Vulnerability hot compensation method and device, equipment and storage medium

Abstract

The invention relates to the technical field of software security, and discloses a vulnerability hot patching method, device and equipment and a storage medium, the method comprises the following steps: when loading information of a pre-compilation module corresponding to a target type program set with vulnerabilities is detected, obtaining structure data of the pre-compilation module; determining current loading information of the target type program set according to the structural data; performing hot compensation on vulnerabilities of the target type program set according to the current loading information; according to the mode, whether the loading information of the pre-compilation module corresponding to the target type program set with the vulnerability is detected or not is judged, if yes, the current loading information of the target type program set is obtained according to the structural data of the pre-compilation module, then the loading information is used for conducting hot patching on the vulnerability of the target type program set, and therefore the vulnerability of the target type program set is detected. Therefore, hot patching of vulnerabilities of the target type program set can be realized, and the security of an operating system is improved.

Description

Technical Field

[0001] The present invention relates to the field of software security technology, and in particular to a vulnerability hot patching method, device, equipment and storage medium. Background Art

[0002] Software vulnerabilities are usually fixed by installing official patches provided by software manufacturers or operating system manufacturers. However, it takes a long time from the development to the release of patches, which makes the above repair method lagging. If users do not install vulnerability patches in time, there will be security risks. Therefore, third-party security vendors provide a "hot patch" mechanism, which can be used to repair or mitigate security threats caused by software vulnerabilities before the official patches are released. However, the commonly used "hot patch" mechanism is aimed at native modules developed in languages ​​such as C / C++ on Windows, and cannot hot patch vulnerabilities in target type assemblies containing managed code, resulting in low security of the operating system.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a vulnerability hot patching method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology cannot implement hot patching of vulnerabilities of target type assembly, resulting in low security of the operating system.

[0005] To achieve the above object, the present invention provides a vulnerability hot patching method, which comprises the following steps:

[0006] When the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, the structural data of the precompiled module is obtained;

[0007] Determine the current loading information of the target type assembly according to the structure data;

[0008] Hot patching is performed on the vulnerability of the target type assembly according to the current loading information.

[0009] Optionally, when the loading information of the precompiled module corresponding to the target type assembly having the vulnerability is detected, before obtaining the structural data of the precompiled module, the method further includes:

[0010] Determine whether a dynamic link library is detected;

[0011] When a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result;

[0012] It is determined whether loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected according to the current loading callback result.

[0013] Optionally, after determining whether a dynamic link library is detected, the method further includes:

[0014] When the dynamic link library is not detected, registering the dynamic link library through the target dll function;

[0015] Continue to execute the step of performing a loading callback according to the dynamic link library to obtain a current loading callback result.

[0016] Optionally, determining the current loading information of the target type assembly according to the structure data includes:

[0017] Obtaining target data of an executable standard structure according to the structure data;

[0018] preventing loading of precompiled modules according to target data of the executable standard structure;

[0019] After the blocking is successful, the target module of the original assembly is automatically loaded;

[0020] During the running process, the current loading information of the target type assembly is obtained in real time.

[0021] Optionally, during the running process, obtaining the current loading information of the target type assembly in real time includes:

[0022] During the running process, the dllHOOK function is used to monitor the loading information of the clrjit module and the mscorjit module in real time;

[0023] Determine the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module;

[0024] The current loading information of the target type assembly is obtained according to the current loading path and the current version information.

[0025] Optionally, determining the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module includes:

[0026] Acquire the corresponding clrjitdll function according to the loading information of the clrjit module, and acquire the corresponding mscorjitdll function according to the loading information of the mscorjit module;

[0027] Obtain the getJit export function of the clrjitdll function and the mscorjitdll function according to the target object virtual table;

[0028] Get the target CILJit function by calling the getJit export function;

[0029] The current loading path and current version information of the target type assembly are determined according to the parsing parameters of the target CILJit function.

[0030] Optionally, hot patching the vulnerability of the target type assembly according to the current loading information includes:

[0031] Obtaining a version number of the target type assembly according to the current loading information;

[0032] Generate the current version number list based on the preset built-in vulnerability number data table;

[0033] Match the version number of the target type assembly with the current version number list;

[0034] Generate a hot patch strategy for the target vulnerability based on the successfully matched version number;

[0035] Hot patching is performed on the vulnerabilities of the target type assembly according to the target vulnerability hot patching strategy.

[0036] Optionally, generating a target vulnerability hot patching strategy according to the successfully matched version number includes:

[0037] Determine the libscentdll function based on the successfully matched version number;

[0038] Obtain the LibscentDispatcher function according to the libscentdll function;

[0039] The target vulnerability hot patching strategy is generated by calling the LibscentDispatcher function.

[0040] Optionally, hot-patching the vulnerability of the target type assembly according to the target vulnerability hot-patching strategy includes:

[0041] Get the corresponding current version number according to the version information of the current process;

[0042] When the current version number is less than or equal to the first version number, obtaining the CorBindToRuntimeEx export function of the mscoree.dll function;

[0043] Get the ICLRRuntimeHost interface by calling the CorBindToRuntimeEx export function;

[0044] Hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRRuntimeHost interface and the target vulnerability hot patch strategy.

[0045] Optionally, after obtaining the corresponding current version number according to the version information of the current process, the method further includes:

[0046] When the current version number is greater than or equal to the second version number, obtaining the CLRCreateInstance export function of the mscoree.dll function;

[0047] Obtain the ICLRMetaHost interface by calling the CLRCreateInstance export function;

[0048] Hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRMetaHost interface and the target vulnerability hot patch strategy.

[0049] Optionally, after hot-patching the vulnerability of the target type assembly according to the current loading information, the method further includes:

[0050] Get the vulnerability name and hotfix method;

[0051] Generate vulnerability blocking prompt information according to the vulnerability name and hot patch processing method;

[0052] The vulnerability prevention prompt information is displayed in a target form.

[0053] In addition, to achieve the above-mentioned purpose, the present invention also provides a vulnerability hot patching device, which includes:

[0054] A detection module, configured to obtain structural data of a precompiled module when loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected;

[0055] A determination module, used to determine the current loading information of the target type assembly according to the structure data;

[0056] A hot patch module is used to hot patch the vulnerability of the target type assembly according to the current loading information.

[0057] Optionally, the detection module is also used to determine whether a dynamic link library is detected; when a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result; and based on the current loading callback result, it is determined whether loading information of a precompiled module corresponding to a target type assembly with a vulnerability is detected.

[0058] Optionally, the detection module is further used to register the dynamic link library through the target dll function when the dynamic link library is not detected; and continue to perform the step of performing a load callback according to the dynamic link library to obtain a current load callback result.

[0059] Optionally, the determination module is also used to obtain target data of the PE structure based on the structural data; block the loading of the precompiled module based on the target data of the PE structure; after successful blocking, run the target module that automatically loads the original assembly; and during the running process, obtain the current loading information of the target type assembly in real time.

[0060] Optionally, the determination module is also used to monitor the loading information of the clrjit module and the loading information of the mscorjit module in real time during operation using the dllHOOK function; determine the current loading path and current version information of the target type assembly based on the loading information of the clrjit module and the loading information of the mscorjit module; and obtain the current loading information of the target type assembly based on the current loading path and the current version information.

[0061] Optionally, the hot patch module is also used to obtain the version number of the target type assembly based on the current loading information; generate a current version number list based on a preset built-in vulnerability number data table; match the version number of the target type assembly with the current version number list; generate a target vulnerability hot patch strategy based on the successfully matched version number; and hot patch the vulnerability of the target type assembly according to the target vulnerability hot patch strategy.

[0062] Optionally, the hot patch module is further used to determine the libscentdll function according to the successfully matched version number; obtain the LibscentDispatcher function according to the libscentdll function; and generate a target vulnerability hot patch strategy by calling the LibscentDispatcher function.

[0063] In addition, to achieve the above-mentioned purpose, the present invention also proposes a vulnerability hot patching device, which includes: a memory, a processor, and a vulnerability hot patching program stored in the memory and executable on the processor, wherein the vulnerability hot patching program is configured to implement the vulnerability hot patching method described above.

[0064] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which a vulnerability hot patching program is stored, and when the vulnerability hot patching program is executed by a processor, the vulnerability hot patching method as described above is implemented.

[0065] The vulnerability hot patching method proposed in the present invention obtains the structural data of the precompiled module when the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected; determines the current loading information of the target type assembly according to the structural data; and hot patches the vulnerability of the target type assembly according to the current loading information. In the above manner, it is first determined whether the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, and if so, the current loading information of the target type assembly is obtained according to the structural data of the precompiled module, and then the vulnerability of the target type assembly is hot patched using the loading information, so that the hot patching of the vulnerability of the target type assembly can be achieved, thereby improving the security of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a schematic diagram of the structure of a vulnerability hot patching device for a hardware operating environment involved in an embodiment of the present invention;

[0067] Figure 2 It is a flowchart of the first embodiment of the vulnerability hot patching method of the present invention;

[0068] Figure 3 It is a schematic diagram of the overall process of an embodiment of a vulnerability hot patching method of the present invention;

[0069] Figure 4 It is a flow chart of the second embodiment of the vulnerability hot patching method of the present invention;

[0070] Figure 5 It is a flowchart of a third embodiment of the vulnerability hot patching method of the present invention;

[0071] Figure 6 Schematic diagram of functional modules of the first embodiment of the vulnerability hot patching device of the present invention.

[0072] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0073] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0074] Reference Figure 1 , Figure 1 The figure is a schematic diagram of the structure of a vulnerability hot patching device for a hardware operating environment according to an embodiment of the present invention.

[0075] like Figure 1 As shown, the vulnerability hot patching device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0076] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the vulnerability hot patching device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0077] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a vulnerability hot patch program.

[0078] exist Figure 1 In the vulnerability hot patching device shown, the network interface 1004 is mainly used for data communication with the network integration platform workstation; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the vulnerability hot patching device of the present invention can be set in the vulnerability hot patching device, and the vulnerability hot patching device calls the vulnerability hot patching program stored in the memory 1005 through the processor 1001, and executes the vulnerability hot patching method provided by the embodiment of the present invention.

[0079] Based on the above hardware structure, an embodiment of the vulnerability hot patching method of the present invention is proposed.

[0080] Reference Figure 2 , Figure 2 Schematic diagram of the process of the first embodiment of the vulnerability hot patching method of the present invention.

[0081] In a first embodiment, the vulnerability hot patching method includes the following steps:

[0082] Step S10, when the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, the structural data of the precompiled module is obtained.

[0083] It should be noted that the executor of this embodiment is a vulnerability hot patching device, and may also be other devices that can achieve the same or similar functions, such as a vulnerability hot patching controller, etc. This embodiment does not limit this. In this embodiment, the vulnerability hot patching controller is taken as an example for explanation.

[0084] It should be understood that loading information refers to the information of a precompiled module when it is precompiled and loaded. The precompiled module corresponds to the target type assembly, and the name of the precompiled module can be [assembly name].ni.dll. The target type assembly refers to the assembly containing managed code. The target type assembly can be a .Net assembly, specifically System.Runtime.Remoting.dll. The target type assembly can also be called a .Net module. The function of the managed code can be system.Runtime.Remoting.MetadataServices.WsdlParser.IsValidUrl. Each call of the function is monitored, and the parameters of IsValidUrl(string) are parsed. If there are control characters (carriage return, line feed, tab, etc.) in the parameters, the parameters are replaced with invalid data "@\". The structure data refers to the data of each structure of the precompiled module, and the structure data includes but is not limited to executable standard structure data and executable non-standard structure data.

[0085] Furthermore, before step S10, it also includes: determining whether a dynamic link library is detected; when a dynamic link library is detected, performing a loading callback according to the dynamic link library to obtain a current loading callback result; and determining whether loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected according to the current loading callback result.

[0086] It can be understood that the dynamic link library refers to a link library used to detect the loading information of precompiled modules. The dynamic link library can be a DLL. When the dynamic link library is detected, it indicates that the dynamic link library has been registered. At this time, the dynamic link library loads a callback, and then determines whether the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected based on the current loading callback result.

[0087] Furthermore, after determining whether a dynamic link library is detected, the method further includes: when no dynamic link library is detected, registering the dynamic link library through a target dll function; and continuing to perform a loading callback according to the dynamic link library to obtain a current loading callback result.

[0088] It should be understood that when the dynamic link library is not detected, it indicates that the dynamic link library is not registered. At this time, the dynamic link library is registered through the target dll function. After the registration is completed, a load callback is performed according to the dynamic link library to obtain the current load callback result. The target dll function can be ntdll! LdrRegisterDllNotification().

[0089] Step S20: determining the current loading information of the target type assembly according to the structural data.

[0090] It can be understood that the current loading information refers to the information when the target type assembly is loaded, and the current loading information includes but is not limited to the current loading path and the current version information. The current loading path refers to the path when the target type assembly is used or loaded. For example, before the function in the target type assembly is used for the first time, it needs to be called for JIT compilation. The current version information refers to the version information of the target type assembly itself, and the current version information includes but is not limited to the version number and version name.

[0091] Step S30: hot-patching the vulnerability of the target type assembly according to the current loading information.

[0092] It should be understood that after obtaining the current loading information, the vulnerabilities existing in the target type assembly are determined according to the current loading information, and then the vulnerabilities existing in the target type assembly are hot-patched to improve the security of the operating system.

[0093] Furthermore, after step S30, the method further includes: obtaining a vulnerability name and a hot patch processing method; generating vulnerability blocking prompt information according to the vulnerability name and the hot patch processing method; and displaying the vulnerability blocking prompt information in a target form.

[0094] It can be understood that the vulnerability name refers to the name of the vulnerability existing in the target type program set. For example, the vulnerability name may be CVE-2017-8759, and the hot patch processing method refers to the method of hot patching the vulnerability existing in the target type program set. For example, the hot patch processing method may be a micropatch that has repaired the vulnerability existing in the target type program set to prevent this dangerous attack, and then generate vulnerability blocking prompt information based on the vulnerability name and the hot patch processing method, and then call the target interface to send the vulnerability blocking prompt information and the display command to the Tray process through the pipeline, and the Tray process displays the vulnerability blocking prompt information in a target form according to the display command, and the target form may be a window.

[0095] It should be understood that reference Figure 3 , Figure 3The overall process diagram is as follows: there are multiple processes of libzdtp.dll, namely process 1, process 2...process N, and then the loading information of the .Net assembly with a vulnerability is detected through the DLL loading callback. If so, libscent.dll is loaded and the CorBindToRuntimeEx() export function of mscoree.dll and the CLR CreateInstance() export function of mscoree.dll are called, and libscent.dl is loaded into the corresponding process by libzdtp.dll. After hot patching the vulnerability of the target type assembly, the vulnerability blocking prompt information is generated according to the vulnerability name and the hot patching processing method, and then the vulnerability blocking prompt information is sent to the Tray process through the pipeline, and the Tray process displays the vulnerability blocking prompt information pop-up window and reports the data.

[0096] When the loading information of the precompiled module corresponding to the target type assembly with a vulnerability is detected, the present embodiment obtains the structural data of the precompiled module; determines the current loading information of the target type assembly based on the structural data; and hot-patches the vulnerability of the target type assembly based on the current loading information. In the above manner, it is first determined whether the loading information of the precompiled module corresponding to the target type assembly with a vulnerability is detected, and if so, the current loading information of the target type assembly is obtained based on the structural data of the precompiled module, and then the vulnerability of the target type assembly is hot-patched using the loading information, thereby achieving hot-patching of the vulnerability of the target type assembly, thereby improving the security of the operating system.

[0097] In one embodiment, if Figure 4 Based on the first embodiment, a second embodiment of the vulnerability hot patching method of the present invention is proposed, and step S20 includes:

[0098] Step S201, obtaining target data of an executable standard structure according to the structure data.

[0099] It should be understood that the target data refers to the structural data of the executable standard structure, which may be a PE structure, and the target data may be NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]. After obtaining the structural data, the target data of the executable standard structure is extracted from the structural data.

[0100] Step S202: preventing the loading of a precompiled module according to the target data of the executable standard structure.

[0101] It is understandable that after obtaining the target data of the executable standard structure, the target data of the executable standard structure is cleared from the PE structure of the precompiled module to prevent the loading of the precompiled module. The existence of the precompiled module is incompatible with the current hot patch mechanism because JIT compilation will no longer be performed when the precompiled module is loaded.

[0102] Step S203, after the blocking is successful, run the target module of the original assembly to load automatically.

[0103] It should be understood that after the blocking is successful, the .Net runtime will automatically load the original assembly in order to save the time of JIT compilation of the intermediate language IL. When the loading of the precompiled module is blocked, the .Net runtime CLR will use the original assembly, which has no effect on the operation of the program.

[0104] Step S204, during the running process, the current loading information of the target type assembly is obtained in real time.

[0105] It is understandable that during the running of .Net, the target type assembly will also be loaded, and the current loading information of the target type assembly can be obtained in real time.

[0106] Furthermore, step S204 includes: during the running process, using the dllHOOK function to monitor the loading information of the clrjit module and the loading information of the mscorjit module in real time; determining the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module; and obtaining the current loading information of the target type assembly according to the current loading path and the current version information.

[0107] It should be understood that during the operation of .Net, the dllHOOK function is used to monitor the loading information of the clrjit module and the loading information of the mscorjit module in real time at the Hook point. The dllHOOK function can be LdrLoadDll(), the location path of the clrjit module can be *\Windows\Microsoft.NET\Framework*\v4.0.30319\clrjit.dll, and the location path of the mscorjit module can be *\Windows\Microsoft.NET\Framework*\v2.0.50727\mscorjit.dll. Then, the current loading path and current version information of the target type assembly are determined according to the loading information of the clrjit module and the loading information of the mscorjit module, that is, the current loading information of the target type assembly.

[0108] Furthermore, the determining the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module includes: obtaining the corresponding clrjitdll function according to the loading information of the clrjit module, and obtaining the corresponding mscorjitdll function according to the loading information of the mscorjit module; obtaining the getJit export function of the clrjitdll function and the mscorjitdll function according to the target object virtual table; obtaining the target CILJit function by calling the getJit export function; and determining the current loading path and current version information of the target type assembly according to the parsing parameters of the target CILJit function.

[0109] It can be understood that the target object virtual table refers to the virtual table determined from the returned C++ object, the clrjitdll function refers to the function called when the clrjit module is loaded, and the clrjitdll function can be clrjit.dll. Similarly, the mscorjitdll function refers to the function called when the mscorjit module is loaded, and then the getJit export function of the clrjitdll function and the mscorjitdll function is obtained according to the target object virtual table. Finally, the target CILJit function is obtained by calling the getJit export function. The target CILJit function can be CILJit::compileMethod(), and the target CILJit function is an internal non-exported function. The parameters are parsed in the function that processes the CILJit::compileMethod()Hook to obtain the current loading path and current version information of the target type assembly. In addition, the Hook point is used to approximate the loading timing of the target type assembly, which is similar to the timing of LoadLibrary.

[0110] This embodiment obtains target data of an executable standard structure according to the structural data; prevents loading of a precompiled module according to the target data of the executable standard structure; after successful prevention, runs the target module that automatically loads the original assembly; during the running process, obtains the current loading information of the target type assembly in real time; through the above-mentioned method, extracts the target data of the executable standard structure from the structural data, and then clears the target data of the executable standard structure to prevent loading of a precompiled module, and then runs the target module that automatically loads the original assembly, and during the running process, obtains the current loading information of the target type assembly in real time, thereby effectively improving the accuracy of obtaining the current loading information and avoiding the impact on program running.

[0111] In one embodiment, if Figure 5Based on the first embodiment, a third embodiment of the vulnerability hot patching method of the present invention is proposed, wherein step S30 includes:

[0112] Step S301, obtaining the version number of the target type assembly according to the current loading information.

[0113] It can be understood that the version number refers to the ID number of the target type assembly, for example, PatchId={PATCH_ID}, PATCH_ID=502.

[0114] Step S302, generating a current version number list according to a preset built-in vulnerability number data table.

[0115] It should be understood that the current version number list refers to a list composed of various version numbers, and the preset built-in vulnerability coding data table at least includes fields such as the vulnerability number, the module name of the vulnerability, and the corresponding version number.

[0116] Step S303: Match the version number of the target type assembly with the current version number list.

[0117] It can be understood that after obtaining the current version number list, the version number of the target type assembly is matched with each version number in the current version number list in sequence.

[0118] Step S304: Generate a target vulnerability hot patching strategy according to the successfully matched version number.

[0119] Furthermore, step S304 includes: determining the libscentdll function according to the successfully matched version number; obtaining the LibscentDispatcher function according to the libscentdll function; and generating a target vulnerability hot patching strategy by calling the LibscentDispatcher function.

[0120] It should be understood that the target vulnerability hot patching strategy refers to the strategy for hot patching the vulnerability. After the matching is completed, the successfully matched version number is extracted from the matching result, and then the libscentdll function is determined according to the successfully matched version number. The libscentdll function can be libscent.dll. Then, the target vulnerability hot patching strategy is generated according to the hot patching logic of the vulnerability by calling the LibscentDispatcher function. The LibscentDispatcher function can be Libscent.DotNetExtV1.Dispatcher().

[0121] Step S305: hot-patching the vulnerability of the target type assembly according to the target vulnerability hot-patching strategy.

[0122] Further, step S305 includes: obtaining the corresponding current version number according to the version information of the current process; when the current version number is less than or equal to the first version number, obtaining the CorBindToRuntimeEx export function of the mscoree.dll function; obtaining the ICLRRuntimeHost interface by calling the CorBindToRuntimeEx export function; and hot-patching the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRRuntimeHost interface and the target vulnerability hot-patching strategy.

[0123] It can be understood that the current version number refers to the version number of the current process. The first version number can be 3.5. After obtaining the current version number of the current process, determine whether the current version number is less than or equal to the first version number. If so, it indicates that the version of the current process is lower. At this time, get the CorBindToRuntimeEx export function of the mscoree.dll function, and then get the ICLRRuntimeHost interface by calling the CorBindToRuntimeEx export function, and then call the ExecuteInDefaultAppDomain function of the ICLRRuntimeHost interface to hot-patch the vulnerability of the target type assembly according to the target vulnerability hot-patch strategy.

[0124] Furthermore, after obtaining the corresponding current version number according to the version information of the current process, it also includes: when the current version number is greater than or equal to the second version number, obtaining the CLRCreateInstance export function of the mscoree.dll function; obtaining the ICLRMetaHost interface by calling the CLRCreateInstance export function; and hot-patching the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRMetaHost interface and the target vulnerability hot-patching strategy.

[0125] It should be understood that the second version number can be 4.0, and then it is determined whether the current version number is greater than or equal to the first version number. If so, it indicates that the version of the current process is higher. At this time, the CLRCreateInstance export function of the mscoree.dll function is obtained, and then the ICLRMetaHost interface is obtained by calling the CLRCreateInstance export function, and then the ICLR MetaHost::GetRuntime() function corresponding to the ICLRMetaHost interface is called to obtain the ICLRRuntimeInfo interface, and then ICLR RuntimeInfo::GetInterface() is called to obtain the ICLRRuntimeHost interface, and finally the ExecuteInDefaultAppDomain function is called to hot-patch the vulnerability of the target type assembly according to the target vulnerability hot-patch strategy. The ExecuteInDefaultApp Domain function can be ICLRRuntimeHost::ExecuteInDefault AppDomain().

[0126] This embodiment obtains the version number of the target type assembly according to the current loading information; generates a current version number list according to a preset built-in vulnerability number data table; matches the version number of the target type assembly with the current version number list; generates a target vulnerability hot patching strategy according to the successfully matched version number; hot patches the vulnerabilities of the target type assembly according to the target vulnerability hot patching strategy; through the above method, the corresponding version number is obtained according to the current loading information of the target type assembly, and then the version number of the target type assembly is matched with the current version number list, and the successfully matched version number is extracted from the matching result, and then the successfully matched version number is used to generate a target vulnerability hot patching strategy to hot patch the vulnerabilities of the target type assembly, thereby achieving hot patching of the vulnerabilities of the target type assembly and reducing the security risks brought by the vulnerabilities.

[0127] In addition, an embodiment of the present invention further provides a storage medium, on which a vulnerability hot patching program is stored. When the vulnerability hot patching program is executed by a processor, the steps of the vulnerability hot patching method described above are implemented.

[0128] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.

[0129] In addition, refer to Figure 6 The embodiment of the present invention further provides a vulnerability hot patching device, the vulnerability hot patching device comprising:

[0130] The detection module 10 is used to obtain the structural data of the precompiled module when the loading information of the precompiled module corresponding to the target type assembly with a vulnerability is detected.

[0131] The determination module 20 is used to determine the current loading information of the target type assembly according to the structure data.

[0132] The hot patch module 30 is used to hot patch the vulnerability of the target type assembly according to the current loading information.

[0133] When the loading information of the precompiled module corresponding to the target type assembly with a vulnerability is detected, the present embodiment obtains the structural data of the precompiled module; determines the current loading information of the target type assembly based on the structural data; and hot-patches the vulnerability of the target type assembly based on the current loading information. In the above manner, it is first determined whether the loading information of the precompiled module corresponding to the target type assembly with a vulnerability is detected, and if so, the current loading information of the target type assembly is obtained based on the structural data of the precompiled module, and then the vulnerability of the target type assembly is hot-patched using the loading information, thereby achieving hot-patching of the vulnerability of the target type assembly, thereby improving the security of the operating system.

[0134] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0135] In addition, for technical details not fully described in this embodiment, reference can be made to the vulnerability hot patching method provided in any embodiment of the present invention, and will not be repeated here.

[0136] In one embodiment, the detection module 10 is also used to determine whether a dynamic link library is detected; when a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result; and based on the current loading callback result, it is determined whether loading information of a precompiled module corresponding to a target type assembly with a vulnerability is detected.

[0137] In one embodiment, the detection module 10 is further used to register the dynamic link library through the target dll function when the dynamic link library is not detected; and continue to perform the step of performing a load callback according to the dynamic link library to obtain a current load callback result.

[0138] In one embodiment, the determination module 20 is also used to obtain target data of an executable standard structure based on the structural data; prevent the loading of a precompiled module based on the target data of the executable standard structure; after successful prevention, run the target module that automatically loads the original assembly; and during the running process, obtain the current loading information of the target type assembly in real time.

[0139] In one embodiment, the determination module 20 is also used to monitor the loading information of the clrjit module and the loading information of the mscorjit module in real time during operation using the dllHOOK function; determine the current loading path and current version information of the target type assembly based on the loading information of the clrjit module and the loading information of the mscorjit module; and obtain the current loading information of the target type assembly based on the current loading path and the current version information.

[0140] In one embodiment, the determination module 20 is further used to obtain the corresponding clrjitdll function according to the loading information of the clrjit module, and to obtain the corresponding mscorjitdll function according to the loading information of the mscorjit module; to obtain the getJit export function of the clrjitdll function and the mscorjitdll function according to the target object virtual table; to obtain the target CILJit function by calling the getJit export function; and to determine the current loading path and current version information of the target type assembly according to the parsing parameters of the target CILJit function.

[0141] In one embodiment, the hot patch module 30 is also used to obtain the version number of the target type assembly according to the current loading information; generate a current version number list according to a preset built-in vulnerability number data table; match the version number of the target type assembly with the current version number list; generate a target vulnerability hot patch strategy according to the successfully matched version number; and hot patch the vulnerability of the target type assembly according to the target vulnerability hot patch strategy.

[0142] In one embodiment, the hot patch module 30 is further used to determine the libscentdll function according to the successfully matched version number; obtain the LibscentDispatcher function according to the libscentdll function; and generate a target vulnerability hot patch strategy by calling the LibscentDispatcher function.

[0143] In one embodiment, the hot patch module 30 is also used to obtain the corresponding current version number according to the version information of the current process; when the current version number is less than or equal to the first version number, obtain the CorBindToRuntimeEx export function of the mscoree.dll function; obtain the ICLRRuntimeHost interface by calling the CorBindToRuntimeEx export function; and hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRRuntimeHost interface and the target vulnerability hot patch policy.

[0144] In one embodiment, the hot patch module 30 is also used to obtain the CLRCreateInstance export function of the mscoree.dll function when the current version number is greater than or equal to the second version number; obtain the ICLRMetaHost interface by calling the CLRCreateInstance export function; and hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRMetaHost interface and the target vulnerability hot patch policy.

[0145] In one embodiment, the hot patch module 30 is further used to obtain a vulnerability name and a hot patch processing method; generate vulnerability blocking prompt information according to the vulnerability name and the hot patch processing method; and display the vulnerability blocking prompt information in a target form.

[0146] Other embodiments of the vulnerability hot patching device of the present invention or implementation methods thereof may refer to the above-mentioned method embodiments, which will not be repeated here.

[0147] The present invention discloses A1, a vulnerability hot patching method, the vulnerability hot patching method comprising the following steps:

[0148] When the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, the structural data of the precompiled module is obtained;

[0149] Determine the current loading information of the target type assembly according to the structure data;

[0150] Hot patching is performed on the vulnerability of the target type assembly according to the current loading information.

[0151] A2. The vulnerability hot patching method as described in A1, when the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, before obtaining the structural data of the precompiled module, further comprising:

[0152] Determine whether a dynamic link library is detected;

[0153] When a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result;

[0154] It is determined whether loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected according to the current loading callback result.

[0155] A3. The vulnerability hot patching method as described in A2, after determining whether a dynamic link library is detected, further comprising:

[0156] When the dynamic link library is not detected, registering the dynamic link library through the target dll function;

[0157] Continue to execute the step of performing a loading callback according to the dynamic link library to obtain a current loading callback result.

[0158] A4. The vulnerability hot patching method as described in A1, wherein determining the current loading information of the target type assembly according to the structure data comprises:

[0159] Obtaining target data of an executable standard structure according to the structure data;

[0160] preventing loading of precompiled modules according to target data of the executable standard structure;

[0161] After the blocking is successful, the target module of the original assembly is automatically loaded;

[0162] During the running process, the current loading information of the target type assembly is obtained in real time.

[0163] A5. The vulnerability hot patching method as described in A4, wherein during the running process, the current loading information of the target type assembly is obtained in real time, including:

[0164] During the running process, the dllHOOK function is used to monitor the loading information of the clrjit module and the mscorjit module in real time;

[0165] Determine the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module;

[0166] The current loading information of the target type assembly is obtained according to the current loading path and the current version information.

[0167] A6. The vulnerability hot patching method as described in A5, wherein the current loading path and current version information of the target type assembly are determined according to the loading information of the clrjit module and the loading information of the mscorjit module, including:

[0168] Acquire the corresponding clrjitdll function according to the loading information of the clrjit module, and acquire the corresponding mscorjitdll function according to the loading information of the mscorjit module;

[0169] Obtain the getJit export function of the clrjitdll function and the mscorjitdll function according to the target object virtual table;

[0170] Get the target CILJit function by calling the getJit export function;

[0171] The current loading path and current version information of the target type assembly are determined according to the parsing parameters of the target CILJit function.

[0172] A7. The vulnerability hot patching method as described in A1, wherein hot patching the vulnerability of the target type assembly according to the current loading information comprises:

[0173] Obtaining a version number of the target type assembly according to the current loading information;

[0174] Generate the current version number list based on the preset built-in vulnerability number data table;

[0175] Match the version number of the target type assembly with the current version number list;

[0176] Generate a hot patch strategy for the target vulnerability based on the successfully matched version number;

[0177] Hot patching is performed on the vulnerabilities of the target type assembly according to the target vulnerability hot patching strategy.

[0178] A8. The vulnerability hot patching method as described in A7, wherein generating a target vulnerability hot patching strategy according to the successfully matched version number comprises:

[0179] Determine the libscentdll function based on the successfully matched version number;

[0180] Obtain the LibscentDispatcher function according to the libscentdll function;

[0181] The target vulnerability hot patching strategy is generated by calling the LibscentDispatcher function.

[0182] A9. The vulnerability hot patching method as described in A7, wherein hot patching the vulnerability of the target type assembly according to the target vulnerability hot patching strategy comprises:

[0183] Get the corresponding current version number according to the version information of the current process;

[0184] When the current version number is less than or equal to the first version number, obtaining the CorBindToRuntimeEx export function of the mscoree.dll function;

[0185] Get the ICLRRuntimeHost interface by calling the CorBindToRuntimeEx export function;

[0186] Hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRRuntimeHost interface and the target vulnerability hot patch strategy.

[0187] A10. The vulnerability hot patching method as described in A9, after obtaining the corresponding current version number according to the version information of the current process, further comprising:

[0188] When the current version number is greater than or equal to the second version number, obtaining the CLRCreateInstance export function of the mscoree.dll function;

[0189] Obtain the ICLRMetaHost interface by calling the CLRCreateInstance export function;

[0190] Hot patch the vulnerability of the target type assembly according to the ExecuteInDefaultAppDomain function of the ICLRMetaHost interface and the target vulnerability hot patch strategy.

[0191] A11. The vulnerability hot patching method as described in any one of A1 to A10, after hot patching the vulnerability of the target type assembly according to the current loading information, further comprising:

[0192] Get the vulnerability name and hotfix method;

[0193] Generate vulnerability blocking prompt information according to the vulnerability name and hot patch processing method;

[0194] The vulnerability prevention prompt information is displayed in a target form.

[0195] The present invention also discloses B12, a vulnerability hot patching device, the vulnerability hot patching device comprising:

[0196] A detection module, configured to obtain structural data of a precompiled module when loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected;

[0197] A determination module, used to determine the current loading information of the target type assembly according to the structure data;

[0198] A hot patch module is used to hot patch the vulnerability of the target type assembly according to the current loading information.

[0199] B13. In the vulnerability hot patching device as described in B12, the detection module is also used to determine whether a dynamic link library is detected; when a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result; and based on the current loading callback result, it is determined whether loading information of a precompiled module corresponding to a target type assembly with a vulnerability is detected.

[0200] B14. In the vulnerability hot patching device as described in B13, the detection module is further used to register the dynamic link library through the target dll function when the dynamic link library is not detected; and continue to execute the step of performing a load callback according to the dynamic link library to obtain the current load callback result.

[0201] B15. In the vulnerability hot patching device as described in B12, the determination module is further used to obtain the target data of the PE structure according to the structure data; to block the loading of the precompiled module according to the target data of the PE structure; after the blocking is successful, run the target module of the original assembly to automatically load; and during the running process, obtain the current loading information of the target type assembly in real time.

[0202] B16. In the vulnerability hot patching device as described in B15, the determination module is also used to monitor the loading information of the clrjit module and the loading information of the mscorjit module in real time during operation by using the dllHOOK function; determine the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module; and obtain the current loading information of the target type assembly according to the current loading path and the current version information.

[0203] B17. In the vulnerability hot-patching device as described in B12, the hot-patching module is further used to obtain the version number of the target type assembly according to the current loading information; generate a current version number list according to a preset built-in vulnerability number data table; match the version number of the target type assembly with the current version number list; generate a target vulnerability hot-patching strategy according to the successfully matched version number; and hot-patch the vulnerability of the target type assembly according to the target vulnerability hot-patching strategy.

[0204] B18. The vulnerability hot patching device as described in B17, wherein the hot patching module is further used to determine the libscentdll function according to the successfully matched version number; obtain the LibscentDispatcher function according to the libscentdll function; and generate a target vulnerability hot patching strategy by calling the LibscentDispatcher function.

[0205] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0206] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0207] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, an integrated platform workstation, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0208] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A vulnerability hot patching method, characterized in that: The vulnerability hot patching method comprises the following steps: When the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, the structural data of the precompiled module is obtained; Determine the current loading information of the target type assembly according to the structure data; Hot patching is performed on the vulnerability of the target type assembly according to the current loading information.

2. The vulnerability hot patching method according to claim 1, characterized in that: When the loading information of the precompiled module corresponding to the target type assembly with the vulnerability is detected, before obtaining the structural data of the precompiled module, the method further includes: Determine whether a dynamic link library is detected; When a dynamic link library is detected, a loading callback is performed according to the dynamic link library to obtain a current loading callback result; It is determined whether loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected according to the current loading callback result.

3. The vulnerability hot patching method according to claim 2, characterized in that: After determining whether a dynamic link library is detected, the method further includes: When the dynamic link library is not detected, registering the dynamic link library through the target dll function; Continue to execute the step of performing a loading callback according to the dynamic link library to obtain a current loading callback result.

4. The vulnerability hot patching method according to claim 1, characterized in that: The step of determining the current loading information of the target type assembly according to the structural data includes: Obtaining target data of an executable standard structure according to the structure data; preventing loading of precompiled modules according to target data of the executable standard structure; After the blocking is successful, the target module of the original assembly is automatically loaded; During the running process, the current loading information of the target type assembly is obtained in real time.

5. The vulnerability hot patching method according to claim 4, characterized in that: During the running process, the current loading information of the target type assembly is obtained in real time, including: During the running process, the dllHOOK function is used to monitor the loading information of the clrjit module and the mscorjit module in real time; Determine the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module; The current loading information of the target type assembly is obtained according to the current loading path and the current version information.

6. The vulnerability hot patching method according to claim 5, characterized in that: The determining the current loading path and current version information of the target type assembly according to the loading information of the clrjit module and the loading information of the mscorjit module includes: Acquire the corresponding clrjitdll function according to the loading information of the clrjit module, and acquire the corresponding mscorjitdll function according to the loading information of the mscorjit module; Obtain the getJit export function of the clrjitdll function and the mscorjitdll function according to the target object virtual table; Get the target CILJit function by calling the getJit export function; The current loading path and current version information of the target type assembly are determined according to the parsing parameters of the target CILJit function.

7. The vulnerability hot patching method according to claim 1, characterized in that: The hot patching of the vulnerability of the target type assembly according to the current loading information includes: Obtaining a version number of the target type assembly according to the current loading information; Generate the current version number list based on the preset built-in vulnerability number data table; Match the version number of the target type assembly with the current version number list; Generate a hot patch strategy for the target vulnerability based on the successfully matched version number; Hot patching is performed on the vulnerabilities of the target type assembly according to the target vulnerability hot patching strategy.

8. A vulnerability hot patching device, characterized in that: The vulnerability hot patching device comprises: A detection module, configured to obtain structural data of a precompiled module when loading information of a precompiled module corresponding to a target type assembly having a vulnerability is detected; A determination module, used to determine the current loading information of the target type assembly according to the structure data; A hot patch module is used to hot patch the vulnerability of the target type assembly according to the current loading information.

9. A vulnerability hot patching device, characterized in that: The vulnerability hot patching device comprises: a memory, a processor, and a vulnerability hot patching program stored in the memory and executable on the processor, wherein the vulnerability hot patching program is configured to implement the vulnerability hot patching method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a vulnerability hot patch program, and when the vulnerability hot patch program is executed by the processor, the vulnerability hot patch method according to any one of claims 1 to 7 is implemented.

Images