A method for identifying mitigation vulnerability attack code in memory based on sample analysis

Abstract

This invention discloses a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis. The method includes: performing code data analysis on a preset retpoline memory code segment to scan binary code features from beginning to end to obtain a scan result of a preset first instruction; determining whether the instruction following the first instruction is a preset second instruction based on the scan result; if so, extracting the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` according to rules defined by the CPU instruction set, and comparing whether the first function address and the second function address are equal; if they are equal, identifying retpoline code in the memory code segment, and outputting the retpoline code identification result of the memory code segment. This invention can determine whether the corresponding memory code has a CPU Spectre vulnerability mitigation mechanism, indicating that the sample program has the ability to resist Spectre vulnerability attacks.

Description

Technical Field

[0001] This invention relates to the field of sample analysis technology in information security, and in particular to a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis. Background Technology

[0002] The Meltdown and Spectre vulnerabilities in Intel, AMD, and ARM processors, which were exposed in early 2018, caused global panic. Although Microsoft subsequently released security updates such as KB4090007 to patch these vulnerabilities, this also led to a decrease in computer performance. Later, Google developed the "retpoline" solution, which solved the performance degradation problem. Operating systems such as Windows and Linux adopted this solution and supported the retpoline mechanism in their respective operating systems.

[0003] Retpoline is a mitigation technique for the CPU Spectre vulnerability that allows the isolation of indirect branches from speculative execution. This can be used to protect sensitive binary software, such as operating systems, from branch-targeting injection attacks that target their indirect branches. Identifying the presence of this type of code in sample analysis is also essential, as it serves as a dimension of threat intelligence for the sample.

[0004] Because a large number of CPUs currently harbor Spectre vulnerabilities, and software developed before 2018 certainly doesn't include retpoline mitigation mechanisms, the presence or absence of retpoline mitigation mechanisms can serve as a dimension / indicator for threat intelligence in sample analysis. Therefore, identifying potentially Spectre-vulnerable code within current system memory code segments is a crucial topic. During sample analysis, identifying retpoline code reveals whether the analyzed program possesses the ability to defend against / mitigate CPU Spectre attacks.

[0005] There is currently no solution to determine whether a module or code segment in memory has a retpoline mitigation mechanism.

[0006] Currently, some standard methods can be used to determine whether module code has retpoline code. For example, check if the executable file (PE file in Windows) contains a Dynamic Value Relocation Table (in the Load Configuration Directory of the PE file for Windows executables). If it does, it indicates that the code in this module file has a retpoline mitigation mechanism. However, this method may not be very effective in determining whether code in memory has a retpoline mitigation mechanism, because the PE header information may have been corrupted in memory.

[0007] The method described above, which determines whether a retpoline mitigation mechanism exists by checking if the executable file contains Dynamic Value Relocation Table information, can be used to determine whether a static file on disk contains retpoline code. It can also be used to determine whether the memory code contains retpoline code if the file is fully loaded into memory and the memory has not been modified by viruses or other malicious code. However, if the file on disk is deleted and the code in memory is modified, the method mentioned above cannot detect whether the code contains retpoline mitigation mechanism code.

[0008] When analyzing the code of threat attack samples, some code may no longer have a file corresponding to the code in memory. In this case, we can only analyze the code in memory. This type of analysis is quite difficult because a lot of information is related to the operating system mechanism. This requires a good understanding of the operating system mechanism, such as which system functions are imported, which need to be identified using special methods. For example, to see if the code fragment has some vulnerability mitigation measures, we also have to rely on the analysis of the code remaining in memory.

[0009] Threat intelligence is evidence-based knowledge that includes context, mechanisms, identifiers, meanings, and actionable recommendations. This knowledge relates to existing or emerging threats or harms facing assets and can be used to support the decision-making of stakeholders in responding to or dealing with these threats or harms. The main content of threat intelligence consists of compromised identifiers used to identify and detect threats, such as file hashes, IP addresses, domain names, program execution paths, registry entries, various internal file identifiers, and related attribution tags.

[0010] The retpoline code identified in the sample analysis is an indicator and evidence that its host information (virus samples, etc.) can mitigate CPU Spectre vulnerability attacks, and can be used as a dimension of host information threat intelligence.

[0011] Retpoline code can mitigate information leakage caused by the CPU Spectre vulnerability. Currently, a large number of CPUs are vulnerable to Spectre. To eliminate the harm caused by this vulnerability, the only way is to place retpoline code in the software to mitigate the potential information leakage. However, some older software certainly does not contain retpoline code. How to identify such software without a retpoline mitigation mechanism is a problem that needs to be solved. During sample analysis, when a piece of memory code is obtained, whether the code has the ability to resist Spectre attacks is also a dimension that needs to be considered and added as a dimension to the threat intelligence of the host sample. Summary of the Invention

[0012] The present invention aims to at least partially solve one of the technical problems in the related art.

[0013] To address this, the present invention proposes a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, thereby identifying whether software has the ability to mitigate CPU Spectre vulnerability attacks.

[0014] Another objective of this invention is to propose a system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis.

[0015] To achieve the above objectives, this invention proposes a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, comprising:

[0016] Code data analysis is performed on a preset retpoline memory code segment to scan binary code features from beginning to end to obtain the scan result of a preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0017] Based on the scan results, determine whether the instruction following the first instruction is a preset second instruction; if so,

[0018] According to the rules defined by the CPU instruction set, the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` are retrieved respectively. The first function address and the second function address are then compared to see if they are equal. If they are equal...

[0019] The system identifies retpoline code within the memory code segment and outputs the retpoline code identification result for the memory code segment.

[0020] The method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis in this embodiment of the invention may also have the following additional technical features:

[0021] In one embodiment of the present invention, the first instruction is the mov r10,qword ptr[iat] instruction, and the second instruction includes a jmp jump instruction or a call function call instruction.

[0022] In one embodiment of the present invention, determining whether the instruction following the first instruction is a preset second instruction includes:

[0023] The length of the first instruction is determined to be seven bytes;

[0024] Determine whether the value of the seven bytes following the first instruction is 0xe8 or 0xe9; where 0xe8 is the call function instruction and 0xe9 is the jmp jump instruction.

[0025] In one embodiment of the present invention, the first instruction is coded as: 0x4c0x8b 0x15 [xx xx xxxx]mov r10, qword ptr[iat_api];

[0026] The code for the second instruction is: 0xe8 / 0xe9 yy yy yy yycall / jmp yy_api.

[0027] In one embodiment of the present invention, the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` are retrieved according to the rules defined by the CPU instruction set, and the comparison between the first function address and the second function address is made to determine whether they are equal, including:

[0028] Rules for determining the CPU instruction set;

[0029] According to the rules of the CPU instruction set, extract the first function address X represented by the 4 bytes [xx xx xx xx] and the second function address Y represented by the 4 bytes yy yy yy yy;

[0030] The first function address X and the second function address Y are compared to determine if they are equal. If they are equal, the code here is found to be part of the retpoline mechanism, and the search is terminated; otherwise,

[0031] Continue scanning and analyzing memory code segments until the scan is complete.

[0032] To achieve the above objectives, a second aspect of the present invention provides a system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, comprising:

[0033] The code snippet analysis module is used to perform code data analysis on a preset retpoline memory code snippet to scan binary code features from beginning to end to obtain the scan result of a preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0034] The instruction type determination module is used to determine, based on the scan results, whether the instruction following the first instruction is a preset second instruction; if so,

[0035] The function address comparison module is used to retrieve the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` according to the rules defined by the CPU instruction set, and compare whether the first function address and the second function address are equal; if they are equal,

[0036] The code snippet recognition module is used to identify retpoline code in the memory code snippet and output the retpoline code recognition result of the memory code snippet.

[0037] The method and system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis according to embodiments of the present invention can identify whether any form of code has a retpoline mitigation mechanism. For code without a retpoline mitigation mechanism, a prompt and alarm can be given. For code with a retpoline mitigation mechanism, it can also be used in the field of sample analysis or threat intelligence to indicate that the corresponding sample program has the ability to mitigate Spectre vulnerability attacks.

[0038] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0039] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0040] Figure 1 This is a flowchart of a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, according to an embodiment of the present invention.

[0041] Figure 2This is a schematic diagram of the structure of a system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, according to an embodiment of the present invention. Detailed Implementation

[0042] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0043] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0044] The following describes, with reference to the accompanying drawings, a method and system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, according to an embodiment of the present invention.

[0045] Understandably, this invention introduces a method for identifying whether memory contains retpoline code that can mitigate Spectre vulnerability attacks during sample analysis. Retpoline code can mitigate information leakage caused by CPU Spectre vulnerability attacks. After identifying code segments in memory that contain retpoline code, this characteristic can also be marked in the host information to which the memory code belongs. Marking whether the host information contains retpoline code can serve as a dimension and indicator of threat intelligence, and is evidence that the host information of this code can mitigate CPU Spectre vulnerability attacks.

[0046] In a real-world environment, code must reside in memory to run. Therefore, detecting the presence of a retpoline mechanism in the code is the most accurate and reliable method, and it cannot be easily fooled. This is more dependable than existing methods that rely on checking for Dynamic Value Relocation Table information in the executable file.

[0047] Therefore, this invention provides a method for identifying whether code has a retpoline mitigation mechanism by examining code or code fragments in memory during sample analysis. It can identify whether any form of code has a retpoline mitigation mechanism. For code without a retpoline mitigation mechanism, it can provide a warning. For code with a retpoline mitigation mechanism, it can be used in sample analysis or threat intelligence fields to indicate that the corresponding sample program has the ability to mitigate Spectre vulnerability attacks.

[0048] This invention first describes some characteristics of the retpoline mitigation mechanism in memory, laying the groundwork for subsequent detection and identification methods. The following describes the retpoline implementation for two types of code.

[0049] The first category is the handling of `call` function calls. Let's take the `retpoline` code in the `ntfs!NtfsDeviceIoControlAsync` function in Windows as an example. The local code of the `ntfs!NtfsDeviceIoControlAsync` function before it is loaded into memory is as follows:

[0050] PAGE:00000001C027F5D8 48 FF 15 69 1D E4 FFcallcs:__imp_KeInitializeEvent

[0051] PAGE:00000001C027F5DF 0F 1F 44 00 00nopdword ptr [rax+rax+00h]

[0052] However, after this part of the code is loaded into memory and retpolined by the operating system, it will become:

[0053] fffff806`5cc6f5d8 4c8b15691de4ffmovr10,qword ptr [Ntfs!_imp_KeInitializeEvent (fffff806`5cab1348)]

[0054] fffff806`5cc6f5df e8acc019fccallnt!KeInitializeEvent (fffff806`58e0b690)

[0055] The second category involves handling jmp function calls. Let's take a Windows function as an example again. The local code of this function before it's loaded into memory is as follows:

[0056] .text:00000001C002CFB0 48 FF 25 21 4B 12 00jmpcs:__imp___chkstk

[0057] .text:00000001C002CFB7 CC CC CC CC CC CC CC CC+byte_1C002CFB7db 0Fhdup(0CCh)

[0058] However, after this part of the code is loaded into memory and retpolined by the operating system, it will become:

[0059] fffff805`6775cfb0 4c8b15214b1200movr10,qword ptr [dxgkrnl!_imp___chkstk (fffff805`67881ad8)]

[0060] fffff805`6775cfb7 e9341d4cfajmpnt!_chkstk (fffff805`61c1ecf0)

[0061] Through the two types of function calls above, it can be seen that the transformed code has a retpoline mitigation mechanism, which can alleviate the information leakage problem caused by the CPU Spectre vulnerability. This part of the code has the following characteristics:

[0062] The code format is as follows: two consecutive instructions, `mov r10, dword ptr [address of the API address]; call / jmp`, call / jump to the API to be called. Both instructions involve the address of the API, and the API address involved by both instructions is the same API address.

[0063] If the code in memory meets the above characteristics, it is retpolined code. Such code can mitigate CPU Spectre vulnerability attacks. Therefore, this invention can identify whether there is retpolined code in memory based on the above characteristics.

[0064] Figure 1 This is a flowchart illustrating a method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0065] S1, perform code data analysis on the preset retpoline memory code segment to scan the binary code features from beginning to end to obtain the scan result of the preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction.

[0066] Specifically, code data analysis is performed on a given memory module or memory code segment, scanning the binary code feature "\x4?\x8b\x15" from beginning to end. These 3 bytes are the first 3 bytes of the machine code of the instruction "mov r10, qword ptr[iat]", where "?" in "\x4?" can be any hexadecimal character. For ease of description, "?" is generally replaced by "c" (i.e., the binary feature is "\x4c\x8b\x15"). If this "mov" instruction is scanned, the scan results are collected, and then step S2 is entered. Scanning it means that a "mov r10, qword ptr[iat]" instruction may have been found, and this instruction is 7 bytes long. It can be known that this scanning process can be divided into the following steps:

[0067] S11, First, determine the range of the memory region or code segment to be searched.

[0068] S12 scans the entire memory region or code segment byte by byte, starting from the beginning.

[0069] S13, During the scan, check if each encountered byte sequence matches 0x4c. If it matches, continue to check if the next byte is 0x8b, and the next byte is 0x15.

[0070] S14, where 'c' in 0x4c in S13 can be any number represented by a hexadecimal character.

[0071] S15: Once a matching 3 bytes are found, check the next 4 bytes to confirm whether the entire 7-byte instruction "\x4c\x8b\x15" + 4 arbitrary bytes are present.

[0072] S16: If a complete 7-byte instruction is found, record this position. This position may be the starting point of the instruction `mov r10,qword ptr[iat]`.

[0073] S17. Continue scanning from the next byte after the found position, repeating steps S13 to S16 until the end of the search range is reached (or directly enter S2, and after the judgment is confirmed, return to S11 to continue the following scanning and recognition steps).

[0074] S18, after completing the scan, analyze the recorded position to determine whether it is a valid mov r10, qword ptr[iat] instruction instance.

[0075] S2, based on the scan results, determine whether the instruction following the first instruction is a preset second instruction.

[0076] Specifically, based on step S1, each position recorded in S1 is analyzed to see if the instruction after 7 bytes is a second instruction (jmp, a jump instruction) or a function call instruction (call, a function call instruction). If so, proceed to step S3; otherwise, continue analyzing the next position in S1. This step checks whether the value of the 7-byte position after the instruction found in step S1 is 0xe8 or 0xe9. 0xe8 is a call instruction, and 0xe9 is a jmp instruction.

[0077] The resulting code instructions are as follows:

[0078] First instruction: 0x4c0x8b 0x15 [xx xx xx xx]mov r10, qword ptr[iat_api]

[0079] Second instruction: 0xe8 / 0xe9yy yy yy call / jmp yy_api

[0080] Specifically, the judgment process of the present invention can be as follows:

[0081] S21. First, locate the first recognized instruction, namely the mov instruction that starts with 0x4c 0x8b 0x15.

[0082] S22, skip the remaining bytes of the instruction (in this case, an offset of 4 bytes [xx xx xxxx]), and then read the next 1 byte.

[0083] S23, if the byte is 0xe9, it indicates that this is a jmp jump instruction, i.e., the second instruction of this invention. Or, if the byte is 0xe8, it indicates that this is a call function call instruction.

[0084] S24. For the jmp instruction, the jump range is ±2^31 bytes relative to the current instruction address. Check if the next 4 bytes are an offset; if so, they will form a complete jmp jump instruction together with the previous byte (0xe9).

[0085] S25. For the `call` instruction, the range of the function call is also relative to the current instruction address ±2^31 bytes. Similarly, check if the next 4 bytes are an offset. If so, they will form a complete `call` function call instruction together with the previous byte (0xe8).

[0086] S26 identifies either the jmp or call instruction.

[0087] S27, if these instructions are not recognized, skip the detection at this location in S1.

[0088] S3: According to the rules defined by the CPU instruction system, retrieve the first function address of the first instruction mov and the second function address of the second instruction jmp or call, and compare whether the first function address and the second function address are equal.

[0089] As is understandable, the CPU instruction set architecture (ISA) is a set of rules and conventions that defines the types of instructions the CPU can execute, the format of the instructions, the types of operands, and the management of CPU states. It is determined during CPU design and dictates how software interacts with hardware. Below are some key pieces of information about the CPU instruction set:

[0090] Instruction Format: Each instruction has a specific format, including an opcode and operands. The opcode indicates the type of instruction, while the operands provide the data or address information required for instruction execution.

[0091] Opcode: The first byte or part of the bytes of an instruction, used to identify the type of instruction. Different opcodes correspond to different operations, such as arithmetic operations, logical operations, data transfer, control flow, etc.

[0092] Operands are the data or data locations required for instruction execution. Operands can be immediate values ​​(values ​​directly embedded in the instruction), registers, or memory addresses.

[0093] Addressing mode: Defines how the address of the operand is determined from the information given in the instruction. Common addressing modes include direct addressing, indirect addressing, base-plus-offset addressing, and proportional addressing.

[0094] Registers are fast storage resources inside the CPU used to store temporary data during instruction execution. Registers are divided into different types, such as general-purpose registers and special-purpose registers (such as the program counter PC and the stack pointer SP).

[0095] Control flow instructions: Instructions used to control the execution flow of a program, such as jump (JMP), conditional jump (JE / JNE), loop (LOOP), subroutine call (CALL), and return (RET).

[0096] Data transfer instructions: used to move data between the CPU and memory or between internal CPU registers, such as MOV, PUSH, POP, etc.

[0097] Arithmetic and logical instructions: Instructions that perform mathematical operations (addition, subtraction, multiplication, division) and logical operations (AND, OR, NOT, XOR).

[0098] Privileged instructions: Some instructions can only be executed in the operating system kernel mode to protect system security and stability.

[0099] Exception and interrupt handling: Defines the CPU's behavior when an exception or interrupt occurs, including the invocation of exception handlers and the execution of interrupt service routines.

[0100] Status registers and flags: The CPU's status registers (such as EFLAGS or RFLAGS) contain multiple flags used to indicate the status of the last operation, such as the zero flag (ZF), carry flag (CF), and sign flag (SF).

[0101] Instruction encoding: Each instruction has a unique binary code. The compiler or assembler is responsible for converting high-level language or assembly language instructions into machine code that the CPU can recognize.

[0102] Furthermore, this invention determines the rules of the CPU instruction system, and extracts the first function address X represented by the four bytes [xxxx xx xx] and the second function address Y represented by the four bytes yy yy yy yy according to the rules of the CPU instruction system; compares the first function address X and the second function address Y to determine whether they are equal. If they are equal, the code here is found to be the code of the retpoline mechanism, and the search is terminated; otherwise, the scanning and analysis of the memory code segment continues until the scanning is completed.

[0103] S4 identifies retpoline code in memory code segments and outputs the retpoline code identification results for the memory code segments.

[0104] Thus, this invention can identify retpoline code in memory and display the detection results (which can be used for sample analysis or threat intelligence, and indicate that the sample has the ability to mitigate CPU Spectre vulnerability attacks), and then end.

[0105] According to the method for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis according to embodiments of the present invention, it is possible to determine whether this memory code has a CPU Spectre vulnerability mitigation mechanism. This has a positive effect on judging system security and can determine whether the software / sample may be subject to Spectre vulnerability attacks. This is useful in sample analysis and can also use the CPU Spectre vulnerability mitigation mechanism (retpoline mechanism) as an indicator of the threat intelligence of the sample or attack code, indicating that the sample program has the ability to resist Spectre vulnerability attacks.

[0106] To achieve the above embodiments, such as Figure 2 As shown, this embodiment also provides a system 10 for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis, including:

[0107] The code snippet analysis module 100 is used to perform code data analysis on a preset retpoline memory code snippet to scan binary code features from beginning to end to obtain the scan result of a preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction;

[0108] The instruction type determination module 200 is used to determine, based on the scan results, whether the instruction following the first instruction is a preset second instruction; if so,

[0109] The function address comparison module 300 is used to retrieve the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` according to the rules defined by the CPU instruction set, and compare whether the first function address and the second function address are equal; if they are equal...

[0110] The code snippet recognition module 400 is used to recognize that there is retpoline code in the memory code snippet and output the retpoline code recognition result of the memory code snippet.

[0111] Furthermore, the first instruction is the mov r10, qword ptr[iat] instruction, and the second instruction includes the jmp jump instruction or the call function call instruction.

[0112] Furthermore, the instruction type determination module 200 is also used for:

[0113] The length of the first instruction is determined to be seven bytes;

[0114] Determine whether the value of the seven bytes following the first instruction is 0xe8 or 0xe9; where 0xe8 is the call function instruction and 0xe9 is the jmp jump instruction.

[0115] Furthermore, the code for the first instruction is: 0x4c0x8b 0x15 [xx xx xx xx]mov r10,qword ptr[iat_api];

[0116] The code for the second instruction is: 0xe8 / 0xe9 yy yy yy yycall / jmp yy_api.

[0117] Furthermore, the code snippet recognition module 400 is also used for:

[0118] Rules for determining the CPU instruction set;

[0119] According to the rules of the CPU instruction set, extract the first function address X represented by the 4 bytes [xx xx xx xx] and the second function address Y represented by the 4 bytes yy yy yy yy;

[0120] The address of the first function X is compared with the address of the second function Y to determine if they are equal. If they are equal, the code here is found to be the code of the retpoline mechanism, and the search is terminated; otherwise, the scanning and analysis of the memory code segment continues until the scan is completed.

[0121] According to the system for identifying retpoline code in memory that mitigates Spectre vulnerability attacks based on sample analysis according to embodiments of the present invention, it is possible to determine whether this memory code has a CPU Spectre vulnerability mitigation mechanism. This has a positive effect on judging system security and can determine whether the software / sample may be subject to Spectre vulnerability attacks. This is useful in sample analysis and can also use the CPU Spectre vulnerability mitigation mechanism (retpoline mechanism) as an indicator of the threat intelligence of the sample or attack code, indicating that the sample program has the ability to resist Spectre vulnerability attacks.

[0122] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0123] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for identifying mitigation vulnerability attack code in memory based on sample analysis, characterized in that, include: Code data analysis is performed on a preset retpoline memory code segment to scan binary code features from beginning to end to obtain the scan result of a preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction; Based on the scan results, determine whether the instruction following the first instruction is a preset second instruction; if so, According to the rules defined by the CPU instruction set, the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` are retrieved respectively. The first function address and the second function address are then compared to see if they are equal. If they are equal... The system identifies retpoline code within the memory code segment and outputs the retpoline code identification result for the memory code segment. Determine whether the instruction following the first instruction is a preset second instruction, including: The length of the first instruction is determined to be seven bytes; Determine whether the value of the seven bytes following the first instruction is 0xe8 or 0xe9; where 0xe8 is the call function instruction and 0xe9 is the jmp jump instruction.

2. The method according to claim 1, characterized in that, The first instruction is the mov r10, qword ptr[iat] instruction, and the second instruction includes the jmp jump instruction or the call function call instruction.

3. The method according to claim 2, characterized in that, The code for the first instruction is: 0x4c 0x8b 0x15 [xx xx xx xx]mov r10, qword ptr[iat_api]; The code for the second instruction is: 0xe8 / 0xe9 yy yy yy yycall / jmp yy_api.

4. The method according to claim 3, characterized in that, According to the rules defined by the CPU instruction set, the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` are retrieved respectively. The first function address and the second function address are compared to see if they are equal, including: Rules for determining the CPU instruction set; According to the rules of the CPU instruction set, extract the first function address X represented by the 4 bytes [xx xx xx xx] and the second function address Y represented by the 4 bytes yy yy yy yy; The first function address X and the second function address Y are compared to determine if they are equal. If they are equal, the code here is found to be part of the retpoline mechanism, and the search is terminated; otherwise, Continue scanning and analyzing memory code segments until the scan is complete.

5. A system for identifying mitigation vulnerability attack code in memory based on sample analysis, characterized in that, include: The code snippet analysis module is used to perform code data analysis on a preset retpoline memory code snippet to scan binary code features from beginning to end to obtain the scan result of a preset first instruction; wherein, the bytes corresponding to the binary code features are the first three bytes of the machine code of the first instruction; The instruction type determination module is used to determine, based on the scan results, whether the instruction following the first instruction is a preset second instruction; if so, The function address comparison module is used to retrieve the first function address of the first instruction `mov` and the second function address of the second instruction `jmp` or `call` according to the rules defined by the CPU instruction set, and compare whether the first function address and the second function address are equal; if they are equal, The code snippet recognition module is used to identify retpoline code in the memory code snippet and output the retpoline code recognition result of the memory code snippet; The instruction type determination module is also used for: The length of the first instruction is determined to be seven bytes; Determine whether the value of the seven bytes following the first instruction is 0xe8 or 0xe9; where 0xe8 is the call function instruction and 0xe9 is the jmp jump instruction.

6. The system according to claim 5, characterized in that, The first instruction is the mov r10, qword ptr[iat] instruction, and the second instruction includes the jmp jump instruction or the call function call instruction.

7. The system according to claim 6, characterized in that, The code for the first instruction is: 0x4c 0x8b 0x15 [xx xx xx xx]mov r10, qword ptr[iat_api]; The code for the second instruction is: 0xe8 / 0xe9 yy yy yy yycall / jmp yy_api.

8. The system according to claim 7, characterized in that, The code snippet recognition module is also used for: Rules for determining the CPU instruction set; According to the rules of the CPU instruction set, extract the first function address X represented by the 4 bytes [xx xx xx xx] and the second function address Y represented by the 4 bytes yy yy yy yy; The first function address X and the second function address Y are compared to determine if they are equal. If they are equal, the code here is found to be part of the retpoline mechanism, and the search is terminated; otherwise, Continue scanning and analyzing memory code segments until the scan is complete.

Images