Pin-based encryption algorithm constant value dynamic detection method and system

Abstract

The invention provides a Pin-based encryption algorithm constant value dynamic detection method and system, and relates to the technical field of network security, and the method comprises the steps: obtaining a dynamic instruction stream during the operation of an executable file; extracting an instruction used for reading data from a memory in the dynamic instruction stream; extracting a memory address and corresponding memory data, storing the memory address and the size of the memory data into a linked list, and finding data continuously read by the memory when the executable file runs according to the memory address and the size of the memory data; according to the data continuously read by the memory and the length of the memory, a corresponding encryption algorithm is searched through detection of an SIMD instruction set and matching of data in a corresponding register, and constant value data extraction is achieved; according to the method and the device, the identification of the encryption function optimized by using the simd instruction is added, and the identification accuracy is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a Pin-based encryption algorithm constant value dynamic detection method and system. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] The encryption algorithm detection technology based on dynamic execution uses the pin tool to simulate the virtual machine running the executable file and, according to the written tool, extracts the instruction stream of the executable file during dynamic execution and the data stream in the register to generate a trace file, then performs call function detection on the trace file, and then detects the relevant features of the encryption algorithm on the call function to find the encryption algorithm function.

[0004] The current Pin-based tracing data extraction does not recognize the encryption algorithm optimized by SIMD instructions, does not extract the data in the XMM, YMM, and ZMM registers, and the recognition method is relatively simple, and there is no recognition method for most encryption algorithms. Summary of the invention

[0005] In order to solve the above problems, the present disclosure proposes a Pin-based dynamic detection method and system for encryption algorithm constant values, which increases the recognition of encryption functions optimized by SIMD instructions, extracts the addresses of dynamic runtime instructions of executable files, and extracts data from encryption algorithms that use SIMD instructions for encryption optimization by detecting the SIMD instruction set and matching the data in the corresponding registers.

[0006] According to some embodiments, the present disclosure adopts the following technical solutions:

[0007] The dynamic detection method of the encryption algorithm constant value based on Pin includes:

[0008] Get the dynamic instruction stream of the executable file when it is running;

[0009] Extracting instructions for reading data from a memory in the dynamic instruction stream;

[0010] Extract the memory address and the corresponding memory data, store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size;

[0011] According to the data read from the continuous memory and the memory length, the corresponding encryption algorithm is found by detecting the SIMD instruction set and matching the data in the corresponding register to realize the constant value data extraction.

[0012] According to some embodiments, the present disclosure adopts the following technical solutions:

[0013] The Pin-based encryption algorithm constant value dynamic detection system includes:

[0014] A data acquisition module is used to acquire the dynamic instruction stream when the executable file is running;

[0015] The data extraction module is used to extract instructions for reading data from the memory in the dynamic instruction stream; extract the memory address and the corresponding memory data, and store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size; according to the data read from the continuous memory and the memory length, find the corresponding encryption algorithm by detecting the SIMD instruction set and matching the data in the corresponding register to realize constant value data extraction.

[0016] According to some embodiments, the present disclosure adopts the following technical solutions:

[0017] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the dynamic detection method of the constant value of the encryption algorithm based on Pin is implemented.

[0018] According to some embodiments, the present disclosure adopts the following technical solutions:

[0019] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the Pin-based encryption algorithm constant value dynamic detection method.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] The present invention discloses a dynamic detection method for constant values ​​of encryption algorithms based on Pin, and the dynamic instruction extraction step is used to track and extract the instruction stream and data in the register when the executable file is dynamically running, and output these data to the trace file. The memory read data extraction step is used to extract the memory address, read data and data size when the program reads data dynamically. The memory read continuous address and data extraction step is to find the next memory address and its data according to the extracted memory address and data size, and can extract the address of the dynamic runtime instruction of the executable file, the identification mark for memory reading, the instruction assembly name, the operand, the address of the instruction for memory operation, the general register data, the r8-r12 register, the data of the XMM register, the data in the YMM register, and the data in the ZMM register. By detecting the SIMD instruction set and matching the data in the corresponding register, the encryption algorithm that uses the simd instruction for encryption optimization can be extracted.

[0022] The present invention discloses a Pin-based dynamic detection method for encryption algorithm constant values, which can find the constant values ​​of the encryption algorithm in the instruction stream by analyzing the dynamic instruction stream when the executable file is running, and finally identify the encryption algorithm hidden in the soft executable file by detecting the constant value, including the encryption algorithm optimized by SIMD instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0024] Figure 1 is a method flow chart of an embodiment of the present disclosure;

[0025] Figure 2 A schematic diagram of instruction information extracted from Pin according to an embodiment of the present disclosure;

[0026] Figure 3 It is a schematic diagram of the continuous memory data effect of an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0028] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0029] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0030] Example 1

[0031] In one embodiment of the present disclosure, a method for dynamic detection of encryption algorithm constant values ​​based on Pin is provided, comprising:

[0032] Step 1: Get the dynamic instruction stream of the executable file when it is running;

[0033] Step 2: extracting instructions for reading data from the memory in the dynamic instruction stream;

[0034] Step 3: Extract the memory address and the corresponding memory data, and store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size;

[0035] Step 4: Match the data read from the continuous memory and the memory length with the constant values ​​of the known encryption algorithm. A successful match indicates that the corresponding encryption algorithm has been found. For the encryption algorithm optimized by SIMD instructions, various data in the SIMD instructions can be obtained by identifying the SIMD instructions and extracting the data in the register. Then, the data is matched with the constant values ​​of the known encryption algorithm optimized by SIMD instructions, and finally the encryption algorithm is identified to realize the constant value data extraction.

[0036] As an embodiment, the present invention discloses a Pin-based dynamic detection method for encryption algorithm constant values, which increases the recognition of encryption functions optimized by SIMD instructions and improves the recognition accuracy.

[0037] Among them, SIMD instruction recognition: by analyzing the dynamic instruction stream of the executable program, SIMD instructions are found, and then the instructions are analyzed, mainly detecting table lookup instructions. The memory data read by this instruction is most likely the data of the T box in the encryption algorithm. Since the data in SIMD is stored in the YMM register, the data in the YMM register is 256 bits, and the data in the T box is 64 bits, the data in the read YMM register should be divided into a group of 64 bits, a total of four groups of data, and then the T box data is searched in the data of the read YMM register according to the known T box data. If all are found, the encryption algorithm can be determined.

[0038] In the example disclosed in the present invention, the Pin-based dynamic detection technology method for encryption algorithm constant values ​​includes: dynamic instruction extraction, memory read data extraction, continuous memory read address and data extraction. Dynamic instruction extraction is used to track and extract the instruction stream and data in the register when the executable file is dynamically running, and output these data to the trace file. Memory read data extraction is used to extract the memory address, read data and data size when the program reads data from the memory dynamically. Memory read continuous address and data extraction is to find the next memory address and its data based on the extracted memory address and data size.

[0039] Furthermore, the specific implementation process of the Pin-based encryption algorithm constant value dynamic detection method disclosed in the present invention is as follows:

[0040] Step 1: Use Pin to obtain the dynamic instruction stream of the executable file when it is running;

[0041] Specifically, the Pin tool is used to implement instruction-level tracking of executable files, and extracts and records the instruction address of each instruction, memory reading judgment, instruction name, virtual address of the instruction's memory operation, value in the general register, value in the r8-r15 register; value in the XMM register, value in the YMM register, and value in the ZMM register into the trace file.

[0042] Step 2: Find the instructions for reading data from the memory from the instruction stream, and store the memory address and data size in the linked list.

[0043] Specifically, in the memory read data extraction step, the instructions are first read and marked for judgment. In the dynamic instruction extraction step, the pin tool is written to implement instruction-level tracking of the executable file, and extracts and records the instruction address of each instruction, the memory read judgment, the instruction name, the virtual address of the instruction on the memory operation, the value in the general register, the value in the r8-r15 register; the value in the xmm register, the value in the ymm register, and the value in the zmm register into the trace file.

[0044] For instructions to read memory data, first determine whether the instruction is a mov instruction (mov instructions include: mov, movsx, movzx, movsb, movsw, movsd). If not, ignore this instruction. If it is, the next step is to determine whether the register read from the memory data is a general register. If not, ignore this instruction. If it is, determine the size of the data read according to the data type read (byte reads one byte, word reads two bytes, dword reads four bytes, and qword reads eight bytes), and then extract the memory address. Since the data extracted by this instruction is stored in the register, and the Pin tool written in this patent cannot directly read the data in the memory, this instruction is truly effective in the register and can read the data stored in this register. When the program runs to the next instruction, it needs to find the data in the corresponding register and find the corresponding data according to the name of the register read. Finally, store the memory address, the read data, and the read data size in the read linked list, and traverse the entire trace document to find all the data read from the memory. In addition, to facilitate subsequent steps, when inserting a linked list node, the memory addresses of the existing nodes are compared, and the nodes are sorted from small to large according to the size of the address.

[0045] The Pin-based dynamic detection technology for encryption algorithm constant values ​​described in the disclosed embodiments can extract the address of the dynamic runtime instruction of the executable file, the identification mark for memory reading, the instruction assembly name, the operand, the address of the instruction for memory operation, the general register data, the r8-r12 register, the data in the XMM register, the data in the YMM register, and the data in the ZMM register. By detecting the SIMD instruction set and matching the data in the corresponding registers, data can be extracted for the encryption algorithm that uses SIMD instructions for encryption optimization.

[0046] Step 3: Extract continuous memory read addresses and data

[0047] Specifically, add the memory address and data size in the read linked list node respectively, and the calculated address is the next continuous memory address, which is matched with the memory address in the next node. If the match is successful, continue to add the memory address and data size of this node until the match fails, and record the length of this continuous address. If the match fails, start from the failed node and continue to search for continuous memory according to the above steps. Figure 3 As shown, the first step is to find the address to read the memory, for example, it is 09, the data size stored at this address is 1 byte, then the next address continuous with this address is 0A, the data size stored at this address is 3 bytes, then the next address continuous with this address is 0D.

[0048] Eventually, all continuous memory and the data in the memory are found, and the memory length is matched with specific values ​​in the known encryption algorithm, including: S box, T box, CK, FK and other fixed values ​​of the SM4 algorithm. If the match is successful, the corresponding encryption algorithm is found. If the match fails, it may be that some S box or T box data is not used during the operation.

[0049] Example 2

[0050] In one embodiment of the present disclosure, a dynamic detection system for constant values ​​of encryption algorithms based on Pin is provided, comprising:

[0051] A data acquisition module is used to acquire the dynamic instruction stream when the executable file is running;

[0052] The data extraction module is used to extract instructions for reading data from the memory in the dynamic instruction stream; extract the memory address and the corresponding memory data, and store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size; according to the data read from the continuous memory and the memory length, find the corresponding encryption algorithm by detecting the SIMD instruction set and matching the data in the corresponding register to realize constant value data extraction.

[0053] Example 3

[0054] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the Pin-based encryption algorithm constant value dynamic detection method is implemented.

[0055] Example 4

[0056] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the Pin-based encryption algorithm constant value dynamic detection method.

[0057] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0059] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A dynamic detection method for constant values ​​of encryption algorithms based on Pin, characterized in that: include: Get the dynamic instruction stream of the executable file when it is running; Extracting instructions for reading data from a memory in the dynamic instruction stream; Extract the memory address and the corresponding memory data, store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size; According to the data read from the continuous memory and the memory length, the corresponding encryption algorithm is found by detecting the SIMD instruction set and matching the data in the corresponding register to realize the constant value data extraction.

2. The method for dynamic detection of encryption algorithm constant values ​​based on Pin as claimed in claim 1, characterized in that: Write a pin tool to implement instruction-level tracing of executable files, and extract and record the instruction address of each instruction, memory reading judgment, instruction name, virtual address of the instruction's memory operation, value in the general register, value in the r8-r15 register, value in the XMM register, value in the YMM register, and value in the ZMM register into the trace file.

3. The Pin-based encryption algorithm constant value dynamic detection method according to claim 1, characterized in that: For instructions to read memory data, first determine whether the instruction is a mov-type instruction. If not, ignore this instruction. If so, determine whether the register from which the memory data is read is a general register. If not, ignore this instruction. If so, determine the size of the data to be read based on the type of data read.

4. The Pin-based encryption algorithm constant value dynamic detection method according to claim 1, characterized in that: Extract the memory address and save the data extracted by the instruction in the register. The Pin tool written cannot directly read the data in the memory, so this instruction is really effective in the register. To read the data saved in this register, you need to find the data in the corresponding register when running to the next instruction, find the corresponding data according to the name of the register read, and finally store the memory address, the read data and the read data size in the read linked list. Similarly, traverse the entire trace document to find all the data read from the memory.

5. The Pin-based encryption algorithm constant value dynamic detection method according to claim 1, characterized in that: SIMD instruction recognition is to find SIMD instructions by analyzing the dynamic instruction stream of the executable program, then analyze the instructions and detect the table lookup instructions. The memory data read by this instruction calls the data of the T box in the encryption algorithm, and the data in the read YMM register is divided into a group of 64 bits, for a total of four groups of data. Then, the T box data is searched in the data of the read YMM register based on the known T box data. If all are found, the encryption algorithm is determined.

6. The Pin-based encryption algorithm constant value dynamic detection method according to claim 5, characterized in that: Since the data in SIMD is stored in the YMM register, the data in the YMM register is 256 bits, while the data in the T box is 64 bits.

7. The Pin-based encryption algorithm constant value dynamic detection method according to claim 1, characterized in that: Extracting continuous memory read addresses and data includes: adding the memory address and data size in the read linked list node respectively, calculating the address as the next continuous memory address, matching it with the memory address in the next node. If the match is successful, continue to add the memory address and data size of this node until the match fails, and record the length of this continuous address. If the match fails, start from the failed node and continue to search for continuous memory.

8. The Pin-based encryption algorithm constant value dynamic detection method according to claim 7, characterized in that: Finally, all the continuous memory and the data in the memory are found, and the memory length is matched with the specific values ​​in the known encryption algorithm, including: S box, T box, CK and FK fixed values ​​of the SM4 algorithm. If the match is successful, the corresponding encryption algorithm is found. If the match fails, it may be that some S box or T box data is not used during the operation.

9. A dynamic detection system for constant values ​​of encryption algorithms based on Pin, characterized in that: include: A data acquisition module is used to acquire the dynamic instruction stream when the executable file is running; The data extraction module is used to extract instructions for reading data from the memory in the dynamic instruction stream; extract the memory address and the corresponding memory data, and store the memory address and the memory data size in a linked list, and find the data read from the continuous memory when the executable file is running according to the memory address and the memory data size; according to the data read from the continuous memory and the memory length, find the corresponding encryption algorithm by detecting the SIMD instruction set and matching the data in the corresponding register to realize constant value data extraction.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the Pin-based encryption algorithm constant value dynamic detection method as described in any one of claims 1-7.

Images