Chromium kernel security detection method and device, equipment and storage medium

Abstract

The invention discloses a Chromium kernel security detection method and device, equipment and a storage medium, and the method comprises the steps: calculating a redundant code of a Chromium kernel module through a preset verification algorithm, and obtaining a first redundant code value; performing hook detection on the kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the kernel module through the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; and analyzing the target detection result and the verification result, and determining a security detection result of the kernel module. According to the invention, the redundancy check is carried out by calculating the redundancy code of the kernel module through the preset check algorithm, and the hook detection is carried out on the kernel module, so that the comprehensive coverage detection of the known security risk of the kernel is realized, and compared with the prior art, the detection capability of the security risk in the Chromium kernel is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a Chromium kernel security detection method, device, equipment and storage medium. Background Art

[0002] In order to provide a better user experience, supporting the Chromium kernel has become an urgent need for current Internet PC products. At present, most PC applications based on the Chromium kernel on the market have almost no attack detection methods and protection solutions. The main risk pain points are as follows: 1. Client programs based on the Chromium kernel usually load Web resources through the File protocol and encrypt Web resources. However, this type of resource encryption method can easily decompress the encrypted resource files by reversing the main program file to find the decompression password or Zip plaintext attack; 2. Each frame of the Chromium kernel will provide an execution context to provide a safe execution environment for JS code. The Chromium kernel opens a large number of interfaces for interacting with client programs. Attackers can use these open interfaces to inject script attacks, monitor the interaction process between customers and clients, and inject malicious code and other malicious operations, thereby bringing serious security risks such as sensitive information leakage or remote attacks; 3. Attackers can use Chromium's own debugging tools to analyze the entire page framework and find breakthroughs to implement attacks such as XSS (Cross Site Scripting) cross-site scripting, XSRF (Cross-site request forgery), SQL, and other serious security risks.

[0003] From the above content, it can be seen that the existing Chromium kernel protection solution has weak recognition of various attack behaviors, and does not perform integrity and correctness verification on the Chromium kernel module, and cannot effectively identify and prevent common hacker attacks.

[0004] Therefore, there is an urgent need for a Chromium kernel security detection method that can effectively improve the detection capability of security risks in the Chromium kernel. Summary of the invention

[0005] The main purpose of the present invention is to provide a Chromium kernel security detection method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology has weak detection ability for security risks in the Chromium kernel.

[0006] To achieve the above object, the present invention provides a Chromium kernel security detection method, which comprises the following steps:

[0007] Calculate the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a first redundant code value;

[0008] Performing hook detection on the Chromium kernel module to obtain a target detection result;

[0009] Return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value;

[0010] Comparing the first redundant code value with the second redundant code value to obtain a verification result;

[0011] The target detection result and the verification result are analyzed to determine the security detection result of the Chromium kernel module.

[0012] Optionally, before the step of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain the first redundant code value, the step further includes:

[0013] Performing function enhancement on the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls;

[0014] Performing function enhancement on the initialization function in the Chromium kernel module via an inline hook to disable the remote debugging port;

[0015] After the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized.

[0016] Optionally, the step of performing hook detection on the Chromium kernel module to obtain a target detection result includes:

[0017] Performing an inline hook detection on the Chromium kernel module to obtain a first detection result;

[0018] Performing an IAT hook detection on the Chromium kernel module to obtain a second detection result;

[0019] The first detection result and the second detection result are used as target detection results.

[0020] Optionally, the step of performing inline hook detection on the Chromium kernel module to obtain a first detection result includes:

[0021] Determine the Chromium kernel API related to obtaining the Browser object;

[0022] Detect whether the Chromium kernel API has a jump instruction, so as to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

[0023] Optionally, the step of performing IAT hook detection on the Chromium kernel module to obtain a second detection result includes:

[0024] Get the IAT export table and determine the Chromium kernel API related to the Browser object;

[0025] Compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result;

[0026] An analysis is performed based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

[0027] Optionally, the step of analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module includes:

[0028] Determine whether the first detection result and the second detection result in the target detection result are abnormal;

[0029] If there is no abnormality in the first detection result and the second detection result, determining whether the first redundant code value and the second redundant code value in the verification result are the same;

[0030] If the first redundant code value is the same as the second redundant code value, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0031] Optionally, the preset verification algorithm is a CRC algorithm, and the step of calculating the redundant code of the Chromium kernel module by the preset verification algorithm to obtain the first redundant code value includes:

[0032] Initialize a CRC register, obtain a Chromium kernel API base address, and determine the data volume of the Chromium kernel module based on the Chromium kernel API base address;

[0033] Based on the data volume of the Chromium kernel module, dividing the Chromium kernel module into blocks according to a preset block rule to obtain multiple data blocks;

[0034] Sequentially performing an XOR operation on each of the databases and the current value of the CRC register, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain an operation result;

[0035] The value of the CRC register is updated according to each of the operation results to obtain a first redundant code value.

[0036] In addition, to achieve the above-mentioned purpose, the present invention also proposes a Chromium kernel security detection device, the device comprising:

[0037] A first redundancy calculation module, used to calculate the redundancy code of the Chromium kernel module by using a preset verification algorithm to obtain a first redundancy code value;

[0038] A hook detection module, used to perform hook detection on the Chromium kernel module to obtain a target detection result;

[0039] The second redundancy calculation module is further used to return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value;

[0040] A code value comparison module, used to compare the first redundant code value with the second redundant code value to obtain a verification result;

[0041] The result output module is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0042] In addition, to achieve the above-mentioned purpose, the present invention also proposes a Chromium kernel security detection device, which includes: a memory, a processor, and a Chromium kernel security detection program stored in the memory and executable on the processor, wherein the Chromium kernel security detection program is configured to implement the steps of the Chromium kernel security detection method described above.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a Chromium kernel security detection program is stored, and when the Chromium kernel security detection program is executed by a processor, the steps of the Chromium kernel security detection method described above are implemented.

[0044] The present invention discloses the steps of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Since the present invention calculates the redundant code of the Chromium kernel module by a preset verification algorithm to perform a redundant check and performs hook detection on the Chromium kernel module, a comprehensive coverage detection of the known security risks of the Chromium kernel is achieved. Compared with the prior art, the present invention effectively improves the detection capability of security risks in the Chromium kernel. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of the first embodiment of the Chromium kernel security detection method of the present invention;

[0046] Figure 2 This is a flow chart of the second embodiment of the Chromium kernel security detection method of the present invention;

[0047] Figure 3 A schematic diagram of the process of the third embodiment of the Chromium kernel security detection method of the present invention;

[0048] Figure 4 This is a structural block diagram of the first embodiment of the Chromium kernel security detection device of the present invention;

[0049] Figure 5 It is a structural diagram of a Chromium kernel security detection device in a hardware operating environment involved in an embodiment of the present invention.

[0050] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0052] The embodiment of the present invention provides a Chromium kernel security detection method, referring to Figure 1 , Figure 1 The figure is a flow chart of the first embodiment of the Chromium kernel security detection method of the present invention.

[0053] In this embodiment, the Chromium kernel security detection method includes the following steps:

[0054] Step S10: Calculate the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a first redundant code value.

[0055] It should be noted that the execution subject of this embodiment can be a computer server device with data processing, network communication and program running functions used in psychological counseling scenarios, such as a personal computer, a laptop computer, a mobile phone, a smart watch, etc., or an electronic device capable of realizing the above functions, a Chromium kernel security detection device, etc. The following takes the Chromium kernel security detection device as an example to illustrate this embodiment and the following embodiments.

[0056] It should be understood that the Chromium kernel module may include a module of the Chromium kernel, which is also known as the Chrome kernel, a browser kernel launched by Google Inc. It is widely praised for its efficiency, scalability, security and cross-platform, and is currently one of the browser kernels with the leading market share in the world.

[0057] The above-mentioned preset check algorithm can be a redundant check algorithm, a parity check algorithm, a cyclic redundancy check algorithm, and a checksum algorithm. This embodiment and the following embodiments take the cyclic redundancy check algorithm as an example to illustrate this embodiment and the following embodiments.

[0058] In a specific implementation, the cyclic redundancy check algorithm includes the following steps:

[0059] (1) Generate CRC32 polynomial: The cyclic redundancy check algorithm may be a CRC32 algorithm, which is based on a predefined binary polynomial, such as 0xEDB88320. This polynomial is the core of CRC32, and it should be understood that different applications may select different polynomials.

[0060] (2) Initialize CRC value: Before starting the calculation, set an initial CRC value, usually all 1s, that is, 0xFFFFFFFF.

[0061] (3) Shift operation: Shift the code (regarded as binary data) left bit by bit, one bit at a time. If the highest bit is shifted out, fill the lowest bit with the lowest bit in the polynomial (usually 1).

[0062] (4) XOR operation: XOR the current CRC value with the shifted code bit. If any bit is 1, perform an XOR operation.

[0063] (5) Repeat steps (3) and (4): perform the above steps for each bit of the code to be detected until all bits have been processed.

[0064] Generate CRC code: After processing all bits, the CRC value obtained is the CRC32 check code of the code, that is, the first redundant code value.

[0065] In redundancy check, the redundant code is additional information used to detect and / or correct errors that may occur during data transmission or storage. This redundant code is generated by processing the original data through a specific algorithm, and its length and generation method depend on the check algorithm used.

[0066] It should be noted that this embodiment performs integrity and correctness verification on the Chromium kernel module through a cyclic redundancy check algorithm to detect errors that occur during data transmission or storage.

[0067] Step S20: Perform hook detection on the Chromium kernel module to obtain a target detection result.

[0068] It should be noted that hook detection, namely HOOK detection, is used to detect and identify whether there are malicious or unauthorized hooks in the system. These hooks may be installed by viruses, Trojans, spyware or other malware to intercept, modify or redirect system events or messages, thereby affecting the normal operation of the system or stealing user data.

[0069] It should be noted that the hook detection in this embodiment includes inline hook detection and IAT hook detection.

[0070] Inline hook is a technology that modifies the execution flow of a function while the program is running. It redirects the execution path of the target function to a custom code segment by modifying the original code of the function, thereby intercepting and modifying the target function. The main purpose of inline hook detection is to identify and remove malicious inline hooks in the system to protect the security and stability of the system.

[0071] IAT hooking is a technique that replaces or intercepts target functions by modifying the program's Import Address Table. In Windows programs, the program needs to call functions in other modules (such as DLL) to complete specific functions. The addresses of these functions are stored in the Import Address Table. The main purpose of IAT hooking detection is to identify and clear malicious replacement items in the IAT table to ensure that the program calls the correct function.

[0072] In order to ensure data security, step S20 includes:

[0073] Step S201: performing an inline hook detection on the Chromium kernel module to obtain a first detection result.

[0074] In a specific implementation, it is possible to determine to obtain a Chromium kernel API related to the Browser object; then detect whether the Chromium kernel API has a jump instruction, so as to perform an inline hook detection on the Chromium kernel module and obtain a first detection result.

[0075] Step S202: Perform an IAT hook detection on the Chromium kernel module to obtain a second detection result.

[0076] In a specific implementation, an IAT export table may be obtained, and a Chromium kernel API related to a Browser object may be determined; a memory address of the Chromium kernel API may be compared with a corresponding function address in the IAT export table to obtain a comparison result; and an analysis may be performed based on the comparison result to implement an IAT hook detection on the Chromium kernel module to obtain a second detection result.

[0077] Step S202: taking the first detection result and the second detection result as target detection results.

[0078] Step S30: Return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value.

[0079] Step S40: Compare the first redundant code value and the second redundant code value to obtain a verification result.

[0080] After performing hook detection on the Chromium kernel module, the redundant code of the Chromium kernel module is calculated again to obtain a second redundant code value, and then the first redundant code value and the second redundant code value are compared to determine whether the first redundant code value and the second redundant code value are the same, to obtain a verification result, and based on the verification result to implement integrity and correctness verification of the Chromium kernel module.

[0081] Step S50: Analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0082] It should be noted that the security test of the Chromium kernel module has passed only when the first test result, the second test result and the verification result in the target test result are all passed.

[0083] In a specific implementation, it is determined whether there is an abnormality in the first detection result and the second detection result in the target detection result; if there is no abnormality in the first detection result and the second detection result, it is determined whether the first redundant code value and the second redundant code value in the verification result are the same; if the first redundant code value and the second redundant code value are the same, it means that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0084] It should be understood that if any of the first test result, the second test result or the verification result is abnormal, it means that the security test of the Chromium kernel module has failed.

[0085] This embodiment discloses the steps of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Since this embodiment calculates the redundant code of the Chromium kernel module by a preset verification algorithm to perform a redundant check and performs hook detection on the Chromium kernel module, a comprehensive coverage detection of the known security risks of the Chromium kernel is achieved. Compared with the prior art, this embodiment effectively improves the detection capability of security risks in the Chromium kernel.

[0086] refer to Figure 2 , Figure 2 Schematic diagram of the process of the second embodiment of the Chromium kernel security detection method of the present invention.

[0087] Based on the first embodiment above, in this embodiment, before step S10, the following steps are further included:

[0088] Step S01: enhancing the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls.

[0089] Step S02: enhancing the initialization function in the Chromium kernel module through an inline hook to disable the remote debugging port.

[0090] Step S03: After the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized.

[0091] In order to prevent local resource leakage and disable Chromium kernel debugging to prevent attackers from exploiting vulnerabilities, this embodiment enhances the file loading function in the Chromium kernel module and the initialization function in the Chromium kernel module through inline hooks before step S10.

[0092] It should be noted that the purpose of function enhancement is usually to improve the flexibility, scalability, performance or functionality of a function. It allows developers to expand and optimize functions without destroying the existing code structure. The specific implementation of function enhancement may vary in different programming languages ​​and environments, but the basic principles and advantages are similar. By properly applying function enhancement technology, the flexibility, maintainability and performance of the program can be significantly improved.

[0093] Initializing the corresponding register in the preset verification algorithm, that is, initializing the CRC register, is to initialize the CRC value to a fixed value (such as 0 or all 1s), which can ensure that the CRC verification value of each data packet is calculated independently and will not be deviated due to the influence of the previous data packet.

[0094] This embodiment discloses that the file loading function in the Chromium kernel module is functionally enhanced by an inline hook to disable the resource loading function call; the initialization function in the Chromium kernel module is functionally enhanced by an inline hook to disable the remote debugging port; after the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized; the redundant code of the Chromium kernel module is calculated by the preset verification algorithm to obtain a first redundant code value; the Chromium kernel module is hooked to obtain a target detection result; the step of calculating the redundant code of the Chromium kernel module by the preset verification algorithm is returned to obtain a second redundant code value; the first redundant code value and the second redundant code value are compared to obtain a verification result; the target detection result and the verification result are analyzed to determine the security detection result of the Chromium kernel module. Since this embodiment performs function enhancement on the file loading function in the Chromium kernel module and the initialization function in the Chromium kernel module by an inline hook, compared with the prior art, this embodiment effectively prevents local resource leakage and disables Chromium kernel debugging to avoid attackers from exploiting vulnerabilities.

[0095] refer to Figure 3 , Figure 3 It is a flowchart of the third embodiment of the Chromium kernel security detection method of the present invention.

[0096] Based on the above embodiments, in this embodiment, step S10 includes:

[0097] Step S101: Initialize the CRC register, obtain the Chromium kernel API base address, and determine the data amount of the Chromium kernel module based on the Chromium kernel API base address.

[0098] Step S102: Based on the data volume of the Chromium kernel module, the Chromium kernel module is divided into blocks according to a preset block rule to obtain a plurality of data blocks.

[0099] Step S103: performing XOR operations on each of the databases and the current value of the CRC register in turn, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain the operation result.

[0100] Step S104: updating the value of the CRC register according to each of the operation results to obtain a first redundant code value.

[0101] It should be noted that the above-mentioned preset block rules may be block rules customized by the user according to the data volume of the Chromium kernel module, and this embodiment does not impose any limitation on this.

[0102] It should be explained that by dividing the Chromium kernel module into blocks according to the preset block rules, only a part of the data content can be loaded into the memory for verification at a time, thereby effectively alleviating resource pressure; it can also facilitate error location and recovery.

[0103] It should be explained that in order to improve the efficiency of CRC verification, the data to be verified can be divided into blocks, and CRC calculation can be performed on each data block in parallel. In a multi-core processor or a distributed system, this parallel calculation can significantly improve the verification efficiency. In addition, for the data blocks that have been verified, if the subsequent operations do not modify these data blocks, their CRC values ​​do not need to be recalculated, thereby further improving the verification efficiency.

[0104] This embodiment discloses initializing a CRC register, obtaining a Chromium kernel API base address, and determining the data volume of the Chromium kernel module based on the Chromium kernel API base address; based on the data volume of the Chromium kernel module, the Chromium kernel module is divided into blocks according to a preset block rule to obtain multiple data blocks; each of the databases is sequentially XORed with the current value of the CRC register, and the XOR result is divided modulo 2 by a generating polynomial to obtain an operation result; the value of the CRC register is updated according to each of the operation results to obtain a first redundant code value. Compared with the prior art, since the present invention divides the Chromium kernel module into blocks according to a preset block rule based on the data volume of the Chromium kernel module, and then performs CRC calculation on each data block, resource pressure is effectively alleviated and verification efficiency is improved.

[0105] In addition, an embodiment of the present invention further proposes a storage medium, on which a Chromium kernel security detection program is stored. When the Chromium kernel security detection program is executed by a processor, the steps of the Chromium kernel security detection method described above are implemented.

[0106] Reference Figure 4 , Figure 4 This is a structural block diagram of the first embodiment of the Chromium kernel security detection device of the present invention.

[0107] like Figure 4 As shown, the Chromium kernel security detection device proposed in the embodiment of the present invention includes: a first redundant calculation module 401, a hook detection module 402, a second redundant calculation module 403, a code value comparison module 404 and a result output module 405.

[0108] The first redundancy calculation module 401 is used to calculate the redundancy code of the Chromium kernel module through a preset verification algorithm to obtain a first redundancy code value.

[0109] The hook detection module 402 is used to perform hook detection on the Chromium kernel module to obtain a target detection result.

[0110] The second redundancy calculation module 403 is further used to return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value.

[0111] The code value comparison module 404 is used to compare the first redundant code value with the second redundant code value to obtain a verification result.

[0112] The result output module 405 is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0113] The hook detection module 402 is further used to perform inline hook detection on the Chromium kernel module to obtain a first detection result; perform IAT hook detection on the Chromium kernel module to obtain a second detection result; and use the first detection result and the second detection result as target detection results.

[0114] The hook detection module 402 is also used to determine and obtain the Chromium kernel API related to the Browser object; detect whether there is a jump instruction in the Chromium kernel API to implement inline hook detection on the Chromium kernel module and obtain a first detection result.

[0115] The hook detection module 402 is also used to obtain the IAT export table and determine to obtain the Chromium kernel API related to the Browser object; compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result; and perform analysis based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

[0116] The result output module 405 is also used to determine whether there are abnormalities in the first detection result and the second detection result in the target detection result; if there are no abnormalities in the first detection result and the second detection result, determine whether the first redundant code value and the second redundant code value in the verification result are the same; if the first redundant code value and the second redundant code value are the same, it means that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0117] The present device embodiment discloses the steps of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Since the present device embodiment calculates the redundant code of the Chromium kernel module by a preset verification algorithm to perform a redundant check and performs hook detection on the Chromium kernel module, a comprehensive coverage detection of the known security risks of the Chromium kernel is achieved. Compared with the prior art, the present device embodiment effectively improves the detection capability of security risks in the Chromium kernel.

[0118] Based on the above-mentioned first embodiment of the Chromium kernel security detection device of the present invention, a second embodiment of the Chromium kernel security detection device of the present invention is proposed.

[0119] In this embodiment, the first redundant calculation module 401 is also used to perform function enhancement on the file loading function in the Chromium kernel module through an inline hook to disable the resource loading function call; perform function enhancement on the initialization function in the Chromium kernel module through an inline hook to disable the remote debugging port; after performing function enhancement on the file loading function and the initialization function, initialize the corresponding registers in the preset verification algorithm.

[0120] Other embodiments or specific implementations of the Chromium kernel security detection device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0121] The present application provides a Chromium kernel security detection device, which includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the Chromium kernel security detection method in the above-mentioned embodiment 1.

[0122] Reference below Figure 5, which shows a schematic diagram of the structure of a Chromium kernel security detection device suitable for implementing the embodiment of the present application. The Chromium kernel security detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The Chromium kernel security detection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0123] like Figure 5 As shown, the Chromium kernel security detection device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the Chromium kernel security detection device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the Chromium kernel security detection device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a Chromium kernel security detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or provided alternatively.

[0124] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0125] The Chromium kernel security detection device provided by the present application adopts the Chromium kernel security detection method in the above embodiment, which can solve the technical problem that the existing technology has a weak detection ability for security risks in the Chromium kernel. Compared with the existing technology, the beneficial effects of the Chromium kernel security detection device provided by the present application are the same as the beneficial effects of the Chromium kernel security detection method provided by the above embodiment, and the other technical features in the Chromium kernel security detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0126] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0127] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0128] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0129] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0131] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A Chromium kernel security detection method, characterized in that: The method comprises: Calculate the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a first redundant code value; Performing hook detection on the Chromium kernel module to obtain a target detection result; Return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value; Comparing the first redundant code value with the second redundant code value to obtain a verification result; The target detection result and the verification result are analyzed to determine the security detection result of the Chromium kernel module.

2. The Chromium kernel security detection method according to claim 1, characterized in that: Before the step of calculating the redundant code of the Chromium kernel module by a preset verification algorithm to obtain the first redundant code value, the method further includes: Performing function enhancement on the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls; Performing function enhancement on the initialization function in the Chromium kernel module via an inline hook to disable the remote debugging port; After the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized.

3. The Chromium kernel security detection method according to claim 1, characterized in that: The step of performing hook detection on the Chromium kernel module to obtain a target detection result includes: Performing an inline hook detection on the Chromium kernel module to obtain a first detection result; Performing an IAT hook detection on the Chromium kernel module to obtain a second detection result; The first detection result and the second detection result are used as target detection results.

4. The Chromium kernel security detection method according to claim 3, characterized in that: The step of performing inline hook detection on the Chromium kernel module to obtain a first detection result includes: Determine the Chromium kernel API related to obtaining the Browser object; Detect whether the Chromium kernel API has a jump instruction, so as to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

5. The Chromium kernel security detection method according to claim 3, characterized in that: The step of performing IAT hook detection on the Chromium kernel module to obtain a second detection result includes: Get the IAT export table and determine the Chromium kernel API related to the Browser object; Compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result; An analysis is performed based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

6. The Chromium kernel security detection method according to claim 3, characterized in that: The step of analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module includes: Determine whether the first detection result and the second detection result in the target detection result are abnormal; If there is no abnormality in the first detection result and the second detection result, determining whether the first redundant code value and the second redundant code value in the verification result are the same; If the first redundant code value is the same as the second redundant code value, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

7. The Chromium kernel security detection method according to claim 1, characterized in that: The preset verification algorithm is a CRC algorithm. The redundant code of the Chromium kernel module is calculated by the preset verification algorithm to obtain the first redundant code value, including: Initialize a CRC register, obtain a Chromium kernel API base address, and determine the data volume of the Chromium kernel module based on the Chromium kernel API base address; Based on the data volume of the Chromium kernel module, dividing the Chromium kernel module into blocks according to a preset block rule to obtain multiple data blocks; Sequentially performing an XOR operation on each of the databases and the current value of the CRC register, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain an operation result; The value of the CRC register is updated according to each of the operation results to obtain a first redundant code value.

8. A Chromium kernel security detection device, characterized in that: The device comprises: A first redundancy calculation module, used to calculate the redundancy code of the Chromium kernel module by using a preset verification algorithm to obtain a first redundancy code value; A hook detection module, used to perform hook detection on the Chromium kernel module to obtain a target detection result; The second redundancy calculation module is further used to return to the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain a second redundant code value; A code value comparison module, used to compare the first redundant code value with the second redundant code value to obtain a verification result; The result output module is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

9. A Chromium kernel security detection device, characterized in that: The device comprises: a memory, a processor, and a Chromium kernel security detection program stored in the memory and executable on the processor, wherein the Chromium kernel security detection program is configured to implement the steps of the Chromium kernel security detection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a Chromium kernel security detection program, and when the Chromium kernel security detection program is executed by the processor, the steps of the Chromium kernel security detection method according to any one of claims 1 to 7 are implemented.

Images