Security defense method and device and electronic equipment

Abstract

The invention discloses a security defense method and device and electronic equipment, and the method comprises the steps: disassembling a shellcode file to obtain an assembly code file, grouping each assembly instruction to obtain a grouping set when the assembly code file meets a preset condition, adding a jump instruction for the tail of each group of instruction, converting the jump instruction into a corresponding Double value, and sending the Double value to a server; the method comprises the following steps of: establishing a Double array by utilizing a Double value to obtain a target html test file, changing a code execution initial address of an optimization function into an initial address of a Double array element, and calling the optimization function to execute shellcode, so that a security defense system detects whether a malicious code exists in a sample file or not according to whether the Double array element in the sample file is executed or not. According to the method, whether malicious codes exist in the sample file or not can be detected according to whether the Double array elements in the sample file are executed or not, so that a security defense strategy is formulated.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and more specifically, to a security defense method, device and electronic equipment. Background Art

[0002] Browser security involves the use of browser vulnerabilities to execute malicious code. Among the most destructive browser vulnerabilities, most of them eventually turn into browser memory corruption vulnerabilities. After the browser gains the ability to read and write arbitrary memory, it needs to copy the executable code shellcode to the memory with read / write / execute (rwx) permissions to execute arbitrary code. In the existing vulnerability exploitation chain, the read / write / execute (rwx) permissions of the memory of the wasm export function are usually used to achieve the purpose of executing shellcode.

[0003] As such problems emerged, Google proposed the wasm mprotect mitigation measure, which prevented the memory write and execution of wasm export functions from coexisting (w^x), effectively blocking the loading and execution of shellcode.

[0004] However, the new network attacks completely abandon the use of wasm export functions, and the existing security defense system is not enough to deal with the new network attacks by checking whether the code content of wasm export functions has changed. Therefore, how to improve the protection ability of network security products has become a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0005] In view of this, the present invention discloses a security defense method, device and electronic device, so as to propose a security defense strategy for loading and executing shellcode, so as to achieve the purpose of improving network security defense.

[0006] A security defense method, comprising:

[0007] Disassemble the shellcode file to obtain the assembly code file;

[0008] When the assembly code file meets the preset file requirements, grouping the assembly instructions in the assembly code file according to the instruction size to obtain a grouping set containing multiple groups of instructions;

[0009] Traversing each group of instructions in the grouped set, adding a jump instruction for jumping to the next element at the end of each group of instructions, and converting each group of instructions to which the jump instruction is added into a corresponding Double value;

[0010] After traversing each group of instructions in the grouping set, an original html test file is created in the directory of the started http server, and a Double array is created using each of the Double values ​​in the optimization function of the original html test file to obtain a target html test file;

[0011] Modify the code execution start address of the optimization function to the start address of the Double array element in the target html test file;

[0012] The optimized function whose address has been modified is called to load and execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

[0013] Optionally, the shellcode file is disassembled to obtain an assembly code file, including:

[0014] The shellcode file is disassembled using the objdump tool to obtain the assembly code file.

[0015] Optionally, when the assembly code file meets the preset file requirement, grouping the assembly instructions in the assembly code file according to the instruction size to obtain a grouping set containing multiple groups of instructions includes:

[0016] When the assembly code file functions normally, the file size of the assembly code file is smaller than a file threshold, and the assembly instructions in the assembly code file all meet the encoding requirements, the assembly instructions in the assembly code file are grouped according to the instruction size to obtain the grouping set.

[0017] Optionally, it also includes:

[0018] When the assembly code file does not meet the preset file requirements, modifying the assembly instructions in the assembly code file to obtain a modified target assembly code file;

[0019] The target assembly code file is compiled to obtain a latest shellcode file, and the decompilation operation of the latest shellcode file is performed again.

[0020] Optionally, when the assembly code file does not meet the preset file requirement, the process of modifying the assembly instructions in the assembly code file includes:

[0021] When the assembly code file does not function properly, modifying the assembly instructions in the assembly code file that do not function properly;

[0022] When the file size of the assembly code file is not less than the file threshold, simplifying the assembly code file to obtain an assembly code file smaller than the file threshold;

[0023] When the assembly instructions in the assembly code file do not meet the encoding requirements, the assembly instructions that do not meet the encoding requirements are modified until the encoding requirements are met.

[0024] Optionally, adding a jump instruction for jumping to the next element at the end of each group of instructions includes:

[0025] Determining whether the total length of each group of instructions is less than a preset length;

[0026] If yes, fill each group of instructions shorter than the preset length with NOP instructions to obtain a target instruction group with a total length equal to the preset length;

[0027] The jump instruction for jumping to the next element is added at the end of the target instruction group.

[0028] If not, the jump instruction for jumping to the next element is added at the end of each group of instructions.

[0029] Optionally, modifying the code execution start address of the optimization function to the start address of the Double array in the target HTML test file, and calling the optimized function with the modified address to execute the shellcode, comprises:

[0030] Performing coding correctness check on the target HTML test file;

[0031] When the target html test file passes the coding correctness check, the code execution start address of the optimization function is modified to the start address of the Double array in the target html test file;

[0032] Call the optimized function with modified address to execute shellcode.

[0033] Optionally, it also includes:

[0034] When the target html test file fails to pass the coding correctness check, the assembly instructions in the assembly code file are modified and re-encoded.

[0035] Optionally, the optimization function is a TurboFan optimization compilation function.

[0036] A security defense device, comprising:

[0037] The disassembly unit is used to disassemble the shellcode file to obtain an assembly code file;

[0038] A grouping unit, used for grouping the assembly instructions in the assembly code file according to the instruction size to obtain a grouping set containing multiple groups of instructions when the assembly code file meets the preset file requirements;

[0039] A traversal unit, used for traversing each group of instructions in the grouped set, adding a jump instruction for jumping to the next element at the end of each group of instructions, and converting each group of instructions to which the jump instruction is added into a corresponding Double value;

[0040] A file creation unit, used for creating an original html test file in the directory of the started http server after traversing each group of instructions of the grouping set, and creating a Double array by using each Double value in the optimization function of the original html test file to obtain a target html test file;

[0041] A modification unit, used for modifying the code execution start address of the optimization function to the start address of the Double array element in the target HTML test file;

[0042] The defense unit is used to call the optimized function with modified address to load and execute shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

[0043] An electronic device, comprising: a memory and a processor;

[0044] The memory is used to store at least one instruction;

[0045] The processor is used to execute the at least one instruction to implement the security defense method described above.

[0046] As can be seen from the above technical scheme, the present invention discloses a security defense method, device and electronic device, which disassembles a shellcode file to obtain an assembly code file. When the assembly code file meets the preset file requirements, each assembly instruction in the assembly code file is grouped according to the instruction size to obtain a group set containing multiple groups of instructions, each group of instructions in the group set is traversed, and a jump instruction for jumping to the next element is added to the end of each group of instructions, and each group of instructions after adding the jump instruction is converted into a corresponding Double value. After traversing each group of instructions in the group set, an original HTML test file is created in the directory of the started http server, and a Double array is created using each Double value in the optimization function of the original HTML test file to obtain a target HTML test file, the code execution start address of the optimization function is modified to the start address of the Double array element in the target HTML test file, and the optimization function with the modified address is called to execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed. The present application omits the use of the memory of the wasm export function, thereby omitting the process of copying the shellcode to the executable memory. By utilizing the compilation characteristics of the optimization function to define the Double array and the executableness of the optimization function memory, the shellcode is loaded and executed, so that the security defense system can detect whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed, so as to formulate corresponding security defense strategies in time and take the initiative to defend before the attack occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without paying creative work.

[0048] Figure 1 A flow chart of a security defense method disclosed in an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the structure of a security defense device disclosed in an embodiment of the present invention;

[0050] Figure 3 The present invention is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses a security defense method, device and electronic device. A shellcode file is disassembled to obtain an assembly code file. When the assembly code file meets the preset file requirements, each assembly instruction in the assembly code file is grouped according to the instruction size to obtain a group set containing multiple groups of instructions. Each group of instructions in the group set is traversed, and a jump instruction for jumping to the next element is added to the end of each group of instructions. Each group of instructions after the jump instruction is added is converted into a corresponding Double value. After traversing each group of instructions in the group set, an original HTML test file is created in the directory of a started HTTP server, and a Double array is created by using each Double value in an optimization function of the original HTML test file to obtain a target HTML test file. The code execution start address of the optimization function is modified to the start address of the Double array element in the target HTML test file, and the optimization function with the modified address is called to execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed. The present application omits the use of the memory of the wasm export function, thereby omitting the process of copying the shellcode to the executable memory. By utilizing the compilation characteristics of the optimization function to define the Double array and the executableness of the optimization function memory, the shellcode is loaded and executed, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed, so as to formulate corresponding security defense strategies in time and take the initiative to defend before the attack occurs.

[0053] See also Figure 1 , a flow chart of a security defense method disclosed in an embodiment of the present invention, the method comprising:

[0054] Step S101, disassemble the shellcode file to obtain an assembly code file.

[0055] It should be noted that when this application loads and executes shellcode, it can start the Chromium browser and http server, using the Python script development environment, nasm and other assembly code compilers, debuggers and objdump binary file viewing tools.

[0056] The shellcode file is a binary file.

[0057] The Chromium browser can be started using the following startup command for debugging. The startup command is as follows:

[0058] . / Chromium --js-flags=”--allow-natives-syntax --no-maglev”

[0059] The dependency packages required for the Python script development environment are as follows:

[0060] pwnlib: used for assembling and disassembling assembly instructions.

[0061] commad: used to check the output content after the program is run.

[0062] struct: used for type conversion: 64-bit integer value is converted to Double value.

[0063] The present application can use the objdump tool to obtain the assembly code file when disassembling the shellcode file, so as to adjust and recompile the shellcode file later.

[0064] objdump is a command-line tool in the GNU Binutils toolset that helps developers view and analyze the internal structure of executable files, object files, and shared libraries.

[0065] Step S102: When the assembly code file meets the preset file requirement, the assembly instructions in the assembly code file are grouped according to the instruction size to obtain a group set including multiple groups of instructions.

[0066] Specifically, when the assembly code file functions normally, the file size of the assembly code file is less than the file threshold, and the assembly instructions in the assembly code file all meet the encoding requirements, it is determined that the assembly code file meets the preset file requirements. At this time, the individual assembly instructions in the assembly code file are grouped according to the instruction size to obtain the group set.

[0067] The value of the file threshold is determined according to actual needs, such as 1 KB, and the present invention does not limit it here.

[0068] In actual applications, the assembly code file contains many assembly instructions, and the sizes of different assembly instructions may be different. This application groups the various assembly instructions in the assembly code file based on the instruction size to obtain a grouping set containing multiple groups of instructions. The total length of each group of instructions in the grouping set should not exceed 6 bytes.

[0069] Step S103, traverse each group of instructions in the group set, add a jump instruction for jumping to the next element at the end of each group of instructions, and convert each group of instructions to which the jump instruction is added into a corresponding Double value.

[0070] A jump instruction is an instruction that changes the execution flow of a program unconditionally or based on conditional judgment. It can jump the execution flow of a program from the current position to a specified position, thereby changing the execution order of the program. This application adds a jump instruction at the end of each group of instructions so that each group of instructions can jump to the next element smoothly after execution.

[0071] In computer science, especially in programming, a double value refers to a double-precision floating-point number data type. Inside the computer, a Double value is stored in binary format and uses a floating-point representation method to approximate real numbers.

[0072] In actual applications, you can use a debugger or the struct dependency package in the development environment to convert each set of instructions into a corresponding Double value.

[0073] It should be noted that the assembly code file obtained by disassembling the shellcode file in this application is divided into several groups according to the instruction size during execution, and each group is connected by jump instructions, which will not change the execution semantics of the original shellcode. The grouping method of shellcode instructions greatly reduces memory usage and also provides the possibility of encoding larger shellcode files in the future.

[0074] Step S104, after traversing all the groups of instructions in the grouping set, create an original html test file in the directory of the started http server, and create a Double array using each of the Double values ​​in the optimization function of the original html test file to obtain a target html test file.

[0075] In actual applications, you can use the launched Chromium browser to access the target html test file.

[0076] Preferably, the optimization function in the present application may be a TurboFan optimization compilation function.

[0077] The JavaScript script parsing language is a weakly typed language, and its type can change at any time during runtime. In order to improve compilation efficiency, the Chromium browser in this application uses the TurboFan optimization compilation function to optimize the compilation of the code that is executed multiple times.

[0078] If a Double array variable is defined in a TurboFan optimization compilation function, the TurboFan optimization compilation function will use the assembly instructions shown below to assign values ​​to the Double array, and each array element is stored in the backend cache in turn through a 64-bit movq instruction.

[0079] The assembly instructions are as follows:

[0080]

[0081] A Double array element (8 bytes) can be divided into a 6-byte instruction set and a 2-byte jump instruction. The 6 bytes can represent one or more assembly instructions. The jump instruction can jump to the next array element to continue execution. By using the characteristics of defining a Double array in an optimization function, the shellcode can be stored as a Double array in the optimization function.

[0082] Step S105: modify the code execution start address of the optimization function to the start address of the Double array element in the target HTML test file.

[0083] Each Double array element is a value in the Double array.

[0084] In this application, by modifying the code execution start address of the optimization function to the start address of the Double array element, the optimized function with the modified address is called to execute the shellcode, and the shellcode encoding process is completed.

[0085] Step S106: Call the optimized function with modified address to execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

[0086] The necessary condition for shellcode execution is that the shellcode can be copied to the executable memory and can be executed. Through the method of loading and executing shellcode disclosed in this application, the encoded shellcode can be completely copied to the executable memory of the optimization function. In the case where the program has arbitrary memory read and write, the optimization function entry address is modified to the starting address of the first element of the array, and the function can be called to execute any shellcode. The execution effect of shellcode is as follows:

[0087]

[0088] In summary, the present application discloses a security defense method, which disassembles a shellcode file to obtain an assembly code file. When the assembly code file meets the preset file requirements, the assembly instructions in the assembly code file are grouped according to the instruction size to obtain a group set containing multiple groups of instructions, each group of instructions in the group set is traversed, and a jump instruction for jumping to the next element is added to the end of each group of instructions, and each group of instructions after the jump instruction is added is converted into a corresponding Double value. After traversing each group of instructions in the group set, an original html test file is created in the directory of the started http server, and a Double array is created using each Double value in the optimization function of the original html test file to obtain a target html test file, the code execution start address of the optimization function is modified to the start address of the Double array element in the target html test file, and the optimization function with the modified address is called to execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed. The present application omits the use of the memory of the wasm export function, thereby omitting the process of copying the shellcode to the executable memory. By utilizing the compilation characteristics of the optimization function to define the Double array and the executableness of the optimization function memory, the shellcode is loaded and executed, so that whether the Double array element in the sample file of the security defense system is executed can detect whether there is malicious code in the sample file, so as to formulate corresponding security defense strategies in time and take the initiative to defend before the attack occurs.

[0089] In addition, this application omits the process of copying shellcode to executable memory in the vulnerability exploitation development, reduces memory operations, and does not change memory access permissions, making the exploitation more stable.

[0090] In one embodiment, the security defense method may further include:

[0091] (1) When the assembly code file does not meet the preset file requirements, the assembly instructions in the assembly code file are modified to obtain a modified target assembly code file.

[0092] Specifically, ① when the assembly code file does not function properly, the assembly instructions with the abnormal functions in the assembly code file are modified to make them function normally.

[0093] Among them, checking whether the assembly code file functions normally mainly checks whether the shellcode can run normally. If not, the corresponding assembly instructions need to be modified to make it function normally.

[0094] ② When the file size of the assembly code file is not less than the file threshold, the assembly code file is streamlined to obtain an assembly code file that is smaller than the file threshold.

[0095] The value of the file threshold is determined according to actual needs, for example, 1 KB.

[0096] Specifically, when the size of the assembly code file is not less than the file threshold, the assembly instructions exceeding the file threshold are streamlined, that is, the shellcode is streamlined, and the streamlining includes: removing repeated and redundant assembly instructions, redundant functions, etc. Shellcode is the first code to be executed as any executable code, and is generally more concise.

[0097] ③ When the assembly instructions in the assembly code file do not meet the encoding requirements, the assembly instructions that do not meet the encoding requirements are modified until the encoding requirements are met.

[0098] Specifically, the encoding logic determines that the size of assembly instructions cannot exceed 6 bytes, and it is necessary to make equivalent adjustments to long jump instructions. Assembly instructions that are repeated multiple times will be ignored by the encoding, and such instructions need to be replaced with equivalent instructions. Some special instructions such as or will be ignored by the encoding, and such instructions need to be replaced with equivalent instructions. Check whether the memory addressing offset of the jump address is correct.

[0099] (2) Compiling the target assembly code file to obtain a latest shellcode file, and returning to step S101 to perform a disassembly operation on the latest shellcode file again.

[0100] In one embodiment, the process of adding a jump instruction to jump to the next element at the end of each group of instructions may specifically include:

[0101] (1) Determining whether the total length of each group of instructions is less than a preset length;

[0102] The value of the preset length is determined according to actual needs, for example, the preset length can be 6 bytes.

[0103] (2) If yes, use NOP instructions to fill each group of instructions that is shorter than the preset length to obtain a target instruction group whose total length is equal to the preset length.

[0104] The NOP (No Operation) instruction is usually regarded as a pseudo-instruction in assembly language, which is used to provide assembly information to the assembler during the assembly process, but it does not generate executable machine code itself. The principle of using the NOP instruction for filling is mainly based on the characteristics of the NOP instruction such as no side effects, placeholders, alignment, and its application in memory alignment, instruction pipeline optimization, delay control, debugging and testing, and safe filling. By inserting NOP instructions reasonably, the execution efficiency, security, and debuggability of the program can be improved.

[0105] (3) Add the jump instruction for jumping to the next element at the end of the target instruction group.

[0106] (4) If not, add the jump instruction for jumping to the next element at the end of each group of instructions.

[0107] In one embodiment, step S105 may specifically include:

[0108] (1) Check the encoding correctness of the target HTML test file.

[0109] In actual applications, the debugger can be used to check the encoding correctness of the target HTML test file.

[0110] (2) When the target HTML test file passes the coding correctness check, the code execution start address of the optimization function is modified to the start address of the Double array in the target HTML test file.

[0111] In some cases, directly accessing data in memory (such as a Double array) can bypass the abstraction layer provided by high-level languages, thereby reducing unnecessary overhead and improving program execution efficiency. By modifying the code execution start address of the optimized function to the Double array start address, the optimized function can directly read or write data from this address, eliminating the need for additional memory access operations.

[0112] In one embodiment, the security defense method may further include:

[0113] When the target html test file fails to pass the coding correctness check, the assembly instructions in the assembly code file are modified and re-encoded.

[0114] In summary, the code in this application is dynamically generated, that is, coding and checking complement each other, ensuring the accuracy of the coding.

[0115] Corresponding to the above method embodiment, the present invention also discloses a security defense device.

[0116] See also Figure 2 , a schematic diagram of the structure of a security defense device disclosed in an embodiment of the present invention, the device may include:

[0117] The disassembly unit 201 is used to disassemble the shellcode file to obtain an assembly code file.

[0118] It should be noted that when this application loads and executes shellcode, it can start the Chromium browser and http server, using the Python script development environment, nasm and other assembly code compilers, debuggers and objdump binary file viewing tools.

[0119] The shellcode file is a binary file.

[0120] The Chromium browser can be started using the following startup command for debugging. The startup command is as follows:

[0121] . / Chromium --js-flags=”--allow-natives-syntax --no-maglev”

[0122] The dependency packages required for the Python script development environment are as follows:

[0123] pwnlib: used for assembling and disassembling assembly instructions.

[0124] commad: used to check the output content after the program is run.

[0125] struct: used for type conversion: 64-bit integer value is converted to Double value.

[0126] The present application can use the objdump tool to obtain the assembly code file when disassembling the shellcode file, so as to adjust and recompile the shellcode file later.

[0127] objdump is a command line tool in the GNU Binutils toolset that helps developers view and analyze the internal structure of executable files, object files, and shared libraries.

[0128] The grouping unit 202 is used to group the assembly instructions in the assembly code file according to the instruction size to obtain a group set containing multiple groups of instructions when the assembly code file meets the preset file requirements.

[0129] The grouping unit 202 can be specifically used for: when the assembly code file functions normally, the file size of the assembly code file is less than the file threshold, and the assembly instructions in the assembly code file all meet the encoding requirements, determining that the assembly code file meets the preset file requirements, at this time, grouping the various assembly instructions in the assembly code file according to the instruction size to obtain the grouping set.

[0130] The value of the file threshold is determined according to actual needs, such as 1 KB, and the present invention does not limit it here.

[0131] In actual applications, the assembly code file contains many assembly instructions, and the sizes of different assembly instructions may be different. This application groups the various assembly instructions in the assembly code file based on the instruction size to obtain a grouping set containing multiple groups of instructions. The total length of each group of instructions in the grouping set should not exceed 6 bytes.

[0132] The traversal unit 203 is used to traverse each group of instructions in the grouped set, add a jump instruction for jumping to the next element at the end of each group of instructions, and convert each group of instructions to which the jump instruction is added into a corresponding Double value.

[0133] It should be noted that the assembly code file obtained by disassembling the shellcode file in this application is divided into several groups according to the instruction size during execution, and each group is connected by jump instructions, which will not change the execution semantics of the original shellcode. The grouping method of shellcode instructions greatly reduces memory usage and also provides the possibility of encoding larger shellcode files in the future.

[0134] The file creation unit 204 is used to create an original HTML test file in the directory of the started http server after traversing each group of instructions in the grouping set, and create a Double array using each Double value in the optimization function of the original HTML test file to obtain a target HTML test file.

[0135] In actual applications, you can use the launched Chromium browser to access the target html test file.

[0136] Preferably, the optimization function in the present application may be a TurboFan optimization compilation function.

[0137] The modifying unit 205 is used to modify the code execution start address of the optimization function to the start address of the Double array element in the target HTML test file.

[0138] Each Double array element is a value in the Double array.

[0139] In this application, by modifying the code execution start address of the optimization function to the start address of the Double array element, the optimized function with the modified address is called to execute the shellcode, and the shellcode encoding process is completed.

[0140] The defense unit 206 is used to call the optimized function with modified address to load and execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

[0141] The necessary condition for shellcode execution is that the shellcode can be copied to the executable memory and can be executed. Through the method of loading and executing shellcode disclosed in the present application, the encoded shellcode can be completely copied to the executable memory of the optimization function. In the case where the program has arbitrary memory read and write, the optimization function entry address is modified to the starting address of the first element of the array, and the function can be called to execute any shellcode.

[0142] In summary, the present application discloses a security defense device, which disassembles a shellcode file to obtain an assembly code file. When the assembly code file meets the preset file requirements, each assembly instruction in the assembly code file is grouped according to the instruction size to obtain a group set containing multiple groups of instructions, each group of instructions in the group set is traversed, and a jump instruction for jumping to the next element is added to the end of each group of instructions, and each group of instructions after adding the jump instruction is converted into a corresponding Double value. After traversing each group of instructions in the group set, an original html test file is created in the directory of the started http server, and a Double array is created using each Double value in the optimization function of the original html test file to obtain a target html test file, the code execution start address of the optimization function is modified to the start address of the Double array element in the target html test file, and the optimization function with the modified address is called to execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed. The present application omits the use of the memory of the wasm export function, thereby omitting the process of copying the shellcode to the executable memory. By utilizing the compilation characteristics of the optimization function to define the Double array and the executableness of the optimization function memory, the shellcode is loaded and executed, so that whether the Double array element in the sample file of the security defense system is executed can detect whether there is malicious code in the sample file, so as to formulate corresponding security defense strategies in time and take the initiative to defend before the attack occurs.

[0143] In addition, this application omits the process of copying shellcode to executable memory in the vulnerability exploitation development, reduces memory operations, and does not change memory access permissions, making the exploitation more stable.

[0144] In one embodiment, the security defense device may further include:

[0145] A modification unit, used for modifying the assembly instructions in the assembly code file to obtain a modified target assembly code file when the assembly code file does not meet the preset file requirements;

[0146] The compiling unit is used to compile the target assembly code file to obtain a latest shellcode file, and return to perform the disassembly operation on the latest shellcode file again.

[0147] In one embodiment, the modification unit is specifically configured to:

[0148] When the assembly code file does not function properly, modifying the assembly instructions in the assembly code file that do not function properly;

[0149] When the file size of the assembly code file is not less than the file threshold, simplifying the assembly code file to obtain an assembly code file smaller than the file threshold;

[0150] When the assembly instructions in the assembly code file do not meet the encoding requirements, the assembly instructions that do not meet the encoding requirements are modified until the encoding requirements are met.

[0151] In one embodiment, the traversal unit 203 may be specifically used for:

[0152] Determining whether the total length of each group of instructions is less than a preset length;

[0153] If yes, fill each group of instructions shorter than the preset length with NOP instructions to obtain a target instruction group with a total length equal to the preset length;

[0154] The jump instruction for jumping to the next element is added at the end of the target instruction group.

[0155] If not, the jump instruction for jumping to the next element is added at the end of each group of instructions.

[0156] In one embodiment, the modification unit 205 may be specifically configured to:

[0157] Performing coding correctness check on the target HTML test file;

[0158] When the target html test file passes the coding correctness check, the code execution start address of the optimization function is modified to the start address of the Double array in the target html test file.

[0159] Call the optimized function with modified address to execute shellcode.

[0160] In one embodiment, the modification unit 205 may be further configured to:

[0161] When the target html test file fails to pass the coding correctness check, the assembly instructions in the assembly code file are modified and re-encoded.

[0162] Corresponding to the above embodiment, Figure 3 As shown, the present invention also provides an electronic device, which may include: a processor 1 and a memory 2;

[0163] The processor 1 and the memory 2 communicate with each other via a communication bus 3;

[0164] Processor 1, configured to execute at least one instruction;

[0165] Memory 2, used to store at least one instruction;

[0166] The processor 1 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0167] The memory 2 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0168] Among them, the processor executes at least one instruction to implement the steps shown in the security defense method embodiment.

[0169] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0170] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0171] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security defense method, characterized in that: include: Disassemble the shellcode file to obtain the assembly code file; When the assembly code file meets the preset file requirements, grouping the assembly instructions in the assembly code file according to the instruction size to obtain a grouping set containing multiple groups of instructions; Traversing each group of instructions in the grouped set, adding a jump instruction for jumping to the next element at the end of each group of instructions, and converting each group of instructions to which the jump instruction is added into a corresponding Double value; After traversing each group of instructions in the grouping set, an original html test file is created in the directory of the started http server, and a Double array is created using each of the Double values ​​in the optimization function of the original html test file to obtain a target html test file; Modify the code execution start address of the optimization function to the start address of the Double array element in the target html test file; The optimized function whose address has been modified is called to load and execute the shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

2. The security defense method according to claim 1, characterized in that: The shellcode file is disassembled to obtain an assembly code file, including: The shellcode file is disassembled using the objdump tool to obtain the assembly code file.

3. The security defense method according to claim 1 or 2, characterized in that: When the assembly code file meets the preset file requirements, each assembly instruction in the assembly code file is grouped according to the instruction size to obtain a grouping set containing multiple groups of instructions, including: When the assembly code file functions normally, the file size of the assembly code file is smaller than a file threshold, and the assembly instructions in the assembly code file all meet the encoding requirements, the assembly instructions in the assembly code file are grouped according to the instruction size to obtain the grouping set.

4. The security defense method according to claim 1 or 2, characterized in that: Also includes: When the assembly code file does not meet the preset file requirements, modifying the assembly instructions in the assembly code file to obtain a modified target assembly code file; The target assembly code file is compiled to obtain a latest shellcode file, and the decompilation operation of the latest shellcode file is performed again.

5. The security defense method according to claim 4, characterized in that: When the assembly code file does not meet the preset file requirement, the process of modifying the assembly instructions in the assembly code file includes: When the assembly code file does not function properly, modifying the assembly instructions in the assembly code file that do not function properly; When the file size of the assembly code file is not less than the file threshold, simplifying the assembly code file to obtain an assembly code file smaller than the file threshold; When the assembly instructions in the assembly code file do not meet the encoding requirements, the assembly instructions that do not meet the encoding requirements are modified until the encoding requirements are met.

6. The security defense method according to claim 1, characterized in that: The step of adding a jump instruction to jump to the next element at the end of each group of instructions comprises: Determining whether the total length of each group of instructions is less than a preset length; If yes, fill each group of instructions shorter than the preset length with NOP instructions to obtain a target instruction group with a total length equal to the preset length; The jump instruction for jumping to the next element is added at the end of the target instruction group. If not, the jump instruction for jumping to the next element is added at the end of each group of instructions.

7. The security defense method according to claim 1 or 6, characterized in that: The step of modifying the code execution start address of the optimization function to the start address of the Double array in the target HTML test file includes: Performing coding correctness check on the target HTML test file; When the target html test file passes the coding correctness check, the code execution start address of the optimization function is modified to the start address of the Double array in the target html test file.

8. The security defense method according to claim 7, characterized in that: Also includes: When the target html test file fails to pass the coding correctness check, the assembly instructions in the assembly code file are modified and re-encoded.

9. The security defense method according to claim 1, characterized in that: The optimization function is a TurboFan optimization compilation function.

10. A security defense device, characterized in that: include: The disassembly unit is used to disassemble the shellcode file to obtain an assembly code file; A grouping unit, used for grouping the assembly instructions in the assembly code file according to the instruction size to obtain a grouping set containing multiple groups of instructions when the assembly code file meets the preset file requirements; A traversal unit, used for traversing each group of instructions in the grouped set, adding a jump instruction for jumping to the next element at the end of each group of instructions, and converting each group of instructions to which the jump instruction is added into a corresponding Double value; A file creation unit, used for creating an original html test file in the directory of the started http server after traversing each group of instructions of the grouping set, and creating a Double array by using each Double value in the optimization function of the original html test file to obtain a target html test file; A modification unit, used for modifying the code execution start address of the optimization function to the start address of the Double array element in the target HTML test file; The defense unit is used to call the optimized function with modified address to load and execute shellcode, so that the security defense system detects whether there is malicious code in the sample file according to whether the Double array element in the sample file is executed.

11. An electronic device, characterized in that: The electronic device comprises: a memory and a processor; The memory is used to store at least one instruction; The processor is used to execute the at least one instruction to implement the security defense method as described in any one of claims 1 to 9.

Images