Control flow integrity protection method and related apparatus

Abstract

The application discloses a control flow integrity protection method and related device. The method can determine whether a function is executed from the start position of the function before executing an indirect jump instruction to the function. If yes, it indicates that the function has a small possibility of JOP attack in the execution process, and the function can be continued to execute. If no, it indicates that the function may have JOP attack in the execution process, and the execution of the function is stopped. It can be seen that the method can monitor whether the control flow of the function in the execution process is abnormal, and then reflect whether the JOP attack occurs in the execution process of the function. Moreover, the method does not need to analyze the global call relationship of the function, shortens the compiling time, and does not need to generate a CFI check table, reduces the occupation of the memory space, the method saves the step of table checking and verification, and only needs to determine whether the current program control flow is tampered by judging a mark, so that the verification speed is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a control flow integrity protection method and related device. BACKGROUND

[0002] Control flow refers to the execution order of statements in a program in an execution phase, which is normally executed from front to back or from top to bottom starting from a main function. Program control flow hijacking is a common code attack method, and its attack types include return oriented programming (ROP) attack and jump oriented programming (JOP) attack. The JOP attack is to use executable code segment gadgets containing jmp / call / bl assembly jump instructions in the code, tamper function pointers or memory or directly modify registers through stack overflow, out-of-bound writing and other ways, so that the code runs out of the original program flow, and then jumps to the attacker's own code, or directly assembles attack logic using these gadgets, such as obtaining root permission, opening a shell, etc. SUMMARY

[0003] The present application provides a control flow integrity protection method and related device, which realizes monitoring of abnormal control flow in the process of executing a function.

[0004] In a first aspect, the present application provides a control flow integrity protection method, which includes: an electronic device determining whether a first function is executed from a starting position of the first function before executing a first indirect jump instruction in the first function; if yes, the electronic device executes the first indirect jump instruction; and if no, the electronic device stops executing the first function.

[0005] The method provided by the first aspect can control the jump node in the function during the execution of the function, interrupt the program when the attacker deviates from the original control flow of the program through the indirect jump instruction, ensure that the function is executed from the starting position, and avoid the attacker from executing the function from the middle and assembling attack logic using gadgets in multiple functions through JOP attack. Moreover, the method does not need to analyze the global call relationship of the function, shortens the compilation time, does not need to generate a CFI check table, reduces the occupation of memory space, and the method saves the step of table checking and verification, and only needs to determine whether the current program control flow is tampered by judging a flag, thereby improving the verification speed of the control flow integrity.

[0006] In an implementation form of the first aspect, the electronic device determines whether the first function is executed from the start position of the first function, specifically comprising: the electronic device determines whether a position marker is generated when the execution of the first function is started; if yes, it is determined that the first function is executed from the start position of the first function; if no, it is determined that the first function is not executed from the start position of the first function.

[0007] That is, if the electronic device detects that no position marker is generated during the execution of the first function before the indirect jump instruction is executed, it indicates that the first function is not executed from the start position. In this way, the electronic device can quickly detect that the first function has an execution abnormality problem.

[0008] In an implementation form of the first aspect, the electronic device determines whether the first function is executed from the start position of the first function, specifically comprising: the electronic device generates a second position marker, and determines whether the second position marker is the same as a first position marker generated when the execution of the first function is started; if yes, it is determined that the first function is executed from the start position of the first function; if no, it is determined that the first function is not executed from the start position of the first function.

[0009] That is, before the indirect jump instruction is executed, the electronic device needs to determine that the position marker is a position marker generated in a specified manner in addition to detecting that the position marker is generated during the execution of the first function, which avoids the attacker from forging the position marker and improves the accuracy of the control flow integrity detection.

[0010] In an implementation form of the first aspect, if the first function is executed from the start position of the first function, before the execution of the first indirect jump instruction in the first function is executed, the method further comprises: the electronic device generates a first position marker; the first position marker is used to indicate that the first function is executed from the start position of the first function; and the electronic device executes the first function from the start position of the first function.

[0011] It can be seen that if the electronic device executes the first function from the start position of the first function, the electronic device will generate a first position marker when the execution of the first function is started, which is used to record that the electronic device executes the first function from the start position of the first function, so as to facilitate the electronic device to verify whether the control flow of the function is abnormal before the jump through the indirect jump instruction.

[0012] In an implementation form of the first aspect, the first position marker is stored on a stack of the first function.

[0013] In an implementation form of the first aspect, the first position marker is a random number or a first address in a first register.

[0014] In an implementation form of the first aspect, the first position marker is a random number. This can enable the electronic device to generate different position markers when executing the first function next time or when generating position markers for other functions, so as to avoid attackers from forging position markers and improve the accuracy of the control flow verification.

[0015] In an implementation form of the first aspect, the first function has a start position, the start position includes a first instruction segment for generating the first position marker, and the first indirect jump instruction is preceded by a second instruction segment, the last instruction of the second instruction segment being the instruction preceding the first indirect jump instruction, and the second instruction segment being configured to determine whether the first function is executed from the start position of the first function.

[0016] In an implementation form of the first aspect, the first instruction segment and the second instruction segment are instruction segments inserted into the first function in a compilation phase.

[0017] In an implementation form of the first aspect, the method further includes: jumping, by the electronic device, to a second function by executing the first indirect jump instruction; and determining, by the electronic device, whether the first indirect jump instruction is a function-to-function jump instruction before executing the second function, and executing the second function if the first indirect jump instruction is the function-to-function jump instruction, and aborting the execution of the second function if the first indirect jump instruction is not the function-to-function jump instruction.

[0018] That is, before the electronic device performs a function-to-function jump, it can be verified whether the electronic device performs the jump by a specified indirect jump instruction, so as to detect abnormal jumps in the function in time and avoid JOP attacks from modifying function pointers of different indirect jump instructions to perform function-to-function jumps.

[0019] In an implementation form of the first aspect, before the electronic device executes the first indirect jump instruction, the method further includes: generating, by the electronic device, a first jump marker, the first jump marker being configured to indicate whether the first indirect jump instruction is a function-to-function jump instruction; and determining, by the electronic device, whether the first indirect jump instruction is the function-to-function jump instruction based on the first jump marker.

[0020] The jump marker of the indirect jump instruction can be generated before the indirect jump instruction is executed, and the jump marker can be used to quickly and accurately verify whether the function has an abnormal jump when jumping.

[0021] In conjunction with the first aspect, in one implementation, the starting position of the second function includes a first instruction fragment. The first instruction fragment is used to determine whether the indirect jump instruction used to jump to the second function is an inter-function jump instruction. The first indirect jump instruction is preceded by a second instruction fragment. The last instruction of the second instruction fragment is the instruction preceding the first indirect jump instruction. The second instruction fragment is used to generate a first jump flag.

[0022] The first instruction fragment and the second instruction fragment can be instruction fragments inserted into the first function during the compilation phase.

[0023] In a second aspect, embodiments of this application provide an electronic device, including a memory, one or more processors, and one or more programs; when the one or more processors execute the one or more programs, the electronic device causes the electronic device to implement the method described in the first aspect or any implementation thereof.

[0024] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on an electronic device, cause the electronic device to perform the method described in the first aspect or any implementation thereof.

[0025] Fourthly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in the first aspect or any implementation thereof. Attached Figure Description

[0026] Figure 1 A comparative diagram of normal and erroneous program control flow provided for embodiments of this application;

[0027] Figure 2 A schematic diagram illustrating the principle of the control flow integrity protection method provided in this application embodiment;

[0028] Figure 3 A flowchart illustrating a control flow integrity protection method provided in an embodiment of this application;

[0029] Figure 4 A schematic diagram illustrating a program with an added tagging module and a verification module, provided as an embodiment of this application;

[0030] Figure 5 A flowchart illustrating another control flow integrity protection method provided in this application embodiment;

[0031] Figure 6 A schematic diagram showing another program provided in this application embodiment with an added tagging module and a verification module;

[0032] Figure 7 A hardware structure schematic diagram of the electronic device 100 provided for an embodiment of the present application is shown in the following figure;

[0033] Figure 8 A software structure block diagram of the electronic device 100 provided for an embodiment of the present application is shown in the following figure. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be described clearly and thoroughly in the following with reference to the drawings. In the description of the embodiments of the present application, unless otherwise specified, “ / ” represents the meaning of or, for example, A / B can represent A or B; the “and / or” in the text only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. In addition, in the description of the embodiments of the present application, “multiple” means two or more than two.

[0035] Hereinafter, the terms “first” and “second” are only used for descriptive purposes, and cannot be understood as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with “first” and “second” can explicitly or implicitly include one or more features, and in the description of the embodiments of the present application, unless otherwise specified, the meaning of “multiple” is two or more than two.

[0036] In order to deal with JOP attacks, the industry proposes a control flow integrity (CFI) protection technology, which limits the control transfer in program running, so that it is always within the range defined by the original program control flow.

[0037] Among them, a specific method in CFI technology is to perform the following operations on the function in the compilation phase:

[0038] 1) Identify function pointers and generate function type check table

[0039] The compiler will identify all function prototypes pointed to by the function pointers in the code during the program compilation phase, and all identified function prototypes will be summarized into a CFI check table and saved in the generated binary file.

[0040] 2) Code instrumentation, pointer verification

[0041] During program running, a verification code inserted before function jumping can be used to determine whether the function prototype pointed to by the function pointer used for function jumping is consistent with that in the CFI check table. If consistent, it means that the current function control flow is correct through CFI; if inconsistent, it triggers CFI exception and terminates the program.

[0042] Although the method can verify the control flow integrity of the program running, the method still has great defects:

[0043] 1) Large overhead

[0044] Because the compiler needs to analyze the global call relationship of the function in the compilation phase when determining the CFI check table by using the CFI technology, the compilation time is long; and the code instrumentation, CFI check table and table lookup verification code generated by the editor will cause large memory occupation overhead.

[0045] 2) Large adaptation difficulty

[0046] Because the CFI technology of the compiler needs the support of the C language basic function library (referred to as C library) to use, in many lightweight embedded devices, the selected C library mostly does not provide support for the CFI technology, therefore, if the lightweight embedded device wants to use the CFI technology, the C library needs to be supplemented and adapted, which is difficult, and it can be seen that the application scenario of the method is limited.

[0047] Because a jump instruction cannot normally jump from the middle position of a function to the middle position of another function, for example, the jmp instruction is used for local address jump, and the call instruction is used for function jump, and neither of them can jump from the middle position of a function to the middle position of another function, therefore, all the normal jump instructions must execute the starting instruction of the function where the jump instruction is located before performing the jump, that is, the control flow is sequentially executed from the starting instruction of the function where the jump instruction is located to the current jump instruction.

[0048] Based on the above derivation process, the embodiment of the application provides a control flow integrity protection method, which can add a marking module at the starting position of a function, when the function starts running, the position mark of the currently executed function can be generated through the marking module, further, the method can also add a verification module before the indirect jump instruction contained in the function, when the program control flow executes to the jump instruction, the verification module needs to be executed first, the position mark is verified, if the verification is passed, it means that the current program control flow is executed from the starting position of the function, and the jump instruction can be executed, otherwise, it means that the current program control flow has been tampered.

[0049] In general, the method provided by the embodiments of the present application can control the jump nodes in the function, interrupt the program in time when the attacker escapes from the original control flow of the program through the indirect jump instruction, ensure that the function is executed from the starting position, avoid the attacker from executing the function from the middle through JOP attack, and use gadgets in multiple functions to piece together attack logic. Moreover, the method does not need to analyze the global call relationship of the function, shortens the compilation time, does not need to generate a CFI check table, reduces the occupation of memory space, in addition, the method also saves the step of table lookup verification, and can determine whether the current program control flow is tampered by only judging a flag, improves the verification speed of the control flow integrity. It can be seen that the method can perform low-overhead forward CFI protection, has low requirements for the hardware of the device, is more suitable for lightweight devices, is more easily adapted, and is more beneficial to popularization and deployment.

[0050] Figure 1 A comparison diagram of a normal program control flow and an incorrect program control flow is shown.

[0051] Exemplarily, Figure 1 The calling relationship of two functions, FUNC_1 and FUNC_2, is shown. The correct function calling relationship is that FUNC_1 calls FUNC_2. The FUNC_1 function includes three indirect jump instructions: jmpLocalLabel_1, jmpLocalLabel_2 and callFUNC_2; the FUNC_2 function includes three indirect jump instructions: jmpLocalLabel_3, jmpLocalLabel_5 and callFUNC_3.

[0052] The normal control flow includes: starting from the starting position of the FUNC_1 function and executing downward, when the jmpLocalLabel_1 instruction is executed, jumping to the instruction corresponding to LocalLabel_1 in the FUNC_1 function (see ① in Figure 1 ), continuing to execute downward, jumping to the instruction corresponding to LocalLabel_2 through the jmpLocalLabel_2 instruction (see ② in Figure 1 ), then continuing to execute downward, switching to FUNC_2 through callFUNC_2 (see ③ in Figure 1 ), then jumping to the instruction corresponding to LocalLabel_3 through jmpLocalLabel_3 (see ④ in Figure 1 ), jumping to the instruction corresponding to LocalLabel_5 through jmpLocalLabel_5 (see ⑤ in Figure 1 ), and continuing to execute downward.

[0053] The incorrect control flow includes: when the instruction jmpLocalLabel_2 is executed, jumping from FUNC_1 to the middle of FUNC_2 (see Figure 1 ⑥), and when the instruction callFUNC_2 is executed, jumping from FUNC_1 to the middle of FUNC_2 (see Figure 1 ⑦).

[0054] That is, when the normal control flow jumps from one function (for example, function 1) to another function (for example, function 2), the execution starts from the start position of function 2 after the jump, and the execution of function 1 also starts from the start position of function 1 during the execution. In addition, the jump from function 1 to function 2 can only be implemented by an indirect jump instruction for implementing the jump between functions, such as the instruction call / bl, and cannot be implemented by an indirect jump instruction for implementing the jump within a segment, such as the instruction jmp.

[0055] Figure 2 A principle diagram of the control flow integrity protection method provided by the embodiment of the application.

[0056] As shown in Figure 2 , the control flow integrity protection method provided by the embodiment of the application can add a marking module and a verification module in the protected program. The marking module is arranged at the start position of a function, and the verification module is arranged before an indirect jump instruction included in the function and immediately before the indirect jump instruction.

[0057] One marking module and one or more verification modules can be included in a function, wherein the number of verification modules is determined by the number of indirect jump instructions included in the function. For example, if three indirect jump instructions are included in the function, three verification modules can be arranged in the function.

[0058] In the embodiment of the application, the marking module is used to generate a position marker indicating the start position of the function, and the verification module is used to verify the position marker to determine whether the current control flow is executed from the start position of the current function. In this way, the abnormal jump from one function to the middle of another function in the program can be identified in time, and the influence of the JOP attack on the device can be reduced as much as possible.

[0059] In the specific implementation, the protected function can be instrumented in the compilation phase to add the marking module and the verification module in the function. Then, when the electronic device executes the function, the abnormal jump occurring in the execution of the function can be identified by executing the marking module and the verification module inserted in the function, and the integrity of the control flow is protected.

[0060] It should be understood that the marking module and the verification module are composed of a plurality of instructions, in the embodiments of the present application, the marking module can also be referred to as a first instruction segment, and the verification module can also be referred to as a second instruction segment.

[0061] The following describes the running principle of the marking module and the verification module in the process of the electronic device 100 executing the first function after inserting the marking module and the verification module in the first function, with the first function as an example. Figure 3

[0062] Exemplarily, Figure 3 A flowchart of a control flow integrity protection method provided by the embodiments of the present application.

[0063] As Figure 3 shown, the control flow integrity protection method can include:

[0064] S101. If the electronic device 100 starts to execute the first function from the starting position of the first function, the electronic device 100 generates a first position mark.

[0065] The starting position of the first function includes the marking module, and the marking module is used to generate the first position mark.

[0066] It should be understood that the starting position of the first function can refer to the entry of the first function, so that when the electronic device 100 normally executes the first function in sequence from the entry of the first function, the marking module will be passed first, triggering the generation of the first position mark.

[0067] In this way, if the electronic device 100 starts to execute the first function from the starting position of the first function, the instructions in the marking module will be executed first to generate the first position mark, which is used to indicate that the electronic device 100 starts to execute the first function from the starting position of the first function.

[0068] Specifically, the electronic device 100 can generate the first position mark by using a first rule. The first rule can make the position mark generated by the electronic device 100 when executing different functions inserted with the marking module be unique to the function. That is, if the electronic device 100 generates a position mark 1 when executing the first function and a position mark 2 when executing a second function, the position mark 1 and the position mark 2 are different. Further, the position mark 1 can be used to indicate the first function, and the position mark 2 can be used to indicate the second function. In this way, it can be ensured that the electronic device 100 can accurately and uniquely identify the execution of the first function by using the first position mark when determining whether the function is executed from the starting position.

[0069] Exemplarily, the first position mark can exist in the following multiple cases: ​

[0070] 1) The first position marker is a random number generated by the electronic device 100

[0071] The first position marker being a random number can enable the electronic device to generate different position markers when the electronic device executes the first function next time or generates a position marker when executing other functions, avoid an attacker from forging a position marker, and improve the accuracy of the control flow verification.

[0072] 2) The first position marker is a parameter generated by the electronic device 100 according to preset information

[0073] The preset information can include any one or more of the following: an address of the first function, a name of the first function, a variable related to the first function, a specific register, and the like. For example, the first position marker is a parameter obtained by the electronic device 100 encrypting a start address of the first function.

[0074] The first position marker being a parameter generated according to preset information can enable the electronic device to generate a specified same position marker before executing the first function from the start position and before executing the indirect jump instruction, so as to verify whether the function control flow is abnormal.

[0075] It should be understood that the present embodiment does not limit the generation manner of the first position marker.

[0076] In addition, the electronic device 100 can store the first position marker in a specified position. For example, the first position marker can be stored on a stack of the first function, or can be stored on other preset storage areas, where the preset storage areas can be used to store position markers generated when the electronic device 100 executes various protected functions.

[0077] If the first position marker is stored on the stack of the first function, the electronic device 100 can quickly determine whether the first function is executed from the start position by judging whether the stack of the first function contains the position marker before executing the indirect jump instruction.

[0078] If the first position marker is stored in the preset storage area, the electronic device 100 can determine whether the first function is executed from the start position by searching the preset storage area for a position marker generated when the electronic device 100 executes the first function, or for a same position marker generated before the electronic device 100 executes the indirect jump instruction.

[0079] S102. The electronic device 100 executes the first function from the start position of the first function.

[0080] Under normal circumstances, the electronic device 100 can execute each instruction in the first function from top to bottom, starting from the beginning of the first function.

[0081] S103. Before executing the first indirect jump instruction to the first function, the electronic device 100 checks the position marker.

[0082] The first indirect jump instruction is any indirect jump instruction contained in the first function. The first indirect jump instruction can be jmp / bl / call, etc.

[0083] In the first function, the first indirect jump instruction is preceded by a check module that can be used to check the position marker to determine whether the first function is executed from the beginning of the first function.

[0084] It should be understood that the check module should be located before all indirect jump instructions contained in the function and immediately before the indirect jump instruction. In other words, after inserting the check module, the next instruction of the check module is the indirect jump instruction. In this way, after the electronic device 100 executes the check module, if the check is successful, the indirect jump instruction can be executed directly to trigger the jump, and if the check fails, the execution of the function can be aborted to avoid triggering the jump.

[0085] Exemplarily, the electronic device 100 can check the position marker in any of the following ways:

[0086] 1) Determine whether a position marker is generated when the first function is started to be executed

[0087] The electronic device 100 can determine whether a position marker is generated when the first function is started to be executed by checking whether the specified address for storing the position marker generated during the execution of the first function contains a position marker.

[0088] If yes, it is determined that the first function is executed from the beginning of the first function, and if no, it is determined that the first function is not executed from the beginning of the first function.

[0089] 2) Generate a second position marker and determine whether the second position marker is the same as the first position marker generated by the electronic device when the first function is started to be executed

[0090] Considering that an attacker may forge a position marker, therefore, the electronic device 100 can more accurately determine whether the first function is executed from the beginning by judging whether the position marker generated when the first function is started to be executed is the same after generating the second position marker.

[0091] If the same, it is determined that the first function is executed from the start position of the first function, and if not, it is determined that the first function is not executed from the start position of the first function.

[0092] It should be noted that, in order to avoid an attacker forging a position mark, the position mark (for example, the first position mark) generated by the electronic device 100 when executing from the start position of the function and the position mark (for example, the second position mark) generated before executing the indirect jump instruction should be generated according to the same rule (for example, the first rule).

[0093] For example, if the first position mark is a parameter obtained by the electronic device 100 encrypting the start address of the first function, when the electronic device 100 checks the position mark, the start address of the first function can be encrypted by using the same encryption algorithm to obtain the second position mark, so that whether the first function is executed from the start position can be determined by comparing whether the second position mark is the same as the first position mark.

[0094] It can be understood that the electronic device 100 can also check the position mark in other ways, for example, in combination with the time, the number of instructions, and the like that have elapsed since the position mark generated by the electronic device 100 when starting to execute the first function to before the current execution of the first indirect jump instruction, to determine whether the first function is executed from the start position when starting to execute the first function. The checking manner is not limited by the embodiments of the present application.

[0095] S104. The electronic device 100 determines whether the check is successful.

[0096] If the electronic device 100 generates a position mark when starting to execute the first function, or the generated position mark, i.e., the first position mark and the second position mark mentioned above are the same, the check is successful, and the electronic device 100 can execute step S105.

[0097] If the electronic device 100 does not generate a position mark when starting to execute the first function, or the generated position mark, i.e., the first position mark and the second position mark mentioned above are not the same, the check fails, and the electronic device 100 can execute step S106.

[0098] S105. The electronic device 100 continues to execute the first function.

[0099] Since the JOP attack is usually a gadget that utilizes multiple functions to piece together the attack logic, i.e., the JOP attack is usually started from the middle of a function, if the verification succeeds, it indicates that the electronic device 100 is not started from the middle of the first function, and the current JOP attack is less likely to exist, therefore, the electronic device 100 can continue to execute the first function, for example, execute the first indirect jump instruction, jump to another instruction segment of the first function, or jump to another function.

[0100] It should be understood that if the electronic device 100 jumps to another instruction segment of the first function through the first indirect jump instruction, if an indirect jump instruction, for example, a second indirect jump instruction, is encountered again during the execution process, the electronic device 100 can continue to verify the position marker according to the description of steps S103-S106 above.

[0101] S106. The electronic device 100 suspends the execution of the first function.

[0102] If the verification fails, it indicates that the electronic device 100 is started from the middle of the first function, and the JOP attack is likely to exist, therefore, the electronic device 100 can suspend the execution of the first function.

[0103] For example, if the verification fails, the electronic device 100 can execute the instruction "brk 0x1".

[0104] It can be understood that the electronic device 100 can also perform other exception processing, which is not limited by the embodiments of the present application.

[0105] As can be seen, when the electronic device 100 executes a function, the electronic device 100 can monitor whether the function is executed in the normal order starting from the starting position of the function through the marker module and the verification module inserted in the function in advance, and further identify whether the JOP attack exists when the electronic device 100 executes the function, thereby protecting the integrity of the control flow.

[0106] In order to better understand the above Figure 3 described process, Figure 4 the protected program includes the FUNC_1 and FUNC_2 shown in the above Figure 1 , a schematic diagram of a program with a marker module and a verification module added is shown.

[0107] As Figure 4 shown, the marker module is used to set a position marker at the starting position of FUNC_1 and FUNC_2, and the verification module is used to obtain the position marker before the indirect jump instruction included in FUNC_1 and FUNC_2 and perform verification, if the verification succeeds, the execution is continued, i.e., the indirect jump instruction is executed, if the verification fails, the execution is interrupted.Figure 4 In the embodiment, the jumpLocalLabel_1, jmpLocalLabel_2 and callFUNC_2 in FUNC_1 are provided with the check module before, and the jumpLocalLabel_3, jmpLocalLabel_5 and callFUNC_3 in FUNC_1 are provided with the check module before.

[0108] It can be understood that, Figure 4 The function is only used for facilitating understanding of the present solution, and does not constitute a limitation on the embodiments of the present application.

[0109] Further, in Figure 2 In the principle schematic diagram shown, the marking module can also be used to acquire a jump mark, and check whether the type of the jump instruction used before jumping to the current function is a call / bl instruction or the like according to the jump mark. Correspondingly, the check module can also be used to set a jump mark before function jumping using an indirect jump instruction, the jump mark being used to indicate the type of the indirect jump instruction. In this way, it can be monitored whether the electronic device 100 jumps to the current function from a specified type of indirect jump instruction when performing function jumping.

[0110] The following will be described in combination with Figure 5 Taking the first function and the second function as the protected functions as an example, the running principle of the marking module and the check module in the process of jumping from the first function to the second function of the electronic device 100 after inserting the marking module and the check module in the first function and the second function will be described.

[0111] Exemplarily, Figure 5 A flow schematic diagram of another control flow integrity protection method provided by the embodiments of the present application.

[0112] As Figure 5 shown, the control flow integrity protection method can include:

[0113] S201. Before the electronic device 100 executes the first indirect jump instruction to the first function, the position mark is checked.

[0114] It should be understood that when the electronic device 100 starts to execute the first function, if the electronic device 100 starts to execute from the starting position of the first function, it also includes generating the first position mark. The description about the electronic device 100 generating the position mark and checking the position mark can be referred to the related content in the foregoing Figure 3 , which will not be described here again.

[0115] S202. If the checking is successful, the electronic device 100 generates the first jump mark, the first jump mark being used to indicate the type of the first indirect jump instruction.

[0116] The type of the indirect jump instruction can include an intra-function jump instruction and an inter-function jump instruction. The intra-function jump instruction is used to implement a jump within a function, such as a jmp instruction. The inter-function jump instruction is used to implement a jump between functions, such as a call instruction, a bl instruction, and the like.

[0117] Since the check module is inserted before each indirect jump instruction in the first function, the check module is used to generate a jump marker in addition to checking the position marker. Therefore, the electronic device 100 can generate the first jump marker before executing the first indirect jump instruction after the position marker is checked.

[0118] It should be understood that since the check module is inserted into the first function in advance during the compilation phase, the compiler can determine the first jump marker in advance according to the type of the first jump instruction during the compilation phase. In this way, the first jump marker indicating the type of the first indirect jump instruction can be generated according to the check module before the electronic device 100 executes the first jump instruction.

[0119] S203. The electronic device 100 jumps to the second function by executing the first indirect jump instruction.

[0120] S204. The electronic device 100 checks the jump marker before executing the second function.

[0121] Specifically, checking the jump marker can include obtaining the first jump marker and determining whether the first jump marker is a marker of an inter-function jump instruction.

[0122] If the first jump marker is a marker of an inter-function jump instruction, it indicates that the first indirect jump instruction is an inter-function jump instruction, and the electronic device 100 jumps to the second function by the inter-function jump instruction, which is a normal jump. If the first jump marker is not a marker of an inter-function jump instruction, it indicates that the first indirect jump instruction is not an inter-function jump instruction, and the electronic device 100 does not jump to the second function by the inter-function jump instruction, which is an abnormal jump.

[0123] S205. The electronic device 100 determines whether the check is successful.

[0124] If the first jump marker is a marker of an inter-function jump instruction, the check is successful, and the electronic device 100 can execute step S206.

[0125] If the first jump marker is not a marker of an inter-function jump instruction, the check fails, and the electronic device 100 can execute step S207.

[0126] S206. The electronic device 100 continues to execute the second function.

[0127] Since a JOP attack does not follow normal function jump logic, if the verification is successful, it means that the first function jumps to the second function through instructions such as call / bl, and the current jump logic to the second function is normal. The possibility of a JOP attack is small, so electronic device 100 can continue to execute the second function.

[0128] Furthermore, if the electronic device 100 starts execution from the beginning of the second function, the electronic device 100 can generate a position marker, such as a third position marker, before executing the second function. This third position marker indicates that the electronic device 100 starts execution from the beginning of the second function. The electronic device 100 can also perform a check on the position marker between execution and the execution of any indirect jump instructions contained in the second function.

[0129] It should be understood that the description of generating and verifying position markers in the execution of the second function by electronic device 100 can be referred to the foregoing. Figure 3 The process of generating and verifying position markers when the electronic device 100 mentioned above executes the first function will not be described in detail here.

[0130] S207. Electronic device 100 aborts the execution of the second function.

[0131] If the verification fails, it indicates that the jump from the first function to the second function is abnormal, which may be due to a JOP attack. In this case, electronic device 100 can stop executing the second function.

[0132] For example, if the verification fails, the electronic device 100 can execute the instruction "brk 0x1".

[0133] It is understood that the electronic device 100 can also perform other abnormal handling, and this application embodiment does not limit this.

[0134] It can be seen that when electronic device 100 executes a function, in addition to monitoring whether electronic device 100 executes the function in the normal order starting from the beginning of the function through the marker module and verification module inserted in advance in the function, it can also use the marker module and verification module to monitor whether electronic device 100 jumps from one function to another according to the normal jump instruction, thereby improving the accuracy of JOP attack identification and protecting the integrity of control flow.

[0135] To better understand the above Figure 5 The process of description Figure 6 The protected procedures include the above. Figure 1The examples shown are FUNC_1 and FUNC_2, illustrating another program with added tagging and verification modules.

[0136] like Figure 6 As shown, the marking module is used to obtain and verify the jump markers at the beginning positions of FUNC_1 and FUNC_2. If the verification is successful, execution continues, i.e., the position marker is set; if the verification fails, execution is aborted. The verification module is used to obtain and verify the position markers before the indirect jump instructions contained in FUNC_1 and FUNC_2. If the verification is successful, the jump marker is set, and then the indirect jump instruction is executed; if the verification fails, execution is aborted. Specifically, in... Figure 6 In FUNC_1, a verification module is set before jumpLocalLabel_1, jmpLocalLabel_2 and callFUNC_2, as well as before jumpLocalLabel_3, jmpLocalLabel_5 and callFUNC_3.

[0137] Understandable, Figure 6 The functions described are merely examples for the purpose of understanding this solution and do not constitute a limitation on the embodiments of this application.

[0138] Figure 7 A schematic diagram of the hardware structure of the electronic device 100 is shown.

[0139] Electronic device 100 may be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, in-vehicle device, smart home device and / or smart city device. The embodiments of this application do not impose any special restrictions on the specific type of electronic device.

[0140] The electronic device 100 can include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, a sensor module 180, a key 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 can include a pressure sensor 180A, a gyro sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0141] It can be understood that the structure shown in the embodiments of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 can include more or fewer components than shown, or combine certain components, or split certain components, or different arrangement of components. The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0142] The processor 110 can include one or more processing units, for example: the processor 110 can include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units can be independent devices, or can be integrated in one or more processors.

[0143] In some embodiments, the processor 110 can be configured to generate a position marker during execution of a function, and check the position marker before executing an indirect jump instruction to determine whether the function is executed from a start position. Further, the processor 110 can be configured to determine whether the function jump is from a specified type of indirect jump instruction before executing the function jump, so as to ensure the integrity of the control flow.

[0144] The controller can generate operation control signals according to the instruction operation code and the timing signal, to complete the control of fetching and executing instructions.

[0145] The processor 110 can also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory can store instructions or data that have just been used or are frequently used by the processor 110. If the processor 110 needs to use the instructions or data again, the processor 110 can directly call the instructions or data from the memory. This avoids repeated access and reduces the waiting time of the processor 110, thereby improving the efficiency of the system.

[0146] The charging management module 140 is configured to receive charging input from a charger. The charger can be a wireless charger or a wired charger. In some embodiments of wired charging, the charging management module 140 can receive charging input from a wired charger through the USB interface 130. In some embodiments of wireless charging, the charging management module 140 can receive wireless charging input through a wireless charging coil of the electronic device 100. The charging management module 140 can charge the battery 142 while also supplying power to the electronic device through the power management module 141.

[0147] The power management module 141 is configured to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to supply power to the processor 110, the internal memory 121, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be configured to monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage, impedance). In some other embodiments, the power management module 141 can also be provided in the processor 110. In some other embodiments, the power management module 141 and the charging management module 140 can also be provided in the same device.

[0148] The wireless communication function of the electronic device 100 can be realized through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, a modem processor, and a baseband processor.

[0149] Antennas 1 and 2 are used for transmitting and receiving electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization of antennas. For example, antenna 1 can be multiplexed as a diversity antenna for wireless local area networks. In some other embodiments, antennas can be used in combination with tuning switches.

[0150] Mobile communication module 150 can provide solutions for wireless communication including 2G / 3G / 4G / 5G, etc. applied on electronic device 100. Mobile communication module 150 can include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. Mobile communication module 150 can receive electromagnetic waves by antenna 1, and perform filtering, amplification, etc. on the received electromagnetic waves, and transmit the processed electromagnetic waves to a modem processor for demodulation. Mobile communication module 150 can also amplify signals modulated by the modem processor, and convert the amplified signals into electromagnetic waves radiated by antenna 1. In some embodiments, at least part of the functional modules of mobile communication module 150 can be arranged in processor 110. In some embodiments, at least part of the functional modules of mobile communication module 150 can be arranged in the same device as at least part of the modules of processor 110.

[0151] The modem processor can include a modulator and a demodulator. The modulator is used to modulate low-frequency baseband signals to be transmitted into medium-high frequency signals. The demodulator is used to demodulate received electromagnetic wave signals into low-frequency baseband signals. The demodulator then transmits the demodulated low-frequency baseband signals to a baseband processor for processing. The low-frequency baseband signals processed by the baseband processor are transmitted to an application processor. The application processor outputs sound signals through an audio device (not limited to loudspeaker 170A, microphone 170B, etc.), or displays images or videos through display screen 194. In some embodiments, the modem processor can be a separate device. In some other embodiments, the modem processor can be independent of processor 110, and arranged in the same device as mobile communication module 150 or other functional modules.

[0152] The wireless communication module 160 can provide a solution for wireless communication including wireless local area networks (WLAN) (e.g., wireless fidelity (Wi-Fi) network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR) technology, etc. applied to the electronic device 100. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives an electromagnetic wave via the antenna 2, demodulates and filters the electromagnetic wave signal, and transmits the processed signal to the processor 110. The wireless communication module 160 can also receive a signal to be transmitted from the processor 110, frequency-modulate it, amplify it, and radiate it as an electromagnetic wave via the antenna 2.

[0153] In some embodiments, the antenna 1 and the mobile communication module 150 of the electronic device 100 are coupled, and the antenna 2 and the wireless communication module 160 are coupled, so that the electronic device 100 can communicate with a network and other devices through wireless communication technology. The wireless communication technology can include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS can include a global positioning system (GPS), a global navigation satellite system (GLONASS), a beidu navigation satellite system (BDS), a quasi-zenith satellite system (QZSS), and / or a satellite based augmentation systems (SBAS).

[0154] The electronic device 100 implements a display function through a GPU, a display screen 194, and an application processor, etc. The GPU is a microprocessor for image processing, which is connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 can include one or more GPUs, which execute program instructions to generate or change display information.

[0155] The display screen 194 is configured to display images, videos, and the like. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD). The display panel can also be manufactured using an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a miniled, a microled, a micro-oled, a quantum dot light emitting diode (QLED), and the like. In some embodiments, the electronic device can include one or N display screens 194, where N is a positive integer greater than 1.

[0156] The electronic device 100 can implement a photographing function through an ISP, a camera 193, a video codec, a GPU, a display screen 194, and an application processor.

[0157] The ISP is configured to process data fed back by the camera 193. For example, when taking a photo, the shutter is opened, light is transmitted to the camera photosensitive element through the lens, the light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing to convert it into an image visible to the naked eye. The ISP can also perform algorithm optimization on the noise and brightness of the image. The ISP can also optimize the exposure, color temperature, and other parameters of the shooting scene. In some embodiments, the ISP can be disposed in the camera 193.

[0158] The camera 193 is configured to capture still images or videos. An object generates an optical image through a lens and projects it onto a photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then transmitted to the ISP to convert it into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV, or the like format. In some embodiments, the electronic device 100 can include one or N cameras 193, where N is a positive integer greater than 1.

[0159] The digital signal processor is used to process digital signals, in addition to being able to process digital image signals, it can also process other digital signals. For example, when the electronic device 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, etc.

[0160] The video codec is used to compress or decompress digital video. The electronic device 100 can support one or more video codecs. In this way, the electronic device 100 can play or record videos in multiple encoding formats, such as: moving picture experts group (MPEG) 1, MPEG 2, MPEG 3, MPEG 4, etc.

[0161] The internal memory 121 can include one or more random access memories (RAMs) and one or more non-volatile memories (NVMs).

[0162] The random access memory can be directly read and written by the processor 110, and can be used to store executable programs (such as machine instructions) of an operating system or other programs that are currently running, and can also be used to store data of users and application programs, etc.

[0163] The non-volatile memory can also store executable programs and store data of users and application programs, etc., which can be loaded into the random access memory in advance for direct reading and writing by the processor 110.

[0164] The external memory interface 120 can be used to connect an external non-volatile memory, to expand the storage capacity of the electronic device 100. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to realize data storage functions. For example, files such as music and video are saved in the external non-volatile memory.

[0165] The electronic device 100 can realize audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor, etc. For example, music playing, recording, etc.

[0166] The audio module 170 is used to convert digital audio information into analog audio signals, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or part of the functions of the audio module 170 can be arranged in the processor 110.

[0167] The speaker 170A, also called a "loudspeaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0168] The receiver 170B, also called a "earpiece", is used to convert an audio electrical signal into a sound signal. When the electronic device 100 receives a call or a voice message, the user can listen to the voice by holding the receiver 170B close to the ear.

[0169] The microphone 170C, also called a "microphone", "sound collector", is used to convert a sound signal into an electrical signal. When making a call or sending a voice message, the user can make a sound by holding the mouth close to the microphone 170C, and input the sound signal into the microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, in addition to collecting sound signals, noise reduction functions can also be realized. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C, to realize the functions of collecting sound signals, noise reduction, identifying sound sources, realizing directional recording, etc.

[0170] The earphone interface 170D is used to connect a wired earphone. The earphone interface 170D can be a USB interface 130, or a 3.5mm open mobile terminal platform (OMTP) standard interface, a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0171] The pressure sensor 180A is used to sense a pressure signal, and can convert the pressure signal into an electrical signal.

[0172] The gyroscope sensor 180B can be used to determine the motion posture of the electronic device 100.

[0173] The barometric sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude, assists positioning and navigation by the air pressure value measured by the barometric sensor 180C.

[0174] The magnetic sensor 180D includes a Hall sensor. The electronic device 100 can detect the opening and closing of a flip cover through the magnetic sensor 180D. In some embodiments, when the electronic device 100 is a flip phone, the electronic device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. In turn, according to the detected opening and closing state of the cover or the opening and closing state of the flip cover, the electronic device 100 can set the characteristics of automatic unlocking of the flip cover, etc.

[0175] The acceleration sensor 180E can detect the magnitude of acceleration of the electronic device 100 in each direction (typically, three axes). The magnitude and direction of gravity can be detected when the electronic device 100 is stationary. It can also be used to identify the electronic device posture, applied to the landscape / portrait screen switching, pedometer, etc.

[0176] The distance sensor 180F is used to measure distance. The electronic device 100 can measure distance by infrared or laser. In some embodiments, the scene is photographed, and the electronic device 100 can use the distance sensor 180F to measure distance to achieve fast focusing.

[0177] The proximity light sensor 180G can include, for example, a light-emitting diode (LED) and a light detector, such as a photodiode. The light-emitting diode can be an infrared light-emitting diode. The electronic device 100 emits infrared light outwardly through the light-emitting diode. The electronic device 100 detects infrared reflected light from nearby objects using the photodiode. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100.

[0178] The ambient light sensor 180L is used to sense ambient light brightness.

[0179] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application lock, fingerprint photographing, fingerprint answering, etc.

[0180] The temperature sensor 180J is used to detect temperature.

[0181] The touch sensor 180K, also known as a "touch device". The touch sensor 180K can be disposed on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also known as a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the touch event type. The visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be disposed on the surface of the electronic device 100, which is different from the position where the display screen 194 is located.

[0182] The bone conduction sensor 180M can obtain vibration signals.

[0183] The key 190 includes a power-on key, a volume key, etc. The key 190 can be a mechanical key. It can also be a touch key. The electronic device 100 can receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0184] The motor 191 can generate a vibration prompt.

[0185] The indicator 192 can be an indicator light, which can be used to indicate a charging state, a power change, and can also be used to indicate a message, a missed call, a notification, etc.

[0186] The SIM card interface 195 is used to connect a SIM card.

[0187] The electronic device can be a portable terminal device, such as a mobile phone, a tablet computer, a wearable device, etc., which runs an iOS, an Android, a Microsoft, or other operating system, and can also be a non-portable terminal device, such as a laptop computer with a touch-sensitive surface or a touch panel, a desktop computer with a touch-sensitive surface or a touch panel, etc. The software system of the electronic device 100 can adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture. The embodiment of the present application takes the Android system with a layered architecture as an example to exemplarily illustrate the software structure of the electronic device 100.

[0188] Figure 8 is a software structure block diagram of the electronic device 100 of the embodiment of the present application.

[0189] The layered architecture divides the software into several layers, each of which has a clear role and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom, an application layer, an application framework layer, an Android runtime and a system library, and a kernel layer.

[0190] The application layer can include a series of application packages.

[0191] As shown in Figure 8 , the application packages can include camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.

[0192] The application framework layer provides application programming interfaces (APIs) and programming frameworks for the applications of the application layer. The application framework layer includes some pre-defined functions.

[0193] As shown in Figure 8 , the application framework layer can include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, etc.

[0194] The window manager is used to manage window programs. The window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, and intercept the screen, etc.

[0195] Content providers store and retrieve data, making that data accessible to applications. This data may include videos, images, audio, made and received phone calls, browsing history and bookmarks, phone books, etc.

[0196] A view system includes visual controls, such as controls for displaying text and controls for displaying images. View systems can be used to build applications. A display interface can consist of one or more views. For example, a display interface including a text notification icon could include views for displaying text and views for displaying images.

[0197] The phone manager is used to provide communication functions for electronic device 100. For example, it manages call status (including connection and disconnection).

[0198] The file explorer provides applications with various resources, such as localized strings, icons, images, layout files, video files, and more.

[0199] The notification manager allows applications to display notifications in the status bar. These notifications can be used to deliver informational messages and can disappear automatically after a short pause, requiring no user interaction. For example, the notification manager can be used to notify users of completed downloads or message alerts. The notification manager can also display notifications as icons or scrolling text in the top status bar, such as notifications from background applications, or as dialog boxes on the screen. Examples include displaying text messages in the status bar, emitting sounds, vibrating electronic devices, and flashing indicator lights.

[0200] The Android Runtime consists of core libraries and a virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

[0201] The core library consists of two parts: one part is the functionalities that need to be called by the Java language, and the other part is the Android core library.

[0202] It is understandable that the core library and the virtual machine may include functions that insert the aforementioned tagging and verification modules during the compilation phase. In this way, when the electronic device 100 calls functions in the core library and uses the virtual machine, the tagging and verification modules inserted in the functions can be used to monitor whether there is a JOP attack during the function execution process.

[0203] The application layer and application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and application framework layer as binary files. The virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0204] The system library can include a plurality of functional modules. For example, a surface manager, media libraries, a three-dimensional graphics processing library (e.g., OpenGL ES), a 2D graphics engine (e.g., SGL), etc.

[0205] The surface manager is used to manage the display subsystem and provides a plurality of applications with a fusion of 2D and 3D layers.

[0206] The media libraries support a plurality of commonly used audio, video format playback and recording, and static image files, etc. The media libraries can support a plurality of audio and video encoding formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0207] The three-dimensional graphics processing library is used to implement three-dimensional graphics drawing, image rendering, synthesis, and layer processing, etc.

[0208] The 2D graphics engine is a drawing engine for 2D drawing.

[0209] The kernel layer is a layer between hardware and software. The kernel layer at least includes a display driver, a camera driver, an audio driver, and a sensor driver.

[0210] The following illustrates the working flow of the software and hardware of the electronic device 100 in a capture photographing scenario.

[0211] When the touch sensor 180K receives a touch operation, a corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, a timestamp of the touch operation, etc.). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the control corresponding to the input event. Taking the touch operation as a touch single click operation and the control corresponding to the touch single click operation as the control of the camera application icon as an example, the camera application calls an interface of the application framework layer, starts the camera application, and then starts the camera driver through the kernel layer, and captures a still image or a video through the camera 193.

[0212] It should be understood that each step in the above method embodiments can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software. The method steps disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution completion, or executed by a combination of hardware and software modules in the processor.

[0213] The application further provides an electronic device, which can include a memory and a processor. The memory can be used to store a computer program, and the processor can be used to call the computer program in the memory to enable the electronic device to perform the method performed by the electronic device 100 in any one of the above-mentioned embodiments.

[0214] The application further provides a chip system, which includes at least one processor for implementing the functions involved in the method performed by the electronic device 100 in any one of the above-mentioned embodiments.

[0215] In a possible design, the chip system further includes a memory for storing program instructions and data, and the memory is located in or outside the processor.

[0216] The chip system can be composed of a chip, or can include a chip and other discrete devices.

[0217] Optionally, the processor in the chip system can be one or more. The processor can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is enabled by reading software codes stored in the memory.

[0218] Optionally, the memory in the chip system can also be one or more. The memory can be integrated with the processor, or can be arranged separately from the processor, and the embodiments of the application do not make any limitation in this aspect. For example, the memory can be a non-transient processor, such as a read-only memory (ROM), which can be integrated on the same chip as the processor, or can be arranged on different chips respectively, and the embodiments of the application do not make any limitation on the type of the memory and the arrangement manner of the memory and the processor.

[0219] Exemplarily, the chip system can be a field programmable gate array (FPGA), can be an application specific integrated circuit (ASIC), can also be a system on chip (SoC), can also be a central processor unit (CPU), can also be a network processor (NP), can also be a digital signal processor (DSP), can also be a micro controller unit (MCU), can also be a programmable logic device (PLD) or other integrated chip.

[0220] The present application also provides a computer program product, which comprises a computer program (also referred to as code or instruction), which, when executed, causes a computer to perform the method executed by any one of the electronic devices 100 in any one of the above embodiments.

[0221] The present application also provides a computer readable storage medium, which stores a computer program (also referred to as code or instruction). When the computer program is executed, it causes a computer to perform the method executed by any one of the electronic devices 100 in any one of the above embodiments.

[0222] It should be understood that the processor in the embodiments of the present application can be an integrated circuit chip with processing capability of signals. In the implementation process, each step of the method embodiments described above can be completed by integrated logic circuits or instructions in the form of software in the processor. The processor described above can be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Each method, step and logic block diagram disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.

[0223] In addition, the embodiments of the present application also provide a device. The device can be specifically a component or a module, and the device can include one or more processors and memories connected thereto. The memory is used to store a computer program. When the computer program is executed by the one or more processors, the device executes the method in each of the above method embodiments.

[0224] Among them, the device, computer readable storage medium, computer program product or chip provided by the embodiments of the present application are used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved are referred to the beneficial effects in the corresponding method provided above, which will not be described here.

[0225] The embodiments of the present application can be combined in any way to achieve different technical effects.

[0226] In the above embodiments, all or part of the methods can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the methods can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0227] Those of ordinary skill in the art can understand that all or part of the processes in the above embodiments can be implemented by a computer program to instruct the relevant hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The storage medium includes ROM or random access memory (RAM), magnetic disk or optical disk, and various media that can store program codes.

[0228] In summary, the above only describes the embodiments of the technical solutions of the present application, and is not used to limit the protection scope of the present application. Any modifications, equivalent replacements, improvements, etc. made according to the disclosure of the present application shall be included in the protection scope of the present application.

Claims

1. A control flow integrity protection method, characterized by, The method comprises: If the first function is executed from a starting position of the first function, the electronic device generates a first position mark, and executes the first function from the starting position of the first function; Before executing a first indirect jump instruction in the first function, the electronic device determines whether the first function is executed from the starting position of the first function by checking the position mark; If yes, the electronic device executes the first indirect jump instruction; If no, the electronic device suspends execution of the first function.

2. The method according to claim 1, wherein the electronic device determines whether the first function is executed from the starting position of the first function by checking the position mark, specifically comprising: The electronic device determines whether a position mark is generated when the first function is executed; If yes, it is determined that the first function is executed from the starting position of the first function; If no, it is determined that the first function is not executed from the starting position of the first function.

3. The method according to claim 1, wherein the electronic device determines whether the first function is executed from the starting position of the first function by checking the position mark, specifically comprising: The electronic device generates a second position mark, and determines whether the second position mark is the same as the first position mark generated by the electronic device when the first function is executed; If yes, it is determined that the first function is executed from the starting position of the first function; If no, it is determined that the first function is not executed from the starting position of the first function. The first position mark is used to indicate that the first function is executed from the starting position of the first function. The first position mark is a random number or a first address in a first register.

4. The method according to any one of claims 1 to 3, characterized in that, The starting position of the first function comprises a first instruction segment, the first instruction segment is used to generate the first position mark, and the first indirect jump instruction is followed by a second instruction segment, the last instruction of the second instruction segment is the last instruction of the first indirect jump instruction, and the second instruction segment is used to determine whether the first function is executed from the starting position of the first function.

5. The method according to any one of claims 1 to 3, characterized in that, The method further comprises:

6. The method according to any one of claims 1 to 3, characterized in that, The electronic device jumps to a second function by executing the first indirect jump instruction; 7. The method according to any one of claims 1 to 3, characterized in that, Before executing the second function, the electronic device determines whether the first indirect jump instruction belongs to an inter-function jump instruction; If yes, the electronic device executes the second function; If no, the electronic device suspends execution of the second function. Before the electronic device executes the first indirect jump instruction, the method further comprises: The electronic device generates a first jump mark, and the first jump mark is used to indicate whether the first indirect jump instruction belongs to an inter-function jump instruction; 8. The method of claim 7, wherein, The electronic device determines whether the first indirect jump instruction belongs to an inter-function jump instruction, specifically comprising: The electronic device determines whether the first indirect jump instruction belongs to an inter-function jump instruction based on the first jump mark. ​ ​ 9. The method of claim 8, wherein, The start position of the second function includes a first instruction segment, the first instruction segment is used for judging whether an indirect jump instruction used for jumping to the second function belongs to an inter-function jump instruction, a second instruction segment is included before the first indirect jump instruction, a last instruction of the second instruction segment is a previous instruction of the first indirect jump instruction, and the second instruction segment is used for generating the first jump mark.

10. An electronic device, comprising: An electronic device including memory, one or more processors, and one or more programs; the one or more processors, when executing the one or more programs, cause the electronic device to implement the method according to any one of claims 1 to 9.

11. A computer-readable storage medium comprising instructions, wherein: The instructions, when executed on an electronic device, cause the electronic device to perform the method according to any one of claims 1 to 9.

Images