execution. If the data packet is normal, the execution process and output results of multiple heterogeneous execution units will be identical; however, if there is an attack data packet, different execution results will inevitably occur in the heterogeneous execution units.

[0059] Based on the above embodiments, such as Figure 2 As shown, this invention also proposes a mimicry compilation device for ARM microcontrollers, comprising:

[0060] The linker customization module is used to customize the linker files required by the cross-compilation toolchain in order to complete the memory layout of the executable program;

[0061] The heterogeneous execution body building module is used for main controllers with ARM architecture and Cortex series cores. Based on cross-compilation technology, it uses the linker files required by the customized cross-compilation toolchain to compile and link a heterogeneous execution body with offset read-only data segments and stack loading base addresses under this architecture and kernel.

[0062] Furthermore, such as Figure 3 As shown, it also includes:

[0063] The heterogeneous execution module is used by heterogeneous executors to process externally input data. If the externally input data is a normal data packet, the output of each heterogeneous executor is the same. If the externally input data includes attack data packets, the output of each heterogeneous executor is different.

[0064] Furthermore, the customization of the linker files required for the cross-compilation toolchain includes:

[0065] In the linker file of the cross-compilation toolchain, the load base address of the stack area and the read-only data segment is set.

[0066] Furthermore, it also includes:

[0067] The startup header file customization module is used to customize the stack size of the executable program's startup header file.

[0068] Furthermore, the cross-compilation toolchain includes fromelf and arm-linux-gcc.

[0069] Furthermore, when using fromelf, the startup header file and the linker files required by the cross-compilation toolchain should be customized as follows:

[0070] First, set the stack and heap size in bytes in the startup header file start.s. Second, customize LR_IROM1, ER_IROM1, and RW_IRAM1 in the link file link.sct.

[0071] Furthermore, the customization of the link file link.sct specifically includes:

[0072] First, the ROM region is divided into two parts, LR__IROM1 and LR__IROM2. Second, the RAM region is also divided into two parts, RW_IRAM1 and RW_IRAM2. The contents of LR__IROM1 represent the data required for initialization operations. LR__IROM2 represents the base address of the read-only data segment in the main function code. RW_IRAM1 represents the base address for reading and writing data and zero data loading required for initialization. In addition to reading and writing data and zero data, stack data is also loaded into RW_IRAM2.

[0073] In summary, compared to hardware-based security defense systems, this invention offers advantages in resisting buffer overflow attacks due to lower storage and computational overhead. The method of constructing heterogeneous redundant execution entities with variable addresses reduces the threat of buffer overflow vulnerabilities. Because microcontroller control systems inherently have limited resources, deploying PC-side security measures is difficult. This invention utilizes a scheme that modifies the linker file to achieve secure deployment of a microcontroller control system with variable addresses.

[0074] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A mimicry compilation method for ARM microcontrollers, characterized in that, include: Customize the linker files required for the cross-compilation toolchain to complete the memory layout of the executable program; For the main controller of ARM architecture and Cortex series core, based on cross-compilation technology, using the linker files required by the customized cross-compilation toolchain, a heterogeneous executable with offset read-only data segment and stack area loading base address under this architecture and kernel is implemented through compilation and linking. After compiling and implementing the heterogeneous executable, the following is also included: Heterogeneous executors process externally input data. If the externally input data is a normal data packet, the output of each heterogeneous executor is the same. If the externally input data includes attack data packets, the output of each heterogeneous executor is different. Also includes: Customize the stack size of the executable program's startup header file; When using fromelf as the cross-compilation toolchain, the startup header file and the linker files required by the cross-compilation toolchain should be customized as follows: First, set the stack and heap size in bytes in the startup header file start.s. Second, customize LR_IROM1, ER_IROM1, and RW_IRAM1 in the link file link.sct. Customization of the link file link.sct specifically includes: First, the ROM region is divided into two parts, LR__IROM1 and LR__IROM2. Second, the RAM region is also divided into two parts, RW_IRAM1 and RW_IRAM2. The contents of LR__IROM1 represent the data required for initialization operations. LR__IROM2 represents the base address of the read-only data segment in the main function code. RW_IRAM1 represents the base address for reading and writing data and zero data loading required for initialization. In addition to reading and writing data and zero data, stack data is also loaded into RW_IRAM2.

2. The mimicry compilation method for ARM microcontrollers according to claim 1, characterized in that, The customization of the linker files required for the cross-compilation toolchain includes: In the linker file of the cross-compilation toolchain, the load base address of the stack area and the read-only data segment is set.

3. The mimicry compilation method for ARM microcontrollers according to claim 1, characterized in that, The cross-compilation toolchain includes fromelf and arm-linux-gcc.

4. A mimicry compiler for ARM microcontrollers, characterized in that, include: The linker customization module is used to customize the linker files required by the cross-compilation toolchain in order to complete the memory layout of the executable program; The heterogeneous execution body building module is used for main controllers with ARM architecture and Cortex series cores. Based on cross-compilation technology, it uses the linker files required by the customized cross-compilation toolchain to compile and link a heterogeneous execution body with offset read-only data segment and stack area loading base address under this architecture and kernel. Also includes: The heterogeneous execution module is used by heterogeneous executors to process externally input data. If the externally input data is a normal data packet, the output of each heterogeneous executor is the same. If the externally input data includes attack data packets, the output of each heterogeneous executor is different. The startup header file customization module is used to customize the stack size of the executable program's startup header file; When using fromelf as the cross-compilation toolchain, the startup header file and the linker files required by the cross-compilation toolchain should be customized as follows: First, set the stack and heap size in bytes in the startup header file start.s. Second, customize LR_IROM1, ER_IROM1, and RW_IRAM1 in the link file link.sct. Customization of the link file link.sct specifically includes: First, the ROM region is divided into two parts, LR__IROM1 and LR__IROM2. Second, the RAM region is also divided into two parts, RW_IRAM1 and RW_IRAM2. The contents of LR__IROM1 represent the data required for initialization operations. LR__IROM2 represents the base address of the read-only data segment in the main function code. RW_IRAM1 represents the base address for reading and writing data and zero data loading required for initialization. In addition to reading and writing data and zero data, stack data is also loaded into RW_IRAM2.

Images