Firmware file system repairing method and device based on Linux kernel

Abstract

The invention provides a firmware file system repairing method and device based on a Linux kernel, and the method comprises the steps: reconstructing a firmware file system based on the Linux kernel according to a determined Linux kernel and a preset reconstruction scheme, and the Linux kernel comprises symbol table information; running a firmware file system based on a Linux kernel in the simulator, and obtaining kernel execution output information in response to the abnormal suspension message; inserting a target breakpoint and a target observation point into the simulator through a preset information base according to the kernel execution output information and the symbol table information; according to the method, the firmware file system based on the Linux kernel is repaired according to the context information of the target observation point, Linux kernel abnormal information can be automatically analyzed, the target breakpoint and the target observation point are inserted based on the symbol table information of the Linux kernel, accurate analysis of the integrity problem of the firmware file system is achieved, and the efficiency of firmware security analysis is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for repairing a firmware file system based on a Linux kernel. Background Art

[0002] With the popularity of IoT devices, IoT devices have become an integral part of people's daily lives and are widely used in production and life. An IoT device is a small embedded system with firmware running on the system. It has various peripherals, applications running in the firmware, and a network communication processor that can communicate with the Internet. Using firmware, analysts can perform manual analysis, binary lifting, or simulation to detect defects in the firmware. In related technologies, large-scale dynamic testing of firmware simulation technology tools is used to analyze the security issues of the firmware file system, but the effectiveness of these tools depends to a large extent on the integrity of the firmware file system, which is affected by the deletion and modification of the firmware source on the one hand, and the functional limitations of the firmware extraction tool on the other hand. Therefore, manual intervention is often required to analyze and repair the integrity of the firmware file system, which affects the efficiency of firmware security analysis. Summary of the invention

[0003] One object of the present invention is to provide a firmware file system repair method based on the Linux kernel, which can automatically analyze the Linux kernel abnormal information, insert target breakpoints and target observation points based on the symbol table information of the Linux kernel, and realize accurate analysis of the firmware file system integrity problem, thereby improving the efficiency of firmware security analysis. Another object of the present invention is to provide a firmware file system repair device based on the Linux kernel. Another object of the present invention is to provide a computer readable medium. Another object of the present invention is to provide a computer device.

[0004] In order to achieve the above objectives, the present invention discloses a method for repairing a firmware file system based on a Linux kernel, comprising:

[0005] According to a predetermined Linux kernel, a firmware file system based on the Linux kernel is reconstructed according to a preset reconstruction scheme, wherein the Linux kernel includes symbol table information;

[0006] Running a Linux kernel-based firmware file system in the simulator, and obtaining kernel execution output information in response to an abnormal termination message;

[0007] Insert target breakpoints and target watchpoints in the simulator based on kernel execution output information and symbol table information through a preset information library;

[0008] According to the context information of the target observation point, the firmware file system based on the Linux kernel is repaired.

[0009] Preferably, the information library includes a correspondence between source code information and breakpoint information and observation point information;

[0010] Through the preset information library, according to the kernel execution output information and symbol table information, insert target breakpoints and target watchpoints in the simulator, including:

[0011] Match the kernel execution output information with the source code information to determine the corresponding target breakpoint information and target observation point information;

[0012] Matching the target breakpoint information and the target observation point information with the symbol table information to determine the target breakpoint position and the target observation point position;

[0013] According to the target breakpoint position and the target watchpoint position, the target breakpoint and the target watchpoint are registered and inserted in the simulator.

[0014] Preferably, repairing the Linux kernel-based firmware file system according to the context information of the target observation point includes:

[0015] Determine whether the current context information is the same as the previous context information;

[0016] If they are the same, add 1 to the preset number of executions;

[0017] Determine whether the number of executions after the addition of 1 is greater than a preset number threshold;

[0018] If not, repeatedly run the Linux kernel-based firmware file system in the simulator, obtain the context information of the target observation point, and continue to execute the step of determining whether the current context information is the same as the previous context information;

[0019] If different, the firmware file system based on the Linux kernel is repaired according to the preset repair strategy and the context information.

[0020] Preferably, according to a preset repair strategy and based on context information, repairing the firmware file system based on the Linux kernel includes:

[0021] Determine whether the current missing problem is a weak missing problem based on context information;

[0022] If so, repair the firmware file system based on the Linux kernel according to the preset weak defect repair strategy;

[0023] If not, the firmware file system based on the Linux kernel is forcibly interrupted and a warning message is sent.

[0024] The present invention also discloses a firmware file system repair device based on the Linux kernel, comprising:

[0025] A firmware file system reconstruction module is used to reconstruct a firmware file system based on a Linux kernel according to a predetermined Linux kernel and a preset reconstruction scheme, wherein the Linux kernel includes symbol table information;

[0026] A running monitoring module is used to run a firmware file system based on the Linux kernel in the simulator, and obtain kernel execution output information in response to an abnormal termination message;

[0027] The information library module is used to insert target breakpoints and target observation points in the simulator according to kernel execution output information and symbol table information through a preset information library;

[0028] The repair module is used to repair the firmware file system based on the Linux kernel according to the context information of the target observation point.

[0029] Preferably, the information library includes a correspondence between source code information and breakpoint information and observation point information;

[0030] The information library module is specifically used to match the kernel execution output information with the source code information to determine the corresponding target breakpoint information and target observation point information; match the target breakpoint information and target observation point information with the symbol table information to determine the target breakpoint position and target observation point position; according to the target breakpoint position and target observation point position, register and insert the target breakpoint and target observation point in the simulator.

[0031] Preferably, the repair module is specifically used to determine whether the current context information is the same as the previous context information; if the same, add 1 to the preset number of executions; determine whether the number of executions after adding 1 is greater than a preset number threshold; if not, repeat running the Linux kernel-based firmware file system in the simulator, obtain the context information of the target observation point, and continue to execute the step of determining whether the current context information is the same as the previous context information; if different, repair the Linux kernel-based firmware file system according to the context information in accordance with the preset repair strategy.

[0032] Preferably, the repair module is specifically used to determine whether the current missing problem is a weak missing problem based on context information; if so, repair the firmware file system based on the Linux kernel according to a preset weak missing repair strategy; if not, forcibly interrupt the firmware file system based on the Linux kernel and send a warning message.

[0033] The present invention also discloses a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0034] The present invention also discloses a computer device, including a memory and a processor, wherein the memory is used to store information including program instructions, the processor is used to control the execution of program instructions, and the processor implements the above method when executing the program.

[0035] The present invention also discloses a computer program product, including a computer program / instruction, and the method described above is implemented when the computer program / instruction is executed by a processor.

[0036] The present invention reconstructs a firmware file system based on the Linux kernel according to a preset reconstruction scheme based on a predetermined Linux kernel, wherein the Linux kernel includes symbol table information; the firmware file system based on the Linux kernel is run in a simulator, and kernel execution output information is obtained in response to an abnormal termination message; a target breakpoint and a target observation point are inserted in the simulator according to the kernel execution output information and the symbol table information through a preset information base; the firmware file system based on the Linux kernel is repaired according to the context information of the target observation point, and the Linux kernel abnormal information can be automatically analyzed, and the target breakpoint and the target observation point are inserted based on the symbol table information of the Linux kernel, so as to realize accurate analysis of the integrity problem of the firmware file system and improve the efficiency of firmware security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A flowchart of a firmware file system repair method based on the Linux kernel provided by an embodiment of the present invention;

[0039] Figure 2 A flowchart of another method for repairing a firmware file system based on the Linux kernel provided by an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of the structure of a firmware file system repair device based on the Linux kernel provided by an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] In order to facilitate the understanding of the technical solution provided by the present application, the relevant contents of the technical solution of the present application are first described below. IoT devices have long been vulnerable to various attacks, so security analysis is crucial for IoT devices. Firmware rehosting is an important technology for security analysis of IoT devices, which can effectively analyze the security issues of IoT device firmware. However, this technology is affected by two major challenges: the complex execution environment and the closed source of the firmware, and is limited in practicality. The firmware emulation technology of large-scale dynamic testing realizes the dynamic operation of the firmware file system by reconstructing the firmware file system. This type of technology is suitable for large-scale testing of IoT device firmware, mainly firmware based on the Linux kernel. In the failure cases of large-scale dynamic testing of hang-up emulation technology, the vast majority of failure cases focus on kernel initialization errors. These error messages often require a large number of experts familiar with various modules of the kernel to intervene and handle. However, kernel error messages are usually misleading, and experts are often required to use program debugging tools (such as GDB, etc.) to deeply run and debug the Linux kernel and analyze the actual cause of the error.

[0044] In order to automatically analyze Linux kernel error information, realize the essential analysis of firmware file system integrity issues, and improve the success rate of large-scale dynamic testing, the present invention proposes a firmware simulation technology based on Linux kernel feedback repair, which is based on the program debugging tool server (GDB Server) function of the simulator (QEMU). Whenever the Linux kernel reports abnormal information that causes the termination, the technical solution of the present invention inserts breakpoints (Breakpoints) and watchpoints (Watchpoints) into the kernel module where the abnormal information is reported according to the symbol table information of the Linux kernel, captures the key information of the actual operation of the kernel, and repairs the integrity of the firmware file system according to the key information.

[0045] The following takes the firmware file system repair device based on the Linux kernel as an example of the execution subject to illustrate the implementation process of the firmware file system repair method based on the Linux kernel provided by the embodiment of the present invention. It can be understood that the execution subject of the firmware file system repair method based on the Linux kernel provided by the embodiment of the present invention includes but is not limited to the firmware file system repair device based on the Linux kernel.

[0046] Figure 1 A flowchart of a firmware file system repair method based on the Linux kernel provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0047] Step 101: Reconstruct a firmware file system based on a Linux kernel according to a predetermined Linux kernel and a preset reconstruction scheme.

[0048] In the embodiment of the present invention, the Linux kernel includes symbol table information.

[0049] It is worth mentioning that several Linux kernels of different versions and architectures with debugging symbol table information have been prepared in advance. These kernels are the basis for implementing kernel information feedback.

[0050] Step 102: Run a firmware file system based on the Linux kernel in the simulator, and obtain kernel execution output information in response to an abnormal termination message.

[0051] Step 103: insert target breakpoints and target observation points into the simulator through a preset information library according to kernel execution output information and symbol table information.

[0052] In the embodiment of the present invention, the information library includes the corresponding relationship between the source code information and the breakpoint information and the observation point information.

[0053] In the embodiment of the present invention, the breakpoints (Breakpoint) and watchpoints (Watchpoint) of the program debugging tool server (GDB Server) based on the simulator (QEMU) are injected. The method automatically injects these watchpoints into QEMU through an external program debugging tool client (GDB-Client) and automatically collects context information.

[0054] Step 104: Repair the Linux kernel-based firmware file system according to the context information of the target observation point.

[0055] In the embodiment of the present invention, an automated analysis method is used to find out the real cause of the integrity of the firmware file system and automatically repair it.

[0056] In the technical solution provided by the embodiment of the present invention, according to a predetermined Linux kernel, a firmware file system based on the Linux kernel is reconstructed according to a preset reconstruction scheme, and the Linux kernel includes symbol table information; the firmware file system based on the Linux kernel is run in a simulator, and kernel execution output information is obtained in response to an abnormal termination message; through a preset information library, target breakpoints and target observation points are inserted in the simulator according to the kernel execution output information and symbol table information; according to the context information of the target observation point, the firmware file system based on the Linux kernel is repaired, and the Linux kernel abnormal information can be automatically analyzed, and the target breakpoints and target observation points are inserted based on the symbol table information of the Linux kernel, so as to realize accurate analysis of the integrity problem of the firmware file system and improve the efficiency of firmware security analysis.

[0057] Figure 2 A flowchart of another method for repairing a firmware file system based on a Linux kernel is provided in an embodiment of the present invention, such as Figure 2 As shown, the method includes:

[0058] Step 201: Reconstruct a firmware file system based on a Linux kernel according to a predetermined Linux kernel and a preset reconstruction scheme.

[0059] In the embodiment of the present invention, each step is performed by a firmware file system repair device based on the Linux kernel.

[0060] Specifically, several Linux kernels of different versions and architectures with debugging symbol table information are prepared in advance. These kernels are the basis for realizing kernel information feedback. According to the characteristics of the firmware file system, appropriate Linux kernels and reconstruction plans are selected to complete the first Linux kernel file system reconstruction.

[0061] In the embodiment of the present invention, the Linux kernel includes symbol table information. In the Linux kernel, the symbol table information (Symbol Table) is a very important data structure, which contains the names of all functions, variables and other symbols in the kernel and their corresponding addresses. The symbol table information is very important for debugging, module loading and kernel analysis, so as to match with the target breakpoint information and the target observation point information to determine the insertion position.

[0062] Step 202: Run a firmware file system based on the Linux kernel in the simulator, and obtain kernel execution output information in response to an abnormal termination message.

[0063] In the embodiment of the present invention, the running state and execution information of the firmware file system based on the Linux kernel in the simulator are monitored in real time. If the running state is detected to be suspended, it indicates that an abnormality has occurred in the Linux kernel, and the internal running monitoring module generates an abnormal suspension message. In response to the abnormal suspension message, the kernel execution output information is obtained, and the kernel execution output information includes but is not limited to the running state and execution information.

[0064] It is worth noting that the kernel execution output information can be represented in log form to facilitate subsequent matching.

[0065] Step 203: Match the kernel execution output information with the source code information to determine the corresponding target breakpoint information and target observation point information.

[0066] In an embodiment of the present invention, the information library includes the correspondence between source code information, breakpoint information, and observation point information. The source code information is the standard source code information of the execution program; the execution information is the source code information where the exception occurs. Specifically, the execution information in the kernel execution output information is matched with the source code information to determine the corresponding target breakpoint information and target observation point information. The target breakpoint information is the source code location information where the interruption is required, and the target observation point information is the context location information of the source code where the exception occurs.

[0067] Step 204: Match the target breakpoint information and the target observation point information with the symbol table information to determine the target breakpoint position and the target observation point position.

[0068] In the embodiment of the present invention, the target breakpoint position is the insertion position where the target breakpoint needs to be inserted, and the target observation point position is the insertion position where the target observation point needs to be inserted. The target breakpoint information is matched with the symbol table information to determine the target breakpoint position where the target breakpoint needs to be inserted in the simulator; the target observation point information is matched with the symbol table information to determine the target observation point position where the target observation point needs to be inserted in the simulator.

[0069] Step 205: register and insert the target breakpoint and target observation point in the simulator according to the target breakpoint position and the target observation point position.

[0070] In the embodiment of the present invention, according to the target breakpoint position, the target breakpoint is automatically registered and inserted into QEMU through the external GDB-Client; according to the target observation point position, the target observation point is automatically registered and inserted into QEMU through the external GDB-Client.

[0071] It is worth noting that the target breakpoint is used to control the location of the execution breakpoint, and the target observation point is used to collect context information of the program source code where the exception occurs.

[0072] Step 206 , determine whether the current context information is the same as the previous context information, if the same, execute step 207 ; if different, execute step 210 .

[0073] In the embodiment of the present invention, the context information of the target observation point is collected by the external GDB-Client at a preset time interval for subsequent judgment of the repair effect. It is worth noting that the time interval can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0074] Specifically, if the current context information is the same as the previous context information, it indicates that the current repair has no effect, and step 207 is continued; if the current context information is different from the previous context information, it indicates that the current repair has a certain effect, and step 210 is continued.

[0075] Step 207: Add 1 to the preset number of executions.

[0076] In the embodiment of the present invention, the execution count is the number of times the current context information is the same as the previous context information.

[0077] It is worth noting that the initial value of the execution times can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0078] Step 208 , determine whether the number of executions after the addition of 1 is greater than a preset number threshold, if so, the process ends; if not, execute step 209 .

[0079] In the embodiment of the present invention, the number threshold can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0080] Specifically, if the number of executions after adding 1 is greater than the number threshold, it indicates that the number of times the current context information is the same as the previous context information has reached the upper limit, and the repair cannot be completed automatically. An early warning message needs to be sent for manual access, and the process ends; if the number of executions after adding 1 is less than or equal to the number threshold, it indicates that the number of times the current context information is the same as the previous context information has not reached the upper limit, and continue to execute step 209.

[0081] Step 209 : Repeat running the Linux kernel-based firmware file system in the simulator to obtain context information of the target observation point, and continue to execute step 206 .

[0082] In an embodiment of the present invention, if the number of times that the current context information is the same as the previous context information has not reached an upper limit, the context information of the current target observation point is determined as the context information of the previous target observation point, the Linux kernel-based firmware file system continues to run in the simulator, and the context information of the current target observation point is obtained, and step 206 is continued to be executed for comparison.

[0083] Step 210: Repair the Linux kernel-based firmware file system according to the preset repair strategy and context information.

[0084] In the embodiment of the present invention, step 210 specifically includes:

[0085] Step 2101 , determine whether the current missing problem is a weak missing problem based on context information, if so, execute step 2102 ; if not, execute step 2103 .

[0086] In an embodiment of the present invention, the context information includes an abnormal problem identifier. An abnormal problem strength mapping table is pre-set, and the abnormal problem strength mapping table includes a mapping relationship between abnormal problem identifiers and missing problem strengths, wherein the missing problem strength includes weak missing problems and strong missing problems, and the abnormal problem identifiers include but are not limited to soft link missing, file not created, and device missing. For example: the missing problem strength corresponding to soft link missing and file not created is a weak missing problem; the missing problem strength corresponding to device missing is a strong missing problem.

[0087] Specifically, through the preset abnormal problem strength mapping table, the abnormal problem identifier in the context information is matched with the abnormal problem identifier in the abnormal problem strength mapping table to determine the corresponding missing problem strength; if the missing problem strength is determined to be a weak missing problem, it indicates that the current missing problem is a weak missing problem and can be automatically repaired, and continue to step 2102; if the missing problem strength is determined to be a strong missing problem, it indicates that the current missing problem is a strong missing problem and cannot be automatically repaired, and continue to step 2103.

[0088] Step 2102: Repair the Linux kernel-based firmware file system according to the preset weak deletion repair strategy.

[0089] In an embodiment of the present invention, the weak deletion repair strategy includes an abnormal problem identifier of the weak deletion problem and a corresponding repair solution. Specifically, the abnormal problem identifier in the context information is matched with the abnormal problem identifier in the weak deletion repair strategy to determine a corresponding repair solution; and the firmware file system based on the Linux kernel is repaired according to the determined repair solution.

[0090] It is worth noting that the weak deletion repair strategy can be set according to actual problems and historical experience, and the present invention does not limit this.

[0091] Step 2103: forcibly interrupt the firmware file system based on the Linux kernel and send a warning message.

[0092] In the embodiment of the present invention, if the current missing problem is a strong missing problem, it cannot be automatically repaired, and an early warning message needs to be sent for manual access.

[0093] The present invention can accurately locate and automatically repair the problem of firmware file system missing by automatically analyzing Linux kernel abnormal information, thereby improving the practicality of large-scale dynamic testing firmware simulation technology; there is no need to modify the source code of the simulator QEMU, and existing functions are used, which has a certain degree of portability.

[0094] It is worth noting that the acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of laws and regulations. The user information in the embodiments of this application is obtained through legal and compliant channels, and the acquisition, storage, use, and processing of user information are authorized and agreed by the customer.

[0095] It is worth noting that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0096] It is worth noting that the technical solution provided in this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0097] In the technical solution of the firmware file system repair method based on the Linux kernel provided by the embodiment of the present invention, according to a predetermined Linux kernel, a firmware file system based on the Linux kernel is reconstructed according to a preset reconstruction scheme, and the Linux kernel includes symbol table information; the firmware file system based on the Linux kernel is run in a simulator, and kernel execution output information is obtained in response to an abnormal termination message; through a preset information library, target breakpoints and target observation points are inserted in the simulator according to the kernel execution output information and the symbol table information; according to the context information of the target observation point, the firmware file system based on the Linux kernel is repaired, and the Linux kernel abnormal information can be automatically analyzed, and the target breakpoints and target observation points are inserted based on the symbol table information of the Linux kernel, so as to achieve accurate analysis of the integrity problem of the firmware file system and improve the efficiency of firmware security analysis.

[0098] Figure 3 A schematic diagram of the structure of a firmware file system repair device based on the Linux kernel provided by an embodiment of the present invention, wherein the device is used to execute the above-mentioned firmware file system repair method based on the Linux kernel, such as Figure 3 As shown, the device includes: a firmware file system reconstruction module 11, an operation monitoring module 12, an information library module 13 and a repair module 14.

[0099] The firmware file system reconstruction module 11 is used to reconstruct a firmware file system based on a Linux kernel according to a predetermined Linux kernel and a preset reconstruction scheme, wherein the Linux kernel includes symbol table information.

[0100] The operation monitoring module 12 is used to run a firmware file system based on the Linux kernel in the simulator, and obtain kernel execution output information in response to an abnormal termination message.

[0101] The information library module 13 is used to insert target breakpoints and target observation points in the simulator according to kernel execution output information and symbol table information through a preset information library.

[0102] The repair module 14 is used to repair the firmware file system based on the Linux kernel according to the context information of the target observation point.

[0103] In an embodiment of the present invention, the information library includes the correspondence between source code information and breakpoint information and observation point information; the information library module 13 is specifically used to match the kernel execution output information with the source code information to determine the corresponding target breakpoint information and target observation point information; match the target breakpoint information and target observation point information with the symbol table information to determine the target breakpoint position and the target observation point position; according to the target breakpoint position and the target observation point position, register and insert the target breakpoint and target observation point in the simulator.

[0104] In an embodiment of the present invention, the repair module 14 is specifically used to determine whether the current context information is the same as the previous context information; if the same, add 1 to the preset number of executions; determine whether the number of executions after adding 1 is greater than the preset number threshold; if not, repeat running the Linux kernel-based firmware file system in the simulator, obtain the context information of the target observation point, and continue to execute the step of determining whether the current context information is the same as the previous context information; if different, repair the Linux kernel-based firmware file system according to the context information in accordance with the preset repair strategy.

[0105] In an embodiment of the present invention, the repair module 14 is specifically used to determine whether the current missing problem is a weak missing problem based on context information; if so, repair the firmware file system based on the Linux kernel according to a preset weak missing repair strategy; if not, forcibly interrupt the firmware file system based on the Linux kernel and send an early warning message.

[0106] In the scheme of the embodiment of the present invention, according to a predetermined Linux kernel, a firmware file system based on the Linux kernel is reconstructed according to a preset reconstruction scheme, and the Linux kernel includes symbol table information; the firmware file system based on the Linux kernel is run in a simulator, and kernel execution output information is obtained in response to an abnormal termination message; through a preset information library, target breakpoints and target observation points are inserted in the simulator according to the kernel execution output information and symbol table information; according to the context information of the target observation point, the firmware file system based on the Linux kernel is repaired, and the Linux kernel abnormal information can be automatically analyzed, and the target breakpoints and target observation points are inserted based on the symbol table information of the Linux kernel, so as to achieve accurate analysis of the integrity problem of the firmware file system and improve the efficiency of firmware security analysis.

[0107] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer device, and specifically, the computer device may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0108] An embodiment of the present invention provides a computer device, including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and when the program instructions are loaded and executed by the processor, the steps of the embodiment of the above-mentioned firmware file system repair method based on the Linux kernel are implemented. For a specific description, please refer to the embodiment of the above-mentioned firmware file system repair method based on the Linux kernel.

[0109] Reference below Figure 4 , which shows a schematic diagram of the structure of a computer device 600 suitable for implementing an embodiment of the present application.

[0110] like Figure 4 As shown, the computer device 600 includes a central processing unit (CPU) 601, which can perform various appropriate operations and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer device 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0111] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal feedback device (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed as needed as the storage section 608.

[0112] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 609, and / or installed from the removable medium 611.

[0113] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0114] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0115] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0119] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0120] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0121] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0122] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0123] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0124] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for repairing a firmware file system based on the Linux kernel, characterized in that: The method comprises: According to a predetermined Linux kernel, a firmware file system based on the Linux kernel is reconstructed according to a preset reconstruction scheme, wherein the Linux kernel includes symbol table information; Running the Linux kernel-based firmware file system in the simulator, and obtaining kernel execution output information in response to an abnormal termination message; Inserting target breakpoints and target observation points in the simulator according to the kernel execution output information and the symbol table information through a preset information library; The Linux kernel-based firmware file system is repaired according to the context information of the target observation point.

2. The method for repairing a firmware file system based on the Linux kernel according to claim 1, characterized in that: The information base includes the corresponding relationship between source code information and breakpoint information and observation point information; The method inserts a target breakpoint and a target observation point in the simulator according to the kernel execution output information and the symbol table information through a preset information library, including: Matching the kernel execution output information with the source code information to determine corresponding target breakpoint information and target observation point information; Matching the target breakpoint information and the target observation point information with the symbol table information to determine the target breakpoint position and the target observation point position; According to the target breakpoint position and the target observation point position, the target breakpoint and the target observation point are registered and inserted in the simulator.

3. The method for repairing a firmware file system based on the Linux kernel according to claim 1, characterized in that: The repairing the Linux kernel-based firmware file system according to the context information of the target observation point includes: Determine whether the current context information is the same as the previous context information; If they are the same, add 1 to the preset number of executions; Determine whether the number of executions after the addition of 1 is greater than a preset number threshold; If not, repeatedly running the Linux kernel-based firmware file system in the simulator, obtaining the context information of the target observation point, and continuing to perform the step of determining whether the current context information is the same as the previous context information; If different, the Linux kernel-based firmware file system is repaired according to the context information in accordance with a preset repair strategy.

4. The method for repairing a firmware file system based on the Linux kernel according to claim 3, characterized in that: The step of repairing the Linux kernel-based firmware file system according to the context information according to the preset repair strategy includes: Determine whether the current missing problem is a weak missing problem according to the context information; If so, repair the Linux kernel-based firmware file system according to a preset weak deletion repair strategy; If not, the Linux kernel-based firmware file system is forcibly interrupted and a warning message is sent.

5. A firmware file system repair device based on Linux kernel, characterized in that: The device comprises: A firmware file system reconstruction module is used to reconstruct a firmware file system based on a Linux kernel according to a predetermined Linux kernel and a preset reconstruction scheme, wherein the Linux kernel includes symbol table information; An operation monitoring module is used to run the firmware file system based on the Linux kernel in the simulator, and obtain kernel execution output information in response to an abnormal termination message; An information library module, used for inserting target breakpoints and target observation points in the simulator according to the kernel execution output information and the symbol table information through a preset information library; A repair module is used to repair the Linux kernel-based firmware file system according to the context information of the target observation point.

6. The firmware file system repair device based on Linux kernel according to claim 5, characterized in that: The information base includes the corresponding relationship between source code information and breakpoint information and observation point information; The information library module is specifically used to match the kernel execution output information with the source code information to determine the corresponding target breakpoint information and target observation point information; match the target breakpoint information and target observation point information with the symbol table information to determine the target breakpoint position and the target observation point position; According to the target breakpoint position and the target observation point position, the target breakpoint and the target observation point are registered and inserted in the simulator.

7. The firmware file system repair device based on Linux kernel according to claim 5, characterized in that: The repair module is specifically used to determine whether the current context information is the same as the previous context information; if the same, add 1 to the preset number of executions; determine whether the number of executions after adding 1 is greater than the preset number threshold; if not, repeatedly run the Linux kernel-based firmware file system in the simulator to obtain the context information of the target observation point, and continue to execute the step of determining whether the current context information is the same as the previous context information; If different, the Linux kernel-based firmware file system is repaired according to the context information in accordance with a preset repair strategy.

8. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the firmware file system repair method based on the Linux kernel as described in any one of claims 1 to 4 is implemented.

9. A computer device comprising a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, characterized in that: When the program instructions are loaded and executed by the processor, the firmware file system repair method based on the Linux kernel as described in any one of claims 1 to 4 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the Linux kernel-based firmware file system repair method according to any one of claims 1 to 4 is implemented.

Images