Dynamic binary instrumentation method and system supporting cross-platform and vulnerability perception

Abstract

The invention discloses a dynamic binary instrumentation method and system supporting cross-platform and vulnerability perception. The method comprises the steps that a target user program is received, and when the target user program sends out system calling, a corresponding system calling processing program is executed through Hyper call; after the target user program is converted into a TCG instruction set at the target front end, the TCG instruction set is converted into an LLVM intermediate code through the TCG front end; the LLVM instrumentation basic block is inserted into the LLVM intermediate code, and the LLVM intermediate code after binary instrumentation is completed is generated into a target code through an LLVM static compiler during operation. According to the scheme, the binary instrumentation performance is improved, in the target code execution stage, memory vulnerability perception is achieved based on a memory error checking mechanism and a shadow memory, and the memory vulnerability perception efficiency is improved. And the memory access count is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a dynamic binary plugging method and system supporting cross-platform and vulnerability perception. Background Art

[0002] Dynamic binary instrumentation is a core technology for debugging and analyzing application executable files, and is widely used in program analysis tools such as memory checking and error detection. However, most current dynamic binary instrumentation technologies are applied to situations where the target user program binary and the host where the instrumentation tool is located use the same instruction set architecture, and are difficult to be effective in scenarios where the binary program and the program running host have different instruction set architectures. Limited by various factors such as performance, cost, technical implementation, and various application scenarios in the energy field, cross-platform dynamic binary instrumentation is becoming increasingly important. Summary of the invention

[0003] In order to solve the deficiencies in the prior art, the present invention provides a cross-platform and vulnerability-aware dynamic binary instrumentation method and system to solve the technical problem of cross-platform dynamic binary instrumentation.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0005] The present invention first discloses a dynamic binary plugging method supporting cross-platform and vulnerability awareness, the method comprising the following steps:

[0006] Step 1: receiving a target user program, and when the target user program issues a system call, executing a corresponding system call handler through Hypercall;

[0007] Step 2: After the target front end converts the target user program into a TCG instruction set, the TCG instruction set is converted into LLVM intermediate code through the TCG front end;

[0008] Step 3: inserting the LLVM instrumentation basic block into the LLVM intermediate code, and generating the LLVM intermediate code after the binary instrumentation into the target code by using the LLVM static compiler at runtime;

[0009] Step 4: During the target code execution phase, memory vulnerability awareness is implemented based on the memory error checking mechanism and shadow memory.

[0010] The present invention further includes the following preferred embodiments:

[0011] The executing of the corresponding system call processing program through Hyper call further includes:

[0012] When the target user program issues a malloc function call, the malloc function is compiled into a shared library; the function hijacking layer is preloaded during the dynamic linker recording the target user program binary file; all malloc function calls from the target user program are intercepted and replaced with the malloc function of the plugging system, and the malloc function of the plugging system notifies the target user program that the malloc function has been called through a hyper call mechanism, and the plugging system receives the notification and executes a corresponding handler.

[0013] The converting the TCG instruction set into LLVM intermediate code through the TCG front end further includes:

[0014] The LLVM metadata technology is used in the TCG front end to add annotations to the target user program binary file, and distinguish the target user program intermediate code and the simulation intermediate code respectively.

[0015] The converting the TCG instruction set into LLVM intermediate code through the TCG front end further includes:

[0016] Use LLVM-GCC / Dragonegg to convert the auxiliary function into intermediate code, and then inline the converted intermediate code of the auxiliary function into the LLVM intermediate code converted by the TCG front end.

[0017] The method simulates ARM executable file instrumentation on an x86 device.

[0018] The present invention also discloses a cross-platform and vulnerability-aware dynamic binary instrumentation system using the above-mentioned cross-platform and vulnerability-aware dynamic binary instrumentation method, comprising:

[0019] A system call module is used to receive a target user program, and when the target user program issues a system call, execute a corresponding system call processing program through Hyper call;

[0020] An intermediate code conversion module, used for converting the target user program into a TCG instruction set at the target front end, and then converting the TCG instruction set into LLVM intermediate code through the TCG front end;

[0021] A binary plug-in module is used to insert the LLVM plug-in basic block into the LLVM intermediate code, and generate the LLVM intermediate code after the binary plug-in into the target code by using the LLVM static compiler at runtime;

[0022] The memory vulnerability awareness module is used to implement memory vulnerability awareness based on the memory error checking mechanism and shadow memory during the target code execution phase.

[0023] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0024] The storage medium is used to store instructions;

[0025] The processor is used to operate according to the instructions to execute the steps of the aforementioned dynamic binary instrumentation method supporting cross-platform and vulnerability awareness.

[0026] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned dynamic binary instrumentation method that supports cross-platform and vulnerability awareness are implemented.

[0027] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a cross-platform and vulnerability-aware dynamic binary instrumentation method and system, which improves the binary instrumentation performance, wherein the performance on the x86 platform is improved by an average of 1.74 times, and the performance on the ARM platform is improved by an average of 8.66 times, while reducing the memory access count and having less memory access overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the dynamic two-stage pile insertion framework in the present invention.

[0029] Figure 2 It is a schematic diagram of the performance test verification results on the x86-64 architecture device in the present invention.

[0030] Figure 3 It is a schematic diagram of the performance test verification results on the ARM architecture device in the present invention.

[0031] Figure 4 It is a schematic diagram of the memory access count test verification result in the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0033] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0034] In view of the deficiencies of the prior art, the present invention proposes a cross-platform and vulnerability-aware dynamic binary instrumentation method and system, based on the LLVM framework, by integrating LLVM IR and binary translation counts across instruction set architectures to achieve cross-platform dynamic binary instrumentation, using TCG IR that can be mapped to binary instructions of the target user program to speed up the conversion process from the target user program to LLVM IR, and using LLVM's IR annotations and static compilation to improve binary instrumentation and program running performance. A dynamic binary instrumentation system across different instruction set architecture platforms is implemented, and memory vulnerability awareness is achieved based on a memory error checking mechanism.

[0035] The present invention discloses a cross-platform and vulnerability-aware dynamic binary instrumentation method, comprising the following steps:

[0036] Step 1: Receive a target user program, and when the target user program issues a system call, execute a corresponding system call handler through Hypercall.

[0037] The structure of the plug-in system is as follows Figure 1 As shown in the figure. The entire instrumentation system takes the target user program as input. The target front end (FE) of QEMU emits code represented by Tiny Code Generator (TCG), and the TCG front end translates these codes. Then, after being processed by LLVM, it is passed in the form of intermediate code IR. The LLVM basic block manager inserts the analysis code into the LLVM intermediate code, and the real-time translator generates the instrumented LLVM IR into the target code at runtime.

[0038] The startup phase is the phase between the command line calling the instrumentation system and the first reading of the target user program binary file for instrumentation. It is used to load the instrumentation system, reserve address space for the target user program and shadow memory, and load the target user program into the same process. The specific effects are shown in Table 1.

[0039] Table 1

[0040] Modules Virtual Address Instrumentation System 0x000060000000-0x00060ddd000 heap 0x0000680ce000-0x00068ce4000 Shadow 0x1ff1c0000000-0x1ff1dfffffff Shared Libraries 0x7f1e7ef34000-0x7f1e80867000 Target user program 0x7f8e00000000 - 0x7f8ef7000000 Stack 0x7fffb64e5000-0x7fffb6507000

[0041] The instrumentation system adds system components, including a function hijacking layer and a Hyper call calling layer, so that the corresponding callback function is executed when system events such as system calls and library function calls are triggered. The function hijacking layer will intercept the function call to the shared library, and then issue a Hyper call, and then notify the instrumentation system when the monitored event is triggered. When the instrumentation system receives a Hyper call, it will execute the corresponding Hyper call function, and then execute the callback function registered for the corresponding specific event. In short, the instrumentation system is based on the QEMU method. When the target user program calls a system call, QEMU will execute the corresponding system call handler. If the system call is under the monitoring of the instrumentation system, the callback function registered by the system call is executed and processed accordingly.

[0042] The function hijacking layer is mainly implemented through shared libraries, which are composed of functions to be intercepted by the instrumentation system. In an example, taking the malloc function call as an example, the complete function call interception process includes:

[0043] 1) Compile the malloc function into a shared library;

[0044] 2) The function hijacking layer is preloaded during the dynamic linker recording of the target user program binary file;

[0045] 3) All malloc function calls from the target user program are intercepted and replaced with the malloc of the instrumentation system. The malloc of the instrumentation system notifies the target user program that malloc has been called through the hyper call mechanism. At this time, the instrumentation system receives the notification and executes the corresponding processing program.

[0046] public int findDuplicate(int size){

[0047] int ret=syscall(TARGET_NR_malloc,size);

[0048] return (void*)ret;

[0049] }

[0050] Step 2: After the target front end converts the target user program into a TCG instruction set, the TCG instruction set is converted into LLVM intermediate code through the TCG front end.

[0051] The QEMU target front end converts the target user program into a TCG instruction set (TCG IR for short), and converts the IR into a binary file for execution. The plugging system of the present invention utilizes the TCG IR that can be mapped to the binary instructions of the target user program, fully utilizes the highly similar characteristics of the TCG IR and the LLVM IR, and simplifies the process of converting the target user binary program into the LLVM IR by constructing the TCG front end to realize the conversion from the TCG IR to the LLVM IR, thereby improving the performance of the binary plugging.

[0052] After the TCG front end converts TCG IR into LLVM IR, in order to further ensure that the IR processed by the LLVM basic block manager is all the IR corresponding to the target user program rather than the simulation IR to improve the correctness of the execution result, the plugging system of the present invention adopts LLVM metadata technology in the TCG front end to add annotations to the target user program binary file, and distinguish the target user program IR and the simulation IR in turn.

[0053] Step 3: inserting the LLVM instrumentation basic block into the LLVM intermediate code, and generating the LLVM intermediate code after the binary instrumentation into the target code by using the LLVM static compiler at runtime.

[0054] After the LLVM intermediate code (LLVM IR) converted by the target front end and the TCG front end is passed to LLVM, the instrumentation operation is completed by the LLVM instrumentation basic block.

[0055] During execution, the LLVM execution engine calls the appropriate code generator at runtime and uses the code generation process of the LLVM static compiler to generate high-quality code, thereby improving the correctness of program execution.

[0056] The target user program is converted into TCG IR and LLVM IR, and then the execution engine regenerates binary code from LLVM IR. The whole process will generate function call instructions of the corresponding auxiliary function helper, which will generate additional overhead, such as parameter passing, parameter adjustment, retrieval results, etc. To this end, the plugging system of the present invention first uses LLVM-GCC / Dragonegg to convert the auxiliary function into LLVM IR, and then inlines the converted auxiliary function IR into the LLVM IR converted by TCG FE, and finally passes the LLVM IR converted by TCG FE to the LLVM execution engine. The number of memory accesses during the execution process is reduced by inlining the helper function, avoiding the additional overhead caused by the helper function call in the process of LLVM IR to binary code, thereby reducing the overall execution overhead of the target user program.

[0057] In addition, traditional dynamic binary instrumentation systems will cause high overhead due to recompiling the instrumentation code at runtime, while the instrumentation system of the present invention uses dynamic binary translation technology across instruction set architectures to simulate the instrumentation code on devices with higher performance to alleviate performance issues. For example, ARM executable file instrumentation is simulated on x86 devices with stronger computing power to avoid the problem of weak computing power of ARM devices.

[0058] Step 4: During the target code execution phase, memory vulnerability awareness is implemented based on the memory error checking mechanism and shadow memory.

[0059] The states of memory bytes include addressable and non-addressable. When functions such as malloc and new allocate memory, the state of the memory bytes changes from non-addressable to addressable, and re-enters the non-addressable state after deallocation. During the execution of the target code, accessing the memory bytes that are currently in the non-addressable state will cause a memory exception. Based on this mechanism, memory exception behavior perception can be realized.

[0060] In order to capture abnormal memory behavior, the instrumentation system generates a red zone when a function calls memory allocation. When the target code is executed normally, the bytes in the red zone will not be accessed and are in an unaddressable state. Once these bytes are accessed during the execution of the target code, it means that there is a memory violation operation, and the memory error information will be reported in time. The instrumentation system uses shadow memory to store the status of memory bytes.

[0061] The following specific examples on x86-64 architecture devices and arm architecture devices are used to verify the superiority of the plugging system of the present invention over the traditional dynamic binary plugging system. The x86-64 architecture device is configured as: Intel Core i7 processor, 12GB memory, Linux operating system. The ARM architecture device is configured as: ARM Cortex-A9 MPcore processor, 1GB memory, Linux operating system.

[0062] (1) Test verification for performance

[0063] like Figure 2 As shown, on an x86-64 architecture device, the SPEC CINT 2006 benchmark test was used as the target user program input for the test. Compared with the traditional dynamic binary instrumentation tool Valgrinds Memcheck, the performance of the instrumentation system proposed in the present invention is improved by an average of 1.74 times.

[0064] like Figure 3As shown, on an ARM architecture device, the SPEC CINT 2006 benchmark test was used as the target user program input for the test. Compared with the traditional dynamic binary instrumentation tool Valgrinds Memcheck, the performance of the instrumentation system proposed in the present invention is improved by 8.66 times on average.

[0065] (2) Experimental verification of memory access count

[0066] like Figure 4 As shown, the experiment was conducted with SPEC CINT 2006 benchmark as the target user program input. Compared with the traditional dynamic binary instrumentation tool Valgrinds Memcheck, the memory access count of the instrumentation system proposed in the present invention was reduced by 1.71 times on average.

[0067] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a dynamic binary instrumentation system supporting cross-platform and vulnerability awareness based on the aforementioned dynamic binary instrumentation method supporting cross-platform and vulnerability awareness, comprising:

[0068] A system call module is used to receive a target user program, and when the target user program issues a system call, execute a corresponding system call processing program through Hyper call;

[0069] An intermediate code conversion module, used for converting the target user program into a TCG instruction set at the target front end, and then converting the TCG instruction set into LLVM intermediate code through the TCG front end;

[0070] A binary plug-in module is used to insert the LLVM plug-in basic block into the LLVM intermediate code, and generate the LLVM intermediate code after the binary plug-in into the target code by using the LLVM static compiler at runtime;

[0071] The memory vulnerability awareness module is used to implement memory vulnerability awareness based on the memory error checking mechanism and shadow memory during the target code execution phase.

[0072] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned dynamic binary instrumentation method that supports cross-platform and vulnerability awareness. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps according to the aforementioned dynamic binary instrumentation method that supports cross-platform and vulnerability awareness.

[0073] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0074] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0075] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A dynamic binary instrumentation method supporting cross-platform and vulnerability awareness, characterized in that: The following steps are involved: Step 1: receiving a target user program, and when the target user program issues a system call, executing a corresponding system call handler through Hyper call; Step 2: After the target front end converts the target user program into a TCG instruction set, the TCG instruction set is converted into LLVM intermediate code through the TCG front end; Step 3: inserting the LLVM instrumentation basic block into the LLVM intermediate code, and generating the LLVM intermediate code after the binary instrumentation into the target code by using the LLVM static compiler at runtime; Step 4: During the target code execution phase, memory vulnerability awareness is implemented based on the memory error checking mechanism and shadow memory.

2. The cross-platform and vulnerability-aware dynamic binary instrumentation method according to claim 1, characterized in that: The executing of the corresponding system call processing program through Hyper call further includes: When the target user program issues a malloc function call, the malloc function is compiled into a shared library; the function hijacking layer is preloaded during the dynamic linker recording the target user program binary file; all malloc function calls from the target user program are intercepted and replaced with the malloc function of the plugging system, and the malloc function of the plugging system notifies the target user program that the malloc function has been called through a hyper call mechanism, and the plugging system receives the notification and executes a corresponding handler.

3. The cross-platform and vulnerability-aware dynamic binary instrumentation method according to claim 2, characterized in that: The converting the TCG instruction set into LLVM intermediate code through the TCG front end further includes: The LLVM metadata technology is used in the TCG front end to add annotations to the target user program binary file, and distinguish the target user program intermediate code and the simulation intermediate code respectively.

4. The cross-platform and vulnerability-aware dynamic binary instrumentation method according to claim 3, characterized in that: The converting the TCG instruction set into LLVM intermediate code through the TCG front end further includes: Use LLVM-GCC / Dragonegg to convert the auxiliary function into intermediate code, and then inline the converted intermediate code of the auxiliary function into the LLVM intermediate code converted by the TCG front end.

5. The cross-platform and vulnerability-aware dynamic binary instrumentation method according to claim 4, characterized in that: The method simulates ARM executable file instrumentation on an x86 device.

6. A cross-platform and vulnerability-aware dynamic binary instrumentation system, characterized in that: include: A system call module is used to receive a target user program, and when the target user program issues a system call, execute a corresponding system call processing program through Hyper call; An intermediate code conversion module, used for converting the target user program into a TCG instruction set at the target front end, and then converting the TCG instruction set into LLVM intermediate code through the TCG front end; A binary plug-in module is used to insert the LLVM plug-in basic block into the LLVM intermediate code, and generate the LLVM intermediate code after the binary plug-in into the target code by using the LLVM static compiler at runtime; The memory vulnerability awareness module is used to implement memory vulnerability awareness based on the memory error checking mechanism and shadow memory during the target code execution phase.

7. The cross-platform and vulnerability-aware dynamic binary instrumentation system according to claim 6, characterized in that: The system call module is further used for: When the target user program issues a malloc function call, the malloc function is compiled into a shared library; the function hijacking layer is preloaded during the dynamic linker recording the target user program binary file; all malloc function calls from the target user program are intercepted and replaced with the malloc function of the plugging system, and the malloc function of the plugging system notifies the target user program that the malloc function has been called through a hyper call mechanism, and the plugging system receives the notification and executes a corresponding handler.

8. The cross-platform and vulnerability-aware dynamic binary instrumentation system according to claim 7, characterized in that: The intermediate code conversion module is further used for: The LLVM metadata technology is used in the TCG front end to add annotations to the target user program binary file, and distinguish the target user program intermediate code and the simulation intermediate code respectively.

9. The cross-platform and vulnerability-aware dynamic binary instrumentation system according to claim 8, characterized in that: The intermediate code conversion module is further used for: Use LLVM-GCC / Dragonegg to convert the auxiliary function into intermediate code, and then inline the converted intermediate code of the auxiliary function into the LLVM intermediate code converted by the TCG front end.

10. The cross-platform and vulnerability-aware dynamic binary instrumentation system according to claim 9, characterized in that: Emulate ARM executable instrumentation on x86 devices.

11. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the cross-platform and vulnerability-aware dynamic binary instrumentation method according to any one of claims 1-5.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the cross-platform and vulnerability-aware dynamic binary instrumentation method described in any one of claims 1 to 5 are implemented.

Images