File debugging method and device, computer storage medium and terminal

Abstract

The invention discloses a file debugging method and device, a computer storage medium and a terminal, and the method comprises the steps: determining parameters needed for operating an executable file according to a file type of the executable file; when the executable file is uploaded to the interior of the sandbox, synchronously uploading the determined parameters required for running the executable file to the interior of the sandbox; and running the executable file in the sandbox through the parameters synchronously uploaded with the executable file. According to the embodiment of the invention, before the executable file is delivered into the sandbox, the parameters required for running the executable file are determined, and the corresponding parameter values are uploaded into the sandbox while the executable file is uploaded, so that the running of the executable file requiring the parameters and the detection of malicious programs are realized, and the sandbox detection quality is improved.

Description

Technical Field

[0001] The present invention relates to virtual machine technology, and more particularly to a method, device, computer storage medium and terminal for file debugging. Background Art

[0002] Most of the currently known sandbox detections are done by delivering executable files such as EXE files or DLL files into the sandbox, then capturing the behavior logs of the executable files, and analyzing the behavior logs to determine whether the files have malicious behaviors, thereby determining whether the files are malicious programs; sandbox detection mainly includes: delivering files, running programs, and obtaining logs.

[0003] Some documents disclose the detection technology of malicious files by virtual machine sandboxes, such as patents such as "A method and system for detecting ransomware by sandboxes" and "Analysis and detection method, device, equipment and storage medium for malicious code". These patents all introduce how sandboxes detect malicious files. The sandbox detection in related technologies focuses on content detection of malicious behavior of files to identify malicious programs. However, related technologies have the problem that some malicious programs cannot be detected, resulting in incomplete sandbox detection.

[0004] In summary, how to prevent some malicious programs from being undetectable and improve the efficiency of sandbox detection has become a problem to be solved. Summary of the invention

[0005] The present application embodiment provides a file debugging method, which is applied to a virtual machine sandbox environment, including: Determine the parameters required to run the executable file based on the file type of the executable file; When uploading the executable file to the sandbox, the parameters required to run the executable file are also uploaded to the sandbox simultaneously; Run the executable file inside the sandbox by syncing the parameters uploaded with the executable file.

[0006] On the other hand, an embodiment of the present application further provides a computer storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned file debugging method is implemented.

[0007] On the other hand, an embodiment of the present application further provides a terminal, comprising: a memory and a processor, wherein the memory stores a computer program; wherein: The processor is configured to execute the computer program in the memory; When the computer program is executed by the processor, the file debugging method described above is implemented.

[0008] In another aspect, the embodiment of the present application further provides a file debugging device, which is applied to a virtual machine sandbox environment, and includes: a parameter determination unit, a synchronization unit, and an operation unit; wherein: The parameter determination unit is set to: determine the parameters required to run the executable file according to the file type of the executable file; The synchronization unit is configured to: upload the executable file to the sandbox and simultaneously upload the parameters required to run the executable file to the sandbox; The run unit is set to run the executable file inside the sandbox with the parameters uploaded synchronously with the executable file.

[0009] The embodiment of the present application includes: determining the parameters required to run the executable file according to the file type of the executable file; uploading the executable file to the sandbox and synchronously uploading the determined parameters required to run the executable file to the sandbox; running the executable file in the sandbox by using the parameters uploaded synchronously with the executable file. The embodiment of the present disclosure determines the parameters required to run the executable file before delivering the executable file to the sandbox, and uploads the corresponding parameter values ​​to the sandbox while uploading the executable file, thereby realizing the running of executable files requiring parameters and the detection of malicious programs, and improving the quality of sandbox detection. .

[0010] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0012] Figure 1 A flowchart of a method for debugging a file according to an embodiment of the present disclosure; Figure 2 The present invention is a structural block diagram of a device for debugging files according to an embodiment of the present invention. DETAILED DESCRIPTION

[0013] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0014] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features and elements disclosed in the present application may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.

[0015] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0016] The inventors of the present application have analyzed and found that the sandbox detection in the related art has the following problems: the execution of some malicious programs in EXE file format depends on some specific parameters (or variables) to run. If these variables are missing, the malicious program will not run; the behavior of some DLL files needs to be based on the parameters required for function operation, and sandbox detection cannot be achieved by simply delivering files to the sandbox; the above problems make it impossible for the sandbox to detect the behavior of malicious programs, resulting in incomplete sandbox detection.

[0017] Figure 1 The flowchart of the method for file debugging of the embodiment of the present disclosure is applied to a virtual machine sandbox environment, such as Figure 1 As shown, including: Step 101: Determine the parameters required to run the executable file according to the file type of the executable file; Step 102: while uploading the executable file to the sandbox, simultaneously upload the determined parameters required to run the executable file to the sandbox; Step 103: Run the executable file in the sandbox using the parameters uploaded synchronously with the executable file.

[0018] The disclosed embodiment determines the parameters required to run the executable file before delivering the executable file to the sandbox, and uploads the corresponding parameter values ​​to the sandbox at the same time as uploading the executable file, thereby realizing the running of executable files requiring parameters and the detection of malicious programs, and improving the quality of sandbox detection.

[0019] In an exemplary embodiment, the file types of the executable files in the embodiments of the present disclosure include: EXE file or DLL file.

[0020] In an exemplary embodiment, when the executable file is an EXE file, the method of the embodiment of the present disclosure further includes determining the parameters required to run the executable file through any of the following types of information: Help page, pre-stored first record file and file running prompt information.

[0021] In an exemplary embodiment, when the executable file is a DLL file, the method of the embodiment of the present disclosure further includes determining the parameters required to run the executable file through any of the following types of information: A second pre-stored record file.

[0022] In an exemplary embodiment, the first record file and / or the second record file in the embodiment of the present disclosure may be a record file generated based on parameter information determined by a technician when the executable file is previously run.

[0023] In an exemplary embodiment, when the executable file is a DLL file, the embodiment of the present disclosure determines the parameters required to run the executable file, including: Outside the sandbox, get the exported functions in the executable file; From a pre-stored third record file, a parameter corresponding to the obtained derivation function is determined.

[0024] In an exemplary embodiment, the embodiment of the present disclosure can refer to the relevant technology and parse the structure of the executable file to obtain the export function in the executable file. It should be noted that after obtaining the export function, the embodiment of the present disclosure can determine the parameter type and number of the export function based on experience by the technician to obtain the third record file.

[0025] In an exemplary embodiment, when the executable file is a DLL file, the embodiment of the present disclosure runs the executable file in the sandbox by using parameters uploaded synchronously with the executable file, including: The executable file is loaded by calling LoadLibrary inside the sandbox, and the export function in the DLL file is executed according to the parameters uploaded synchronously to run the executable file.

[0026] The embodiment of the present disclosure also provides a computer storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned file debugging method is implemented.

[0027] The embodiment of the present disclosure further provides a terminal, comprising: a memory and a processor, wherein a computer program is stored in the memory; The processor is configured to execute the computer program in the memory; When the computer program is executed by a processor, the method of file debugging as described above is implemented.

[0028] Figure 2 The structural block diagram of the file debugging device of the embodiment of the present disclosure is applied to the virtual machine sandbox environment, including: a parameter determination unit, a synchronization unit and an operation unit; wherein, The parameter determination unit is set to: determine the parameters required to run the executable file according to the file type of the executable file; The synchronization unit is configured to: upload the executable file to the sandbox and simultaneously upload the parameters required to run the executable file to the sandbox; The run unit is set to run the executable file inside the sandbox with the parameters uploaded synchronously with the executable file.

[0029] In an exemplary embodiment, the file types of the executable files in the embodiments of the present disclosure include: EXE file or DLL file.

[0030] In an exemplary embodiment, the device of the embodiment of the present disclosure further includes a judgment unit, which is configured to: When the executable file is an EXE file, the parameters required to run the executable file are determined by any of the following types of information: a Help page, a pre-stored first record file, and file running prompt information; and / or, When the executable file is a DLL file, the parameters required to run the executable file are determined by any of the following types of information: a pre-stored second record file.

[0031] In an exemplary embodiment, the present disclosure determines that the parameter unit is set to: When the executable file is a DLL file, an export function in the executable file is obtained outside the sandbox; and a parameter corresponding to the obtained export function is determined from a pre-stored third record file.

[0032] In an exemplary embodiment, the operating unit of the embodiment of the present disclosure is configured as follows: When the executable file is a DLL file, the executable file is loaded by calling LoadLibrary inside the sandbox, and the export function in the DLL file is executed according to the parameters uploaded synchronously to run the executable file. The following briefly describes the embodiments of the present disclosure through application examples. The application examples are only used to illustrate the embodiments of the present disclosure and are not used to limit the protection scope of the embodiments of the present disclosure.

[0033] Determine the file type of the executable file to be detected, the file type includes an EXE file or a DLL file; here, the determination of the file type can be implemented by referring to the relevant technology; When the executable file is an EXE file, when the executable file is uploaded to the sandbox (sandbox environment in the server), the parameters of the executable file determined in advance are also transmitted to the sandbox environment to run the executable file with the obtained parameters; When the executable file is a DLL file, upload the DLL file to the outside of the sandbox, and obtain the export function to be debugged in the DLL file; determine the parameters required for the obtained export function; While uploading the DLL file that obtains the parameters required to run the obtained export function into the sandbox, the parameters required for the determined obtained export function are also passed into the sandbox environment to run the executable file that obtains the parameters; The execution of the executable file in the embodiment of the present disclosure can obtain the corresponding execution result, and the execution result can be reflected by the screenshot inside the sandbox. Based on the execution result, the executable file can be analyzed to determine whether the executable file is a malicious program.

[0034] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A file debugging method, applied to a virtual machine sandbox environment, characterized in that: include: Determine the parameters required to run the executable file based on the file type of the executable file; When uploading the executable file to the sandbox, the parameters required to run the executable file are also uploaded to the sandbox simultaneously; Run the executable file inside the sandbox by syncing the parameters uploaded with the executable file.

2. The method according to claim 1, characterized in that: The file types of the executable files include: EXE file or DLL file.

3. The method according to claim 2, characterized in that When the executable file is an EXE file, the method further includes determining that the parameter is required to run the executable file through any of the following types of information: Help page, pre-stored first record file and file running prompt information.

4. The method according to claim 2, characterized in that: When the executable file is a DLL file, the method further includes determining that the parameter is required to run the executable file through any of the following types of information: A second pre-stored record file.

5. The method according to claim 2, characterized in that: When the executable file is a DLL file, the step of determining the parameters required to run the executable file includes: Outside the sandbox, obtaining the export function in the executable file; The parameters corresponding to the obtained derivation function are determined from a pre-stored third record file.

6. The method according to claim 5, characterized in that When the executable file is a DLL file, the step of running the executable file in the sandbox by using the parameters uploaded synchronously with the executable file includes: The executable file is loaded by calling LoadLibrary inside the sandbox, and the export function in the DLL file is executed according to the parameters uploaded synchronously to run the executable file.

7. A computer storage medium, wherein a computer program is stored in the computer storage medium, and when the computer program is executed by a processor, the file debugging method according to any one of claims 1 to 6 is implemented.

8. A terminal, comprising: A memory and a processor, wherein the memory stores a computer program; wherein, The processor is configured to execute the computer program in the memory; When the computer program is executed by the processor, the file debugging method according to any one of claims 1 to 6 is implemented.

9. A file debugging device, applied to a virtual machine sandbox environment, characterized in that: include: Determine the parameter unit, synchronization unit and operation unit; wherein, The parameter determination unit is set to: determine the parameters required to run the executable file according to the file type of the executable file; The synchronization unit is configured to: upload the executable file to the sandbox and simultaneously upload the parameters required to run the executable file to the sandbox; The run unit is set to run the executable file inside the sandbox with the parameters uploaded synchronously with the executable file.

10. The device according to claim 9, characterized in that The file types of the executable files include: EXE file or DLL file.

Images