Method, device and equipment for detecting vulnerability utilization of desktop window manager
By preloading the dynamic link library and the call of shared memory method functions, automatic, fast and accurate detection of the exploit behavior of desktop window managers is achieved, and the problem of high detection capabilities and experience requirements in the existing technology can be solved, and the encryption or Samples of code obfuscation.
Patent Information
- Application Number
- CN202411237489.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-04
- Publication Date
- 2024-12-27
AI Technical Summary
The existing desktop window manager vulnerability detection methods require high technician capabilities and experience, and cannot effectively detect desktop window manager vulnerability attacks, especially for encrypted or code obfuscated samples.
By preloading the dynamic link library, when the mapping shared memory method function in the shared area base class is detected to be called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address, and the preset bias is used Compare the data to be verified in the shifted address with the attack discriminating data to determine whether there is any vulnerability exploitation of the desktop window manager.
It realizes automatic, fast and accurate detection of vulnerability exploit behavior of desktop window managers, reduces the ability and experience requirements of technicians, and can effectively detect encrypted or code obfuscated samples.
Smart Images
Figure CN119203151A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and computer-readable storage medium for detecting a desktop window manager vulnerability exploit. Background Art
[0002] The Windows Desktop Window Manager (DWM) is an important component of the Windows operating system, which is responsible for managing and rendering the display of the desktop window. In recent years, the Windows Desktop Window Manager has begun to become a new attack vector for privilege escalation vulnerabilities.
[0003] Faced with the increasing number of Windows Desktop Window Manager vulnerability exploitation cases, the current protection methods are mainly to identify vulnerability samples through static feature scanning or to identify vulnerability samples through process token comparison. The method of identifying vulnerability samples through static feature scanning needs to be combined with manual analysis, which requires high ability and experience of technical personnel. In addition, this method cannot effectively scan samples that are encrypted or obfuscated, which is insufficient. The method of identifying vulnerability samples through process token comparison is to compare whether the current process token is consistent with the token of the common system process. If the consistency is found, it means that the current process token has been maliciously replaced and is considered detected. However, the Windows Desktop Window Manager vulnerability exploitation techniques that have appeared in recent years do not have the token replacement operation that is common in traditional privilege escalation vulnerability exploitation. This detection method cannot effectively detect Windows Desktop Window Manager vulnerability exploitation attack behaviors.
[0004] To sum up, how to effectively solve the problems that the current detection method of desktop window manager vulnerability exploitation has high requirements on the ability and experience of technical personnel and cannot effectively detect the desktop window manager vulnerability exploitation attack behavior is a problem that technical personnel in this field urgently need to solve. Summary of the invention
[0005] The purpose of this application is to provide a method for detecting desktop window manager vulnerability exploitation, which method realizes automatic, rapid, accurate and effective detection of desktop window manager vulnerability exploitation behavior, greatly reducing the ability and experience requirements of technical personnel; another purpose of this application is to provide a desktop window manager vulnerability exploitation detection device, equipment and computer-readable storage medium.
[0006] In order to solve the above technical problems, this application provides the following technical solutions:
[0007] A method for detecting a desktop window manager vulnerability exploit, comprising:
[0008] When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called by using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process;
[0009] Acquire a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address;
[0010] Obtaining attack identification data corresponding to the preset offset address;
[0011] When it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0012] In a specific implementation of the present application, obtaining a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address includes:
[0013] Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address and 8 bytes of data at the shared data base address;
[0014] Accordingly, acquiring the attack identification data corresponding to the preset offset address includes:
[0015] Obtain the attack determination data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the attack determination data 0xFFEEFFEE corresponding to the shared data base address;
[0016] Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including:
[0017] When it is determined that the 8-byte data at the shared data base address+0x10 address is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address is the attack determination data 0xFFEEFFEE, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0018] In a specific implementation of the present application, obtaining a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address includes:
[0019] Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address + 0x1E8 address and 8 bytes of data at the shared data base address + 0x1E8 address;
[0020] Accordingly, acquiring the attack identification data corresponding to the preset offset address includes:
[0021] Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the standard stub buffer debugging server release function address corresponding to the shared data base address + 0x1E8 address;
[0022] Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including:
[0023] When it is determined that the 8-byte data at the shared data base address+0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address+0x1E8 is the standard stub buffer debugging server release function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0024] In a specific implementation of the present application, obtaining a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address includes:
[0025] Acquire the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and acquire the shared data base address + 0x230 address and 8 bytes of data at the shared data base address + 0x230 address;
[0026] Accordingly, acquiring the attack identification data corresponding to the preset offset address includes:
[0027] Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the multi-byte character loading module function address and the wide character loading module function address corresponding to the shared data base address + 0x230 address;
[0028] Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including:
[0029] When it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x230 address is a multi-byte character loading module function address or a wide character loading module function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0030] In a specific implementation of the present application, obtaining a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address includes:
[0031] Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address + 0x1C0 address and 8 bytes of data at the shared data base address + 0x1C0 address;
[0032] Accordingly, acquiring the attack identification data corresponding to the preset offset address includes:
[0033] Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the network data representation proxy forwarding function address and the standard stub buffer release connection function address corresponding to the shared data base address + 0x1C0 address;
[0034] Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including:
[0035] When it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1C0 address is the network data representing the proxy forwarding function address or the standard stub buffer release connection function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0036] In a specific implementation of the present application, it also includes:
[0037] When it is determined that the 8-byte data at the shared data base address+0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
[0038] In a specific implementation of the present application, a loading process of the dynamic link library is also included, and the loading process of the dynamic link library includes:
[0039] Injecting a remote thread of machine code into the Desktop Window Manager process;
[0040] The machine code remote thread is loaded by utilizing the desktop window manager process to load the dynamic link library.
[0041] A detection device for a desktop window manager vulnerability exploit, comprising:
[0042] A base address acquisition module is used to, when detecting that a mapping shared memory method function in a shared area base class is called, call the mapping shared memory method function using a preloaded dynamic link library to obtain a shared data base address for data sharing in this rendering process;
[0043] A to-be-verified data acquisition module, used to acquire a preset offset address corresponding to the shared data base address and the to-be-verified data in the preset offset address;
[0044] An attack discrimination data acquisition module, used to obtain the attack discrimination data corresponding to the preset offset address;
[0045] The vulnerability exploitation behavior determination module is used to determine the presence of a desktop window manager vulnerability exploitation behavior when it is determined that the data to be verified is consistent with the corresponding attack identification data.
[0046] A detection device for desktop window manager vulnerability exploitation, comprising:
[0047] Memory for storing computer programs;
[0048] The processor is used to implement the steps of the method for detecting the exploitation of the desktop window manager vulnerability as described above when executing the computer program.
[0049] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting a desktop window manager vulnerability exploit as described above.
[0050] The desktop window manager vulnerability exploit detection method provided by the present application, when it is detected that the mapping shared memory method function in the shared area base class is called, uses the preloaded dynamic link library to call the mapping shared memory method function to obtain the shared data base address for data sharing in this rendering process; obtains the preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address; obtains the attack discrimination data corresponding to the preset offset address; and when it is determined that the data to be verified is consistent with the corresponding attack discrimination data, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0051] It can be seen from the above technical solution that by pre-loading the dynamic link library, when it is detected that the mapping shared memory method function in the shared area base class is called, the pre-loaded dynamic link library is used to call the mapping shared memory method function to obtain the shared data base address for data sharing of the current rendering process returned by the mapping shared memory method function. The preset offset address corresponding to each shared data base address and the attack discrimination data corresponding to the preset offset address are pre-set, and the data to be verified in the preset offset address is obtained, and the obtained data to be verified is compared with the corresponding attack discrimination data for consistency. When it is determined that the data is consistent, it is determined that there is a desktop window manager vulnerability exploitation behavior. Thereby, the automatic, rapid, accurate and effective detection of the desktop window manager vulnerability exploitation behavior is realized, which greatly reduces the ability and experience requirements for technical personnel.
[0052] Correspondingly, the present application also provides a desktop window manager vulnerability exploitation detection device, equipment and computer-readable storage medium corresponding to the above-mentioned desktop window manager vulnerability exploitation detection method, which has the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS
[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0054] Figure 1 A flowchart of an implementation of a method for detecting a desktop window manager vulnerability exploit in an embodiment of the present application;
[0055] Figure 2 It is a structural block diagram of a system for detecting a desktop window manager vulnerability exploit in an embodiment of the present application;
[0056] Figure 3 This is a block diagram of a desktop window manager memory sharing structure in an embodiment of the present application;
[0057] Figure 4 This is a flowchart of an implementation process of a desktop window manager vulnerability exploitation process in an embodiment of the present application;
[0058] Figure 5 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application;
[0059] Figure 6 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application;
[0060] Figure 7 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application;
[0061] Figure 8 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application;
[0062] Fig. 9 It is a structural block diagram of a detection device for a desktop window manager vulnerability exploit in an embodiment of the present application;
[0063] Fig.10 It is a structural block diagram of a detection device for a desktop window manager vulnerability exploit in an embodiment of the present application;
[0064] Fig.11 A schematic diagram of the specific structure of a device for detecting a desktop window manager vulnerability exploit provided in an embodiment of the present application. DETAILED DESCRIPTION
[0065] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.
[0066] See also Figure 1 , Figure 1 This is a flowchart of an implementation of a method for detecting a desktop window manager vulnerability exploit in an embodiment of the present application. The method may include the following steps:
[0067] S101: When it is detected that a mapping shared memory method function in a shared area base class is called, the mapping shared memory method function is called using a preloaded dynamic link library to obtain a shared data base address for data sharing in this rendering process.
[0068] When any rendering process shares data with the desktop window manager process, it is necessary to call the map shared memory method (CSharedSectionBase::MapSharedMemory) function in the shared area base class to share data.
[0069] The dynamic link library (DLL) is preloaded, and the call detection is performed on the mapping shared memory method function in the shared area base class. When it is detected that the mapping shared memory method function in the shared area base class is called, the preloaded dynamic link library is used to call the mapping shared memory method function to obtain the shared data base address (base address) for data sharing in this rendering process. For example, the shared data base address called can be set to p.
[0070] Rendering process refers to all processes that interact with the Desktop Window Manager process through data communication. Including but not limited to winlogon.exe, LogonUI.exe and consent.exe. Rendering processes have high process permissions. Once the execution logic of the rendering process is tampered with, it may cause some harmful behaviors under high permissions, such as starting a malicious program with system permissions.
[0071] A dynamic link library is an executable file that is shared by multiple programs at runtime and contains functions and resources (such as data and code). By using dynamic link libraries, programs can reduce the memory and disk space occupied. In the Windows operating system, dynamic link libraries generally refer to various dlls, such as dwmcore.dll.
[0072] The base address refers to the "module loading base address", specifically the starting memory address assigned by the operating system when it loads an executable file or dynamic link library into memory. This address is used to locate all code and data in the module.
[0073] S102: Obtain a preset offset address corresponding to a shared data base address and the data to be verified in the preset offset address.
[0074] The offset address to be verified is set in advance according to the address data modification of the desktop window manager vulnerability exploitation process. After calling the shared data base address for data sharing in this rendering process, the preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address are obtained.
[0075] S103: Obtain attack identification data corresponding to a preset offset address.
[0076] The attack discrimination data corresponding to each preset offset address is set in advance according to the data rewriting situation of the desktop window manager vulnerability exploitation process. After obtaining the preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address, the attack discrimination data corresponding to the preset offset address is obtained.
[0077] S104: When it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0078] After obtaining the attack discrimination data corresponding to the preset offset address and the data to be verified in the preset offset address, the consistency comparison is performed between the data to be verified and the corresponding attack discrimination data. When it is determined that the data to be verified is consistent with the corresponding attack discrimination data, it is determined that there is a desktop window manager vulnerability exploitation behavior. By hooking the specific application programming interface (Application Programming Interface, API) call of the Windows desktop window manager process, a series of data comparisons are performed in the hook function to detect whether the current system is attacked by the Windows desktop window manager vulnerability exploitation, thereby realizing automatic, rapid, accurate and effective detection of the desktop window manager vulnerability exploitation behavior, and greatly reducing the ability and experience requirements of technical personnel.
[0079] A vulnerability refers to a security flaw in an operating system or software code.
[0080] It can be seen from the above technical solution that by pre-loading the dynamic link library, when it is detected that the mapping shared memory method function in the shared area base class is called, the pre-loaded dynamic link library is used to call the mapping shared memory method function to obtain the shared data base address for data sharing of the current rendering process returned by the mapping shared memory method function. The preset offset address corresponding to each shared data base address and the attack discrimination data corresponding to the preset offset address are pre-set, and the data to be verified in the preset offset address is obtained, and the obtained data to be verified is compared with the corresponding attack discrimination data for consistency. When it is determined that the data is consistent, it is determined that there is a desktop window manager vulnerability exploitation behavior. Thereby, the automatic, rapid, accurate and effective detection of the desktop window manager vulnerability exploitation behavior is realized, which greatly reduces the ability and experience requirements for technical personnel.
[0081] It should be noted that, based on the above embodiments, the embodiments of the present application also provide corresponding improved solutions. In the subsequent embodiments, the same steps or corresponding steps as those in the above embodiments can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, which will not be repeated one by one in the following improved embodiments.
[0082] See also Figure 2 , Figure 2This is a structural block diagram of a detection system for a desktop window manager vulnerability exploit in an embodiment of the present application. When the Windows operating system is running normally, different rendering processes communicate with the Windows kernel by calling different DirectComposition application programming interfaces. The desktop window manager process communicates with the Windows kernel through a special message mechanism.
[0083] DirectComposition is a series of application programming interfaces provided by Microsoft for high-performance and low-latency graphics synthesis. It allows developers to create and manage complex graphics content, and efficiently render through GPU (Graphics Processing Unit) acceleration, which is suitable for the user interface of Windows applications.
[0084] When the Desktop Window Manager vulnerability exploit is launched, the attacker will start an attack process (that is, an attack program, which is represented as a "process" in the operating system after it is started). In the attack process, the vulnerabilities in the Desktop Window Manager process are first triggered by calling DirectComposition application programming interfaces such as NtDCompositionCreateChannel, NtDCompositionProcessChannelBatchBuffer, and NtDCompositionCommitChannel. These vulnerabilities are usually located in the dwmcore.dll module loaded by the Desktop Window Manager process. From the cases observed so far, the causes of these vulnerabilities are diverse, including arbitrary pointer dereference, out-of-bounds write, etc.
[0085] like Figure 2 As shown in the figure, when the Desktop Window Manager is running normally, each rendering process will interact with the Desktop Window Manager process. Due to the large number of rendering processes, it is impossible for the Desktop Window Manager process to load the data of all rendering processes into its own process memory space. In order to solve this problem, the Windows operating system has designed a special mechanism for the Desktop Window Manager process, namely SharedSection. SharedSection can be understood as a "shared data segment", and its function is to map the data that the rendering process needs to interact with the Desktop Window Manager process in a shared memory manner. At the code implementation level, SharedSection is encapsulated as the CSharedSection class, which is encoded in the dwmcore.dll module.
[0086] dwmcore.dll is a dynamic link library that comes with the Windows operating system and is loaded and used by processes in need when needed. The dynamic link library implements the core logic of the Windows Desktop Window Manager.
[0087] See also Figure 3 , Figure 3 This is a block diagram of a desktop window manager memory sharing structure in an embodiment of the present application. A CSharedSectionBase::OnChanged function is encapsulated inside dwmcore.dll. The function of this function is to map or unmap shared memory when the rendering process needs to communicate data with the desktop window manager process. When shared memory mapping is required, the CSharedSectionBase::MapSharedMemory function is called inside the CSharedSectionBase::OnChanged function to map the shared data of the rendering process to the memory space of the desktop window manager process. When shared memory unmapping is required, the CSharedSectionBase::UnmapSharedMemory function is called inside the CSharedSectionBase::OnChanged function to unmap the memory that the rendering process has shared from the desktop window manager process space.
[0088] The CSharedSectionBase::MapSharedMemory function maps the shared data operation of the rendering process to the memory space of the Desktop Window Manager process by calling the MapViewOfFile function. The MapViewOfFile function is an export function of the kernelbase.dll dynamic link library and is used as an import function by dwmcore.dll here.
[0089] See also Figure 4 , Figure 4 The following is a flowchart of the implementation of a desktop window manager vulnerability exploitation process in an embodiment of the present application. The attacker hijacks the memory sharing logic of the rendering process communication data by hooking the MapViewOfFile function in the desktop window manager process. Specifically, when the desktop window manager process calls the MapViewOfFile function, through the hook mechanism, the attacker first hijacks the execution logic to the hooked Hook_MapViewOfFile function (this function name can be specified arbitrarily, and this embodiment of the present application does not limit this).
[0090] Inside the Hook_MapViewOfFile function, the attacker first calls the MapViewOfFile function to map the shared data of the rendering process to the Desktop Window Manager process space, and then obtains the call return value of the MapViewOfFile function, which is an address. This address represents the first address of the shared memory mapped to the Desktop Window Manager process space, such as setting it to MappedBuffer.
[0091] After implementing the MapViewOfFile hook, when any rendering process shares data with the Desktop Window Manager process, it will enter Hook_MapViewOfFile. Figure 4 The data modification logic in the flowchart shown in the figure shows that the attack program successfully induced the desktop window manager process to tamper with the shared data from the rendering process, which contains the virtual function tables of some key objects and the corresponding parameters. When the desktop window manager modifies the shared data from the rendering process, the corresponding data in the memory space of the rendering process is also changed. In this way, the attack program successfully modifies the memory data of the rendering process, thereby hijacking a specific virtual function call, and further inducing the rendering process to call the function specified by the attacker, and on this basis, load the dynamic link library specified by the attacker, so as to execute the attack code with the permissions of the rendering process, and complete the malicious code execution under high permissions.
[0092] See also Figure 5 , Figure 5 This is another implementation flow chart of a method for detecting a vulnerability exploit of a desktop window manager in an embodiment of the present application. The method may include the following steps:
[0093] S501: Inject a machine code remote thread into the desktop window manager process.
[0094] Perform remote thread injection into the desktop window manager process in advance, inject a machine code (Shellcode) remote thread into the desktop window manager process, that is, inject a functional machine code.
[0095] S502: Utilize the desktop window manager process to load the machine code remote thread to load the dynamic link library.
[0096] After injecting the machine code remote thread into the desktop window manager process, the desktop window manager process is used to load the machine code remote thread, and the desktop window manager process is induced to load the specified detection dynamic link library by loading the machine code remote thread.
[0097] S503: When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process.
[0098] S504: Acquire the shared data base address + 0x10 address and the 8-byte data at the shared data base address + 0x10 address, and acquire the shared data base address and the 8-byte data at the shared data base address.
[0099] After obtaining the shared data base address for data sharing in this rendering process, the 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address are obtained.
[0100] S505: Acquire the attack determination data 0x1FFEEFFEE corresponding to the shared data base address+0x10 address, and acquire the attack determination data 0xFFEEFFEE corresponding to the shared data base address.
[0101] According to the rules of exploiting the Desktop Window Manager vulnerability, the attack discrimination data corresponding to the shared data base address + 0x10 is set to 0x1FFEEFFEE in advance, and the attack discrimination data corresponding to the shared data base address is set to 0xFFEEFFEE in advance. After obtaining the shared data base address and the 8-byte data at the shared data base address, the attack discrimination data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 is obtained, and the attack discrimination data 0xFFEEFFEE corresponding to the shared data base address is obtained.
[0102] S506: When it is determined that the 8-byte data at the shared data base address+0x10 address is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address is the attack determination data 0xFFEEFFEE, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0103] After obtaining the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtaining the attack identification data 0xFFEEFFEE corresponding to the shared data base address, when it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address is the attack identification data 0xFFEEFFEE, it is determined that there is a desktop window manager vulnerability exploitation behavior. The desktop window manager vulnerability exploitation behavior is accurately identified based on the 8-byte data at the shared data base address.
[0104] S507: When it is determined that the 8-byte data at the shared data base address+0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
[0105] When the consistency comparison between the data to be checked and the corresponding attack discrimination data is performed, the consistency comparison between the 8-byte data at the shared data base address +0x10 and the corresponding attack discrimination data is first performed. When it is determined that the 8-byte data at the shared data base address +0x10 is not the attack discrimination data 0x1FFEEFFEE, the next data consistency comparison step is not performed, and it is directly determined that there is no desktop window manager vulnerability exploitation behavior. By first performing a consistency comparison between the data to be checked and the corresponding attack discrimination data at the shared data base address +0x10, unnecessary comparison processes are avoided, thereby improving the detection efficiency of the desktop window manager vulnerability exploitation.
[0106] See also Figure 6 , Figure 6 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application, the method may include the following steps:
[0107] S601: Inject a machine code remote thread into the desktop window manager process.
[0108] S602: Utilize the desktop window manager process to load the machine code remote thread to load the dynamic link library.
[0109] S603: When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process.
[0110] S604: Acquire 8 bytes of data at the shared data base address + 0x10 and the shared data base address + 0x10, and acquire 8 bytes of data at the shared data base address + 0x1E8 and the shared data base address + 0x1E8.
[0111] After obtaining the shared data base address for data sharing in this rendering process, obtain the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and obtain the 8-byte data at the shared data base address + 0x1E8 and the shared data base address + 0x1E8.
[0112] S605: Acquire the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquire the standard stub buffer debug server release function address corresponding to the shared data base address + 0x1E8 address.
[0113] According to the rules of exploiting the Desktop Window Manager vulnerability, the attack discrimination data corresponding to the shared data base address + 0x10 is set to 0x1FFEEFFEE in advance, and the attack discrimination data corresponding to the shared data base address + 0x1E8 is set to the address of the standard stub buffer debug server release function (CStdStubBuffer_DebugServerRelease) in advance. Get the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and get the 8-byte data at the shared data base address + 0x1E8 and the shared data base address + 0x1E8.
[0114] S606: When it is determined that the 8-byte data at the shared data base address + 0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1E8 is the standard stub buffer debug server release function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0115] After obtaining the attack discrimination data 0x1FFEEFFEE corresponding to the shared data base address +0x10, and obtaining the attack discrimination data standard stub buffer debug server release function address corresponding to the shared data base address +0x1E8, when it is determined that the 8-byte data at the shared data base address +0x10 is the attack discrimination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address +0x1E8 is the standard stub buffer debug server release function address, it is determined that there is a desktop window manager vulnerability exploitation behavior. The desktop window manager vulnerability exploitation behavior is accurately discriminated based on the 8-byte data at the shared data base address +0x1E8.
[0116] S607: When it is determined that the 8-byte data at the shared data base address + 0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
[0117] See also Figure 7 , Figure 7 Another implementation flow chart of the method for detecting the desktop window manager vulnerability exploit in the embodiment of the present application, the method may include the following steps:
[0118] S701: Inject a machine code remote thread into the desktop window manager process.
[0119] S702: Utilize the desktop window manager process to load the machine code remote thread to load the dynamic link library.
[0120] S703: When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process.
[0121] S704: Acquire 8 bytes of data at the shared data base address + 0x10 and the shared data base address + 0x10, and acquire 8 bytes of data at the shared data base address + 0x230 and the shared data base address + 0x230.
[0122] After obtaining the shared data base address for data sharing in this rendering process, obtain the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and obtain the 8-byte data at the shared data base address + 0x230 and the shared data base address + 0x230.
[0123] S705: Acquire the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquire the multi-byte character loading module function address and the wide character loading module function address corresponding to the shared data base address + 0x230 address.
[0124] According to the rules of exploiting the Desktop Window Manager vulnerability, the attack discrimination data corresponding to the shared data base address + 0x10 is set to 0x1FFEEFFEE in advance, and the attack discrimination data corresponding to the shared data base address + 0x230 is set to the multi-byte character loading module (LoadLibraryA) function address and the wide character loading module (LoadLibraryW) function address in advance. Get the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and get the multi-byte character loading module function address and the wide character loading module function address corresponding to the shared data base address + 0x230.
[0125] S706: When it is determined that the 8-byte data at the shared data base address + 0x10 is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x230 is the multi-byte character loading module function address or the wide character loading module function address, it is determined that there is a Desktop Window Manager vulnerability exploitation behavior.
[0126] After obtaining the attack identification data 0x1FFEEFFEE corresponding to the shared data base address +0x10, and obtaining the attack identification data multi-byte character loading module function address and wide character loading module function address corresponding to the shared data base address +0x230, when it is determined that the 8-byte data at the shared data base address +0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address +0x230 is the multi-byte character loading module function address or the wide character loading module function address, it is determined that there is a desktop window manager vulnerability exploitation behavior. The desktop window manager vulnerability exploitation behavior is accurately identified based on the 8-byte data at the shared data base address +0x230.
[0127] S707: When it is determined that the 8-byte data at the shared data base address + 0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
[0128] See also Figure 8 , Figure 8 This is another implementation flow chart of a method for detecting a vulnerability exploit of a desktop window manager in an embodiment of the present application. The method may include the following steps:
[0129] S801: Inject a machine code remote thread into the desktop window manager process.
[0130] S802: Utilize the desktop window manager process to load the machine code remote thread to load the dynamic link library.
[0131] S803: When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process.
[0132] S804: Acquire 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address, and acquire 8 bytes of data at the shared data base address + 0x1C0 address and the shared data base address + 0x1C0 address.
[0133] After obtaining the shared data base address for data sharing in this rendering process, obtain the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and obtain the 8-byte data at the shared data base address + 0x1C0 and the shared data base address + 0x1C0.
[0134] S805: Acquire the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquire the network data representation proxy forwarding function address and the standard stub buffer release connection function address corresponding to the shared data base address + 0x1C0 address.
[0135] According to the rules of exploiting the Desktop Window Manager vulnerability, the attack discrimination data corresponding to the shared data base address + 0x10 is set to 0x1FFEEFFEE in advance, and the attack discrimination data corresponding to the shared data base address + 0x1C0 is set to the network data representation proxy forwarding function address and the standard stub buffer release connection function address in advance. Get the 8-byte data at the shared data base address + 0x10 and the shared data base address + 0x10, and get the network data representation proxy forwarding (NdrProxyForwardingFunction3) function address and the standard stub buffer release connection (CStdStubBuffer2_Disconnect) function address corresponding to the shared data base address + 0x1C0.
[0136] S806: When it is determined that the 8-byte data at the shared data base address + 0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1C0 is the network data representing the proxy forwarding function address or the standard stub buffer release connection function address, it is determined that there is a Desktop Window Manager vulnerability exploitation behavior.
[0137] After obtaining the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10, and obtaining the network data representation proxy forwarding function address and the standard stub buffer release connection function address corresponding to the shared data base address + 0x1C0, when it is determined that the 8-byte data at the shared data base address + 0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1C0 is the network data representation proxy forwarding function address or the standard stub buffer release connection function address, it is determined that there is a desktop window manager vulnerability exploitation behavior. The desktop window manager vulnerability exploitation behavior is accurately identified based on the 8-byte data at the shared data base address + 0x1C0.
[0138] S807: When it is determined that the 8-byte data at the shared data base address + 0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
[0139] It should be noted that the embodiments of the present application do not limit the selection of the offset address of the shared data base address used for attack identification. In addition to the offset addresses listed in the above embodiments, it can also be other offset addresses of the shared data base address that can identify the desktop window manager vulnerability exploitation behavior.
[0140] Corresponding to the above method embodiments, the present application also provides a device for detecting a desktop window manager vulnerability exploitation. The device for detecting a desktop window manager vulnerability exploitation described below and the method for detecting a desktop window manager vulnerability exploitation described above can refer to each other.
[0141] See also Fig. 9 , Fig. 9 This is a structural block diagram of a device for detecting a desktop window manager vulnerability exploit in an embodiment of the present application. The device may include:
[0142] The base address acquisition module 91 is used to call the mapping shared memory method function using the preloaded dynamic link library when detecting that the mapping shared memory method function in the shared area base class is called, so as to obtain the shared data base address for data sharing in the current rendering process;
[0143] The to-be-verified data acquisition module 92 is used to acquire the preset offset address corresponding to the shared data base address and the to-be-verified data in the preset offset address;
[0144] An attack discrimination data acquisition module 93, used to acquire attack discrimination data corresponding to a preset offset address;
[0145] The vulnerability exploitation behavior determination module 94 is used to determine that there is a desktop window manager vulnerability exploitation behavior when it is determined that the data to be verified is consistent with the corresponding attack identification data.
[0146] It can be seen from the above technical solution that by pre-loading the dynamic link library, when it is detected that the mapping shared memory method function in the shared area base class is called, the pre-loaded dynamic link library is used to call the mapping shared memory method function to obtain the shared data base address for data sharing of the current rendering process returned by the mapping shared memory method function. The preset offset address corresponding to each shared data base address and the attack discrimination data corresponding to the preset offset address are pre-set, and the data to be verified in the preset offset address is obtained, and the obtained data to be verified is compared with the corresponding attack discrimination data for consistency. When it is determined that the data is consistent, it is determined that there is a desktop window manager vulnerability exploitation behavior. Thereby, the automatic, rapid, accurate and effective detection of the desktop window manager vulnerability exploitation behavior is realized, which greatly reduces the ability and experience requirements for technical personnel.
[0147] In a specific implementation of the present application, the to-be-verified data acquisition module 92 is specifically a module for acquiring 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address, and acquiring the shared data base address and the 8 bytes of data at the shared data base address;
[0148] The attack discrimination data acquisition module 93 is specifically a module for acquiring the attack discrimination data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquiring the attack discrimination data 0xFFEEFFEE corresponding to the shared data base address;
[0149] The vulnerability exploitation behavior determination module 94 is specifically a module that determines that there is a desktop window manager vulnerability exploitation behavior when it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack determination data 0x1FFEEFFEE and the 8-byte data at the shared data base address is the attack determination data 0xFFEEFFEE.
[0150] In a specific implementation of the present application, the to-be-verified data acquisition module 92 is specifically a module for acquiring 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address, and acquiring 8 bytes of data at the shared data base address + 0x1E8 address and the shared data base address + 0x1E8 address;
[0151] The attack identification data acquisition module 93 is specifically a module for acquiring the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquiring the standard stub buffer debugging server release function address corresponding to the shared data base address + 0x1E8 address;
[0152] The vulnerability exploitation behavior determination module 94 is specifically a module that determines that there is a desktop window manager vulnerability exploitation behavior when it is determined that the 8-byte data at the shared data base address + 0x10 is the attack judgment data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1E8 is the standard stub buffer debug server release function address.
[0153] In a specific implementation of the present application, the to-be-verified data acquisition module 92 is specifically a module for acquiring 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address, and acquiring 8 bytes of data at the shared data base address + 0x230 address and the shared data base address + 0x230 address;
[0154] The attack identification data acquisition module 93 is specifically a module for acquiring the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquiring the multi-byte character loading module function address and the wide character loading module function address corresponding to the shared data base address + 0x230 address;
[0155] The vulnerability exploitation behavior determination module 94 specifically determines that there is a module for desktop window manager vulnerability exploitation behavior when it is determined that the 8-byte data at the shared data base address + 0x10 is the attack judgment data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x230 is a multi-byte character loading module function address or a wide character loading module function address.
[0156] In a specific implementation of the present application, the to-be-verified data acquisition module 92 is specifically a module for acquiring 8 bytes of data at the shared data base address + 0x10 address and the shared data base address + 0x10 address, and acquiring 8 bytes of data at the shared data base address + 0x1C0 address and the shared data base address + 0x1C0 address;
[0157] The attack identification data acquisition module 93 is specifically a module for acquiring the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and acquiring the network data representation proxy forwarding function address and the standard stub buffer release connection function address corresponding to the shared data base address + 0x1C0 address;
[0158] The vulnerability exploitation behavior determination module 94 is specifically a module that determines that there is a desktop window manager vulnerability exploitation behavior when it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack judgment data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1C0 address is the network data representing the proxy forwarding function address or the standard stub buffer release connection function address.
[0159] In a specific embodiment of the present application, the device may further include:
[0160] The module for determining that there is no vulnerability exploitation behavior is used to determine that there is no desktop window manager vulnerability exploitation behavior when it is determined that the 8-byte data at the shared data base address + 0x10 address is not the attack judgment data 0x1FFEEFFEE.
[0161] In a specific implementation of the present application, the device may further include a dynamic link library loading module, and the dynamic link library loading module includes:
[0162] A machine code remote thread injection submodule is used to inject a machine code remote thread into the desktop window manager process;
[0163] The dynamic link library loading submodule is used to load the machine code remote thread using the desktop window manager process to load the dynamic link library.
[0164] Corresponding to the above method embodiment, see Fig.10 , Fig.10 A schematic diagram of a detection device for a desktop window manager vulnerability exploit provided by the present application, the device may include:
[0165] A memory 332, for storing computer programs;
[0166] The processor 322 is used to implement the steps of the method for detecting the exploitation of the desktop window manager in the above method embodiment when executing the computer program.
[0167] For details, please refer to Fig.11 , Fig.11 A specific structural diagram of a detection device for a desktop window manager vulnerability exploit provided in this embodiment, the detection device for the desktop window manager vulnerability exploit may have relatively large differences due to different configurations or performances, and may include a processor (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 322 can be configured to communicate with the memory 332, and execute a series of instruction operations in the memory 332 on the detection device 301 for the desktop window manager vulnerability exploit.
[0168] The desktop window manager vulnerability exploit detection device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .
[0169] The steps in the method for detecting a desktop window manager vulnerability exploit described above can be implemented by the structure of a device for detecting a desktop window manager vulnerability exploit.
[0170] Corresponding to the above method embodiment, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps can be implemented:
[0171] When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process; obtain the preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address; obtain the attack discrimination data corresponding to the preset offset address; and when it is determined that the data to be verified is consistent with the corresponding attack discrimination data, it is determined that there is a desktop window manager vulnerability exploitation behavior.
[0172] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0173] For an introduction to the computer-readable storage medium provided in this application, please refer to the above method embodiment, and this application will not go into details here.
[0174] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the devices, equipment and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0175] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the technical solution and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.
Claims
1. A method for detecting a desktop window manager vulnerability exploit, characterized in that: include: When it is detected that the mapping shared memory method function in the shared area base class is called, the mapping shared memory method function is called by using the preloaded dynamic link library to obtain the shared data base address for data sharing in this rendering process; Acquire a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address; Obtaining attack identification data corresponding to the preset offset address; When it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior.
2. The method for detecting a desktop window manager vulnerability exploit according to claim 1, characterized in that: Acquiring a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address, including: Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address and 8 bytes of data at the shared data base address; Accordingly, acquiring the attack identification data corresponding to the preset offset address includes: Obtain the attack determination data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the attack determination data 0xFFEEFFEE corresponding to the shared data base address; Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including: When it is determined that the 8-byte data at the shared data base address+0x10 address is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address is the attack determination data 0xFFEEFFEE, it is determined that there is a desktop window manager vulnerability exploitation behavior.
3. The method for detecting a desktop window manager vulnerability exploit according to claim 1, characterized in that: Acquiring a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address, including: Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address + 0x1E8 address and 8 bytes of data at the shared data base address + 0x1E8 address; Accordingly, acquiring the attack identification data corresponding to the preset offset address includes: Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the standard stub buffer debugging server release function address corresponding to the shared data base address + 0x1E8 address; Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including: When it is determined that the 8-byte data at the shared data base address+0x10 is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address+0x1E8 is the standard stub buffer debugging server release function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
4. The method for detecting a desktop window manager vulnerability exploit according to claim 1, wherein: Acquiring a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address, including: Acquire the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and acquire the shared data base address + 0x230 address and 8 bytes of data at the shared data base address + 0x230 address; Accordingly, acquiring the attack identification data corresponding to the preset offset address includes: Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the multi-byte character loading module function address and the wide character loading module function address corresponding to the shared data base address + 0x230 address; Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including: When it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack determination data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x230 address is a multi-byte character loading module function address or a wide character loading module function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
5. The method for detecting a desktop window manager vulnerability exploit according to claim 1, characterized in that: Acquiring a preset offset address corresponding to the shared data base address and the data to be verified in the preset offset address, including: Obtain the shared data base address + 0x10 address and 8 bytes of data at the shared data base address + 0x10 address, and obtain the shared data base address + 0x1C0 address and 8 bytes of data at the shared data base address + 0x1C0 address; Accordingly, acquiring the attack identification data corresponding to the preset offset address includes: Obtain the attack identification data 0x1FFEEFFEE corresponding to the shared data base address + 0x10 address, and obtain the network data representation proxy forwarding function address and the standard stub buffer release connection function address corresponding to the shared data base address + 0x1C0 address; Correspondingly, when it is determined that the data to be verified is consistent with the corresponding attack identification data, it is determined that there is a desktop window manager vulnerability exploitation behavior, including: When it is determined that the 8-byte data at the shared data base address + 0x10 address is the attack identification data 0x1FFEEFFEE, and the 8-byte data at the shared data base address + 0x1C0 address is the network data representing the proxy forwarding function address or the standard stub buffer release connection function address, it is determined that there is a desktop window manager vulnerability exploitation behavior.
6. The method for detecting a desktop window manager vulnerability exploit according to any one of claims 2 to 5, characterized in that: Also includes: When it is determined that the 8-byte data at the shared data base address+0x10 address is not the attack determination data 0x1FFEEFFEE, it is determined that there is no desktop window manager vulnerability exploitation behavior.
7. The method for detecting a desktop window manager vulnerability exploit according to claim 1, characterized in that: The method also includes a loading process of the dynamic link library, wherein the loading process of the dynamic link library includes: Injecting a remote thread of machine code into the Desktop Window Manager process; The machine code remote thread is loaded by utilizing the desktop window manager process to load the dynamic link library.
8. A device for detecting a desktop window manager vulnerability exploit, characterized in that: include: A base address acquisition module is used to, when detecting that a mapping shared memory method function in a shared area base class is called, call the mapping shared memory method function using a preloaded dynamic link library to obtain a shared data base address for data sharing in this rendering process; A to-be-verified data acquisition module, used to acquire a preset offset address corresponding to the shared data base address and the to-be-verified data in the preset offset address; An attack discrimination data acquisition module, used to obtain the attack discrimination data corresponding to the preset offset address; The vulnerability exploitation behavior determination module is used to determine the presence of a desktop window manager vulnerability exploitation behavior when it is determined that the data to be verified is consistent with the corresponding attack identification data.
9. A device for detecting a desktop window manager vulnerability exploit, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for detecting a desktop window manager vulnerability exploit as claimed in any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting a desktop window manager vulnerability exploit as claimed in any one of claims 1 to 7.