Malicious code defense method, system, electronic device and storage medium based on simulated camouflage debugging environment

Abstract

The malicious code defense method, system, electronic device and storage medium based on simulated disguised debugging environment disclosed in the embodiment of the present invention relate to the technical field of malicious code protection. It can realize the detection and defense of malicious code. The method includes: obtaining the function call related to debugging in the system, modifying the return value of the function call; modifying the registry item related to the debugger configuration in the system registry; the registry item includes: calling the debugger name; starting at least one debugger process in the system to simulate and disguise the running debugging environment to confuse the malicious code to misjudge that it is currently in the running debugging environment when executing; monitoring the execution of instructions used to measure the execution time of malicious code; when the execution time of the instruction is monitored to be abnormal, controlling the execution behavior of the instruction to prevent the malicious code from judging the current simulated disguised debugging environment. It is suitable for malicious code detection scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of malicious code protection, and in particular to a malicious code defense method, system, electronic device and storage medium based on a simulated camouflage debugging environment. Background Art

[0002] Malicious code refers to software or programs designed to perform malicious actions. Its purpose is usually to cause damage to computer systems, data, user privacy or networks, including but not limited to stealing personal information, spreading viruses, launching network attacks, and extorting data. In order to protect and hide their code, malicious code developers will use a variety of means to make it difficult to detect, analyze and remove malicious code.

[0003] Currently, malicious code is constantly evolving and upgrading, and continues to try new methods to evade detection and analysis. One of the commonly used strategies is to detect whether it is in a debugging state, so as to avoid monitoring and analysis by security researchers and anti-virus software. This strategy makes it more difficult to detect and combat malicious code. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide a malicious code defense method, system, electronic device and storage medium based on a simulated camouflage debugging environment, which can realize the detection and defense of malicious code.

[0005] In order to achieve the above-mentioned invention object, the following technical scheme is adopted:

[0006] In the first aspect, an embodiment of the present invention provides a malicious code defense method based on simulating and disguising a debugging environment, the method comprising: obtaining a debugging-related function call in the system, and modifying a return value of the function call; modifying a registry entry related to a debugger configuration in a system registry; the registry entry comprises: a debugger name; starting at least one debugger process in the system to simulate and disguise a running debugging environment to confuse malicious code execution into misjudging that the code is currently in a running debugging environment; monitoring the execution of instructions for measuring the execution time of malicious code; the execution comprises: execution time; when an abnormality is detected in the execution time of the instruction, controlling the execution behavior of the instruction to prevent malicious code from determining the current simulated and disguising debugging environment.

[0007] Optionally, when it is monitored that the execution time of the instruction is abnormal, the execution behavior of the instruction is controlled, including: when it is monitored that the malicious code continuously calls the instruction for a time exceeding a preset threshold, the execution behavior of the instruction is intercepted and the timestamp counter value is stopped from being increased.

[0008] Optionally, before obtaining debugging-related function calls in the system, the method also includes: turning on the virtualization option of the current environment of the system; installing at least one virtual machine software in a designated directory, and making the executable file and related components of the virtual machine software exist to simulate a real virtual machine environment; installing the driver of the virtual machine software in the virtual machine environment; creating processes related to at least one of the virtual machine software, and monitoring the processes so that when the malicious code detects the process indicated by the process name identifier of the process, it mistakenly determines that it is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process.

[0009] Optionally, the acquisition of debugging-related function calls in the system and modifying the return value of the function call include: determining a debugging-related system function that needs to be acquired, the debugging-related system function being used to detect the presence of a debugger or interact with a debugger; calling a dynamic link library import table or obtaining an address of a target function in memory through an API query; using a hook function to intercept calls to the target function; inserting a jump instruction at the beginning of the target function to transfer control to a custom processing function, the custom processing function being used to modify the function call return value when malicious code calls the target function.

[0010] In a second aspect, the present invention also provides an embodiment of a malicious code defense system based on a simulated camouflaged debugging environment, the system comprising: a first modification module, used to obtain debugging-related function calls in the system and modify the return value of the function call; a second modification module, used to modify the registry items related to the debugger configuration in the system registry; the registry items include: the debugger name; a process simulation camouflage module, used to start at least one debugger process in the system to simulate and camouflage the running debugging environment, so as to confuse the malicious code to misjudge that it is currently in the running debugging environment when executing; a first monitoring module, used to monitor the execution of instructions used to measure the execution time of malicious code; the execution status includes: execution time; a first control module, used to control the execution behavior of the instruction when the execution time of the instruction is monitored to be abnormal, so as to prevent the malicious code from determining the current simulated camouflaged debugging environment.

[0011] Optionally, the first control module is specifically used to intercept the execution of the instruction and stop increasing the timestamp counter value when it is monitored that the malicious code continuously calls the instruction for a time exceeding a preset threshold.

[0012] Optionally, it also includes: a virtual environment creation module, which is specifically used to enable the virtualization option of the current environment of the system; install at least one virtual machine software in a specified directory, and make the executable files and related components of the virtual machine software exist to simulate a real virtual machine environment; install the driver of the virtual machine software in the virtual machine environment; create processes related to at least one virtual machine software, and monitor the processes so that when the malicious code detects the process indicated by the process name identifier of the process, it mistakenly determines that it is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process.

[0013] Optionally, the first modification module is specifically used to determine the debugging-related system functions that need to be obtained, and the debugging-related system functions are used to detect the existence of a debugger or interact with a debugger; call the dynamic link library import table or obtain the address of the target function in the memory through an API query; use a hook function to intercept the call to the target function; insert a jump instruction at the beginning of the target function to transfer control to a custom processing function, and the custom processing function is used to modify the function call return value when the malicious code calls the target function.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the malicious code defense method based on the simulated camouflage debugging environment described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to execute any malicious code defense method based on a simulated camouflage debugging environment as described in the first aspect.

[0016] The malicious code defense method, system, electronic device and storage medium based on the simulated disguised debugging environment provided by the embodiment of the present invention first obtains the function call related to debugging in the system, modifies the return value of the function call, so that the malicious code judges that it is being debugged according to the return value; then, the registry item related to the debugger configuration in the system registry is modified to the name of the debugging software, so that the malicious code judges that it is the debugging software according to the value of the registry, and finally starts at least one debugger process in the system to simulate and disguise the running debugging environment to confuse the malicious code to mistakenly judge that it is currently in the running debugging environment when executing. In this way, by simulating the disguised debugging environment, the malicious code mistakenly believes that it is currently being analyzed and debugged, so as to stop executing malicious behavior and end the process, thereby realizing the detection and defense of malicious code. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a malicious code defense method based on a simulated camouflage debugging environment according to an embodiment of the present invention;

[0019] Figure 2 A schematic diagram of a method flow in step S110 of a malicious code defense method based on a simulated camouflage debugging environment according to an embodiment of the invention;

[0020] Figure 3 This is a schematic block diagram of a malicious code defense system architecture based on a simulated camouflage debugging environment according to an embodiment of the present invention;

[0021] Figure 4 The present invention is a schematic block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In the related art, malicious code is a software or program designed to perform malicious behavior. The goal of malicious code is usually to cause damage to computer systems, data, user privacy or networks, including but not limited to stealing personal information, spreading viruses, attacking networks, extorting data, etc. These malware developers use various techniques to protect and hide their codes, making them difficult to detect, analyze and remove. One common technique is to detect whether it is being debugged to evade the monitoring and analysis of security researchers and anti-virus software.

[0025] Take GuLoader as an example. GuLoader is a common malware payload loader used to spread and execute malicious code, including banking Trojans, ransomware, spyware, or other malware variants. GuLoader's main function is to load malicious code onto the user's computer while minimizing the risk of being detected. In addition, GuLoader uses a lot of anti-debugging techniques to make it more difficult for users to detect.

[0026] The embodiment of the present invention provides a malicious code defense method based on simulating a disguised debugging environment. By simulating a disguised debugging environment, the malicious code mistakenly believes that it is being analyzed, thereby stopping the execution of malicious behavior, thereby preventing users from being attacked by the malicious code and suffering losses.

[0027] See also Figure 1 As shown, the embodiment of the present invention provides a malicious code defense method based on simulating a disguised debugging environment. The method can be solidified in a certain manufactured physical product in the form of software. When the user uses the product, the method flow of the present application can be reproduced. The method includes the steps of:

[0028] S110: Obtain a debugging-related function call in the system, and modify a return value of the function call.

[0029] In this embodiment, one of the common techniques for detecting malicious code is to detect whether it is being debugged. If it is detected that it is being debugged, the malicious code can stop executing malicious behavior, making it more difficult to identify and analyze. This embodiment uses the above characteristics of malicious code to hijack the debugging-related function calls in the system through API hooking technology, and modify the return value of the function call, so that when the malicious code calls such a function, it will get a result with a return value of True, that is, it will think that the malicious code itself is currently being debugged, and thus stop continuing to execute malicious behavior.

[0030] Specifically, the Windows operating system provides some APIs, and an application can detect whether it is being debugged by calling these APIs, for example, IsDebuggerPresent, NtQueryInformationProcess, GetLastError, ZwSetInformationThread and other functions.

[0031] In this embodiment, when the function call related to debugging in the system is hijacked and the return value of the function call is modified, for example, the function call can be hijacked through the API hooking technology, and the return value of the APIs such as IsDebuggerPresent and CheckRemoteDebuggerPresent that detect whether the system is being debugged is modified to True. When the malicious code calls such an API and gets a return value of True, it will think that it is currently being debugged and will stop executing malicious behavior.

[0032] In some embodiments, see Figure 2 As shown, the acquiring of the debugging-related function call in the system and the modification of the return value of the function call include:

[0033] S111, determining a debugging-related system function that needs to be acquired, where the debugging-related system function is used to detect the existence of a debugger or interact with a debugger;

[0034] S113, calling the dynamic link library import table or querying through the API to obtain the address of the target function in the memory;

[0035] S115, using the hook function to intercept the call to the target function;

[0036] S117, inserting a jump instruction at the beginning of the target function to transfer control to a custom processing function, wherein the custom processing function is used to modify the function call return value when the malicious code calls the target function.

[0037] In this embodiment, the debugging-related function calls in the system are hijacked through API hooking technology, and the return value of the function call is modified. The API hooking technology is a technology used in software development and system programming, which allows programmers to intercept and modify the behavior of API calls of the operating system or application.

[0038] Specifically, determine the debugging-related system functions that need to be obtained, such as sDebuggerPresent and CheckRemoteDebuggerPresent functions, which are used to detect whether the system is being debugged. Obtain the address of the target function in memory by calling the dynamic link library import table or querying the API. Use the hook function to intercept the call to the target function, insert a jump instruction at the beginning of the target function, and transfer control to the custom processing function. The custom processing function is used to modify the function call return value when the malicious code calls the target function.

[0039] Specifically, by traversing the import table of the dynamic link library, the address of the target function in the DLL (Dynamic Link Library) is found, the call to the target function is intercepted by a hook function, and a jump instruction is inserted at the beginning of the target function to transfer control to a custom processing function, where the custom processing function is used to modify the function call return value when the malicious code calls the target function. In this way, when the malicious code calls the API, the custom processing function modifies the function call return value, and the malicious code gets a return value of True, which means that it will think that it is currently being debugged and will stop executing malicious behavior.

[0040] In some embodiments, the import table in the dynamic link library lists: DDL name: the names of all dynamic link libraries required by the program. For example, if a program needs to use `kernel32.dll`, the name of the DLL will be listed in the import table, and, Function name or serial number: For each DLL, the import table will also list the specific function called by the program, which can be the name of the function (such as `CreateFile`) or the serial number of the function in the DLL.

[0041] S120: Modify a registry entry related to debugger configuration in the system registry; the registry entry includes: a debugger name.

[0042] In this embodiment, the characteristic of malicious code that reads the value under the registry path when evading detection and compares it with the value added to the blacklist is utilized, and the registry items related to the debugger configuration in each system registry are modified according to different systems. The registry items include the debugger name, so that when the malicious code reads the value in the registry, it compares it with the debugger name added to the blacklist, and stops the malicious behavior when it finds a match.

[0043] Specifically, in some embodiments, the values ​​of the following registry paths may be modified according to different systems:

[0044] "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\WindowsNT\CurrentVersion\AeDebug" (32-bit systems); or,

[0045] "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\AeDebug" (64-bit system); change the value to the name of the debugging software such as "Ollydbg". When the malicious code reads the value under this path, it compares it with the debugger name added to the blacklist. If it is consistent, the malicious behavior will be stopped.

[0046] S130: starting at least one debugger process in the system to simulate and disguise a running debugging environment, so as to confuse malicious code into misjudging that it is currently in a running debugging environment when executing.

[0047] A debugging environment is an operating environment or a collection of tools used to analyze, test, and debug computer programs. When performing malicious code detection, a debugging environment is used to analyze and reverse engineer malicious code, use debuggers to study the inner workings of malicious code, look for signs of malicious behavior, and develop solutions to detect and remove malware.

[0048] Malicious code usually enumerates the list of processes running in the system and searches for common debugger processes. When it finds that a debugger process is running in the system, it terminates the malicious behavior. In this embodiment, at least one debugger process is created and started in the system to simulate and disguise a running debugging environment, so as to confuse the malicious code to misjudge that it is currently in a running debugging environment when it is executed, thereby terminating the malicious behavior.

[0049] The debugger process includes at least processes of debugger software such as Ollydbg, Windbg, and IDA.

[0050] The malicious code defense method based on simulating a disguised debugging environment provided by the embodiment of the present invention obtains the function call related to debugging in the system, modifies the return value of the function call, so that the malicious code judges that it is being debugged according to the return value; modifies the registry item related to the debugger configuration in the system registry to the name of the debugging software, so that the malicious code judges that it is the debugging software according to the value of the registry, and finally starts at least one debugger process in the system to simulate and disguise the running debugging environment to confuse the malicious code to mistakenly judge that it is currently in the running debugging environment when executing. In this way, by simulating the disguised debugging environment, the malicious code mistakenly believes that it is currently being analyzed and debugged, thereby stopping the execution of malicious behavior and terminating the process, thereby protecting the terminal.

[0051] S140, monitoring the execution status of instructions for measuring the execution time of malicious code; the execution status includes: execution time;

[0052] S150: When the execution time of the instruction is monitored to be abnormal, the execution behavior of the instruction is controlled to prevent malicious code from determining the current simulated camouflage debugging environment.

[0053] In some embodiments, when the execution time of the instruction is monitored to be abnormal, the execution behavior of the instruction is controlled, including: when it is monitored that the malicious code continuously calls the instruction for a time exceeding a preset threshold, the execution behavior of the instruction is intercepted and the timestamp counter value is stopped from being increased.

[0054] The purpose of the malicious code executing the rdtsc instruction (reading the timestamp counter) multiple times continuously is to detect whether it is being debugged or monitored. The basic principle is to use the characteristics of the timestamp counter to detect the presence of the debugger. For malicious code software with anti-debugging technology, the rdtsc instruction is executed multiple times, and the execution time of the instruction is calculated. When it is found that the execution time is too long, the malicious code will end its operation.

[0055] In this embodiment, the time for which malicious code continuously calls instructions is monitored. When it is monitored that the time for which the malicious code continuously calls the instructions exceeds a preset threshold, the execution of the instructions is intercepted and the incrementing of the timestamp counter value is stopped, so that the malicious code believes that it is being debugged, thereby ending the malicious behavior.

[0056] In some embodiments, the timestamp counter is a counter inside a processor, which is used to measure time intervals. When the system is operating normally, the value of the timestamp counter will continue to increase. However, when a program is being debugged, the debugger will pause or fall into a breakpoint during program execution, which will cause the increase speed of the timestamp counter to slow down or stop. The embodiments of the present invention can also set a threshold value according to the increase speed of the timestamp counter under normal circumstances, so that the malicious code does not exceed the increase speed threshold when continuously reading the timestamp counter value. In this way, the malicious code will believe that there may be a debugger and that it is being debugged, thereby ending the malicious behavior.

[0057] The malicious code defense method based on simulating a disguised debugging environment provided by this embodiment can not only detect ordinary malicious code and prevent the malicious behavior of malicious code, but also for malicious code with a higher technical level such as GuLoader that has anti-debugging technology, even if the malicious code is not detected by the security software, the method provided by this embodiment can be used to make the malicious code terminate its operation when it finds that the instruction execution time is too long and it detects that it is being debugged, thereby effectively preventing the execution of its malicious behavior, thereby achieving the purpose of protecting the terminal.

[0058] In some implementations, before obtaining the debugging-related function call in the system, the method further includes:

[0059] Enable the virtualization option of the current environment of the system;

[0060] Install at least one virtual machine software in a designated directory, and make executable files and related components of the virtual machine software exist to simulate a real virtual machine environment;

[0061] Installing a driver of the virtual machine software in the virtual machine environment;

[0062] Create a process related to at least one of the virtual machine software, and monitor the process so that when the malicious code detects the process indicated by the process name identifier of the process, it will mistakenly judge that it is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process.

[0063] In this embodiment, the virtual environment allows each application to run on a desktop, laptop, or Remote Desktop Session Host (RD Session Host) server without installing or changing the host operating system. By executing malicious code in a virtual machine environment, users can observe its behavior and capture its malicious operations. This behavioral analysis can be used to determine the purpose of the malicious code, the method of intrusion, and the potential threat level, and find corresponding solutions.

[0064] In this embodiment, before obtaining the debugging-related function call in the system, a virtual environment may be simulated to make the malicious code think that it is running in a virtual machine environment, thereby stopping the running of the malicious code.

[0065] Another common strategy for malicious code to evade detection is to detect whether it is running in a virtual machine environment. A virtual machine environment is an isolated environment used to run multiple virtual operating systems on a single physical computer. It is usually used for security research, software development, testing, cloud computing, etc. After the malicious code detects that it is running in a virtual machine, it usually takes measures to hide its true behavior or delay the execution of its malicious activities, which makes it more difficult to analyze and detect the malicious code.

[0066] The embodiment of the present invention adds a virtual environment feature to the system, thereby misleading malicious code into thinking that it is running in a virtual machine, causing the malicious code to automatically terminate the process.

[0067] Specifically, the virtualization option of the current environment of the system is turned on; for example, the Hyper-V option of the current environment is turned on. Hyper-V is a virtualization technology developed by Microsoft that allows multiple virtual operating systems to run on a single physical computer. It is usually used in scenarios such as data centers, server virtualization, testing and development environments. Hyper-V can provide isolation and virtual machine environments. Some malware may contain anti-virtualization technology, which will detect whether it is running in a virtual machine and try to stop execution to avoid monitoring and analysis in the virtual machine environment. This is a self-protection measure designed to make malware more difficult to detect and analyze. Advanced malware may have anti-forensic capabilities to prevent users from analyzing its behavior. Once it is detected that it is running in a virtual machine environment, the malicious code may stop executing to avoid reverse engineering analysis. If the malicious code is detected to be running in a virtual machine environment, it may choose to stop to avoid being exposed and cleared. In this embodiment, by turning on the virtualization option of the current environment of the system, the malicious code that is executed in the virtual environment by detecting the virtualization option is automatically exited.

[0068] For malicious codes that have not exited after detecting the virtualization option, at least one virtual machine software is installed in a designated directory, and the executable file and related components of the virtual machine software are made to exist to simulate a real virtual machine environment.

[0069] Specifically, for some advanced malware, a fixed file name is created for various popular virtual machine software such as QEMU, VMware, VirtualBox, etc. to be installed in a terminal or system-specified directory, and the executable files and related components of the virtual machine software are made to exist.

[0070] Specifically, for example, for QEMU software, the main executable file of QEMU software is usually located in the QEMU installation directory, which may include qemu-system-ARCH (for example, qemu-system-x86_64), etc., or QEMU Guest Agent, if QEMU Guest Agent (qemu-ga) is installed, the relevant files may be located in the installation directory, such as C:\Program Files\Qemu-ga\qemu-ga.exe; for VMware software, including VMware Workstation, the main executable file of VMware Workstation is usually stored in the installation directory, such as C:\Program Files (x86)\VMware\VMware Workstation; for VirtualBox software, including the main program of VirtualBox, the main program of VirtualBox is usually located in the installation directory, such as C:\Program Files\Oracle\VirtualBox. Other virtual machine software is similar to the above virtual machine software and will not be repeated here.

[0071] After creating the relevant files of the virtual environment, the driver of the virtual machine software is installed in the virtual machine environment; for example, the driver name installed in each virtual machine environment is created. For QEMU, the virtual machine detection tool may check the hardware and driver of the virtual machine to detect whether there are QEMU-related drivers or components. Some malicious codes may look for QEMU driver names, such as qemu-ga or qemu-kvm; for Virtio, the malicious code may check whether there are Virtio driver-related components in the virtual machine, such as virtio-net, virtio-blk, etc. These drivers are usually used to provide network and storage devices for virtual machines; for VMware, the malicious code may detect the network adapter driver name in VMware Tools or VMware virtual machines, such as vmxnet. It may also check whether there are vmware-tools-related processes or services in the virtual machine; for VirtualBox, the malicious code may detect whether there are VirtualBox Guest Additions-related components in the virtual machine, such as vboxsf, vboxguest, etc. These components are usually used to provide enhanced functions for virtual machines. By creating the driver name installed in each virtual machine environment, the malicious code can detect the virtual machine-related driver and suspend the execution of malicious behavior.

[0072] Afterwards, a process related to at least one virtual machine software is created and monitored so that when the malicious code detects the process indicated by the process name identifier of the process, it will mistakenly judge that the process is currently running in a virtual environment. It should be noted that each process carries a process name identifier for identifying the process identity.

[0073] Specifically, processes in various popular virtual machine environments such as Qemu, VMware, and VirtualBox are created, but no operation is required. For example, for Qemu, the malicious code may check the list of running processes and check whether there are process name identifiers related to QEMU, such as qemu or qemu-system; for Virtio, the malicious code may detect whether there are processes related to the Virtio driver in the virtual machine, such as checking the process list to detect whether there are processes indicated by process name identifiers such as virtio, virtio-net, or virtio-blk; for VMware, the malicious code may check whether there are processes related to VMware Tools in the virtual machine, check the process list to detect whether there are processes indicated by process name identifiers such as vmtoolsd or vmwaretray; for VirtualBox, the malicious code may detect whether there are processes related to VirtualBox Guest Additions in the virtual machine, and check the process list to detect whether there are processes indicated by process name identifiers such as VBoxService or VBoxTray. If a virtual machine-related process appears in the process list, the malicious code will mistakenly judge that it is currently running in a virtual environment. In addition, the malicious code may also detect the network adapter driver in the virtual machine. For example, for VMware, it detects network adapter drivers including vmxnet; for VirtualBox, it detects network adapter drivers including vboxnetflt or vboxnetadp. The malicious code uses this to determine whether it is in a virtual machine environment.

[0074] Through the above method, virtual machine-related files, drivers and processes are created in the system, allowing the malicious code to determine that it is executed in a virtual machine and thus stop running.

[0075] Specifically, for malware such as GuLoader, GuLoader, also known as CloudEyE, is mainly used to spread remote access Trojans on infected computers. GuLoader has been used in a large number of attacks, mainly for the transmission of various types of malware. GuLoader has been active for more than three years and is still under further development. The latest version integrates new anti-analysis techniques, which makes detection increasingly difficult. The new GuLoader sample has almost zero detections on VirusTotal, ensuring that its malicious payload is also undetected. GuLoader uses a large number of anti-analysis techniques, including: searching for QEMU related files: C:\Program files\QEMU ga\QEMU-ga.exe and C:\Programfiles\qga\qga.exe; using the EnumDeviceDrivers API function to check if there are vm-related drivers; using NtQuerySystemInformation combined with the SystemProcessInformation parameter to obtain system process information and scan the process table. If a virtual machine platform process appears, a series of anti-analysis technologies such as refusing to execute are used. Through the method provided in this embodiment, by creating virtual machine features such as files, drivers and processes related to virtual machines in the system, the malicious code is judged to be executed in the virtual machine, and thus stops running. In this way, even if the security software does not detect Guloader, the malicious code will end its operation when it detects the presence of the above virtual machine features in the system, thereby achieving the purpose of protecting the terminal. It can effectively protect the user system and prevent malicious code from being executed in the system without the user's knowledge.

[0076] Moreover, through the above method, it is also possible to detect malicious codes with anti-analysis technology. The execution of malicious codes can be blocked simply by creating files, drivers and processes. It takes up very little hard disk storage space and memory, and does not require feature-based detection of malicious codes. It has a certain degree of versatility.

[0077] Embodiment 2

[0078] Figure 3 This is a schematic block diagram of the malicious code defense system architecture based on the simulated camouflage debugging environment according to an embodiment of the present invention. Figure 3 As shown, based on the same technical concept as the above embodiments, the present invention also provides a malicious code defense system based on a simulated camouflage debugging environment, including:

[0079] A first modification module 31 is used to obtain a debugging-related function call in the system and modify a return value of the function call;

[0080] The second modification module 32 is used to modify the registry items related to the debugger configuration in the system registry; the registry items include: the debugger name;

[0081] The process simulation camouflage module 33 is used to start at least one debugger process in the system to simulate and camouflage the running debugging environment, so as to confuse the malicious code into misjudging the current running debugging environment when executing.

[0082] The first monitoring module 34 is used to monitor the execution status of instructions used to measure code execution time; the execution status includes: execution time;

[0083] The first control module 35 is used to control the execution behavior of the instruction when the execution time of the instruction is monitored to be abnormal, so as to prevent malicious code from determining the current simulated camouflage debugging environment.

[0084] In some embodiments, the first control module is specifically used to intercept the execution of the instruction and stop increasing the timestamp counter value when it is monitored that the malicious code continuously calls the instruction for a time exceeding a preset threshold.

[0085] In some embodiments, it further includes: a virtual environment creation module, specifically used to enable a virtualization option of the current environment of the system;

[0086] Install at least one virtual machine software in a designated directory, and make executable files and related components of the virtual machine software exist to simulate a real virtual machine environment;

[0087] Installing a driver of the virtual machine software in the virtual machine environment;

[0088] Create a process related to at least one of the virtual machine software, and monitor the process so that when the malicious code detects the process indicated by the process name identifier of the process, it will mistakenly judge that it is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process.

[0089] In some embodiments, the first modification module is specifically used to determine the debugging-related system functions that need to be obtained, and the debugging-related system functions are used to detect the existence of a debugger or interact with a debugger; call the dynamic link library import table or obtain the address of the target function in the memory through an API query; use a hook function to intercept the call to the target function; insert a jump instruction at the beginning of the target function to transfer control to a custom processing function, and the custom processing function is used to modify the function call return value when the malicious code calls the target function.

[0090] The malicious code defense system based on the simulated disguise debugging environment can be used to execute Figure 1The technical solution of the method embodiment shown has similar implementation principles and technical effects to those of the first embodiment, which will not be described in detail here and can be referenced by each other.

[0091] In addition, it is understandable that Figure 3 The system shown is also applicable to executing the step processes in other embodiments of the first embodiment. For the sake of brevity, please refer to the relevant description in the first embodiment, and the remaining embodiments will not be described one by one here.

[0092] The malicious code defense system based on the simulated disguised debugging environment provided by the embodiment of the present invention obtains the function call related to debugging in the system, modifies the return value of the function call, so that the malicious code judges that it is being debugged according to the return value; modifies the registry item related to the debugger configuration in the system registry to the name of the debugging software, so that the malicious code judges that it is the debugging software according to the value of the registry, and finally starts at least one debugger process in the system to simulate and disguise the running debugging environment to confuse the malicious code to mistakenly judge that it is currently in the running debugging environment when executing. In this way, by simulating the disguised debugging environment, the malicious code mistakenly believes that it is currently being analyzed and debugged, thereby stopping the execution of malicious behavior and terminating the process, thereby protecting the terminal.

[0093] In addition, in this embodiment, there is no need to detect malicious code based on features, and it has a certain degree of versatility. It only needs to use API hooking technology, hook system instructions, modify the registry and other technologies to prevent malicious code from executing malicious behavior. It takes up very little hard disk storage space and memory, thereby protecting the security of the computer.

[0094] Embodiment 3

[0095] The present invention also provides an electronic device according to an embodiment, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the malicious code defense method based on the simulated camouflage debugging environment described in any one of the first embodiments.

[0096] Figure 4 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 4As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program code; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, and is used to execute the malicious code defense method based on the simulated camouflage debugging environment described in any of the above-mentioned embodiments one.

[0097] The specific execution process of the processor 42 for the above steps and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the malicious code defense method based on the simulated camouflage debugging environment of the present invention, which will not be repeated here.

[0098] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are mainly aimed at providing voice and data communications. Such terminals include: smart phones, multimedia phones, functional phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0099] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the malicious code defense method based on simulated camouflage debugging environment as described in any of the above-mentioned embodiments.

[0100] In summary, according to the description of the above embodiments, the malicious code defense method, system, electronic device and storage medium based on the simulated disguised debugging environment disclosed in the embodiments of the present invention first obtains the function call related to debugging in the system, modifies the return value of the function call, so that the malicious code judges that it is being debugged according to the return value; then, the registry item related to the debugger configuration in the system registry is modified to the name of the debugging software, so that the malicious code judges that it is the debugging software according to the value of the registry, and finally starts at least one debugger process in the system to simulate the debug environment being disguised, so as to confuse the malicious code to be in the debug environment being run when executing. In this way, by simulating the disguised debugging environment, the malicious code mistakenly believes that it is currently being analyzed and debugged, thereby stopping the execution of malicious behavior, terminating the process, and realizing the detection and defense of malicious code.

[0101] In addition, the malicious code defense method based on the simulated camouflage debugging environment provided by this embodiment occupies less system resources, is universal, and can effectively protect the user system and prevent malicious code from being executed in the system without the user's knowledge.

[0102] It should be noted that, in this article, if the description involves the relational terms such as first and second, it is only used to distinguish one entity or operation from another entity or operation, and does not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0103] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0104] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can also be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0105] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A malicious code defense method based on simulating a disguised debugging environment, characterized in that: The method comprises: obtaining a debugging-related function call in the system, and modifying a return value of the function call; Modify the registry items related to the debugger configuration in the system registry; the registry items include: the debugger name; Initiating at least one debugger process in the system to simulate and disguise a running debugging environment, so as to confuse the malicious code into misjudging that it is currently in a running debugging environment when executing; Monitoring the execution of instructions used to measure the execution time of malicious code; the execution status includes: execution time; When the execution time of the instruction is monitored to be abnormal, the execution behavior of the instruction is controlled to prevent malicious code from determining the current simulated disguised debugging environment; Before acquiring the debugging-related function call in the system, the method further includes: Enable the virtualization option of the current environment of the system; Install at least one virtual machine software in a designated directory, and make executable files and related components of the virtual machine software exist to simulate a real virtual machine environment; Installing a driver of the virtual machine software in the virtual machine environment; Creating a process related to at least one of the virtual machine software and monitoring the process so that the malicious code, when detecting a process indicated by a process name identifier of the process, mistakenly determines that the process is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process; The obtaining of the debugging-related function call in the system and modifying the return value of the function call include: Determine a debugging-related system function that needs to be acquired, wherein the debugging-related system function is used to detect the existence of a debugger or interact with a debugger; Call the dynamic link library import table or query the API to obtain the address of the target function in memory; Use the hook function to intercept calls to the target function; A jump instruction is inserted at the beginning of the target function to transfer control to a custom processing function, wherein the custom processing function is used to modify the function call return value when the malicious code calls the target function.

2. The malicious code defense method based on simulating a camouflage debugging environment according to claim 1 is characterized in that: When the execution time of the instruction is monitored to be abnormal, the execution behavior of the instruction is controlled, including: when it is monitored that the time for the malicious code to continuously call the instruction exceeds a preset threshold, the execution behavior of the instruction is intercepted and the increase of the timestamp counter value is stopped.

3. A malicious code defense system based on a simulated camouflage debugging environment, characterized in that: The system comprises: A first modification module is used to obtain a debugging-related function call in the system and modify a return value of the function call; The second modification module is used to modify the registry items related to the debugger configuration in the system registry; the registry items include: the debugger name; A process simulation camouflage module, used to start at least one debugger process in the system to simulate and camouflage a running debugging environment, so as to confuse malicious code execution into misjudging that it is currently in a running debugging environment; A first monitoring module is used to monitor the execution status of instructions used to measure the execution time of malicious code; the execution status includes: execution time; A first control module is used to control the execution behavior of the instruction when the execution time of the instruction is monitored to be abnormal, so as to prevent malicious code from determining the current simulated disguised debugging environment; A virtual environment creation module, specifically used to enable a virtualization option of the current environment of the system before acquiring a debugging-related function call in the system; Install at least one virtual machine software in a designated directory, and make executable files and related components of the virtual machine software exist to simulate a real virtual machine environment; Installing a driver of the virtual machine software in the virtual machine environment; Creating a process related to at least one of the virtual machine software and monitoring the process so that the malicious code, when detecting a process indicated by a process name identifier of the process, mistakenly determines that the process is currently running in a virtual environment; wherein each process carries a process name identifier for identifying the identity of the process; The first modification module is specifically used to determine the debugging-related system functions that need to be acquired, and the debugging-related system functions are used to detect the existence of a debugger or interact with a debugger; Call the dynamic link library import table or query the API to obtain the address of the target function in memory; Use the hook function to intercept calls to the target function; A jump instruction is inserted at the beginning of the target function to transfer control to a custom processing function, wherein the custom processing function is used to modify the function call return value when the malicious code calls the target function.

4. The malicious code defense system based on simulated camouflage debugging environment according to claim 3 is characterized in that: The first control module is specifically used to intercept the execution of the instruction and stop increasing the timestamp counter value when it is monitored that the malicious code continuously calls the instruction for a time period exceeding a preset threshold.

5. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the malicious code defense method based on simulated camouflage debugging environment described in any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to execute the malicious code defense method based on simulated camouflage debugging environment as described in any one of claims 1 to 2.

Images