TCG-based multi-instruction-set dynamic information flow tracking method

Abstract

The invention discloses a TCG-based multi-instruction-set dynamic information flow tracking method, and belongs to the field of system security. The method comprises the following steps of: simulating and running a client on a host machine by using full-system virtualization software QEMU; creating a shadow memory, a shadow environment variable and a shadow stack for storing the data label for the client; a TCG dynamic binary translator is used for converting program instructions of different instruction sets into TCG micro-operations and constraining the TCG micro-operations; and translating the constrained TCG microoperation into a host machine instruction with a tracking function by using a TCG dynamic binary translator, and realizing dynamic information flow tracking of multiple instruction sets by running the host machine instruction. According to the method, the multi-instruction-set supportability of a dynamic information flow tracking technology is improved, and the dynamic information flow tracking requirements of emerging equipment programs adopting diversified instruction sets can be met.

Description

Technical Field

[0001] The invention belongs to the field of system security, and in particular relates to a multi-instruction set dynamic information flow tracking method based on TCG (Tiny Code Generator). Background Art

[0002] Dynamic information flow tracking technology, also known as dynamic taint tracking technology, is based on the principle of marking data in CPU registers or memory, and then tracking the location where the marked data reaches as the program runs, thereby detecting security issues such as data leakage and software vulnerabilities. At the same time, this technology can also enhance the fuzz testing function and bring improvements in efficiency or coverage.

[0003] At present, dynamic information flow tracking technology is widely used in the security analysis of binary files. However, this technology still has some challenges. One of the key challenges is that traditional dynamic information flow tracking technology is difficult to meet the needs of program analysis in emerging devices, such as IoT devices and mobile terminal devices. The reason is that traditional dynamic information flow tracking tools are mostly used for analysis of common instruction sets of PCs and servers such as x86 and arm, while emerging device programs often use diversified instruction sets, such as avr, mips, riscv and other instruction sets. Due to the limitation of instruction set support, traditional tools are difficult to meet the analysis needs of such programs. Patent CN117556388A proposes a dynamic taint analysis method for firmware full system simulation, which specifically divides the categories of TCG instructions into four categories of instructions, designs taint propagation rules for these four categories of instructions, and inserts dynamic taint into TCG instructions by detecting TCG instructions with taint propagation rules. This method focuses on taint tracking in the firmware environment, especially physical memory management, real-time detection and taint data recording, and does not involve diversified instruction sets. It can be seen that how to achieve dynamic information flow tracking of multiple instruction sets is an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to propose a dynamic information flow tracing method based on TCG dynamic binary translator, to improve the multi-instruction set support of dynamic information flow tracing technology, so as to meet the dynamic information flow tracing needs of emerging device programs using diversified instruction sets.

[0005] The present invention adopts the following technical solutions to achieve the above-mentioned purpose:

[0006] A multi-instruction set dynamic information flow tracking method based on TCG, comprising the following steps:

[0007] Use QEMU, a full-system virtualization software, to simulate and run the client on the host, which includes the client memory, client environment variables, and QEMU's own stack;

[0008] Creating a shadow memory, a shadow environment variable, and a shadow stack for storing data tags for the client;

[0009] Use TCG dynamic binary translator to convert program instructions of different instruction sets into unified intermediate representation TCG micro-operations, and constrain TCG micro-operations;

[0010] The TCG dynamic binary translator is used to translate the instructions, and the constrained TCG micro-operations are translated into host machine instructions with tracing function. The dynamic information flow tracing of multiple instruction sets is realized by running the host machine instructions.

[0011] Furthermore, data in client memory is mapped one-to-one with labels in shadow memory, data in client environment variables is mapped one-to-one with labels in the shadow environment, and data in QEMU's own stack is mapped one-to-one with labels in the shadow stack. The label is a data structure used to mark the location of tracked data.

[0012] Furthermore, the implementation of shadow memory in QEMU is as follows: a structure with the same size as the client's actual memory is provided in the client memory data structure, which is created when the client's actual memory is created; the implementation of shadow environment variables in QEMU is as follows: a pointer to a memory area of ​​the same size as the variable is provided in the client environment variable, and the shadow environment variable is subsequently accessed through the pointer; the shadow stack is implemented in QEMU as follows: a pointer to an area with the same size as QEMU's own stack is provided in the client environment variable, and the shadow stack is subsequently accessed through the pointer.

[0013] Furthermore, the constraints of TCG micro-operations include:

[0014] The input and output of TCG micro-operations are all registers;

[0015] Disabling the TCG dynamic binary translator from translating guest instructions into vector-related TCG micro-ops; and

[0016] Constrain the available registers for TCG micro-operations.

[0017] Furthermore, the available registers for constraining TCG micro-operations include:

[0018] Not using at least three general purpose registers reserved for maintaining trace operations;

[0019] Do not use a function general register reserved for holding a pointer to a shadow environment variable;

[0020] Not using a function general register reserved for maintaining a shadow stack pointer; and

[0021] Vector registers are not used.

[0022] Furthermore, translating the constrained TCG micro-operations into host machine instructions with tracing functions includes: translating the TCG micro-operations into functional instructions and tracing instructions, wherein the functional instructions are mainly composed of integer instructions, which are responsible for maintaining the operation of the client operating system; the tracing instructions are composed of vector instructions, which are responsible for dynamic information flow tracking of the client program.

[0023] Furthermore, context switching is performed when the TCG dynamic binary translator is used for instruction translation. The context switching refers to the state switching between the running state of QEMU itself and the running state of the client operating system when the QEMU code itself is executed and the translated code is executed, and the data in the vector register is saved and restored during the state switching.

[0024] Furthermore, the state switching between the QEMU operating state and the translated client operating system operating state is performed through the QEMU stack.

[0025] Furthermore, when using the TCG dynamic binary translator to translate instructions, TCG variables are read and written back: when the TCG dynamic binary translator is running, TCG variable form data is read and written back between the client memory and the general registers, and at the same time, the shadow registers used by the tracking instructions perform synchronous read and write back operations on the tracking instructions.

[0026] Furthermore, there is a one-to-one correspondence between the shadow registers and the general registers.

[0027] Compared with the prior art, the positive effects of the present invention are embodied in the following aspects:

[0028] 1) The present invention targets a multi-instruction set architecture and uses QEMU's TCG to track taints of different instruction sets. The TCG dynamic binary translator can be used to uniformly promote the analyzed program instruction set to an intermediate representation, namely, TCG micro-operation, to eliminate the differences related to the analyzed program instruction set. Subsequently, the intermediate representation is constrained to an instruction format that is easy to track, which helps to effectively track tainted data in a multi-instruction environment. Due to the existence of this constraint, vector registers can be used in the process of dynamic information flow tracking, which has higher efficiency.

[0029] 2) Reduce the translation level and directly translate the improved intermediate representation into host instructions with dynamic information flow tracking function to implement dynamic information flow tracking function that supports multiple instruction sets while maintaining good compatibility and performance.

[0030] 3) The present invention sets shadow memory, shadow register and shadow stack to track tainted data during execution, and because it targets multiple instruction sets, it is applicable to devices with different architectures and has a significantly wider scope of application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a diagram of the elements required for the client to run and their shadow data structure.

[0032] Figure 2 This is a schematic diagram of TCG micro-operation constraint rules.

[0033] Figure 3 It is a diagram of the instruction translation process.

[0034] Figure 4 It is a schematic diagram of the transition between the client's running state and QEMU's own running state. DETAILED DESCRIPTION

[0035] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0036] The embodiment of the present invention specifically discloses a multi-instruction set dynamic information flow tracking method based on TCG, and the processing means of the method are specifically described below.

[0037] 1. Set up shadow memory, shadow environment variables, and shadow stack

[0038] This method uses the full system simulation capability of the full system virtualization software QEMU to simulate the client on the host machine (the physical machine where the client is located). The client includes client memory, client environment variables and QEMU's own stack, and provides the operating environment of client operating systems with different instruction sets based on the TCG dynamic binary translator. On this basis, in order to achieve data tracking, three key components, shadow memory, shadow registers and shadow stack, need to be provided. Figure 1 As shown in the figure, when QEMU simulates running a client, it involves the three elements (a), (b) and (c) in the figure. This method sets up three shadow data structures (d), (e) and (f) for these three elements respectively. The definition, function and implementation of these three components are introduced in turn below.

[0039] 1) Shadow Memory

[0040] Shadow memory is the storage area for data labels corresponding to the QEMU client memory. The data in the memory and the labels in the shadow memory are mapped one to one, so it is called shadow memory. A label refers to a data structure attached to the tracked data and used to mark and track the location of the data. Shadow memory has a single function and only provides a client memory data label storage area for the tracking process to meet data storage requirements. Its implementation in QEMU is to provide a structure with the same size as the client's actual memory in the client memory data structure "RAMBlock", which is created when the client's actual memory is created.

[0041] 2) Shadow environment variables

[0042] Shadow environment variables are the data label storage areas in the CPU and coprocessors of the QEMU client. In QEMU, data of the CPU, coprocessors, etc. are stored in the "CPUArchState" structure, and its common variable name is env, so this structure is called an environment variable. The data in the environment variable and the label in the shadow environment variable are mapped one to one, so it is called a shadow environment variable. Shadow environment variables only provide a storage area for data labels in the environment variable for the tracking process to meet the tracking data storage requirements. Its implementation in QEMU is to provide a pointer to a memory area of ​​the same size as "CPUArchState" in the client environment variable "CPUArchState", and then access the shadow environment variable through this pointer.

[0043] 3) Shadow stack

[0044] The shadow stack is the storage area for labels in the QEMU program's own stack. The main function of the QEMU stack during client operation is to save and read variables when the generated code switches context with the QEMU code itself. The data in the stack and the labels in the shadow stack are mapped one to one, so it is called a shadow stack. The shadow stack only provides a storage area for stack data when the context switches during the operation of the QEMU client to meet the needs of tracking data storage. It is implemented in QEMU by providing a pointer to an area of ​​the same size as the QEMU stack itself in "CPUArchState", and the shadow stack is subsequently accessed through this pointer.

[0045] 2. Convert the analyzed program instructions into TCG micro-operations and constrain them to the specified format

[0046] This method uses the TCG dynamic binary translator in the full system virtualization software QEMU to uniformly convert the analyzed program instructions of different instruction sets into intermediate representations that are independent of the instruction set, so as to achieve multi-instruction set support for the analyzed program, and then constrains the intermediate representation to an instruction format that is easy to track, so as to facilitate subsequent host machine instruction translation. The intermediate representation here refers to a RISC-like instruction set by the TCG dynamic binary translator to eliminate the differences in the translated instructions. The present invention refers to the intermediate representation as TCG micro-operation.

[0047] During the TCG operation, the TCG front end translates instruction programs of different instruction sets into TCG micro-operations to realize multi-instruction set support for the client, and the TCG back end subsequently translates TCG micro-operations into instructions of different instruction sets to realize multi-instruction set support for the host. This method involves the process of translating TCG micro-operations into host machine instructions, and facilitates the generation of tracking instructions by constraining TCG micro-operations to a format that is easy to track instruction generation. Specifically, the TCG micro-operation constraints are as follows:

[0048] 1) All TCG micro-operations have input and output registers for easy tracking

[0049] For example, the TCG micro-operation sub_i32 can be constrained to "one output register, two input registers, one of which is an output register" to facilitate the i386 instruction set tracking instruction generation. The instruction can then be translated into an i386 instruction like "SUB EAX,EBX", and then data tracking can be achieved by tracking data transfer in registers.

[0050] 2) Disable the TCG translator from translating client instructions into vector-related TCG micro-operations

[0051] This method will subsequently use vector instructions to generate trace instructions. If there are vector operations in the constrained TCG micro-operations, it will affect the trace. Therefore, the TCG translator is prohibited from translating the client instructions into vector-related TCG micro-operations.

[0052] 3) Constrain the available registers of TCG micro-operations to facilitate tracking instruction generation

[0053] To facilitate subsequent host machine instruction generation, it is necessary to limit the available registers for TCG micro-operations. At least 3 general registers need to be reserved to maintain the normal operation of the tracing operation, 1 function general register needs to be reserved to maintain the pointer to the shadow environment variable, and another function general register needs to be reserved to maintain the shadow stack pointer. All TCG micro-operations do not use vector registers.

[0054] like Figure 2 As shown in FIG. 1 , the constraints of this method on TCG micro-operations are mainly as follows: (a) It is forbidden to translate client instructions into vector-related TCG micro-operations. (b) The input and output of TCG micro-operations are both registers. (c) Vector registers are not used. (d) The reserved general registers described in 3) are not used.

[0055] 3. Translate the constrained TCG micro-operations into host machine instructions with tracing capabilities

[0056] In order to realize the dynamic information flow tracking function supporting multiple instruction sets, this method translates TCG micro-operations that are independent of the instruction set into host machine instructions with tracking functions. During the translation process, TCG micro-operations will be translated into two instructions that do not affect each other. One is a functional instruction, which is mainly composed of integer instructions and is responsible for maintaining the operation of the client operating system; the other is a tracking instruction, which is composed of vector instructions and is responsible for dynamic information flow tracking of the client program. This method calls the registers used in the tracking instructions shadow registers, and the shadow registers have a one-to-one correspondence with the general registers. During the translation process, three parts need to be considered, namely instruction translation, context switching, and reading and writing back of TCG variables.

[0057] 1) Command Translation

[0058] Instruction translation is divided into two parts: functional instruction translation and tracing instruction translation. Functional instruction translation is to translate TCG operations into equivalent instructions, while tracing instruction translation requires designing tracing instructions based on the functions of different TCG micro-operations.

[0059] like Figure 3 As shown, TCG micro-operations are translated into (a) host machine instructions with tracing functions, which are composed of (b) functional instructions and (c) tracing instructions, where the functional instructions are responsible for the operation of the client operating system and the tracing instructions are responsible for data tracing.

[0060] 2) Context Switching

[0061] During the operation of the TCG dynamic binary translator, context switching is required. Context switching refers to the state transition between the QEMU code running state and the translated code running state during code execution. Since vector registers are temporary registers during context switching, the values ​​in the vector registers will change when executing other functions, so it is necessary to save and read the data in the vector registers during context switching.

[0062] like Figure 4 As shown in the figure, when QEMU's own code is running, it is the QEMU running state, and when the translated code is running, it is the client operating system running state. According to the process shown by the arrow, the state switching between the two is mainly realized by QEMU's own stack. When the state is switched, the relevant shadow data, such as the content of the vector register, is saved in the shadow stack, as shown in (a), (b), (c), and (d).

[0063] 3) TCG variable reading and writing back

[0064] During the operation of the TCG dynamic binary translator, it is necessary to load data from the client memory into the general register, or write data from the general register to the client memory. During this process, the data in the memory will exist in the form of TCG variables. During the data reading and writing process, the shadow register should also implement the same reading and writing operations.

[0065] By realizing the generation of the above three parts of instructions, a complete dynamic information flow tracking function can be implemented in the translated instructions.

[0066] 4. Run host machine instructions

[0067] After the above steps 2 and 3, the client instructions of different instruction sets can be uniformly translated into host instructions with tracing function. The translated host instructions have the same functions as the original instructions and also have tracing function. The tracing function can be realized by running the host instructions. So far, this method has realized the dynamic information flow tracing function supporting multiple instruction sets.

[0068] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A multi-instruction set dynamic information flow tracking method based on TCG, characterized in that: The following steps are involved: Use QEMU, a full-system virtualization software, to simulate and run the client on the host, which includes the client memory, client environment variables, and QEMU's own stack; Creating a shadow memory, a shadow environment variable, and a shadow stack for storing data tags for the client; Use TCG dynamic binary translator to convert program instructions of different instruction sets into unified intermediate representation TCG micro-operations, and constrain TCG micro-operations; The TCG dynamic binary translator is used to translate the instructions, and the constrained TCG micro-operations are translated into host machine instructions with tracing function. The dynamic information flow tracing of multiple instruction sets is realized by running the host machine instructions.

2. The method according to claim 1, characterized in that The data in the client memory is mapped one-to-one with the labels in the shadow memory, the data in the client environment variables is mapped one-to-one with the labels in the shadow environment, and the data in the QEMU stack itself is mapped one-to-one with the labels in the shadow stack. The label is a data structure used to mark the location of the tracked data.

3. The method according to claim 1, characterized in that The implementation of shadow memory in QEMU is as follows: a structure with the same size as the client's actual memory is provided in the client memory data structure, which is created when the client's actual memory is created; The implementation of shadow environment variables in QEMU is as follows: a pointer to a memory area of ​​the same size as the variable is provided in the client environment variable, and the shadow environment variable is subsequently accessed through the pointer; the shadow stack is implemented in QEMU as follows: a pointer to an area of ​​the same size as QEMU's own stack is provided in the client environment variable, and the shadow stack is subsequently accessed through the pointer.

4. The method according to claim 1, characterized in that The constraints of TCG micro-operations include: The input and output of TCG micro-operations are all registers; Disabling the TCG dynamic binary translator from translating guest instructions into vector-related TCG micro-ops; and Constrain the available registers for TCG micro-operations.

5. The method according to claim 4, characterized in that The available registers for constraining TCG micro-operations include: Not using at least three general purpose registers reserved for maintaining trace operations; Do not use a function general register reserved for holding a pointer to a shadow environment variable; Not using a function general register reserved for maintaining a shadow stack pointer; and Vector registers are not used.

6. The method according to claim 1, characterized in that Translating the constrained TCG micro-operations into host machine instructions with tracing functions includes: translating the TCG micro-operations into functional instructions and tracing instructions, wherein the functional instructions are mainly composed of integer instructions, responsible for maintaining the operation of the client operating system; the tracing instructions are composed of vector instructions, responsible for dynamic information flow tracking of the client program.

7. The method according to claim 1, characterized in that Context switching is performed when using the TCG dynamic binary translator for instruction translation. The context switching refers to the state switching between the QEMU operating state and the client operating system operating state when the QEMU code itself is executed and the translated code is executed. The data in the vector register is saved and restored during the state switching.

8. The method according to claim 7, characterized in that The state switching between QEMU's own running state and the translated client operating system running state is performed through QEMU's own stack.

9. The method according to claim 1, characterized in that When using the TCG dynamic binary translator to translate instructions, TCG variables are read and written back: When the TCG dynamic binary translator is running, TCG variable form data is read and written back between the client memory and the general registers, and the shadow registers used by the tracking instructions are synchronized with the reading and writing operations on the tracking instructions.

10. The method according to claim 9, characterized in that There is a one-to-one correspondence between shadow registers and general registers.

Images