Chromium kernel security detection method, device, equipment and storage medium

Abstract

The present invention discloses a Chromium kernel security detection method, apparatus, device, and storage medium. The method comprises: calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a first redundant code value; performing hook detection on the kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the kernel module using the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; and analyzing the target detection result and the verification result to determine the security detection result of the kernel module. Because the present invention calculates the redundant code of the kernel module using the preset verification algorithm to perform redundant verification and performs hook detection on the kernel module, comprehensive coverage detection of known security risks of the kernel is achieved. Compared with the existing technology, the present invention effectively improves the detection capability of security risks in the Chromium kernel.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a Chromium kernel security detection method, device, equipment and storage medium. Background Art

[0002] To provide a better user experience, support for the Chromium kernel is a pressing need for current internet PC products. Currently, most Chromium-based PC applications lack attack detection and protection solutions. Key risks and pain points include the following: 1. Chromium-based client applications typically load web resources through the File protocol and encrypt them. However, this encryption method can be easily decompressed by reversing the main program file to find the decompression password or performing a Zip plaintext attack. 2. Each frame in the Chromium kernel provides an execution context, providing a secure execution environment for JavaScript code. The Chromium kernel exposes numerous interfaces for interaction with client applications. Attackers can exploit these interfaces to inject scripts, eavesdrop on client-side interactions, and inject malicious code, leading to serious security risks such as sensitive information leakage and remote attacks. 3. Attackers can use Chromium's built-in debugging tools to analyze the entire page frame, looking for vulnerabilities to exploit attacks such as Cross Site Scripting (XSS), Cross-site Request Forgery (XSRF), and SQL injection, thus creating serious security risks.

[0003] From the above content, it can be seen that the existing Chromium kernel protection solution has weak recognition of various attack behaviors, and does not verify the integrity and correctness of the Chromium kernel module, and cannot effectively identify and prevent common hacker attacks.

[0004] Therefore, there is an urgent need for a Chromium kernel security detection method that can effectively improve the detection capability of security risks in the Chromium kernel. Summary of the Invention

[0005] The main purpose of the present invention is to provide a Chromium kernel security detection method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology has weak detection capabilities for security risks in the Chromium kernel.

[0006] To achieve the above object, the present invention provides a Chromium kernel security detection method, which includes the following steps:

[0007] Calculate the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a first redundant code value;

[0008] Performing hook detection on the Chromium kernel module to obtain a target detection result;

[0009] Returning to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value;

[0010] Comparing the first redundant code value with the second redundant code value to obtain a verification result;

[0011] The target detection result and the verification result are analyzed to determine the security detection result of the Chromium kernel module.

[0012] Optionally, before the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain the first redundant code value, the step further includes:

[0013] Enhance the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls;

[0014] Enhance the initialization function in the Chromium kernel module via an inline hook to disable the remote debugging port;

[0015] After the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized.

[0016] Optionally, the step of performing hook detection on the Chromium kernel module to obtain a target detection result includes:

[0017] Performing an inline hook detection on the Chromium kernel module to obtain a first detection result;

[0018] Performing an IAT hook test on the Chromium kernel module to obtain a second test result;

[0019] The first detection result and the second detection result are used as target detection results.

[0020] Optionally, the step of performing inline hook detection on the Chromium kernel module to obtain a first detection result includes:

[0021] Determine the Chromium kernel API related to obtaining the Browser object;

[0022] Detecting whether the Chromium kernel API has a jump instruction to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

[0023] Optionally, the step of performing IAT hook detection on the Chromium kernel module to obtain a second detection result includes:

[0024] Get the IAT export table and determine the Chromium kernel API related to the Browser object;

[0025] Compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result;

[0026] An analysis is performed based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

[0027] Optionally, the step of analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module includes:

[0028] Determining whether there is an abnormality in the first detection result and the second detection result in the target detection result;

[0029] If there is no abnormality in the first detection result and the second detection result, determining whether the first redundant code value and the second redundant code value in the verification result are the same;

[0030] If the first redundant code value is the same as the second redundant code value, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0031] Optionally, the preset check algorithm is a CRC algorithm, and the step of calculating the redundant code of the Chromium kernel module using the preset check algorithm to obtain the first redundant code value includes:

[0032] Initialize a CRC register, obtain a Chromium kernel API base address, and determine the data volume of the Chromium kernel module based on the Chromium kernel API base address;

[0033] Based on the data volume of the Chromium kernel module, dividing the Chromium kernel module into blocks according to a preset block rule to obtain multiple data blocks;

[0034] Sequentially performing an XOR operation on each of the databases and the current value of the CRC register, and performing modulo-2 division on the XOR operation result and the generator polynomial to obtain an operation result;

[0035] The value of the CRC register is updated according to each of the operation results to obtain a first redundant code value.

[0036] In addition, to achieve the above-mentioned purpose, the present invention also proposes a Chromium kernel security detection device, which includes:

[0037] A first redundancy calculation module is used to calculate the redundancy code of the Chromium kernel module using a preset verification algorithm to obtain a first redundancy code value;

[0038] A hook detection module, configured to perform hook detection on the Chromium kernel module to obtain a target detection result;

[0039] The second redundancy calculation module is further configured to return to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value;

[0040] a code value comparison module, configured to compare the first redundant code value with the second redundant code value to obtain a verification result;

[0041] The result output module is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0042] In addition, to achieve the above-mentioned purpose, the present invention also proposes a Chromium kernel security detection device, which includes: a memory, a processor, and a Chromium kernel security detection program stored in the memory and executable on the processor, wherein the Chromium kernel security detection program is configured to implement the steps of the Chromium kernel security detection method as described above.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a Chromium kernel security detection program is stored. When the Chromium kernel security detection program is executed by a processor, the steps of the Chromium kernel security detection method described above are implemented.

[0044] The present invention discloses the following steps: calculating the redundant code of a Chromium kernel module using a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module using the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine a security detection result of the Chromium kernel module. Because the present invention calculates the redundant code of the Chromium kernel module using a preset verification algorithm to perform redundant verification and performs hook detection on the Chromium kernel module, comprehensive coverage detection of known security risks of the Chromium kernel is achieved. Compared with the prior art, the present invention effectively improves the detection capability of security risks in the Chromium kernel. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of the first embodiment of the Chromium kernel security detection method of the present invention;

[0046] Figure 2 This is a flow chart of a second embodiment of the Chromium kernel security detection method of the present invention;

[0047] Figure 3 This is a flow chart of the third embodiment of the Chromium kernel security detection method of the present invention;

[0048] Figure 4 This is a structural block diagram of the first embodiment of the Chromium kernel security detection device of the present invention;

[0049] Figure 5 It is a structural diagram of a Chromium kernel security detection device in a hardware operating environment involved in an embodiment of the present invention.

[0050] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0052] The embodiment of the present invention provides a Chromium kernel security detection method, referring to Figure 1 , Figure 1 Schematic diagram of the process of the first embodiment of the Chromium kernel security detection method of the present invention.

[0053] In this embodiment, the Chromium kernel security detection method includes the following steps:

[0054] Step S10: Calculate the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a first redundant code value.

[0055] It should be noted that the execution subject of this embodiment can be a computer server device with data processing, network communication, and program execution functions used in psychological counseling scenarios, such as a personal computer, laptop computer, mobile phone, smart watch, etc., or an electronic device capable of implementing the above functions, a Chromium kernel security detection device, etc. The following uses the Chromium kernel security detection device as an example to illustrate this embodiment and the following embodiments.

[0056] It should be understood that the Chromium kernel module may include a module of the Chromium kernel. The Chromium kernel, also known as the Chrome kernel, is a browser kernel launched by Google. It is widely praised for its efficiency, scalability, security, and cross-platform nature, and is currently one of the browser kernels with the leading global market share.

[0057] The above-mentioned preset check algorithm can be a redundancy check algorithm, a parity check algorithm, a cyclic redundancy check algorithm, or a checksum algorithm. This embodiment and the following embodiments take the cyclic redundancy check algorithm as an example to illustrate this embodiment and the following embodiments.

[0058] In a specific implementation, the cyclic redundancy check algorithm includes the following steps:

[0059] (1) Generate a CRC32 polynomial: The cyclic redundancy check algorithm may be a CRC32 algorithm, which is based on a predefined binary polynomial, such as 0xEDB88320. This polynomial is the core of CRC32, and it should be understood that different applications may select different polynomials.

[0060] (2) Initialize CRC value: Before starting the calculation, set an initial CRC value, usually all 1s, that is, 0xFFFFFFFF.

[0061] (3) Shift operation: Shift the code (considered as binary data) to the left bit by bit, one bit at a time. If the highest bit is shifted out, fill the lowest bit with the lowest bit in the polynomial (usually 1).

[0062] (4) XOR operation: XOR the current CRC value with the shifted code bit. If any bit is 1, perform the XOR operation.

[0063] (5) Repeat steps (3) and (4): perform the above steps for each bit of the code to be detected until all bits are processed.

[0064] Generate CRC code: After processing all bits, the CRC value obtained is the CRC32 check code of the code, that is, the first redundant code value.

[0065] In redundancy checking, the resulting redundant code is additional information used to detect and / or correct errors that may occur during data transmission or storage. This redundant code is generated by processing the original data using a specific algorithm. Its length and generation method depend on the checksum algorithm used.

[0066] It should be noted that this embodiment uses a cyclic redundancy check algorithm to check the integrity and correctness of the Chromium kernel module to detect errors that occur during data transmission or storage.

[0067] Step S20: performing hook detection on the Chromium kernel module to obtain a target detection result.

[0068] It should be noted that hook detection, also known as HOOK detection, is used to detect and identify whether there are malicious or unauthorized hooks in the system. These hooks may be installed by viruses, Trojans, spyware or other malware to intercept, modify or redirect system events or messages, thereby affecting the normal operation of the system or stealing user data.

[0069] It should be noted that the hook detection in this embodiment includes inline hook detection and IAT hook detection.

[0070] Inline hooking is a technique that modifies the execution flow of a function while the program is running. It intercepts and modifies the target function by modifying its original code and redirecting its execution path to a custom code segment. The primary purpose of inline hook detection is to identify and remove malicious inline hooks from the system, protecting system security and stability.

[0071] IAT hooking is a technique that replaces or intercepts target functions by modifying a program's Import Address Table (IAT). Windows programs often call functions in other modules (such as DLLs) to complete specific functions. The addresses of these functions are stored in the IAT. The primary purpose of IAT hooking detection is to identify and remove malicious replacement entries in the IAT, ensuring that the program calls the correct function.

[0072] To ensure data security, step S20 includes:

[0073] Step S201: performing an inline hook detection on the Chromium kernel module to obtain a first detection result.

[0074] In a specific implementation, it is possible to determine and obtain a Chromium kernel API related to the Browser object; then detect whether the Chromium kernel API has a jump instruction, so as to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

[0075] Step S202: performing an IAT hook test on the Chromium kernel module to obtain a second test result.

[0076] In a specific implementation, an IAT export table can be obtained, and a Chromium kernel API related to a Browser object can be determined; a memory address of the Chromium kernel API is compared with a corresponding function address in the IAT export table to obtain a comparison result; and an analysis is performed based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

[0077] Step S202: taking the first detection result and the second detection result as target detection results.

[0078] Step S30: Return to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value.

[0079] Step S40: Compare the first redundant code value and the second redundant code value to obtain a verification result.

[0080] After performing hook detection on the Chromium kernel module, the redundant code of the Chromium kernel module is calculated again to obtain a second redundant code value, and then the first redundant code value and the second redundant code value are compared to determine whether the first redundant code value and the second redundant code value are the same, to obtain a verification result, and based on the verification result, the integrity and correctness of the Chromium kernel module are verified.

[0081] Step S50: Analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0082] It should be noted that the security test of the Chromium kernel module has passed only when the first test result, the second test result, and the verification result in the target test result are all passed.

[0083] In a specific implementation, it is determined whether there is an abnormality in the first detection result and the second detection result in the target detection result; if there is no abnormality in the first detection result and the second detection result, it is determined whether the first redundant code value and the second redundant code value in the verification result are the same; if the first redundant code value and the second redundant code value are the same, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0084] It should be understood that if any of the first test result, the second test result or the verification result is abnormal, it means that the security test of the Chromium kernel module has failed.

[0085] This embodiment discloses calculating the redundant code of the Chromium kernel module through a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module through the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value and the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Because this embodiment calculates the redundant code of the Chromium kernel module through a preset verification algorithm to perform redundant verification and performs hook detection on the Chromium kernel module, it achieves comprehensive coverage detection of known security risks in the Chromium kernel. Compared with the existing technology, this embodiment effectively improves the detection capability of security risks in the Chromium kernel.

[0086] refer to Figure 2 , Figure 2 Schematic diagram of the second embodiment of the Chromium kernel security detection method of the present invention.

[0087] Based on the first embodiment above, in this embodiment, before step S10, the following steps are further included:

[0088] Step S01: enhancing the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls.

[0089] Step S02: enhancing the initialization function in the Chromium kernel module through an inline hook to disable the remote debugging port.

[0090] Step S03: After enhancing the file loading function and the initialization function, initialize the corresponding registers in the preset verification algorithm.

[0091] In order to prevent local resource leakage and disable Chromium kernel debugging to prevent attackers from exploiting vulnerabilities, this embodiment enhances the file loading function and the initialization function in the Chromium kernel module through inline hooks before step S10.

[0092] It's important to note that the purpose of function enhancement is generally to improve a function's flexibility, scalability, performance, or functionality. It allows developers to extend and optimize functions without disrupting existing code structures. While the specific implementation of function enhancement may vary across programming languages ​​and environments, the underlying principles and advantages are similar. By properly applying function enhancement techniques, program flexibility, maintainability, and performance can be significantly improved.

[0093] Initializing the corresponding register in the preset verification algorithm, that is, initializing the CRC register, is to initialize the CRC value to a fixed value (such as 0 or all 1s), which can ensure that the CRC check value of each data packet is calculated independently and will not deviate due to the influence of the previous data packet.

[0094] This embodiment discloses a method for enhancing the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls; enhancing the initialization function in the Chromium kernel module through an inline hook to disable remote debugging ports; initializing the corresponding registers in the preset verification algorithm after enhancing the file loading function and the initialization function; calculating the redundant code of the Chromium kernel module through the preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to the step of calculating the redundant code of the Chromium kernel module through the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value and the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Because this embodiment enhances the file loading function and the initialization function in the Chromium kernel module through an inline hook, compared to the prior art, this embodiment effectively prevents local resource leakage and disables Chromium kernel debugging to prevent attackers from exploiting vulnerabilities.

[0095] refer to Figure 3 , Figure 3 2 is a flow chart of the third embodiment of the Chromium kernel security detection method of the present invention.

[0096] Based on the above embodiments, in this embodiment, step S10 includes:

[0097] Step S101: Initialize a CRC register, obtain a Chromium kernel API base address, and determine the data volume of the Chromium kernel module based on the Chromium kernel API base address.

[0098] Step S102: Based on the data volume of the Chromium kernel module, the Chromium kernel module is divided into blocks according to a preset block rule to obtain multiple data blocks.

[0099] Step S103: performing an XOR operation on each of the databases and the current value of the CRC register in sequence, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain an operation result.

[0100] Step S104: updating the value of the CRC register according to each of the operation results to obtain a first redundant code value.

[0101] It should be noted that the above-mentioned preset block rules may be user-defined block rules according to the data volume of the Chromium kernel module, and this embodiment does not impose any limitation on this.

[0102] It should be explained that by dividing the Chromium kernel module into blocks according to preset block rules, only a portion of the data content can be loaded into the memory for verification at a time, thereby effectively alleviating resource pressure; and it can also facilitate error location and recovery.

[0103] It should be noted that to improve the efficiency of CRC verification, the data to be verified can be divided into blocks, and the CRC calculation can be performed on each data block in parallel. In multi-core processors or distributed systems, this parallel calculation can significantly improve verification efficiency. In addition, for data blocks that have already been verified, if subsequent operations do not modify these data blocks, their CRC values ​​do not need to be recalculated, further improving verification efficiency.

[0104] This embodiment discloses initializing a CRC register, obtaining a Chromium kernel API base address, and determining the data volume of the Chromium kernel module based on the Chromium kernel API base address; based on the data volume of the Chromium kernel module, dividing the Chromium kernel module into blocks according to a preset block rule to obtain multiple data blocks; sequentially performing an XOR operation on each of the databases and the current value of the CRC register, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain an operation result; and updating the value of the CRC register according to each of the operation results to obtain a first redundant code value. Compared to the prior art, the present invention divides the Chromium kernel module into blocks according to a preset block rule based on the data volume of the Chromium kernel module, and then performs a CRC calculation on each data block, thereby effectively alleviating resource pressure and improving verification efficiency.

[0105] In addition, an embodiment of the present invention further proposes a storage medium on which a Chromium kernel security detection program is stored. When the Chromium kernel security detection program is executed by a processor, the steps of the Chromium kernel security detection method described above are implemented.

[0106] Reference Figure 4 , Figure 4 This is a structural block diagram of the first embodiment of the Chromium kernel security detection device of the present invention.

[0107] like Figure 4 As shown, the Chromium kernel security detection device proposed in the embodiment of the present invention includes: a first redundant calculation module 401, a hook detection module 402, a second redundant calculation module 403, a code value comparison module 404 and a result output module 405.

[0108] The first redundancy calculation module 401 is used to calculate the redundancy code of the Chromium kernel module using a preset verification algorithm to obtain a first redundancy code value.

[0109] The hook detection module 402 is used to perform hook detection on the Chromium kernel module to obtain a target detection result.

[0110] The second redundancy calculation module 403 is further configured to return to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value.

[0111] The code value comparison module 404 is configured to compare the first redundant code value with the second redundant code value to obtain a verification result.

[0112] The result output module 405 is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

[0113] The hook detection module 402 is further configured to perform an inline hook detection on the Chromium kernel module to obtain a first detection result; perform an IAT hook detection on the Chromium kernel module to obtain a second detection result; and use the first detection result and the second detection result as target detection results.

[0114] The hook detection module 402 is further configured to determine and obtain a Chromium kernel API related to a Browser object; and detect whether the Chromium kernel API contains a jump instruction, so as to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

[0115] The hook detection module 402 is further used to obtain the IAT export table and determine the Chromium kernel API related to the Browser object; compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result; and perform analysis based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

[0116] The result output module 405 is further used to determine whether there are any abnormalities in the first detection result and the second detection result in the target detection result; if there are no abnormalities in the first detection result and the second detection result, determine whether the first redundant code value and the second redundant code value in the verification result are the same; if the first redundant code value and the second redundant code value are the same, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

[0117] The present device embodiment discloses the steps of calculating the redundant code of the Chromium kernel module through a preset verification algorithm to obtain a first redundant code value; performing hook detection on the Chromium kernel module to obtain a target detection result; returning to execute the step of calculating the redundant code of the Chromium kernel module through the preset verification algorithm to obtain a second redundant code value; comparing the first redundant code value with the second redundant code value to obtain a verification result; analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module. Because the present device embodiment calculates the redundant code of the Chromium kernel module through a preset verification algorithm to perform redundant verification and performs hook detection on the Chromium kernel module, it achieves comprehensive coverage detection of known security risks of the Chromium kernel. Compared with the existing technology, the present device embodiment effectively improves the detection capability of security risks in the Chromium kernel.

[0118] Based on the first embodiment of the Chromium kernel security detection device of the present invention, a second embodiment of the Chromium kernel security detection device of the present invention is proposed.

[0119] In this embodiment, the first redundant calculation module 401 is further used to perform function enhancement on the file loading function in the Chromium kernel module through an inline hook to disable the resource loading function call; perform function enhancement on the initialization function in the Chromium kernel module through an inline hook to disable the remote debugging port; and after performing function enhancement on the file loading function and the initialization function, initialize the corresponding registers in the preset verification algorithm.

[0120] Other embodiments or specific implementations of the Chromium kernel security detection device of the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0121] The present application provides a Chromium kernel security detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the Chromium kernel security detection method in the above-mentioned embodiment 1.

[0122] Reference below Figure 5, which shows a schematic diagram of the structure of a Chromium kernel security detection device suitable for implementing the embodiments of the present application. The Chromium kernel security detection device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The Chromium kernel security detection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0123] like Figure 5 As shown, the Chromium kernel security detection device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 to the random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the Chromium kernel security detection device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the Chromium kernel security detection device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a Chromium kernel security detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0124] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0125] The Chromium kernel security detection device provided in this application utilizes the Chromium kernel security detection method described in the aforementioned embodiments, thereby resolving the technical issue of the prior art's relatively weak ability to detect security risks within the Chromium kernel. Compared to the prior art, the Chromium kernel security detection device provided in this application achieves the same beneficial effects as the Chromium kernel security detection method described in the aforementioned embodiments. The other technical features of the Chromium kernel security detection device are the same as those disclosed in the aforementioned embodiments, and are not further elaborated upon here.

[0126] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0127] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0128] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0129] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0130] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0131] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A Chromium kernel security detection method, characterized in that: The method comprises: Calculate the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a first redundant code value; Performing hook detection on the Chromium kernel module to obtain a target detection result, wherein the hook detection is used to detect and identify whether there are maliciously exploited or unauthorized hooks in the system; Returning to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value; Comparing the first redundant code value with the second redundant code value to obtain a verification result; The target detection result and the verification result are analyzed to determine the security detection result of the Chromium kernel module.

2. The Chromium kernel security detection method according to claim 1, characterized in that: Before the step of calculating the redundant code of the Chromium kernel module by using a preset verification algorithm to obtain the first redundant code value, the method further includes: Enhance the file loading function in the Chromium kernel module through an inline hook to disable resource loading function calls; Enhance the initialization function in the Chromium kernel module via an inline hook to disable the remote debugging port; After the file loading function and the initialization function are functionally enhanced, the corresponding registers in the preset verification algorithm are initialized.

3. The Chromium kernel security detection method according to claim 1, wherein: The step of performing hook detection on the Chromium kernel module to obtain a target detection result includes: Performing an inline hook detection on the Chromium kernel module to obtain a first detection result; Performing an IAT hook test on the Chromium kernel module to obtain a second test result; The first detection result and the second detection result are used as target detection results.

4. The Chromium kernel security detection method according to claim 3, wherein: The step of performing inline hook detection on the Chromium kernel module to obtain a first detection result includes: Determine the Chromium kernel API related to obtaining the Browser object; Detecting whether the Chromium kernel API has a jump instruction to perform inline hook detection on the Chromium kernel module and obtain a first detection result.

5. The Chromium kernel security detection method according to claim 3, wherein: The step of performing IAT hook detection on the Chromium kernel module to obtain a second detection result includes: Get the IAT export table and determine the Chromium kernel API related to the Browser object; Compare the memory address of the Chromium kernel API with the corresponding function address in the IAT export table to obtain a comparison result; An analysis is performed based on the comparison result to implement IAT hook detection on the Chromium kernel module and obtain a second detection result.

6. The Chromium kernel security detection method according to claim 3, wherein: The step of analyzing the target detection result and the verification result to determine the security detection result of the Chromium kernel module includes: Determining whether there is an abnormality in the first detection result and the second detection result in the target detection result; If there is no abnormality in the first detection result and the second detection result, determining whether the first redundant code value and the second redundant code value in the verification result are the same; If the first redundant code value is the same as the second redundant code value, it indicates that the security check of the Chromium kernel module has passed, and the security check passing is used as the security check result of the Chromium kernel module.

7. The Chromium kernel security detection method according to claim 1, wherein: The preset check algorithm is a CRC algorithm. The step of calculating the redundant code of the Chromium kernel module by the preset check algorithm to obtain the first redundant code value includes: Initialize a CRC register, obtain a Chromium kernel API base address, and determine the data volume of the Chromium kernel module based on the Chromium kernel API base address; Based on the data volume of the Chromium kernel module, dividing the Chromium kernel module into blocks according to a preset block rule to obtain multiple data blocks; Sequentially performing an XOR operation on each of the data blocks and the current value of the CRC register, and performing modulo-2 division on the XOR operation result and the generating polynomial to obtain an operation result; The value of the CRC register is updated according to each of the operation results to obtain a first redundant code value.

8. A Chromium kernel security detection device, characterized in that: The device comprises: A first redundancy calculation module is used to calculate the redundancy code of the Chromium kernel module using a preset verification algorithm to obtain a first redundancy code value; A hook detection module, configured to perform hook detection on the Chromium kernel module to obtain a target detection result, wherein the hook detection is used to detect and identify whether there are maliciously exploited or unauthorized hooks in the system; The second redundancy calculation module is further configured to return to the step of calculating the redundant code of the Chromium kernel module using a preset verification algorithm to obtain a second redundant code value; a code value comparison module, configured to compare the first redundant code value with the second redundant code value to obtain a verification result; The result output module is used to analyze the target detection result and the verification result to determine the security detection result of the Chromium kernel module.

9. A Chromium kernel security detection device, characterized in that: The device includes: a memory, a processor, and a Chromium kernel security detection program stored in the memory and executable on the processor, wherein the Chromium kernel security detection program is configured to implement the steps of the Chromium kernel security detection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a Chromium kernel security detection program, which, when executed by a processor, implements the steps of the Chromium kernel security detection method according to any one of claims 1 to 7.

Images