Control flow integrity protection method and related device

Abstract

The invention discloses a control flow integrity protection method and a related device, and the method can judge whether a function starts to be executed from a starting position of the function or not before an indirect jump instruction of the function is executed, if yes, it is indicated that the possibility of JOP attack in the execution process of the function is small, the function can continue to be executed, and if not, it is indicated that JOP attack exists in the execution process of the function. If yes, JOP attacks possibly exist in the execution process of the function, and execution of the function can be stopped. Therefore, the method can monitor whether the control flow of the function in the execution process is abnormal or not, and further reflects whether the JOP attack occurs or not in the execution process of the function. Moreover, the method does not need to analyze the global call relationship of the function, shortens the compiling time, does not need to generate a CFI check table, reduces the occupation of the memory space, omits the step of table look-up verification, can judge whether the current program control flow is tampered or not only by judging one mark, and improves the verification speed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a control flow integrity protection method and related devices. Background Art

[0002] Control flow refers to the order in which statements in a program are executed by the system from the main function to the back or from top to bottom in the execution phase. Program control flow hijacking is a common code attack method, and its attack types include return oriented programming (ROP) attack and jump oriented programming (JOP) attack. Among them, JOP attack uses the executable code segment gadgets of assembly jump instructions such as jmp / call / bl contained in the code to tamper with function pointers or memory or directly modify registers through stack overflow, out-of-bounds write, etc., so that the code is out of the original program flow during execution, thereby jumping to the attacker's own code, or using these gadgets to directly piece together the attack logic, such as obtaining root permissions, opening a shell, etc. Summary of the invention

[0003] The present application provides a control flow integrity protection method and related devices, which realizes monitoring of abnormal control flows during the execution of functions.

[0004] In a first aspect, the present application provides a control flow integrity protection method, the method comprising: before the electronic device executes a first indirect jump instruction in a first function, determining whether the first function is executed from the starting position of the first function; if so, the electronic device executes the first indirect jump instruction; if not, the electronic device terminates execution of the first function.

[0005] By implementing the method provided in the first aspect, the jump nodes in the function can be controlled during the function execution process, and the program can be interrupted in time when the attacker escapes from the original control flow of the program through an indirect jump instruction, ensuring that the function is executed from the starting position, and preventing the attacker from executing from the middle of the function through a JOP attack, and using gadgets in multiple functions to piece together the attack logic. In addition, this method does not need to analyze the global call relationship of the function, shortens the compilation time, does not need to generate a CFI check table, and reduces the memory space occupied. In addition, this method omits the step of table lookup verification, and can determine whether the current program control flow has been tampered with by only judging a mark, which improves the verification speed of the control flow integrity.

[0006] In combination with the first aspect, in one implementation, the electronic device determines whether the execution of the first function starts from the starting position of the first function, specifically including: the electronic device determines whether a position mark is generated when the execution of the first function starts; if so, it is determined that the first function is executed from the starting position of the first function; if not, it is determined that the first function is not executed from the starting position of the first function.

[0007] That is, if the electronic device detects that no position mark is generated during the execution of the first function before executing the indirect jump instruction, it means that the first function is not executed from the starting position. In this way, the electronic device can quickly detect that the first function has an execution abnormality.

[0008] In combination with the first aspect, in one implementation, the electronic device determines whether the execution of a first function starts from the starting position of the first function, specifically including: the electronic device generates a second position mark, and determines whether the second position mark is the same as the first position mark generated by the electronic device when the first function starts to execute; if they are the same, it is determined that the first function is executed from the starting position of the first function; if they are not the same, it is determined that the first function is not executed from the starting position of the first function.

[0009] That is to say, before executing an indirect jump instruction, in addition to detecting that a position mark is generated by the electronic device during the execution of the first function, the electronic device also needs to determine that the position mark is a position mark generated in a prescribed manner, thereby preventing attackers from forging position marks and improving the accuracy of control flow integrity detection.

[0010] In combination with the first aspect, in one implementation, if the first function is executed from the starting position of the first function, then before the electronic device executes the first indirect jump instruction in the first function, it determines whether the first function is executed from the starting position of the first function. The method also includes: the electronic device generates a first position mark; the first position mark is used to indicate that the first function is executed from the starting position of the first function; the electronic device executes the first function from the starting position of the first function.

[0011] It can be seen that if the electronic device executes the first function from the starting position of the first function, the electronic device will generate a first position mark when it starts to execute the first function, which is used to record that the electronic device starts to execute the first function from the starting position of the first function, so that the electronic device can check whether the control flow of the function is abnormal before jumping through an indirect jump instruction.

[0012] In combination with the first aspect, in one implementation, the first position mark is stored on a stack of the first function.

[0013] In combination with the first aspect, in one implementation, the first position marker is a random number or a first address in a first register.

[0014] The first position mark being a random number can enable the electronic device to generate a different position mark the next time it executes the first function or generates a position mark when executing other functions, thereby preventing attackers from forging position marks and improving the accuracy of control flow verification. The first position mark being an address in a specified register can enable the electronic device to generate a specified identical position mark before executing the first function from the starting position and executing an indirect jump instruction, so as to verify whether the function control flow is abnormal.

[0015] In combination with the first aspect, in one implementation, the starting position of the first function includes a first instruction fragment, the first instruction fragment is used to generate a first position mark, the first indirect jump instruction includes a second instruction fragment, the last instruction of the second instruction fragment is the previous instruction of the first indirect jump instruction, and the second instruction fragment is used to determine whether the first function is executed from the starting position of the first function.

[0016] The first instruction fragment and the second instruction fragment may be instruction fragments inserted into the first function during the compiling phase.

[0017] In combination with the first aspect, in one implementation, the method also includes: the electronic device jumps to the second function by executing a first indirect jump instruction; before executing the second function, the electronic device determines whether the first indirect jump instruction is an inter-function jump instruction; if so, the electronic device executes the second function; if not, the electronic device terminates executing the second function.

[0018] That is to say, before an electronic device executes a jump between functions, it can verify whether the electronic device implements the function jump through a specified indirect jump instruction, promptly detect abnormal jumps in the function, and prevent JOP attacks from jumping between functions by modifying function pointers of different indirect jump instructions.

[0019] In combination with the first aspect, in one implementation, before the electronic device executes the first indirect jump instruction, the method also includes: the electronic device generates a first jump tag, the first jump tag is used to indicate whether the first indirect jump instruction belongs to an inter-function jump instruction; the electronic device determines whether the first indirect jump instruction belongs to an inter-function jump instruction, specifically including: the electronic device determines whether the first indirect jump instruction belongs to an inter-function jump instruction based on the first jump tag.

[0020] Before executing the indirect jump instruction, a jump tag for indicating the indirect jump instruction can be generated, and the jump tag can be used to quickly and accurately check whether there is an abnormal jump when the function jumps.

[0021] In combination with the first aspect, in one implementation, the starting position of the second function includes a first instruction fragment, the first instruction fragment is used to determine whether the indirect jump instruction used to jump to the second function is an inter-function jump instruction, the first indirect jump instruction includes a second instruction fragment before it, the last instruction of the second instruction fragment is the previous instruction of the first indirect jump instruction, and the second instruction fragment is used to generate a first jump marker.

[0022] The first instruction fragment and the second instruction fragment may be instruction fragments inserted into the first function during the compiling phase.

[0023] In a second aspect, an embodiment of the present application provides an electronic device, comprising a memory, one or more processors, and one or more programs; when the one or more processors execute the one or more programs, the electronic device implements the method described in the first aspect or any one of the implementation methods in the first aspect.

[0024] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on an electronic device, causes the electronic device to execute a method as described in the first aspect or any one of the implementations of the first aspect.

[0025] In a fourth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the method described in the first aspect or any one of the implementations of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram comparing a normal program control flow and an erroneous program control flow provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of the principle of the control flow integrity protection method provided in an embodiment of the present application;

[0028] Figure 3 A flow chart of a control flow integrity protection method provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of a program provided in an embodiment of the present application in which a marking module and a verification module are added;

[0030] Figure 5 A flowchart of another control flow integrity protection method provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of another program provided in an embodiment of the present application in which a marking module and a verification module are added;

[0032] Figure 7 A schematic diagram of the hardware structure of an electronic device 100 provided in an embodiment of the present application;

[0033] Figure 8 A software structure block diagram of the electronic device 100 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0035] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0036] To counter JOP attacks, the industry has proposed control-flow integrity (CFI) protection technology, which limits control transfer during program execution so that it is always within the scope defined by the original program control flow.

[0037] Among them, a specific response method in CFI technology is to perform the following operations on the function during the compilation phase:

[0038] 1) Identify function pointers and generate function type check table

[0039] During the program compilation phase, the compiler will identify the function prototypes pointed to by all function pointers in the code, and summarize all identified function prototypes into a CFI checklist and save it in the generated binary file.

[0040] 2) Code stub and pointer verification

[0041] During program execution, a verification code can be inserted before a function jump to determine whether the function prototype pointed to by the function pointer used in the function jump is consistent with the one in the CFI check table. If they are consistent, CFI is passed, indicating that the current direction of the function control flow is correct; if they are inconsistent, a CFI exception is triggered and the program is terminated.

[0042] Although this method can verify the control flow integrity of the program during runtime, it still has major flaws:

[0043] 1) High cost

[0044] Because the compiler needs to analyze the global calling relationship of the function during the compilation phase when using CFI technology to determine the CFI check table, the compilation time is long; and the code stubs, CFI check table, and table check verification code generated by the editor will result in a large memory usage overhead.

[0045] 2) Adaptation is difficult

[0046] Since the compiler's CFI technology requires the C language basic function library (C library for short) to provide corresponding support before it can be used, in many lightweight embedded devices, the selected C library mostly does not provide support for CFI technology. Therefore, if lightweight embedded devices want to use CFI technology, they also need to supplement and adapt the C library, which is quite difficult. It can also be seen that the application scenarios of this method are limited.

[0047] Because a jump instruction cannot normally jump from the middle of a function to the middle of another function, for example, the jmp instruction is used for local address jump, and the call instruction is used for function jump, neither of which can jump from the middle of a function to the middle of another function. Therefore, all standardized and reasonable jump instructions must execute the starting instruction of the function where the jump instruction is located before executing the jump, that is, the control flow is executed sequentially from the starting instruction of the function where the jump instruction is located to the current jump instruction.

[0048] Based on the above derivation process, an embodiment of the present application provides a control flow integrity protection method, which can add a marking module at the starting position of the function. When the function starts running, the position mark of the currently executed function can be generated through the marking module. Furthermore, the method can also add a verification module before the indirect jump instruction contained in the function. When the program control flow executes to the jump instruction, the verification module needs to be executed first to verify the position mark. If the verification passes, it means that the current program control flow is executed from the starting position of the function and the jump instruction can be executed. Otherwise, it means that the current program control flow has been tampered with.

[0049] In general, the method provided by the embodiment of the present application can control the jump nodes in the function, interrupt the program in time when the attacker escapes from the original control flow of the program through an indirect jump instruction, ensure that the function is executed from the starting position, and avoid the attacker from executing from the middle of the function through a JOP attack, and using the gadgets in multiple functions to piece together the attack logic. In addition, the method does not need to analyze the global call relationship of the function, shortens the compilation time, does not need to generate a CFI check table, and reduces the memory space occupied. In addition, the method also saves the step of table check, and can determine whether the current program control flow has been tampered with by only judging a mark, which improves the verification speed of the control flow integrity. It can also be seen that the method can perform low-overhead forward CFI protection, has low hardware requirements for the device, is more suitable for lightweight devices, is easier to adapt, and is more conducive to promotion and deployment.

[0050] Figure 1 A schematic diagram showing the comparison between normal program control flow and erroneous program control flow is shown.

[0051] For example, Figure 1 The figure shows the calling relationship of two functions: FUNC_1 and FUNC_2. The correct function calling relationship is: FUNC_1 calls FUNC_2. Among them, the FUNC_1 function includes three indirect jump instructions: jmpLocalLabel_1, jmpLocalLabel_2, callFUNC_2; the FUNC_2 function includes three indirect jump instructions: jmpLocalLabel_3, jmpLocalLabel_5, callFUNC_3.

[0052] The normal control flow includes: starting from the start position of the FUNC_1 function and executing downward, when the jmpLocalLabel_1 instruction is executed, it jumps to the instruction corresponding to LocalLabel_1 in the FUNC_1 function (see Figure 1 ①), when continuing to execute, the jmpLocalLabel_2 instruction jumps to the instruction corresponding to LocalLabel_2 (see Figure 1 ②), then, when continuing to execute downward, it switches to FUNC_2 through callFUNC_2 (see Figure 1 ③), and then jump to the instruction corresponding to LocalLabel_3 through jmp LocalLabel_3 (see Figure 1 ④), and then jump to the instruction corresponding to LocalLabel_5 through jmpLocalLabel_5 (see Figure 1 ⑤) in the above code and continue to execute downwards.

[0053] The incorrect control flow includes: when executing the jmpLocalLabel_2 instruction, jumping from FUNC_1 to the middle of FUNC_2 (see Figure 1 ⑥), when the callFUNC_2 instruction is executed, it jumps from FUNC_1 to the middle of FUNC_2 (see Figure 1 ⑦).

[0054] That is to say, when the normal control flow jumps from one function (such as function 1) to another function (such as function 2), the execution starts from the starting position of function 2 after the jump, and function 1 also starts from its starting position during execution. In addition, the jump from function 1 to function 2 can only be achieved through indirect jump instructions used to implement jumps between functions, such as call / bl instructions, and the jump from function 1 to function 2 cannot be achieved through indirect jump instructions used to implement jumps within a segment, such as jmp instructions.

[0055] Figure 2 A schematic diagram of the principles of the control flow integrity protection method provided in an embodiment of the present application.

[0056] like Figure 2 As shown, the control flow integrity protection method provided by the embodiment of the present application can add a marking module and a verification module to the protected program. Among them, the marking module is set at the beginning of the function, and the verification module is set before the indirect jump instruction contained in the function and is adjacent to the indirect jump instruction.

[0057] A function may include a marking module and one or more verification modules, wherein the number of verification modules is determined by the number of indirect jump instructions contained in the function. For example, if the function contains three indirect jump instructions, three verification modules may be set in the function.

[0058] In the embodiment of the present application, the marking module is used to generate a position mark indicating the starting position of the function, and the verification module is used to verify the position mark to determine whether the current control flow is executed from the starting position of the current function. In this way, abnormal jumps from one function to the middle position of another function in the program can be identified in time, and the impact of JOP attacks on the device can be reduced as much as possible.

[0059] In a specific implementation, the protected function can be plugged in the compilation stage to add a marking module and a verification module to the function. Then, when the electronic device executes the function, the marking module and the verification module inserted in the execution function can be used to identify abnormal jumps that occur during the function operation and protect the integrity of the control flow.

[0060] It should be understood that the marking module and the verification module are composed of multiple instructions. In the embodiment of the present application, the marking module can also be called a first instruction fragment, and the verification module can also be called a second instruction fragment.

[0061] Combine the following Figure 3 , taking the first function as a protected function as an example, the operation principle of the marking module and the verification module during the process of the electronic device 100 executing the first function after the marking module and the verification module are inserted into the first function is described.

[0062] For example, Figure 3 A flowchart of a control flow integrity protection method provided in an embodiment of the present application.

[0063] like Figure 3 As shown, the control flow integrity protection method may include:

[0064] S101. If the electronic device 100 starts to execute the first function from the starting position of the first function, the electronic device 100 generates a first position mark.

[0065] The starting position of the first function includes a marking module, and the marking module is used to generate a first position mark.

[0066] It should be understood that the starting position of the first function may refer to the entry of the first function. Thus, when the electronic device 100 executes the first function in sequence normally from the entry of the first function, it will first pass through the marking module to trigger the generation of the first position mark.

[0067] In this way, if the electronic device 100 starts to execute the first function from the starting position of the first function, it will first execute the instructions in the marking module to generate a first position mark, which is used to indicate that the electronic device 100 starts to execute the first function from the starting position of the first function when executing the first function.

[0068] Specifically, the electronic device 100 can generate the first position marker using the first rule. The first rule can enable the electronic device 100 to generate a position marker that uniquely corresponds to the function when executing different functions with the marking module inserted. That is to say, if the electronic device 100 generates position marker 1 when executing the first function and generates position marker 2 when executing the second function, the position marker 1 is different from the position marker 2. Further, position marker 1 can be used to indicate the first function, and position marker 2 can be used to indicate the second function. In this way, it can be ensured that the electronic device 100 can use the first position marker to accurately and uniquely identify the execution status of the first function when determining whether the function is executed from the starting position.

[0069] Exemplarily, the first position mark may exist in the following situations:

[0070] 1) The first position mark is a random number generated by the electronic device 100

[0071] Among them, the first position mark is a random number, which can enable the electronic device to generate a different position mark the next time it executes the first function, or executes other functions to generate position marks, thereby preventing attackers from forging position marks and improving the accuracy of control flow verification.

[0072] 2) The first position mark is a parameter generated by the electronic device 100 according to the preset information

[0073] The preset information may include any one or more of the following: the address of the first function, the name of the first function, variables involved in the first function, specific registers, etc. For example, the first position mark is a parameter obtained by the electronic device 100 after encrypting the start address of the first function.

[0074] The first position mark is a parameter generated according to preset information, which can enable the electronic device to generate the same specified position mark before executing the first function from the starting position and executing the indirect jump instruction, so as to verify whether the function control flow is abnormal.

[0075] It should be understood that the embodiment of the present application does not limit the method for generating the first position mark.

[0076] In addition, the electronic device 100 can store the first position marker in a specified location. For example, the first position marker can be stored on the stack of the first function or in other preset storage areas, wherein the preset storage area can be used to store the position markers generated when the electronic device 100 executes each protected function.

[0077] If the first position mark is stored on the stack of the first function, the electronic device 100 can quickly determine whether the first function is executed from the starting position by judging whether the stack of the first function contains the position mark before executing the indirect jump instruction.

[0078] If the first position marker is stored in a preset storage area, before executing the indirect jump instruction, the electronic device 100 can determine whether the first function is executed from the starting position by searching whether the preset storage area contains a position marker generated when the electronic device 100 executes the first function, or a position marker identical to the position marker generated by the electronic device 100 before executing the indirect jump instruction.

[0079] S102. The electronic device 100 starts executing the first function from the starting position of the first function.

[0080] Normally, the electronic device 100 may start from the start position of the first function and execute each instruction in the first function from top to bottom.

[0081] S103. Before executing the first indirect jump instruction to the first function, the electronic device 100 checks the position mark.

[0082] The first indirect jump instruction is any indirect jump instruction included in the first function. The first indirect jump instruction may be jmp / bl / call or other instructions.

[0083] In the first function, a check module is included before the first indirect jump instruction, and the check module can be used to check the position mark to determine whether the first function is executed from the starting position of the first function.

[0084] It should be understood that the verification module should be located before all indirect jump instructions contained in the function and close to the indirect jump instruction. In other words, after the verification module is inserted, the next instruction of the verification module is the indirect jump instruction. In this way, after the electronic device 100 executes the verification module, if the verification is successful, the indirect jump instruction can be directly executed to trigger the jump. If the verification fails, the execution of the function can be suspended to avoid triggering the jump.

[0085] Exemplarily, the electronic device 100 may verify the location mark in any of the following ways:

[0086] 1) Determine whether a position mark is generated when the first function is started

[0087] The electronic device 100 can determine whether a position marker is generated when the first function starts to be executed by checking whether the address designated for storing the position marker generated during the execution of the first function contains the position marker.

[0088] If yes, it is determined that the first function is executed from the starting position of the first function; if no, it is determined that the first function is not executed from the starting position of the first function.

[0089] 2) Generate a second position marker, and determine whether the second position marker is the same as the first position marker generated by the electronic device when the electronic device starts to execute the first function

[0090] Considering that an attacker may forge a location marker, after generating the second location marker, the electronic device 100 can more accurately determine whether the first function is executed from the starting position by judging whether the location marker generated when the first function starts to execute is the same.

[0091] If they are the same, it is determined that the first function is executed from the starting position of the first function; if they are not the same, it is determined that the first function is not executed from the starting position of the first function.

[0092] It should be noted that in order to prevent attackers from forging location markers, the location marker (e.g., the first location marker) generated by the electronic device 100 when executing from the start position of the function and the location marker (e.g., the second location marker) generated before executing an indirect jump instruction should be generated according to the same rule (e.g., the first rule).

[0093] For example, if the first position mark is a parameter obtained by encrypting the starting address of the first function by the electronic device 100, when the electronic device 100 verifies the position mark, it can use the same encryption algorithm to encrypt the starting address of the first function to obtain the second position mark. In this way, by comparing the second position mark with the first position mark to see if they are the same, it can be determined whether the first function is executed from the starting position.

[0094] It is understandable that the electronic device 100 can also verify the position mark in other ways, for example, combining the position mark generated by the electronic device 100 when starting to execute the first function, the time elapsed before the current execution of the first indirect jump instruction, the number of instructions, etc., to determine whether the execution of the first function starts from the starting position. The embodiment of the present application does not limit this verification method.

[0095] S104. The electronic device 100 determines whether the verification is successful.

[0096] If the electronic device 100 generates a position marker when starting to execute the first function, or the generated position marker, that is, the first position marker mentioned above is the same as the second position marker, then the verification is successful and the electronic device 100 can execute step S105.

[0097] If the electronic device 100 does not generate a position marker when starting to execute the first function, or the generated position marker, that is, the first position marker mentioned above is different from the second position marker, the verification fails and the electronic device 100 can execute step S106.

[0098] S105. The electronic device 100 continues to execute the first function.

[0099] Since a JOP attack usually uses gadgets from multiple functions to piece together the attack logic, that is, a JOP attack often starts from the middle of a function. If the verification is successful, it means that the electronic device 100 does not start from the middle of the first function, and the possibility of a JOP attack is currently small. Therefore, the electronic device 100 can continue to execute the first function, for example, execute the first indirect jump instruction, jump to another instruction fragment of the first function, or jump to another function.

[0100] It should be understood that if the electronic device 100 jumps to another instruction fragment of the first function through the first indirect jump instruction, if an indirect jump instruction is encountered again during the execution process, such as a second indirect jump instruction, the electronic device 100 can continue to check the position mark as described in the above steps S103-S106.

[0101] S106. The electronic device 100 stops executing the first function.

[0102] If the verification fails, it means that the electronic device 100 starts to execute from the middle of the first function, and a JOP attack may exist. Therefore, the electronic device 100 can terminate the execution of the first function.

[0103] Exemplarily, if the verification fails, the electronic device 100 may execute the instruction “brk 0x1”.

[0104] It is understandable that the electronic device 100 may also perform other exception processing, which is not limited in the embodiments of the present application.

[0105] It can be seen that when the electronic device 100 executes a function, it can monitor whether the electronic device 100 executes the function in a normal order starting from the starting position of the function through the marking module and the verification module pre-inserted into the function, and then identify whether a JOP attack occurs when the electronic device 100 executes the function, thereby protecting the integrity of the control flow.

[0106] To better understand the above Figure 3 The process described, Figure 4 The protected program includes the above Figure 1 Taking FUNC_1 and FUNC_2 as examples, a schematic diagram of a program with a marking module and a verification module added thereto is shown.

[0107] like Figure 4 As shown, the marking module is used to set the position mark at the starting position of FUNC_1 and FUNC_2, and the verification module is used to obtain the position mark before the indirect jump instruction included in FUNC_1 and FUNC_2 and perform verification. If the verification succeeds, the execution continues, that is, the indirect jump instruction is executed. If the verification fails, the execution is interrupted. Figure 4 In the example, verification modules are set before jumpLocalLabel_1, jmpLocalLabel_2 and callFUNC_2 in FUNC_1, and before jumpLocalLabel_3, jmpLocalLabel_5 and callFUNC_3 in FUNC_1.

[0108] Understandably, Figure 4 The function is only used as an example to facilitate understanding of the present solution, and does not constitute a limitation on the embodiments of the present application.

[0109] Further, in Figure 2 In the principle diagram shown, the marking module can also be used to obtain a jump tag, and check whether the type of the jump instruction used before jumping to the current function is a call / bl instruction or the like according to the jump tag. Accordingly, the checking module can also be used to set a jump tag before using an indirect jump instruction to perform a function jump, and the jump tag is used to indicate the type of the indirect jump instruction. In this way, it is possible to monitor whether the electronic device 100 jumps to the current function from an indirect jump instruction of a specified type when executing a function jump.

[0110] Combine the following Figure 5 Taking the first function and the second function as protected functions as an example, the operation principle of the marking module and the verification module in the process of the electronic device 100 jumping from the first function to the second function after the marking module and the verification module are inserted into the first function and the second function is described.

[0111] For example, Figure 5 A flowchart of another control flow integrity protection method provided in an embodiment of the present application.

[0112] like Figure 5 As shown, the control flow integrity protection method may include:

[0113] S201. Before executing the first indirect jump instruction to the first function, the electronic device 100 checks the position mark.

[0114] It should be understood that when the electronic device 100 starts to execute the first function, if the electronic device 100 starts to execute from the starting position of the first function, it also includes generating a first position mark. For a detailed description of the electronic device 100 generating a position mark and verifying the position mark, please refer to the aforementioned Figure 3 The relevant content in will not be repeated here.

[0115] S202. If the verification is successful, the electronic device 100 generates a first jump tag, where the first jump tag is used to indicate the type of the first indirect jump instruction.

[0116] The types of indirect jump instructions may include: intra-segment jump instructions and inter-function jump instructions. The intra-segment jump instructions are used to implement jumps within a function, such as jmp instructions, and inter-function jump instructions are used to implement jumps between functions, such as call instructions, bl instructions, etc.

[0117] Since the indirect jump instruction included in the first function is preceded by a check module, the check module is used to generate a jump tag in addition to checking the position tag. Therefore, the electronic device 100 can generate a first jump tag before executing the first indirect jump instruction after checking the position tag.

[0118] It should be understood that since the verification module is pre-inserted into the first function during the compilation stage, during the compilation stage, the compiler can pre-determine the first jump marker based on the type of the first jump instruction. In this way, before the electronic device 100 executes the first jump instruction, a first jump marker indicating the type of the first indirect jump instruction can be generated according to the verification module.

[0119] S203. The electronic device 100 jumps to the second function by executing the first indirect jump instruction.

[0120] S204. Before executing the second function, the electronic device 100 checks the jump flag.

[0121] Specifically, checking the jump tag may include acquiring the first jump tag and determining whether the first jump tag is a tag of an inter-function jump instruction.

[0122] If the first jump mark is the mark of the jump instruction between functions, it means that the first indirect jump instruction is the jump instruction between functions. When the electronic device 100 executes the jump from the first function to the second function, it jumps through the jump instruction between functions, which is a normal jump. If the first jump mark is not the mark of the jump instruction between functions, it means that the first indirect jump instruction is not the jump instruction between functions. When the electronic device 100 executes the jump from the first function to the second function, it does not jump through the jump instruction between functions. It is an abnormal jump.

[0123] S205. The electronic device 100 determines whether the verification is successful.

[0124] If the first jump mark is a mark of an inter-function jump instruction, the verification is successful and the electronic device 100 can execute step S206.

[0125] If the first jump mark is not the mark of the inter-function jump instruction, the verification fails and the electronic device 100 can execute step S207.

[0126] S206. The electronic device 100 continues to execute the second function.

[0127] Since the JOP attack does not implement the jump between functions according to the normal jump logic, if the verification is successful, it means that the first function jumps to the second function through instructions such as call / bl, and the current jump logic to the second function is normal. The possibility of a JOP attack is small at present, and the electronic device 100 can continue to execute the second function.

[0128] Furthermore, if the electronic device 100 starts executing from the start position of the second function, the electronic device 100 may generate a position marker, such as a third position marker, before executing the second function, and the third position marker is used to indicate that the electronic device 100 starts executing from the start position of the second function when executing the second function. Furthermore, the electronic device 100 may perform a check on the position marker before executing the indirect jump instruction included in the second function.

[0129] It should be understood that the description of generating and verifying the position mark in the electronic device 100 during the execution of the second function can refer to the aforementioned Figure 3 The process of generating and verifying the position mark when the electronic device 100 mentioned in the above executes the first function will not be repeated here.

[0130] S207. The electronic device 100 stops executing the second function.

[0131] If the verification fails, it means that the current jump from the first function to the second function is abnormal, and there may be a JOP attack, so the electronic device 100 can terminate the execution of the second function.

[0132] Exemplarily, if the verification fails, the electronic device 100 may execute the instruction “brk 0x1”.

[0133] It is understandable that the electronic device 100 may also perform other exception processing, which is not limited in the embodiments of the present application.

[0134] It can be seen that when the electronic device 100 executes a function, in addition to monitoring whether the electronic device 100 executes the function in the normal order starting from the starting position of the function through the marking module and the verification module pre-inserted in the function, the marking module and the verification module can also be used to monitor whether the electronic device 100 jumps from one function to another function according to normal jump instructions, thereby improving the accuracy of JOP attack identification and protecting the integrity of the control flow.

[0135] To better understand the above Figure 5 The process described, Figure 6 The protected program includes the above Figure 1Taking FUNC_1 and FUNC_2 as examples, a schematic diagram of another program with a marking module and a verification module added is shown.

[0136] like Figure 6 As shown, the marking module is used to obtain the jump mark at the starting position of FUNC_1 and FUNC_2 and perform verification. If the verification is successful, the execution continues, that is, the position mark is set. If the verification fails, the execution is terminated. The verification module is used to obtain the position mark before the indirect jump instruction included in FUNC_1 and FUNC_2 and perform verification. If the verification is successful, the jump mark is set, and then the indirect jump instruction is executed. If the verification fails, the execution is terminated. Figure 6 In the example, verification modules are set before jumpLocalLabel_1, jmpLocalLabel_2 and callFUNC_2 in FUNC_1, and before jumpLocalLabel_3, jmpLocalLabel_5 and callFUNC_3 in FUNC_1.

[0137] Understandably, Figure 6 The function is only used as an example to facilitate understanding of the present solution, and does not constitute a limitation on the embodiments of the present application.

[0138] Figure 7 A schematic diagram of the hardware structure of the electronic device 100 is shown.

[0139] The electronic device 100 may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a wearable device, an in-vehicle device, a smart home device and / or a smart city device. The embodiments of the present application do not impose any special restrictions on the specific type of the electronic device.

[0140] The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0141] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0142] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0143] In some implementations, the processor 110 may be used to generate a position mark during the execution of a function, and to check the position mark before executing an indirect jump instruction to determine whether the function is executed from the start position. Further, the processor 110 may be used to determine whether the function jump is performed from an indirect jump instruction of a specified type before executing the function jump, thereby ensuring the integrity of the control flow.

[0144] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0145] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0146] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the electronic device 100. While the charging management module 140 is charging the battery 142, it may also power the electronic device through the power management module 141.

[0147] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0148] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0149] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0150] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0151] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0152] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, demodulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0153] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0154] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0155] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD). The display panel can also be made of an organic light-emitting diode (OLED), an active-matrix organic light emitting diode or an active-matrix organic light emitting diode (AMOLED), a flexible light-emitting diode (FLED), miniled, microled, micro-oled, quantum dot light emitting diodes (QLED), etc. In some embodiments, the electronic device may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0156] The electronic device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0157] The ISP is used to process the data fed back by the camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing and converts it into an image visible to the naked eye. The ISP can also perform algorithm optimization on the noise and brightness of the image. The ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, the ISP can be set in the camera 193.

[0158] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0159] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0160] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0161] The internal memory 121 may include one or more random access memories (RAM) and one or more non-volatile memories (NVM).

[0162] The random access memory can be directly read and written by the processor 110, and can be used to store executable programs (such as machine instructions) of the operating system or other running programs, and can also be used to store user and application data.

[0163] The non-volatile memory may also store executable programs and user and application data, etc., and may be loaded into the random access memory in advance for direct reading and writing by the processor 110 .

[0164] The external memory interface 120 can be used to connect to an external non-volatile memory to expand the storage capacity of the electronic device 100. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to implement a data storage function. For example, files such as music and videos are stored in the external non-volatile memory.

[0165] The electronic device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0166] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0167] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0168] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0169] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to microphone 170C to input the sound signal into microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify the sound source, realize directional recording function, etc.

[0170] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0171] The pressure sensor 180A is used to sense pressure signals and convert the pressure signals into electrical signals.

[0172] The gyro sensor 180B may be used to determine the motion posture of the electronic device 100 .

[0173] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0174] The magnetic sensor 180D includes a Hall sensor. The electronic device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the electronic device 100 is a flip phone, the electronic device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover can be automatically unlocked.

[0175] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in all directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the electronic device and is applied to applications such as horizontal and vertical screen switching and pedometers.

[0176] The distance sensor 180F is used to measure the distance. The electronic device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0177] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The electronic device 100 emits infrared light outward through the light emitting diode. The electronic device 100 uses the photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100.

[0178] The ambient light sensor 180L is used to sense the brightness of ambient light.

[0179] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0180] The temperature sensor 180J is used to detect the temperature.

[0181] The touch sensor 180K is also called a "touch control device". The touch sensor 180K can be set on the display screen 194. The touch sensor 180K and the display screen 194 form a touch screen, also called a "touch control screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0182] Bone conduction sensor 180M can obtain vibration signals.

[0183] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The electronic device 100 may receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0184] Motor 191 can generate vibration prompts.

[0185] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0186] The SIM card interface 195 is used to connect a SIM card.

[0187] The electronic device may be a portable terminal device equipped with iOS, Android, Microsoft or other operating systems, such as a mobile phone, a tablet computer, a wearable device, etc., and may also be a non-portable terminal device such as a laptop computer with a touch-sensitive surface or a touch panel, a desktop computer with a touch-sensitive surface or a touch panel. The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. The embodiment of the present invention takes the Android system of the layered architecture as an example to exemplify the software structure of the electronic device 100.

[0188] Figure 8 It is a software structure block diagram of the electronic device 100 according to an embodiment of the present application.

[0189] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0190] The application layer can include a series of application packages.

[0191] like Figure 8 As shown, the application package may include camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message and other applications.

[0192] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0193] like Figure 8 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0194] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0195] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0196] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0197] The phone manager is used to provide communication functions of the electronic device 100, such as management of call status (including connecting, hanging up, etc.).

[0198] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0199] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, an electronic device vibrates, an indicator light flashes, etc.

[0200] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0201] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0202] It is understandable that the core library and the virtual machine may include functions of inserting the above-mentioned marking module and verification module during the compilation stage. In this way, when the electronic device 100 calls the function in the core library and uses the virtual machine, the marking module and verification module inserted in the function can be used to monitor whether there is a JOP attack during the execution of the function.

[0203] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0204] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0205] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0206] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0207] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0208] A 2D graphics engine is a drawing engine for 2D drawings.

[0209] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0210] The following is an illustrative description of the workflow of the software and hardware of the electronic device 100 in conjunction with capturing a photo scene.

[0211] When the touch sensor 180K receives a touch operation, the corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, timestamp of the touch operation, and other information). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the control corresponding to the input event. For example, if the touch operation is a touch single-click operation and the control corresponding to the single-click operation is the control of the camera application icon, the camera application calls the interface of the application framework layer to start the camera application, and then starts the camera driver by calling the kernel layer to capture static images or videos through the camera 193.

[0212] It should be understood that each step in the above method embodiment can be completed by an integrated logic circuit of hardware in a processor or by instructions in the form of software. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0213] The present application also provides an electronic device, which may include: a memory and a processor. The memory may be used to store a computer program; the processor may be used to call the computer program in the memory, so that the electronic device executes the method executed by the electronic device 100 in any of the above embodiments.

[0214] The present application also provides a chip system, which includes at least one processor for implementing the functions involved in the method performed by the electronic device 100 in any of the above embodiments.

[0215] In one possible design, the chip system also includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0216] The chip system may be composed of the chip, or may include the chip and other discrete devices.

[0217] Optionally, the processor in the chip system may be one or more. The processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0218] Optionally, the memory in the chip system may also be one or more. The memory may be integrated with the processor or may be separately arranged with the processor, which is not limited in the embodiments of the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be arranged on different chips respectively. The embodiments of the present application do not specifically limit the type of memory and the arrangement of the memory and the processor.

[0219] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0220] The present application also provides a computer program product, which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute a method executed by any one of the electronic devices 100 in any of the above embodiments.

[0221] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program (also referred to as code or instruction). When the computer program is executed, the computer executes any method executed by the electronic device 100 in any of the above embodiments.

[0222] It should be understood that the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (digitalsignal processor, DSP), an application specific integrated circuit (AP 800plication specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined to perform. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0223] In addition, an embodiment of the present application further provides a device. The device may be a component or a module, and the device may include one or more processors and a memory connected to each other. The memory is used to store a computer program. When the computer program is executed by one or more processors, the device executes the method in each of the above method embodiments.

[0224] Among them, the device, computer-readable storage medium, computer program product or chip provided in the embodiments of the present application are used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0225] The various implementation modes of the present application can be combined arbitrarily to achieve different technical effects.

[0226] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0227] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0228] In short, the above description is only an embodiment of the technical solution of the present invention, and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made according to the disclosure of the present invention shall be included in the protection scope of the present invention.

Claims

1. A control flow integrity protection method, characterized in that: The method comprises: Before executing a first indirect jump instruction in a first function, the electronic device determines whether the first function is executed from a starting position of the first function; If yes, the electronic device executes the first indirect jump instruction; If not, the electronic device stops executing the first function.

2. The method according to claim 1, characterized in that The electronic device determines whether the first function is executed from the starting position of the first function, specifically including: The electronic device determines whether a position mark is generated when the first function starts to be executed; If yes, determining that the first function is executed from the starting position of the first function; If not, it is determined that the first function is not executed from the starting position of the first function.

3. The method according to claim 1, characterized in that The electronic device determines whether the first function is executed from the starting position of the first function, specifically including: The electronic device generates a second position marker, and determines whether the second position marker is the same as a first position marker generated when the electronic device starts to execute the first function; If they are the same, determining that the first function is executed from the starting position of the first function; If they are not the same, it is determined that the first function is not executed from the starting position of the first function.

4. The method according to any one of claims 1 to 3, characterized in that: If the first function is executed from the starting position of the first function, before the electronic device executes the first indirect jump instruction in the first function, before determining whether the first function is executed from the starting position of the first function, the method further includes: The electronic device generates a first position mark; the first position mark is used to indicate that the first function is executed from the starting position of the first function; The electronic device executes the first function from a starting position of the first function.

5. The method according to claim 4, characterized in that The first location marker is a random number or a first address in a first register.

6. The method according to any one of claims 3 to 5, characterized in that: The starting position of the first function includes a first instruction fragment, the first instruction fragment is used to generate the first position mark, the first indirect jump instruction includes a second instruction fragment, the last instruction of the second instruction fragment is the previous instruction of the first indirect jump instruction, and the second instruction fragment is used to determine whether the first function is executed from the starting position of the first function.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The electronic device jumps to the second function by executing the first indirect jump instruction; Before executing the second function, the electronic device determines whether the first indirect jump instruction is an inter-function jump instruction; If yes, the electronic device executes the second function; If not, the electronic device stops executing the second function.

8. The method according to claim 7, characterized in that Before the electronic device executes the first indirect jump instruction, the method further includes: The electronic device generates a first jump tag, where the first jump tag is used to indicate whether the first indirect jump instruction belongs to an inter-function jump instruction; The electronic device determines whether the first indirect jump instruction is an inter-function jump instruction, specifically including: The electronic device determines whether the first indirect jump instruction is an inter-function jump instruction based on the first jump tag.

9. The method according to claim 8, characterized in that The starting position of the second function includes a first instruction fragment, the first instruction fragment is used to determine whether the indirect jump instruction used to jump to the second function is an inter-function jump instruction, the first indirect jump instruction includes a second instruction fragment before it, the last instruction of the second instruction fragment is the previous instruction of the first indirect jump instruction, and the second instruction fragment is used to generate the first jump flag.

10. An electronic device, characterized in that: The electronic device comprises a memory, one or more processors, and one or more programs; when the one or more processors execute the one or more programs, the electronic device implements the method as claimed in any one of claims 1 to 9.

11. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 9.

Images