Method and device for detecting replacement of memory function pointer

Abstract

The invention provides a method and device for detecting replacement of a memory function pointer, and the method comprises the following steps: reading a physical file of a target module, and loading the physical file into a memory to form a first memory region; reading a complete memory corresponding to the target module from the memory to form a second memory area; according to the type of the operating system, an executable program head of the target module is analyzed, and a list of functions and function pointers which can be modified by a system loader is obtained; analyzing an executable program head of the first memory area, and comparing code segments in the first memory area and the second memory area to obtain a comparison result; according to the comparison result, on the basis of a preset judgment standard, the replaced content of the memory function pointer is obtained, and the preset judgment standard is related to the list. According to the invention, self-modification of an operating system can be avoided, false alarms are avoided, and the accuracy of a detection result is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of malicious code detection for information security, and in particular to a method and device for detecting whether a memory function pointer has been replaced. Background Art

[0002] For information security, memory function pointers in the scanning system will be replaced. After a module is loaded into memory, some function addresses in the module will be corrected or replaced by the operating system, and third-party software / malicious code may also modify these function addresses in memory (similar to code hooks), thereby achieving the purpose of changing program flow and monitoring certain types of events that occur in the system. When security software (such as Anti-Rootkit software) performs inline hook scanning and detection, it is easy to scan out the above system modifications and third-party software / malicious code modifications and display alarms. This crude method of showing that the code in the memory is different from the code in the module obviously cannot meet the requirements of security detection.

[0003] In order to hijack the normal execution process of the system, some viruses will hook some system functions, which is manifested as the replacement of memory function pointers. It is very important to scan these replaced memory function addresses, because once they are scanned, it can be basically determined whether they have been tampered with by viruses or other third-party software. Generally, these replacements are not well-intentioned, so identifying the replacement of memory function pointers is also a routine test that the security industry must do. However, most existing detection solutions do not pay attention to the modifications made to the system, which leads to the identification of modifications and replacements made by the operating system, which will cause many false positives in the detection results. This type of false positives is relatively rare in the early XP, Windows2003, Vista, Win7, and Win8 systems, because the system modifications in these systems are very few, but in Win10 and Win11 systems, this type of modification is very large, which leads to a large number of false positives due to normal system modifications. Summary of the invention

[0004] The purpose of the present invention is to solve the deficiencies in the above-mentioned prior art and to provide a method and device for detecting the replacement of a memory function pointer, which can avoid false alarms and improve the accuracy of detection.

[0005] The present invention provides a method for detecting that a memory function pointer is replaced, comprising the following steps:

[0006] (1) reading a physical file of a target module and loading the physical file into a memory to form a first memory area;

[0007] (2) reading the complete memory corresponding to the target module from the memory to form a second memory area;

[0008] (3) According to the operating system type, parse the executable program header of the target module to obtain the list of functions and function pointers that will be modified by the system loader;

[0009] (4) parsing the executable program header of the first memory area, comparing the code segments in the first memory area and the second memory area, and obtaining a comparison result;

[0010] (5) According to the comparison result, based on a preset judgment standard, the replaced content of the memory function pointer is obtained, and the preset judgment standard is related to the list.

[0011] Preferably, in step (1), loading the physical file into the memory includes:

[0012] The physical file is loaded into the memory by using an executable program loader, and the physical file relocation table is corrected.

[0013] Preferably, in step (2), according to the operating system type, the executable program header of the target module is parsed to obtain a list of functions and function pointers that will be modified by the system loader, including:

[0014] According to the operating system type and the executable program format of the operating system, a structure including a system loader modification module memory code in the executable program header is parsed;

[0015] A list of functions and function pointers that will be modified by the system loader is obtained from the structure of the system loader modification module memory code.

[0016] Preferably, the operating system includes Windows system and Linux system.

[0017] Preferably, in step (3), parsing the executable program header of the target module to obtain a list of functions and function pointers that will be modified by the system loader includes: when the operating system is a Windows system, the structure of the module memory code modified by the system loader includes an IMAGE_LOAD_CONFIG_DIRECTORY structure;

[0018] Parse the LockPrefixTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the first code offset position information in the LockPrefixTable table, and store the first code offset position information in the list.

[0019] Preferably, parsing the executable program header of the target module to obtain a list of functions and function pointers that will be modified by the system loader also includes:

[0020] Parse the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the second code offset position information in the DynamicValueRelocTable table, and store the second code offset position information in the list.

[0021] Preferably, in step (5), the preset judgment criteria include:

[0022] If there are inconsistent positions in the comparison result, determine whether the inconsistent positions are in the list;

[0023] If the inconsistent position is in the list, continue to judge.

[0024] In another aspect of the present invention, preferably, the preset judgment criteria also include:

[0025] If the inconsistent position is not in the list, determining whether the content of the inconsistent position in the second memory area is an accessible address; if it is an accessible address, determining whether the content of the inconsistent position in the first memory area is an accessible RVA address;

[0026] If it is an accessible RVA address, the memory function pointer of the content of the second memory area at the inconsistent location is replaced.

[0027] In another aspect of the present invention, preferably, the operating system types include Windows system and Linux system, when the operating system is Windows system, the executable program header is a PE file header, and when the operating system is Linux system, the executable program header is an ELF file header.

[0028] Another aspect of the present invention further provides a device for detecting that a memory function pointer has been replaced, characterized in that it comprises:

[0029] A first reading module: reads a physical file of a target module, and loads the physical file into a memory to form a first memory area;

[0030] The second reading module: reads the complete memory corresponding to the target module from the memory to form a second memory area;

[0031] Get module: According to the operating system type, parse the executable program header of the target module to obtain the list of functions and function pointers that will be modified by the system loader;

[0032] Comparison module: parses the executable program header in the first memory area, compares the code segments in the first memory area and the second memory area, and obtains the comparison result;

[0033] A judgment module: according to the comparison result and based on a preset judgment standard, obtains the replaced content of the memory function pointer, wherein the preset judgment standard is related to the list.

[0034] The beneficial effects of the present invention are as follows:

[0035] The present invention forms a first memory area by reading a physical file of a target module and reads a second memory area of ​​a complete memory corresponding to the target module from the memory; compares the code segments of the two, and obtains a list of functions and function pointers that will be modified by a system loader through the comparison result; obtains the replaced content of the memory function pointer based on a preset judgment standard; avoids false alarms caused by self-modification of the operating system. After loading the executable program, the executable program loader of the operating system will automatically perform some self-modification of the code according to some configuration information in the executable program header. The present invention can avoid these self-modifications, avoid false alarms, and improve the accuracy of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention:

[0037] Figure 1 The present invention is a flowchart of a method for detecting whether a memory function pointer has been replaced according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0039] In the description of the present invention, it should be noted that the terms “first”, “second” and “third” are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0040] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0041] Embodiment 1

[0042] A method for detecting that a memory function pointer has been replaced. Figure 1 FIG. 1 shows an overall flow chart of an embodiment of the present invention, as shown in FIG. Figure 1 As shown, including:

[0043] Read the physical file of the target module, load the physical file into the memory, and form a first memory area; the physical file refers to the file actually stored on the hard disk or other physical storage medium of the target module, which usually has a specific format; when the computer needs to run a program, the operating system will be responsible for loading the physical file stored on the hard disk or other physical storage medium into the computer's memory, which can quickly read and write data; the specific method of loading the physical file into the memory is not limited here, and optionally, in this embodiment, loading the physical file into the memory includes using an executable program loader to load the physical file into the memory, and the executable program loader in the Windows system is PELoader; in the Windows system, PELoader (Portable Executable Loader) is responsible for loading the physical file of the target module into the memory. PELoader is a part of the Windows operating system, which is specifically used to process files in PE (Portable Executable) format, which is the standard format of executable files on Windows; and correct the physical file relocation table; correcting the relocation table of the physical file is one of the key steps to ensure the correct loading and execution of the program. The relocation table is a data structure that contains references in the program that need to be adjusted in address. When a program is loaded into memory, its code and data segments may be placed at different addresses than when it was compiled; therefore, the relocation table is used to update these references so that they point to the correct memory addresses;

[0044] Read the complete memory corresponding to the target module from the memory to form a second memory area. Read the complete memory dump corresponding to the target module from the memory to form a second memory area. The second memory area is the memory after the system executable program loader expands the target module. In some older operating systems, in theory, the code in the second memory area is completely consistent with the code in the first memory area.

[0045] According to the operating system type, parse the executable program header of the target module to obtain a list of functions and function pointers that will be modified by the system loader; the functions and function pointers that will be modified by the system loader refer to the functions and function pointers that will be modified by the system loader recorded in the executable file. Build a list based on the functions and function pointers that will be modified by the system loader recorded in the found executable file. The specific content of the executable program header varies depending on the operating system. In Windows, it is the PE file header, and in Linux, it is the ELF file header.

[0046] Furthermore, in this embodiment, according to the operating system type, parsing the executable program header of the target module and obtaining a list of functions and function pointers that will be modified by the system loader includes:

[0047] According to the operating system type and the executable program format of the operating system, a structure including a system loader modification module memory code in the executable program header is parsed;

[0048] A list of functions and function pointers that will be modified by the system loader is obtained from the structure of the system loader modification module memory code.

[0049] The collection of the list is slightly different in different operating systems, including Windows and Linux. The following uses Windows to explain the collection of this part of information. Other operating systems use similar methods to collect and form a list.

[0050] When the operating system is a Windows system, the IMAGE_LOAD_CONFIG_DIRECTORY structure of the PE header is parsed according to the PE file format officially disclosed by Microsoft. Some fields in this structure record the information of the system loader modifying the module memory code. According to the format description of the PE file, these field tables are parsed and collected to form a list; further, in this embodiment, the structure of the system loader modifying the module memory code includes the IMAGE_LOAD_CONFIG_DIRECTORY structure;

[0051] Parse the LockPrefixTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the first code offset position information in the LockPrefixTable table, and store the first code offset position information in the table. The LockPrefixTable table records the instruction Lock prefix in the program. On an X86 single-core system, the system executable program loader will convert the Lock prefix instruction into a NOP instruction;

[0052] The method further includes: parsing the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtaining the second code offset position information in the DynamicValueRelocTable table, and storing the second code offset position information in the list.

[0053] Parse the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, locate the detailed information of DynamicValueRelocTable through the DynamicValueRelocTableOffset and DynamicValueRelocTableSection fields in the IMAGE_LOAD_CONFIG_DIRECTORY structure, parse the DynamicValueRelocTable table according to the PE format description, collect the code offset position information in this table and store it in a list;

[0054] The above steps form a list. With the development of the operating system, it is not ruled out that more types of system executable program loaders will modify the code in the future, but these modified point locations can be collected and put into the list through similar methods;

[0055] Parsing the executable program header of the first memory area, determining the location of the code segment, comparing the code segments in the first memory area and the second memory area, and obtaining the comparison result;

[0056] According to the comparison result, based on the preset judgment standard, the replaced content of the memory function pointer is obtained, and the preset judgment standard is related to the list. The specific content of the preset judgment standard is not limited here. Optionally, in this embodiment, the preset judgment standard includes:

[0057] If there are inconsistent positions in the comparison results, determine whether the inconsistent positions are in the list; if different positions are found, it means that there is a code modification, and at this time, first check whether the modified position is in the list;

[0058] If the inconsistent position is in the list, continue to judge; continue to scan down to prevent false alarms;

[0059] If the inconsistent position is not in the list, determining whether the content of the inconsistent position in the second memory area is an accessible address; that is, determining whether the content of the inconsistent position in the second memory area points to an accessible memory;

[0060] If it is an accessible address, determining whether the content of the inconsistent position in the first memory area is an accessible RVA address;

[0061] If it is an accessible RVA address, the memory function pointer of the content of the second memory area at the inconsistent location is replaced.

[0062] The present invention forms a first memory area by reading a physical file of a target module and reads a second memory area of ​​a complete memory corresponding to the target module from the memory; compares the code segments of the two, and obtains a list of functions and function pointers that will be modified by a system loader through the comparison result; obtains the replaced content of the memory function pointer based on a preset judgment standard; avoids false alarms caused by self-modification of the operating system. After loading the executable program, the executable program loader of the operating system will automatically perform some self-modification of the code according to some configuration information in the executable program header. The present invention can avoid these self-modifications, avoid false alarms, and improve the accuracy of the detection results.

[0063] Some modifications made by the operating system executable program loader to the code can be perceived through the identifier of the executable program header. The identifier of the executable program header identifies whether the program has the behavior of the operating system executable program loader to modify the code, avoiding false alarms. The executable program header will also identify the storage location of these codes to be modified by the system. Therefore, when the inline hook detects, when inconsistent code is found in these locations, it chooses to ignore and not alarm, so that the above false alarms can be avoided. The present invention avoids false alarms based on the above principles, making the memory function pointer replacement detection method more accurate and without false alarms.

[0064] Embodiment 2

[0065] A device for detecting whether a memory function pointer has been replaced, comprising:

[0066] A first reading module: reads a physical file of a target module, and loads the physical file into a memory to form a first memory area;

[0067] A physical file refers to a file actually stored on a hard disk or other physical storage medium by a target module, and usually has a specific format; when a computer needs to run a program, the operating system will be responsible for loading the physical file stored on the hard disk or other physical storage medium into the computer's memory, which can quickly read and write data; the specific method of loading the physical file into the memory is not limited here, and optionally, in this embodiment, loading the physical file into the memory includes using an executable program loader to load the physical file into the memory, and in the Windows system, the executable program loader is PELoader; in the Windows system, PELoader (Portable Executable Loader) is responsible for loading the physical file of the target module into the memory. PELoader is part of the Windows operating system, which is specifically used to process files in PE (Portable Executable) format, which is the standard format of executable files on Windows; and correct the physical file relocation table; correcting the relocation table of the physical file is one of the key steps to ensure that the program is correctly loaded and executed. The relocation table is a data structure that contains references in the program that need to be adjusted in address. When a program is loaded into memory, its code and data segments may be placed at different addresses than when it was compiled; therefore, the relocation table is used to update these references so that they point to the correct memory addresses;

[0068] Second reading module: reads the complete memory corresponding to the target module from the memory to form a second memory area; reads the complete memory dump corresponding to the target module from the memory to form a second memory area; the second memory area is the memory after the system executable program loader expands the target module. In some older operating systems, in theory, the code in the second memory area is completely consistent with the code in the first memory area;

[0069] Get module: according to the operating system type, parse the executable program header of the target module and obtain the list of functions and function pointers that will be modified by the system loader; the functions and function pointers that will be modified by the system loader refer to the functions and function pointers that will be modified by the system loader recorded in the executable file. Build a list based on the functions and function pointers that will be modified by the system loader recorded in the found executable file. The specific content of the executable program header varies depending on the operating system. In Windows, it is the PE file header, and in Linux, it is the ELF file header.

[0070] Furthermore, in this embodiment, according to the operating system type, parsing the executable program header of the target module and obtaining a list of functions and function pointers that will be modified by the system loader includes:

[0071] According to the operating system type and the executable program format of the operating system, a structure including a system loader modification module memory code in the executable program header is parsed;

[0072] A list of functions and function pointers that will be modified by the system loader is obtained from the structure of the system loader modification module memory code.

[0073] The collection of the list is slightly different in different operating systems, including Windows and Linux. The following uses Windows to explain the collection of this part of information. Other operating systems use similar methods to collect and form a list.

[0074] When the operating system is a Windows system, the IMAGE_LOAD_CONFIG_DIRECTORY structure of the PE header is parsed according to the PE file format officially disclosed by Microsoft. Some fields in this structure record the information of the system loader modifying the module memory code. According to the format description of the PE file, these field tables are parsed and collected to form a list; further, in this embodiment, the structure of the system loader modifying the module memory code includes the IMAGE_LOAD_CONFIG_DIRECTORY structure;

[0075] Parse the LockPrefixTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the first code offset position information in the LockPrefixTable table, and store the first code offset position information in the table. The LockPrefixTable table records the instruction Lock prefix in the program. On an X86 single-core system, the system executable program loader will convert the Lock prefix instruction into a NOP instruction;

[0076] The method further includes: parsing the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtaining the second code offset position information in the DynamicValueRelocTable table, and storing the second code offset position information in the list.

[0077] Parse the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, locate the detailed information of DynamicValueRelocTable through the DynamicValueRelocTableOffset and DynamicValueRelocTableSection fields in the IMAGE_LOAD_CONFIG_DIRECTORY structure, parse the DynamicValueRelocTable table according to the PE format description, collect the code offset position information in this table and store it in a list;

[0078] The above steps form a list. With the development of the operating system, it is not ruled out that more types of system executable program loaders will modify the code in the future, but these modified point locations can be collected and put into the list through similar methods;

[0079] Comparison module: parses the executable program header in the first memory area, compares the code segments in the first memory area and the second memory area, and obtains the comparison result;

[0080] Judgment module: according to the comparison result, based on the preset judgment standard, obtain the replaced content of the memory function pointer, and the preset judgment standard is related to the list. The specific content of the preset judgment standard is not limited here. Optionally, in this embodiment, the preset judgment standard includes:

[0081] If there are inconsistent positions in the comparison results, determine whether the inconsistent positions are in the list; if different positions are found, it means that there is a code modification, and at this time, first check whether the modified position is in the list;

[0082] If the inconsistent position is in the list, continue to judge; continue to scan down to prevent false alarms;

[0083] If the inconsistent position is not in the list, determining whether the content of the inconsistent position in the second memory area is an accessible address; that is, determining whether the content of the inconsistent position in the second memory area points to an accessible memory;

[0084] If it is an accessible address, determining whether the content of the inconsistent position in the first memory area is an accessible RVA address;

[0085] If it is an accessible RVA address, the memory function pointer of the content of the second memory area at the inconsistent location is replaced.

[0086] The present invention can avoid self-modification of the operating system, avoid causing false alarms, and improve the accuracy of the detection results.

[0087] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. In addition, the appended claims of the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the appended claims, or the equivalent forms of such scope and boundaries.

Claims

1. A method for detecting that a memory function pointer has been replaced, characterized in that: The following steps are involved: (1) reading a physical file of a target module and loading the physical file into a memory to form a first memory area; (2) reading the complete memory corresponding to the target module from the memory to form a second memory area; (3) According to the operating system type, parse the executable program header of the target module to obtain the list of functions and function pointers that will be modified by the system loader; (4) parsing the executable program header of the first memory area, comparing the code segments in the first memory area and the second memory area, and obtaining a comparison result; (5) According to the comparison result, based on a preset judgment standard, the replaced content of the memory function pointer is obtained, and the preset judgment standard is related to the list.

2. A method for detecting that a memory function pointer has been replaced according to claim 1, characterized in that: Loading the physical file into memory includes: The physical file is loaded into the memory by using an executable program loader, and the physical file relocation table is corrected.

3. A method for detecting that a memory function pointer has been replaced according to claim 1, characterized in that: According to the operating system type, parse the executable program header of the target module to obtain a list of functions and function pointers that will be modified by the system loader, including: According to the operating system type and the executable program format of the operating system, a structure including a system loader modification module memory code in the executable program header is parsed; A list of functions and function pointers that will be modified by the system loader is obtained from the structure of the system loader modification module memory code.

4. A method for detecting that a memory function pointer has been replaced according to claim 3, characterized in that: The operating system includes Windows system and Linux system; Parsing the executable program header of the target module to obtain a list of functions and function pointers that will be modified by the system loader, further comprising: when the operating system is a Windows system, the system loader modifies the structure of the module memory code including the IMAGE_LOAD_CONFIG_DIRECTORY structure; Parse the LockPrefixTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the first code offset position information in the LockPrefixTable table, and store the first code offset position information in the list.

5. A method for detecting that a memory function pointer has been replaced according to claim 4, characterized in that: Parse the target module's executable header to obtain a list of functions and function pointers that will be modified by the system loader, including: Parse the DynamicValueRelocTable table in the IMAGE_LOAD_CONFIG_DIRECTORY structure, obtain the second code offset position information in the DynamicValueRelocTable table, and store the second code offset position information in the list.

6. A method for detecting that a memory function pointer has been replaced according to claim 1, characterized in that: The preset judgment criteria include: If there are inconsistent positions in the comparison result, determine whether the inconsistent positions are in the list; If the inconsistent position is in the list, continue to judge.

7. A method for detecting that a memory function pointer has been replaced according to claim 6, characterized in that: The preset judgment criteria also include: If the inconsistent position is not in the list, determining whether the content of the inconsistent position in the second memory area is an accessible address; if it is an accessible address, determining whether the content of the inconsistent position in the first memory area is an accessible RVA address; If it is an accessible RVA address, the memory function pointer of the content of the second memory area at the inconsistent location is replaced.

8. A method for detecting that a memory function pointer has been replaced according to claim 1, characterized in that: The operating system types include Windows system and Linux system. When the operating system is Windows system, the executable program header is a PE file header, and when the operating system is Linux system, the executable program header is an ELF file header.

9. A device for detecting that a memory function pointer has been replaced, characterized in that: include: A first reading module: reads a physical file of a target module, and loads the physical file into a memory to form a first memory area; The second reading module: reads the complete memory corresponding to the target module from the memory to form a second memory area; Get module: According to the operating system type, parse the executable program header of the target module to obtain the list of functions and function pointers that will be modified by the system loader; Comparison module: parses the executable program header in the first memory area, compares the code segments in the first memory area and the second memory area, and obtains the comparison result; A judgment module: according to the comparison result and based on a preset judgment standard, obtains the replaced content of the memory function pointer, wherein the preset judgment standard is related to the list.

Images