Process monitoring method and terminal

Abstract

The application discloses a process monitoring method and a terminal, and acquires a process page table address of a process to be monitored, wherein the address stores a common page table management object, so that a first page table management object address corresponding to the process to be monitored is acquired; then, a preset memory block with the same data as the first page table management object address is newly created; and a second page table management object address is used to replace a page table item of the first page table management object address in the page table management object, so that a single process is flexibly monitored. In this way, the process to be monitored is monitored by only replacing the page table item of the process, and compared with a method for monitoring all processes by using a chip technology in the prior art, the application does not need the support of the chip technology, and can flexibly monitor a single process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of process monitoring, in particular to a process monitoring method and a terminal. BACKGROUND

[0002] At present, in the virtual machine mode, each component of the monitoring system is allowed to be monitored, including the monitoring of API. Since the inline hook is required to monitor the API call in the non-virtual environment, Microsoft prohibits the developer from modifying the system function at will in the system design, and only allows the virtual machine to take over the API and monitoring.

[0003] Whether it is the VT-x virtualization function of the Intel chip or the SVM virtualization function of the AMD chip, only one pit position can exist when the virtual technology is used, and other interveners are either kicked out of the original pit position or nested, which exists priority level capture. Therefore, instability and uncertainty exist in the monitoring process, which causes some software to have fault codes; and there are version differences between systems, which cannot guarantee that all versions of the system are stable and allowed on the virtualization, and at the same time, version adaptation is required in the use of the virtual technology, thereby increasing the workload. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a process monitoring method and a terminal, which can flexibly monitor any process and do not require the support of chip technology.

[0005] In order to solve the above technical problems, the technical scheme adopted by the present application is:

[0006] A process monitoring method, comprising the steps of:

[0007] Obtaining the process page table address of a process to be monitored, determining the corresponding system space page table management object according to the process page table address, and obtaining the first page table management object address corresponding to the process to be monitored from the page table management object;

[0008] Copying the content of the obtained first page table management object address to a preset memory block to obtain a second page table management object address;

[0009] Modifying the page table entry of the corresponding first page table management object address in the page table management object to the second page table management object address, and monitoring the second page table management object address.

[0010] In order to solve the above technical problems, another technical scheme adopted by the present application is:

[0011] A process monitoring terminal comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the following steps when executing the computer program:

[0012] Obtaining a process page table address of a process to be monitored, determining a corresponding system space page table management object according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0013] Copying the content of the obtained first page table management object address to a preset memory block to obtain a second page table management object address;

[0014] Modifying the page table entry of the corresponding first page table management object address in the page table management object to the second page table management object address, and monitoring the second page table management object address.

[0015] The present application has the beneficial effect that the process page table address of the process to be monitored is obtained, the address stores a common page table management object, thereby obtaining the first page table management object address corresponding to the process to be monitored, and then a preset memory block with the same data as the first page table management object address is newly created, and the second page table management object address replaces the page table entry of the original first page table management object address in the page table management object, so as to flexibly monitor a single process. In this way, the process to be monitored can be monitored by only replacing the page table entry of the process, and compared with the method of monitoring all processes using chip technology in the prior art, the present application does not need the support of chip technology and can also flexibly monitor a single process. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A flow chart of a process monitoring method according to an embodiment of the present application;

[0017] Figure 2 A schematic diagram of a process monitoring terminal according to an embodiment of the present application;

[0018] Figure 3 A storage structure diagram of a process space of a process monitoring method according to an embodiment of the present application;

[0019] REFERENCE NUMERALS:

[0020] 1. A process monitoring terminal; 2. a memory; 3. a processor. DETAILED DESCRIPTION

[0021] To describe the technical content, purposes and effects of the present application in detail, the following will be described in combination with the embodiments and the accompanying drawings.

[0022] Please refer to Figure 1The embodiment of the present application provides a process monitoring method, comprising the steps of:

[0023] Obtaining a process page table address of a process to be monitored, determining a corresponding system space page table management object according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object;

[0024] Copying the content of the obtained first page table management object address to a preset memory block to obtain a second page table management object address;

[0025] Modifying the page table item of the corresponding first page table management object address in the page table management object to the second page table management object address, and monitoring the second page table management object address.

[0026] From the above description, the beneficial effects of the present application are that the process page table address of the process to be monitored is obtained, the address stores a common page table management object, so that the first page table management object address corresponding to the process to be monitored is obtained, then a preset memory block with the same data as the first page table management object address is newly created, the second page table management object address is used to replace the page table item of the original first page table management object address in the page table management object, so as to flexibly monitor the single process. In this way, the process to be monitored can be monitored by replacing the page table item of the process, compared with the method of monitoring all processes by using chip technology in the prior art, the present application does not need the support of chip technology, and can flexibly monitor the single process.

[0027] Further, copying the content of the obtained first page table management object address to a preset memory block to obtain a second page table management object address comprises:

[0028] Aligning the obtained first page table management object address, copying the content of the first page table management object address to the preset memory block according to the offset of the alignment to obtain the second page table management object address.

[0029] From the above description, the data alignment is performed on the address, and the data is copied according to the offset of the alignment, so that the efficiency and performance during data reading and writing can be improved.

[0030] Further, the data alignment of the obtained first page table management object address comprises:

[0031] Determining a corresponding alignment start address according to the first page table management object address, and obtaining an offset according to the first page table management object address and the alignment start address.

[0032] From the above description, the first page table management object address is data-aligned, which can quickly perform addressing operation and avoid wasting unnecessary time and resources.

[0033] Further, the first page table management object address is data-aligned, which can quickly perform addressing operation and avoid wasting unnecessary time and resources.

[0034] The content of the first page table management object address is copied to the preset memory block, and the offset is added to obtain the second page table management object address.

[0035] From the above description, since the first page table management object address belongs to a certain position in the starting alignment address, the offset of the original starting alignment address of the first page table management object address is obtained, and the offset is copied based on this, which can accurately locate the position of the second page table management object address on the preset memory address.

[0036] Further, the address on the preset memory block is monitored, including:

[0037] The content of the second page table management object address is monitored by obtaining the second page table management object address in the page table management object of the process to be monitored.

[0038] From the above description, through this monitoring method, the process to be monitored can be flexibly monitored without damaging the original system call method, and the engineering quantity caused by data cleaning is reduced.

[0039] Please refer to Figure 2 Another embodiment of the present application provides a process monitoring terminal, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0040] The process page table address of the process to be monitored is obtained, the corresponding page table management object of the system space is determined according to the process page table address, and the first page table management object address corresponding to the process to be monitored is obtained from the page table management object.

[0041] The content of the obtained first page table management object address is copied to the preset memory block to obtain the second page table management object address.

[0042] The page table entry of the corresponding first page table management object address in the page table management object is modified to the second page table management object address, and the second page table management object address is monitored.

[0043] From the above description, the beneficial effects of the present application are that the process page table address of the process to be monitored is obtained, the address stores a common page table management object, so that the first page table management object address corresponding to the process to be monitored is obtained, then a preset memory block with the same data as the first page table management object address is newly created, the second page table management object address replaces the page table item of the original first page table management object address in the page table management object, so as to flexibly monitor the single process. In this way, the process to be monitored can be monitored by replacing the page table item of the process, compared with the method of monitoring all processes using chip technology in the prior art, the present application does not need the support of chip technology, and can flexibly monitor the single process.

[0044] Further, the content of the obtained first page table management object address is copied into the preset memory block to obtain the second page table management object address.

[0045] The obtained first page table management object address is data-aligned, and the content of the first page table management object address is copied into the preset memory block according to the offset of data alignment to obtain the second page table management object address.

[0046] From the above description, the data alignment of the address and the data copying according to the offset of alignment can improve the efficiency and performance of data reading and writing.

[0047] Further, the data alignment of the obtained first page table management object address includes:

[0048] The corresponding alignment starting address is determined according to the first page table management object address, and the offset is obtained according to the first page table management object address and the alignment starting address.

[0049] From the above description, the data alignment of the first page table management object address can quickly perform addressing operation, and avoid wasting unnecessary time and resources.

[0050] Further, the copying of the content of the first page table management object address into the preset memory block according to the offset of data alignment to obtain the second page table management object address includes:

[0051] The content of the first page table management object address is copied into the preset memory block, and the offset is added to obtain the second page table management object address.

[0052] From the above description, since the first page table management object address belongs to a certain position in the starting alignment address, the offset of the original starting alignment address of the first page table management object address is obtained and the copying offset is based on this, so that the position of the second page table management object address on the preset memory address can be accurately located.

[0053] Further, the monitoring of the address on the preset memory block comprises:

[0054] By obtaining the second page table management object address in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

[0055] From the above description, through this monitoring method, the process to be monitored can be flexibly monitored without destroying the original system call mode, and the engineering quantity caused by data cleaning is reduced.

[0056] The process monitoring method and terminal described above are suitable for single or multiple process monitoring, can flexibly monitor any process, and do not require chip technology support. The following will be described through specific implementation manners:

[0057] Embodiment one

[0058] Please refer to Figure 1 A process monitoring method comprises the following steps:

[0059] S1, obtaining a process page table address of a process to be monitored, determining a page table management object of a corresponding system space according to the process page table address, and obtaining a first page table management object address corresponding to the process to be monitored from the page table management object.

[0060] Among them, please refer to Figure 3 All process spaces are divided into system space and user space, all processes contained in the system space share a page table management object, i.e. a kernel page table, which contains the page table item of the API; and the user space page table is an independent page table that distinguishes the independence of each process data, and she exists and may refer to the system API function.

[0061] Therefore, each process has an independent process page table address, which stores the system space shared by the process, the user space contains the system API page table item to be referred to by the user page table, and the page table item stores the physical address corresponding to each block of memory address.

[0062] In this embodiment, the system comprises a plurality of processes, for example:

[0063] Process 1: System, process identifier: 4;

[0064] Process 2: Smss, process identifier: 505;

[0065] Process 3: Support, process identifier: 700.

[0066] Processes 1-3 have a common page table management object, and there is a PatchGuard protecting the address of the common page table management object.

[0067] For the convenience of developers, several API interfaces are developed, and when the developers refer to and use the API, the related system space is executed. If the system space is directly modified, all process object calls will be taken over, and the PatchGuard will detect it and cause the system to crash. For example, 0xFFFFF8000988E is the address of the common API, and if the address is directly modified, the PatchGuard will detect it and terminate the system, causing the system to crash.

[0068] Therefore, in the embodiment, the process page table address to be monitored is obtained, and the first page table management object address corresponding to the system space to be monitored, that is, the system API address, is obtained. Since the system space belongs to shared memory, the address has uniqueness.

[0069] S2, copy the content of the obtained first page table management object address to a preset memory block to obtain a second page table management object address.

[0070] Among them, the first page table management object address obtained is data aligned, and the content of the first page table management object address is copied to the preset memory block according to the offset of the data alignment to obtain the second page table management object address.

[0071] S21, determine the corresponding alignment start address according to the first page table management object address, and obtain the offset according to the first page table management object address and the alignment start address.

[0072] Specifically, in the storage, transmission and processing of a computer, data is often processed in the form of blocks, and each block has a certain capacity. 4K alignment means that the start address (start byte) of the data block must be an integer multiple of 4K. 4K alignment is an optimization method adopted to improve the efficiency and performance of data reading and writing. Without 4K alignment, more addressing operations are required when reading and writing data, wasting unnecessary time and resources.

[0073] In the embodiment, the extracted API address page is 4K aligned, and the PAGE_SIZE of 4K alignment is set to 0X1000. For example, the API address is 0x14585E, and the 4K start address is 0x145000, and the offset is 0x85E.

[0074] S22, copy the content of the first page table management object address to a preset memory block, and add the offset to obtain a second page table management object address.

[0075] Specifically, the content of the first page table management object address is copied to a preset memory block as data replacing the original page address.

[0076] In the embodiment, the newly allocated memory address is 0x2400. If the direct copy API address does not exist alignment, only the start alignment address corresponding to the API address to be copied, i.e. 0x145000, is obtained, the data of 0x145000 is copied to 0x24000, and then the offset 0x85E is added to obtain the new API function address.

[0077] Therefore, each API is in the form of XXX000 belonging to its start alignment address, and the newly allocated memory address must satisfy the above condition. Since the API belongs to a certain position in the start alignment address, the start alignment address is calculated through the API, the offset of the original start alignment address of the API is obtained, and thus the position of the new API on the new memory address is located.

[0078] S3, modifying the page table item corresponding to the first page table management object address in the page table management object to the second page table management object address, and monitoring the second page table management object address.

[0079] Specifically, the second page table management object address in the page table management object of the process to be monitored is obtained, and the content of the second page table management object address is monitored.

[0080] In the embodiment, the page table item is modified by the page table address to set a memory with the same data as the public API address of 0x14585E to replace it. Since PatchGuard protects the public address of 0x14585E, the new memory address does not belong to the protection range, and thus the monitoring of the single process is completed.

[0081] For example, Support is an external process, and the API function of 0x14585E is a key function related to reading. As long as the page table item of the Support process is replaced, the operation is completed, and the use of all processes is not affected.

[0082] If the VT technology is used, the entire system is taken over, all operations of the public API page table are captured, and thus data filtering and data cleaning are also required.

[0083] VT technology is not needed in the embodiment, if a process file name is suspicious or the process file has no digital signature of a legal manufacturer, the page table corresponding to the related API function is modified and monitored, if the parameter in the monitoring involves the suspicious "identity information" of the attacking code of the target process, the process information is acquired: process name, process path, file MD5 and other information.

[0084] The above is repeated, that is, the original system call mode is not damaged, the suspicious process to be monitored is flexibly monitored, and the engineering quantity caused by data cleaning is reduced.

[0085] Embodiment two

[0086] Please refer to Figure 2 A process monitoring terminal 1 comprises a memory 2, a processor 3 and a computer program stored in the memory 2 and capable of running on the processor 3, and the processor 3 implements each step of the process monitoring method of embodiment one when the computer program is executed.

[0087] In summary, the process monitoring method and terminal provided by the application acquire the process page table address of the process to be monitored, the address stores a public page table management object, thereby acquiring the first page table management object address corresponding to the process to be monitored, and then a preset memory block with the same data as the first page table management object address is newly created, and the second page table management object address replaces the page table item of the first page table management object address in the page table management object, so as to flexibly monitor the single process. In this way, the single process page table management realizes the monitoring of the page table of the single process through simulation reconstruction replacement. The monitoring object is converted into the physical address corresponding to the page table and monitored. As long as the page table item of the process to be monitored is replaced, the process can be monitored. Compared with the method of monitoring all processes by using chip technology in the prior art, the application does not need the support of PatchGuard or chip technology, and can flexibly monitor the single process.

[0088] The above is only an embodiment of the application, and does not limit the patent range of the application, any equivalent transformation or direct or indirect application in the related technical field based on the content of the specification and drawings of the application is also included in the patent protection range of the application.

Claims

1. A process monitoring method, characterized in that, Including the following steps: Obtain the process page table address of the process to be monitored, determine the corresponding page table management object in the system space based on the process page table address, and obtain the address of the first page table management object corresponding to the process to be monitored from the page table management object; Copy the contents of the first page table management object address to the preset memory block to obtain the second page table management object address; Modify the page table entry in the page table management object corresponding to the address of the first page table management object to the address of the second page table management object, and monitor the address of the second page table management object; The contents of the first page table management object address are copied to a preset memory block to obtain the second page table management object address, which includes: The obtained address of the first page table management object is aligned with data, and the contents of the first page table management object address are copied to a preset memory block according to the data alignment offset to obtain the address of the second page table management object. The step of aligning the obtained first page table management object address with data includes: The corresponding alignment start address is determined based on the address of the first page table management object, and the offset is obtained based on the address of the first page table management object and the alignment start address; wherein the alignment start address is an integer multiple of 4K; The step of copying the contents of the first page table management object address to a preset memory block based on the data alignment offset to obtain the second page table management object address includes: The contents of the first page table management object address are copied to a preset memory block, and the offset is added to obtain the second page table management object address.

2. The process monitoring method according to claim 1, characterized in that, Monitoring the addresses on the preset memory block includes: By obtaining the address of the second page table management object in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

3. A process monitoring terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it performs the following steps: Obtain the process page table address of the process to be monitored, determine the corresponding page table management object in the system space based on the process page table address, and obtain the address of the first page table management object corresponding to the process to be monitored from the page table management object; Copy the contents of the first page table management object address to the preset memory block to obtain the second page table management object address; Modify the page table entry in the page table management object corresponding to the address of the first page table management object to the address of the second page table management object, and monitor the address of the second page table management object; The contents of the first page table management object address are copied to a preset memory block to obtain the second page table management object address, which includes: The obtained address of the first page table management object is aligned with data, and the contents of the first page table management object address are copied to a preset memory block according to the data alignment offset to obtain the address of the second page table management object. The step of aligning the obtained first page table management object address with data includes: The corresponding alignment start address is determined based on the address of the first page table management object, and the offset is obtained based on the address of the first page table management object and the alignment start address; wherein the alignment start address is an integer multiple of 4K; The step of copying the contents of the first page table management object address to a preset memory block based on the data alignment offset to obtain the second page table management object address includes: The contents of the first page table management object address are copied to a preset memory block, and the offset is added to obtain the second page table management object address.

4. A process monitoring terminal according to claim 3, characterized in that, Monitoring the addresses on the preset memory block includes: By obtaining the address of the second page table management object in the page table management object of the process to be monitored, the content of the second page table management object address is monitored.

Images