Method for analyzing and identifying retpoly code for relieving Spectre vulnerability attack in memory based on sample

Abstract

The invention discloses a method for analyzing and identifying a retline code for relieving Spectre vulnerability attack in a memory based on a sample. The method comprises the following steps: performing code data analysis on a preset retline memory code snippet to scan binary code features from beginning to end to obtain a scanning result of a preset first instruction; judging whether an instruction after the first instruction is a preset second instruction or not based on the scanning result; if yes, respectively extracting a first function address of the first instruction mov and a second function address of the second instruction jmp or call according to a rule defined by a CPU instruction system, and comparing whether the first function address is equal to the second function address or not; if yes, it is recognized that the retline code exists in the memory code snippets, and a retline code recognition result of the memory code snippets is output. According to the method, whether the corresponding memory code has a CPU Spectre vulnerability relieving mechanism or not can be judged, and the sample program is marked to have the capability of resisting Spectre vulnerability attack.

Description

Technical Field

[0001] The present invention relates to the technical field of sample analysis for information security, and in particular to a method for identifying retpoline codes in memory for mitigating Spectre vulnerability attacks based on sample analysis. Background Art

[0002] In early 2018, Intel, AMD, and ARM processors were exposed to the Meltdown and Spectre vulnerabilities. Although Microsoft later pushed security updates such as KB4090007 to patch the vulnerabilities, it also caused computer performance degradation. Later, Google developed a "retpoline" repair solution to solve the performance degradation problem. Operating systems such as Windows and Linux also borrowed from this solution and supported the retpoline mechanism in their operating systems.

[0003] Retpoline is a mitigation technique for the CPU Spectre vulnerability that allows indirect branches to be isolated from speculative execution. This can be used to protect sensitive binary software (such as operating systems) from branch target injection attacks against their indirect branches. It is also necessary to identify whether there is such code in sample analysis, which can serve as a dimension of sample threat intelligence information.

[0004] Because there are currently a large number of CPUs with Spectre vulnerabilities, and software developed before 2018 certainly does not have a retpoline mitigation mechanism, whether or not there is a retpoline mitigation mechanism can be used as a dimension / marker of sample threat intelligence, so how to identify the code that may be vulnerable to Spectre vulnerabilities in the current system memory code fragment is also a relatively important topic. When analyzing samples, identifying the retpoline code can tell whether the analyzed program has the ability to resist / mitigate CPU Spectre vulnerability attacks.

[0005] For modules or code snippets in memory, there is currently no such solution to determine whether the code in memory has a retpoline mitigation mechanism.

[0006] Currently, some standard methods can be used to determine whether the module code has retpoline code, such as determining whether the executable file (PE file in Windows system) contains Dynamic Value Relocation Table (in the Load Configuration Directory of PE file if it is a Windows executable file). If it does, it means that the code in this module file has retpoline mitigation mechanism. Of course, this method may not be very effective in determining whether the code in memory has retpoline mitigation mechanism, because the PE header information may have been destroyed in memory.

[0007] The above method determines whether there is a retpoline mitigation mechanism by whether the executable file contains Dynamic Value Relocation Table information. This method can be used to determine whether a static file on the disk contains retpoline code. It can also be used to determine whether the memory code contains retpoline code when the file is completely loaded into the memory and the memory is not modified by malicious code such as viruses. However, if the file on the disk is deleted and the code in the memory is modified, the above method cannot detect whether the code contains the retpoline mitigation mechanism code.

[0008] When analyzing the code of threat attack samples, some codes may no longer have files corresponding to the codes in memory. In this case, we can only analyze the codes in memory. This type of analysis is more difficult because a lot of information is related to the operating system mechanism. This requires a better understanding of the operating system mechanism, such as which system functions are imported and need to be identified using special methods; for example, to see whether this code snippet has some vulnerability mitigation measures, we also have to rely on the analysis of the code retained in the memory.

[0009] Threat intelligence is a kind of evidence-based knowledge, which includes context, mechanism, label, meaning and executable suggestions. This knowledge is related to existing or brewing threats or hazards faced by assets, and can be used to provide information support for asset-related entities to respond to threats or hazards or make decisions on handling them. The main content of threat intelligence is the compromised identifiers used to identify and detect threats, such as file hash values, IP addresses, domain names, program running paths, registry entries, various labels inside files, etc., as well as related attribution tags.

[0010] The retpoline code identified in the sample analysis is an indicator and evidence of the host information (virus samples, etc.) that can mitigate CPU Spectre vulnerability attacks, and can be used as a dimension of host information threat intelligence.

[0011] The retpoline code can mitigate the information leakage caused by the CPU Spectre vulnerability. Currently, a large number of CPUs have Spectre vulnerabilities. To prevent the harm of this vulnerability, the only way is to place retpoline code in the software to mitigate the information leakage that may be caused by the Spectre vulnerability. However, some old software definitely does not have retpoline code. How to identify such software without retpoline code mitigation mechanism is a problem that needs to be solved. When analyzing samples, when you get a piece of memory code, whether the code has the ability to resist Spectre vulnerability attacks is also a dimension that needs to be paid attention to, and it is added as a dimension to the threat intelligence of the code host sample. Summary of the invention

[0012] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0013] To this end, the present invention proposes a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, so as to identify whether the software has the ability to mitigate CPU Spectre vulnerability attacks.

[0014] Another object of the present invention is to provide a system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis.

[0015] To achieve the above objectives, the present invention proposes, on one hand, a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, comprising:

[0016] Performing code data analysis on a preset retpoline memory code fragment to scan binary code features from beginning to end to obtain a scanning result of a preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0017] Based on the scanning result, determine whether the instruction after the first instruction is a preset second instruction; if so,

[0018] According to the rules defined by the CPU instruction system, the first function address of the first instruction mov and the second function address of the second instruction jmp or call are respectively taken out, and the first function address and the second function address are compared to see whether they are equal; if they are equal,

[0019] It is identified that there is a retpoline code in the memory code fragment, and the retpoline code identification result of the memory code fragment is output.

[0020] The method for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis in an embodiment of the present invention may also have the following additional technical features:

[0021] In one embodiment of the present invention, the first instruction is a mov r10, qword ptr[iat] instruction, and the second instruction includes a jmp jump instruction or a call function call instruction.

[0022] In one embodiment of the present invention, determining whether the instruction after the first instruction is a preset second instruction includes:

[0023] Determining that the length of the first instruction is seven bytes;

[0024] Determine whether the value of the seven-byte position after the first instruction is 0xe8 or 0xe9; wherein 0xe8 is the call function call instruction, and 0xe9 is the jmp jump instruction.

[0025] In one embodiment of the present invention, the first instruction is coded as: 0x4c 0x8b 0x15[xx xx xxxx]mov r10,qword ptr[iat_api];

[0026] The second instruction is coded as: 0xe8 / 0xe9 yy yy yy yy call / jmp yy_api.

[0027] In one embodiment of the present invention, taking out a first function address of a first instruction mov and a second function address of a second instruction jmp or call respectively according to a rule defined by a CPU instruction system, and comparing whether the first function address and the second function address are equal, comprises:

[0028] Determine the rules of the CPU instruction set;

[0029] According to the rules of the CPU instruction system, the first function address X represented by the four bytes [xx xx xx xx] and the second function address Y represented by the four bytes yy yy yy yy are respectively taken out;

[0030] Compare the first function address X and the second function address Y to determine whether they are equal. If they are equal, find that the code here is the code of the retpoline mechanism and exit the search; otherwise,

[0031] Continue scanning and analyzing memory code fragments until the scanning is completed.

[0032] To achieve the above-mentioned purpose, a second embodiment of the present invention proposes a system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, including:

[0033] A code snippet analysis module, used to perform code data analysis on a preset retpoline memory code snippet to scan binary code features from beginning to end to obtain a scanning result of a preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0034] An instruction type determination module is used to determine whether the instruction after the first instruction is a preset second instruction based on the scanning result; if so,

[0035] The function address comparison module is used to fetch the first function address of the first instruction mov and the second function address of the second instruction jmp or call respectively according to the rules defined by the CPU instruction system, and compare whether the first function address and the second function address are equal; if they are equal,

[0036] The code fragment identification module is used to identify whether there is a retpoline code in the memory code fragment and output the retpoline code identification result of the memory code fragment.

[0037] The method and system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis in an embodiment of the present invention can identify whether any form of code has a retpoline mitigation mechanism, and can give a prompt warning for code without a retpoline mitigation mechanism. For code with a retpoline mitigation mechanism, it can also be used for sample analysis or threat intelligence to indicate that the corresponding sample program contains the ability to mitigate Spectre vulnerability attacks.

[0038] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0040] Figure 1 The present invention is a flowchart of a method for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis according to an embodiment of the present invention.

[0041] Figure 21 is a schematic diagram of the structure of a system for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0043] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0044] The following describes a method and system for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis according to an embodiment of the present invention with reference to the accompanying drawings.

[0045] It can be understood that the present invention introduces a method for identifying whether the memory contains retpoline code that can mitigate Spectre vulnerability attacks during sample analysis. The retpoline code can mitigate information leakage caused by CPU Spectre vulnerability attacks. After identifying that the code fragment in the memory has retpoline code, this feature can also be marked in the host information to which the memory code belongs. Marking whether the host information contains retpoline code can be used as a dimension and indicator of threat intelligence, which is evidence that this code host information can mitigate CPU Spectre vulnerability attacks.

[0046] In the actual environment, the code must exist in the memory to run. To determine whether the code contains the retpoline mitigation mechanism, memory code detection is definitely the most accurate and true, and it cannot be deceived. It is more reliable than the existing method of determining whether the executable file contains Dynamic Value Relocation Table information.

[0047] Therefore, the present invention provides a method for identifying whether a code has a retpoline mitigation mechanism through the code or code fragment in the memory during sample analysis. The method can identify whether any form of code has a retpoline mitigation mechanism. For code without a retpoline mitigation mechanism, a prompt warning can be given. For code with a retpoline mitigation mechanism, the method can be used for sample analysis or threat intelligence to indicate that the corresponding sample program has the ability to mitigate Spectre vulnerability attacks.

[0048] The present invention first describes some characteristics of the retpoline mitigation mechanism in memory, paving the way for subsequent detection and identification methods. The following is the retpoline of two types of code.

[0049] The first category is the processing of calling the call function. Let’s take the retpoline code in the ntfs! NtfsDeviceIoControlAsync function in the Windows system as an example. The local code of the ntfs! NtfsDeviceIoControlAsync function before loading into memory is:

[0050] PAGE:00000001C027F5D8 48FF 15 69 1D E4 FF callcs:__imp_KeInitializeEvent

[0051] PAGE:00000001C027F5DF 0F 1F 44 00 00nop dword ptr[rax+rax+00h]

[0052] But after this part of the code is loaded into memory and retpolined by the operating system, it will become:

[0053] fffff806ˋ5cc6f5d8 4c8b15691de4ff mov r10,qword ptr[Ntfs! _imp_KeInitializeEvent(fffff806ˋ5cab1348)]

[0054] fffff806ˋ5cc6f5df e8acc019fc call nt! KeInitializeEvent(fffff806ˋ58e0b690)

[0055] The second category is the processing of jmp function calls. Let's take a Windows function as an example. The local code of this function before loading into memory is:

[0056] .text:00000001C002CFB0 48FF 25 21 4B 12 00jmpcs:__imp___chkstk

[0057] .text:00000001C002CFB7 CC CC CC CC CC CC CC CC+byte_1C002CFB7 db0Fhdup(0CCh)

[0058] But after this part of the code is loaded into memory and retpolined by the operating system, it will become:

[0059] fffff805ˋ6775cfb0 4c8b15214b1200 mov r10,qword ptr[dxgkrnl! _imp___chkstk(fffff805ˋ67881ad8)]

[0060] fffff805ˋ6775cfb7 e9341d4cfa jmp nt! _chkstk(fffff805ˋ61c1ecf0)

[0061] Through the above two types of function calls, we can find that the transformed code is the code with retpoline mitigation mechanism, which can alleviate the information leakage problem caused by CPU Spectre vulnerability. This part of the code has the following characteristics:

[0062] The format of the code is: the two instructions that follow are mov r10, dword ptr [iat address storing API address]; call / jmp calls / jumps to the API to be called. Both instructions involve the address of the API, and the API addresses involved in these two instructions are the same API address.

[0063] If the code in the memory meets the above characteristics, it is retpolined code, and such code can alleviate the CPU Spectre vulnerability attack. Therefore, the present invention can identify whether there is retpoline code in the memory based on the above characteristics.

[0064] Figure 1 is a flow chart of a method for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0065] S1, performing code data analysis on a preset retpoline memory code fragment to scan binary code features from beginning to end to obtain a scanning result of a preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction.

[0066] Specifically, a code data analysis is performed on a given memory module or memory code fragment, and the binary code feature "\x4?\x8b\x15" is scanned from beginning to end. These three bytes are the first three bytes of the machine code of the instruction mov r10, qword ptr[iat], where the ? in \x4? can be any hexadecimal character. In the present invention, for ease of description, ? is generally replaced by c (i.e., the binary feature is "\x4c\x8b\x15"). If the mov instruction is scanned, the scanning results are collected, and step S2 is entered. Scanning means that a mov r10, qword ptr[iat] instruction may be found, and the length of this instruction is 7 bytes. It can be known that the scanning process can be the following steps:

[0067] S11, first, determine the range of the memory area or code fragment to be searched.

[0068] S12, starts from the beginning and scans the entire memory area or code fragment byte by byte.

[0069] S13, during the scanning process, check whether each byte sequence encountered matches 0x4c. If it matches, continue to check whether the next byte is 0x8b, and then the next byte is 0x15.

[0070] S14, where the c in 0x4c in S13 can be any number represented by hexadecimal characters.

[0071] S15, once the matching 3 bytes are found, the next 4 bytes are checked to confirm whether the entire 7-byte instruction "\x4c\x8b\x15" + 4 arbitrary bytes exist completely.

[0072] S16, if a complete 7-byte instruction is found, record this location. This location may be the starting point of the mov r10,qword ptr[iat] instruction.

[0073] S17, continue scanning from the next byte of the found position, repeating steps S13 to S16 until the end of the search range is reached (or directly enter S2, and after confirmation, return to S11 to continue the following scanning and identification steps).

[0074] S18, after completing the scan, analyze the recorded position to determine whether it is a valid mov r10, qword ptr[iat] instruction instance.

[0075] S2, judging whether the instruction after the first instruction is a preset second instruction based on the scanning result.

[0076] Specifically, based on step S1, each position recorded in S1 is analyzed to see whether the instruction after 7 bytes is the second instruction jmp jump instruction or the function call instruction call function call. If so, step S3 is entered, otherwise, the next position in S1 is analyzed. This step is to check whether the value of the 7-byte position after the instruction found in step S1 is 0xe8 or 0xe9, 0xe8 is a call instruction, and 0xe9 is a jmp instruction.

[0077] The code instructions found are as follows:

[0078] First instruction: 0x4c 0x8b 0x15[xx xx xx xx]mov r10,qword ptr[iat_api]

[0079] Second instruction: 0xe8 / 0xe9 yy yy yy yy call / jmp yy_api

[0080] Specifically, the judgment process of the present invention may be as follows:

[0081] S21, first, locate the first instruction that has been identified, that is, the mov instruction starting with 0x4c 0x8b 0x15.

[0082] S22, skip the remaining bytes of the instruction (in this case, the 4-byte offset [xx xx xx xx]), and then read the next 1 byte.

[0083] S23, if the byte is 0xe9, it indicates that this is a jmp instruction, i.e., the second instruction of the present invention. Or, if the byte is 0xe8, it indicates that this is a call function instruction.

[0084] S24, for the jmp instruction, the jump range is ±2^31 bytes relative to the current instruction address. Check if the next 4 bytes are an offset, if so, then it will form a complete jmp jump instruction together with the previous byte (0xe9).

[0085] S25, for the call instruction, the range of the function call is also ±2^31 bytes relative to the current instruction address. Similarly, check whether the next 4 bytes are offsets. If so, then it will form a complete call function call instruction together with the previous byte (0xe8).

[0086] S26, recognize the jmp or call instruction.

[0087] S27, if these instructions are not recognized, skip the detection of the position here in S1.

[0088] S3, according to the rules defined by the CPU instruction system, respectively fetch the first function address of the first instruction mov and the second function address of the second instruction jmp or call, and compare whether the first function address and the second function address are equal.

[0089] It is understandable that the CPU instruction system, also known as the instruction set architecture (ISA), is a set of rules and conventions that define the types of instructions that the CPU can execute, the format of instructions, the types of operands, and the management of CPU status. It is determined when the CPU is designed and determines how the software interacts with the hardware. The following is some key information about the CPU instruction system:

[0090] Instruction format: Each instruction has a specific format, including an opcode and operands. The opcode is used to indicate the type of instruction, while the operand provides the data or address information required for the instruction to execute.

[0091] Opcode: It is the first byte or part of the byte of the instruction, which is used to identify the type of instruction. Different opcodes correspond to different operations, such as arithmetic operations, logical operations, data transfer, control flow, etc.

[0092] Operand: is the data or data location required by the instruction to perform an operation. Operands can be immediate values ​​(values ​​embedded directly in the instruction), registers, or memory locations.

[0093] Addressing mode: defines how to determine the address of the operand through the information given in the instruction. Common addressing modes include direct addressing, indirect addressing, base plus offset addressing, proportional addressing, etc.

[0094] Register: A fast storage resource inside the CPU that is used to store temporary data during instruction execution. Registers are divided into different types, such as general registers, special registers (such as program counter PC, stack pointer SP), etc.

[0095] Control flow instructions: Instructions used to control the execution flow of a program, such as jump (JMP), conditional jump (JE / JNE), loop (LOOP), subroutine call (CALL) and return (RET).

[0096] Data transfer instructions: used to move data between the CPU and memory or between CPU internal registers, such as MOV, PUSH, POP, etc.

[0097] Arithmetic and logical instructions: Instructions that perform mathematical operations (addition, subtraction, multiplication, division) and logical operations (AND, OR, NOT, XOR).

[0098] Privileged instructions: Certain instructions can only be executed in the operating system kernel mode to protect system security and stability.

[0099] Exception and interrupt handling: defines the behavior of the CPU when an exception or interrupt occurs, including the calling of exception handlers and the execution of interrupt service routines.

[0100] Status register and flag bits: The CPU status register (such as EFLAGS or RFLAGS) contains multiple flag bits to indicate the status of the last operation, such as the zero flag (ZF), carry flag (CF), sign flag (SF), etc.

[0101] Instruction encoding: Each instruction has a unique binary encoding, and the compiler or assembler is responsible for converting high-level language or assembly language instructions into machine code that the CPU can recognize.

[0102] Furthermore, the present invention determines the rule of the CPU instruction system, and respectively takes out the first function address X represented by the four bytes [xxxx xx xx] and the second function address Y represented by the four bytes yy yy yy yy according to the rule of the CPU instruction system; compares the first function address X and the second function address Y to determine whether they are equal; if they are equal, it is found that the code here is the code of the retpoline mechanism and the search is exited; otherwise, the memory code fragment is continuously scanned and analyzed until the scanning is completed.

[0103] S4, identifies whether there is a retpoline code in the memory code fragment, and outputs the retpoline code identification result of the memory code fragment.

[0104] Therefore, the present invention can identify that there is retpoline code in the memory, and display the detection result (which can be used for sample analysis or threat intelligence, and indicates that the sample has the ability to mitigate CPU Spectre vulnerability attacks), and then ends.

[0105] According to the method for identifying the retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis in an embodiment of the present invention, it is possible to determine whether this memory code has a CPU Spectre vulnerability mitigation mechanism, which has a certain positive effect on determining system security, and can determine whether the software / sample may be attacked by a Spectre vulnerability, which is useful in sample analysis. The CPU Spectre vulnerability mitigation mechanism (retpoline mechanism) can also be used as an indicator of sample or attack code threat intelligence, indicating that the sample program has the ability to resist Spectre vulnerability attacks.

[0106] In order to implement the above embodiment, Figure 2 As shown, this embodiment also provides a system 10 for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis, including:

[0107] The code snippet analysis module 100 is used to perform code data analysis on the preset retpoline memory code snippet to scan the binary code features from beginning to end to obtain the scanning result of the preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0108] The instruction type determination module 200 is used to determine whether the instruction after the first instruction is a preset second instruction based on the scanning result; if so,

[0109] The function address comparison module 300 is used to fetch the first function address of the first instruction mov and the second function address of the second instruction jmp or call respectively according to the rules defined by the CPU instruction system, and compare whether the first function address and the second function address are equal; if they are equal,

[0110] The code segment identification module 400 is used to identify whether there is a retpoline code in the memory code segment and output the retpoline code identification result of the memory code segment.

[0111] Furthermore, the first instruction is a mov r10, qword ptr[iat] instruction, and the second instruction includes a jmp jump instruction or a call function call instruction.

[0112] Furthermore, the instruction type determination module 200 is further configured to:

[0113] Determining that the length of the first instruction is seven bytes;

[0114] Determine whether the value of the seven-byte position after the first instruction is 0xe8 or 0xe9; wherein 0xe8 is the call function call instruction, and 0xe9 is the jmp jump instruction.

[0115] Further, the first instruction is coded as: 0x4c 0x8b 0x15[xx xx xx xx]mov r10,qword ptr[iat_api];

[0116] The second instruction is coded as: 0xe8 / 0xe9 yy yy yy yy call / jmp yy_api.

[0117] Furthermore, the code snippet identification module 400 is also used for:

[0118] Determine the rules of the CPU instruction set;

[0119] According to the rules of the CPU instruction system, the first function address X represented by the four bytes [xx xx xx xx] and the second function address Y represented by the four bytes yy yy yy yy are respectively taken out;

[0120] Compare the first function address X and the second function address Y to determine whether they are equal. If they are equal, find that the code here is the code of the retpoline mechanism and exit the search; otherwise, continue to scan and analyze the memory code fragment until the scan is completed.

[0121] According to the system for identifying retpoline code in memory for mitigating Spectre vulnerability attacks based on sample analysis according to an embodiment of the present invention, it is possible to determine whether this memory code has a CPU Spectre vulnerability mitigation mechanism, which has a certain positive effect on determining system security and whether the software / sample may be attacked by a Spectre vulnerability, which is useful in sample analysis. The CPU Spectre vulnerability mitigation mechanism (retpoline mechanism) can also be used as an indicator of sample or attack code threat intelligence, indicating that the sample program has the ability to resist Spectre vulnerability attacks.

[0122] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0123] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

Claims

1. A method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, characterized in that: include: Performing code data analysis on a preset retpoline memory code fragment to scan binary code features from beginning to end to obtain a scan result of a preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction; Based on the scanning result, determine whether the instruction after the first instruction is a preset second instruction; if so, According to the rules defined by the CPU instruction system, respectively fetch the first function address of the first instruction mov and the second function address of the second instruction jmp or call, and compare whether the first function address and the second function address are equal; If they are equal, It is identified that there is a retpoline code in the memory code fragment, and the retpoline code identification result of the memory code fragment is output.

2. The method according to claim 1, characterized in that The first instruction is a mov r10, qword ptr[iat] instruction, and the second instruction includes a jmp jump instruction or a call function call instruction.

3. The method according to claim 2, characterized in that Determining whether the instruction after the first instruction is a preset second instruction includes: Determining that the length of the first instruction is seven bytes; Determine whether the value of the seven-byte position after the first instruction is 0xe8 or 0xe9; wherein 0xe8 is the call function call instruction, and 0xe9 is the jmp jump instruction.

4. The method according to claim 3, characterized in that The first instruction is coded as follows: 0x4c 0x8b 0x15[xx xx xx xx]mov r10,qword ptr[iat_api]; The second instruction is coded as: 0xe8 / 0xe9 yy yy yy yy call / jmp yy_api.

5. The method according to claim 4, characterized in that According to the rules defined by the CPU instruction system, the first function address of the first instruction mov and the second function address of the second instruction jmp or call are respectively taken out, and the first function address and the second function address are compared to see whether they are equal, including: Determine the rules of the CPU instruction set; According to the rules of the CPU instruction system, the first function address X represented by the four bytes [xx xx xx xx] and the second function address Y represented by the four bytes yy yy yy yy are respectively taken out; Compare the first function address X and the second function address Y to determine whether they are equal. If they are equal, find that the code here is the code of the retpoline mechanism and exit the search; otherwise, Continue scanning and analyzing memory code fragments until the scanning is completed.

6. A system for identifying retpoline code in memory to mitigate Spectre vulnerability attacks based on sample analysis, characterized in that: include: A code snippet analysis module, used to perform code data analysis on a preset retpoline memory code snippet to scan binary code features from beginning to end to obtain a scanning result of a preset first instruction; wherein the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction; An instruction type determination module is used to determine whether the instruction after the first instruction is a preset second instruction based on the scanning result; if so, The function address comparison module is used to fetch the first function address of the first instruction mov and the second function address of the second instruction jmp or call respectively according to the rules defined by the CPU instruction system, and compare whether the first function address and the second function address are equal; if they are equal, The code fragment identification module is used to identify whether there is a retpoline code in the memory code fragment and output the retpoline code identification result of the memory code fragment.

7. The system according to claim 6, characterized in that The first instruction is a mov r10, qword ptr[iat] instruction, and the second instruction includes a jmp jump instruction or a call function call instruction.

8. The system according to claim 7, characterized in that The instruction type judgment module is also used to: Determining that the length of the first instruction is seven bytes; Determine whether the value of the seven-byte position after the first instruction is 0xe8 or 0xe9; wherein 0xe8 is the call function call instruction, and 0xe9 is the jmp jump instruction.

9. The system according to claim 8, characterized in that The first instruction is coded as follows: 0x4c 0x8b 0x15[xx xx xx xx]mov r10,qword ptr[iat_api]; The second instruction is coded as: 0xe8 / 0xe9 yy yy yy yy call / jmp yy_api.

10. The system according to claim 9, characterized in that The code snippet recognition module is also used to: Determine the rules of the CPU instruction set; According to the rules of the CPU instruction system, the first function address X represented by the four bytes [xx xx xx xx] and the second function address Y represented by the four bytes yy yy yy yy are respectively taken out; Compare the first function address X and the second function address Y to determine whether they are equal. If they are equal, find that the code here is the code of the retpoline mechanism and exit the search; otherwise, Continue scanning and analyzing memory code fragments until the scanning is completed.

Images