Hidden memory execution detection method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a hidden memory execution detection method and device, electronic equipment, a storage medium and a program product, and belongs to the technical field of network security. According to the embodiment of the invention, at least one piece of target memory address information of a process is obtained for any process of a current system, and the target memory address information is historically executable memory address information; then obtaining the current memory attribute of each piece of target memory address information, and determining the target memory address information of which the current memory attribute does not comprise an executable attribute as a hidden memory execution address; and finally, warning the memory indicated by the hidden memory execution address. According to the embodiment of the invention, full-amount memory scanning is not needed, only the current memory attribute of the target memory address information with the executable attribute needs to be detected, efficient detection of hidden memory execution can be realized, potential safety risks can be found in time, meanwhile, the method does not need to depend on processor hardware support, and the method has relatively high universality and compatibility.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a hidden memory execution detection method, device, electronic equipment, storage medium and program product. Background Art

[0002] A fileless attack is an attack method that does not write executable files to disk, allowing attackers to compromise systems with anti-virus and application whitelist policies, thereby bypassing conventional detection methods. Fileless attacks are generally implemented through memory execution.

[0003] Hidden memory execution is a technique used by attackers to circumvent terminal security software's scanning of executable memory and achieve memory anti-killing. This technique is generally implemented by modifying memory attributes at runtime, that is, by removing the executable attributes of the memory, thereby achieving the purpose of circumventing terminal security software's memory scanning.

[0004] Terminal security software generally fights against fileless attacks by scanning process memory. Because the memory address space is huge, it generally only scans the memory space whose memory attributes include executable memory. To avoid being scanned by memory, attackers will modify the malicious code execution memory attributes and then encrypt the malicious code memory to hide the memory and avoid detection.

[0005] Therefore, how to effectively detect hidden memory execution is a technical problem that needs to be solved urgently. Summary of the invention

[0006] The present invention provides a hidden memory execution detection method, device, electronic device, storage medium and program product to solve the problem that it is difficult to detect hidden memory execution at present.

[0007] In order to solve the above problems, the present invention adopts the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides a hidden memory execution detection method, the method comprising:

[0009] For any process of the current system, obtaining at least one target memory address information of the process; the target memory address information is historical executable memory address information;

[0010] Obtaining current memory attributes of each of the target memory address information;

[0011] Determine the target memory address information where the current memory attribute does not include an executable attribute as a hidden memory execution address;

[0012] A warning is issued to the memory indicated by the hidden memory execution address.

[0013] In one embodiment of the present invention, obtaining at least one target memory address information of the process includes:

[0014] Obtaining bitmap information of a control flow graph of the process;

[0015] Based on the bitmap information, at least one target memory address information of the process is determined.

[0016] In one embodiment of the present invention, obtaining bitmap information of the control flow graph of the process includes:

[0017] Obtaining access rights for the process;

[0018] Based on the access permission, obtaining a process handle of the process;

[0019] Based on the process handle, bitmap information of a control flow graph of the process is obtained.

[0020] In one embodiment of the present invention, determining at least one target memory address information of the process based on the bitmap information includes:

[0021] Performing address reliability verification on the bitmap information;

[0022] When the address reliability verification is passed, obtaining the minimum memory address and the maximum memory address in the address space of the process;

[0023] The address space is traversed in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information of the process.

[0024] In one embodiment of the present invention, address reliability verification is performed on the bitmap information, including:

[0025] Determine whether the address memory of the bitmap information is in a memory mapping state;

[0026] When the address memory of the bitmap information is in a memory mapping state, it is determined that the address reliability verification passes.

[0027] In one embodiment of the present invention, traversing the address space to obtain at least one target memory address information of the process includes:

[0028] For the traversed current memory address information, determine whether the current memory address information is in a submitted state;

[0029] When the current memory address information is in the committed state, the current memory address information is determined as the target memory address information.

[0030] In a second aspect, based on the same inventive concept, an embodiment of the present invention provides a hidden memory execution detection device, the device comprising:

[0031] A first acquisition module, used for acquiring at least one target memory address information of any process in the current system;

[0032] A second acquisition module is used to acquire the current memory attribute of each target memory address information;

[0033] A determination module, configured to determine the target memory address information where the current memory attribute does not include an executable attribute as a hidden memory execution address;

[0034] The warning module is used to warn the memory indicated by the hidden memory execution address.

[0035] In one embodiment of the present invention, the first acquisition module includes:

[0036] A bitmap information acquisition submodule, used to acquire bitmap information of the control flow graph of the process;

[0037] The address information acquisition submodule is used to determine at least one target memory address information of the process based on the bitmap information.

[0038] In one embodiment of the present invention, the bitmap information acquisition submodule includes:

[0039] An access permission obtaining unit, used for obtaining access permission of the process;

[0040] A process handle acquisition unit, configured to acquire a process handle of the process based on the access permission;

[0041] The bitmap information acquisition unit is used to acquire the bitmap information of the control flow graph of the process based on the process handle.

[0042] In one embodiment of the present invention, the address information acquisition submodule includes:

[0043] A reliability verification unit, used to perform address reliability verification on the bitmap information;

[0044] An address acquisition unit, configured to acquire a minimum memory address and a maximum memory address in the address space of the process if the address reliability verification passes;

[0045] The address traversal unit is used to traverse the address space in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information of the process.

[0046] In one embodiment of the present invention, the reliability verification unit includes:

[0047] A first state determination subunit, used to determine whether the address memory of the bitmap information is in a memory mapping state;

[0048] The verification pass subunit is used to determine that the address reliability verification has passed when the address memory of the bitmap information is in a memory mapping state.

[0049] In one embodiment of the present invention, the address traversal unit includes:

[0050] A second state determination subunit is used to determine whether the current memory address information traversed is in a submitted state;

[0051] The address information determining subunit is used to determine the current memory address information as the target memory address information when the current memory address information is in the submitted state.

[0052] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executed, implements the hidden memory execution detection method as described in the first aspect of the present invention.

[0053] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the hidden memory execution detection method as described in the first aspect of the present invention.

[0054] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which is implemented by a processor to perform the steps in the hidden memory execution detection method described in the first aspect of the present invention.

[0055] Compared with the prior art, the present invention has the following advantages:

[0056] A hidden memory execution detection method provided by an embodiment of the present invention first obtains at least one target memory address information of any process in the current system, where the target memory address information is historically executable memory address information; then obtains the current memory attributes of each target memory address information, and determines the target memory address information whose current memory attributes do not include executable attributes as a hidden memory execution address; finally, warns the memory indicated by the hidden memory execution address. The embodiment of the present invention obtains the historically executable target memory address information of each process, and once it is detected that the current memory attributes of any target memory address information that should have executable attributes do not include executable attributes, it indicates that the target memory address information is a hidden memory execution address. In this way, there is no need to perform a full memory scan, and only the current memory attributes of the target memory address information need to be detected, so that efficient detection of hidden memory execution can be achieved, thereby timely discovering potential security risks. At the same time, there is no need to rely on processor hardware support, and it has strong versatility and compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 It is a flowchart of the steps of a hidden memory execution detection method in one embodiment of the present invention.

[0059] Figure 2 It is a schematic diagram of the overall flow of a hidden memory execution detection method in one embodiment of the present invention.

[0060] Figure 3 It is a schematic diagram of the reading process of CfgBitMap in one embodiment of the present invention.

[0061] Figure 4 It is a functional module diagram of a hidden memory execution detection device in one embodiment of the present invention.

[0062] Figure 5 It is a schematic structural diagram of an electronic device in one embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] It should be noted that hidden memory execution is a technique used by attackers to circumvent terminal security software's scanning of executable memory and achieve memory anti-killing. Terminal security software generally fights against fileless attacks by scanning process memory. Because the memory address space is huge, it generally only scans the memory space whose memory attributes include executable memory. To avoid being scanned by memory, attackers will obtain the execution time through exception handling and hooking function calls, and then modify the malicious code execution memory attributes, and then encrypt the malicious code memory to achieve hidden memory and evade detection.

[0065] In the related art, a vulnerability detection method and system are proposed, which hooks the function called by the machine code execution; obtains the return address of the function; detects whether the entry instruction of the function is a normal call instruction CALL based on the return address; if not, it is determined that a vulnerability is detected. This method is mainly used to detect memory execution behavior based on vulnerability attacks, relying on function hooking. Attackers can use hooking countermeasure technology to make the hook invalid, making it impossible to detect. At the same time, if the memory execution code does not call the hook function, it cannot be detected, and the coverage is limited.

[0066] In the related technology, a memory malicious code detection method based on processor tracking is also proposed, including: a. The driver module initializes the Intel processor tracking function; b. Monitors the code execution path of the target process; c. Decodes the buffer to obtain the complete virtual address of the execution path; d. Performs malicious code detection on the memory page; e. Determines whether the code belongs to the trusted memory code; f. Detects the memory code API call record and COM interface call record, and matches them with the abnormal behavior knowledge base. This method can detect the execution of memory code in fileless attacks, the malicious code after shelling, and the shellcode execution in the process of vulnerability exploitation, but this method strongly relies on the hardware characteristics of the processor's tracking function, and its applicable scenarios are limited. At the same time, recording all code execution paths has a large performance overhead.

[0067] Therefore, the current detection methods still have the following shortcomings:

[0068] (1) The non-executable memory address space is not detected, because the memory address space is huge. Due to performance overhead, the memory scanning method generally only scans the memory space with executable attributes, and cannot detect the hidden memory code execution by modifying the memory attributes.

[0069] (2) It is easy to be bypassed and has low coverage. The method of hooking functions and then detecting the function return address instruction is easy to be detected by attackers. Attackers can detect the function hook by detecting the integrity of the function code segment. If the attack code does not call the hook function, it cannot be detected. At the same time, the function hook method requires modifying the instruction execution detection, which is invasive and easily causes process instability.

[0070] (3) It relies on the hardware characteristics of the processor and has a large performance overhead. Detecting memory execution through instruction tracing strongly relies on the hardware characteristics of the processor, and the performance overhead of tracing all instruction executions is large, which is not applicable in many scenarios.

[0071] In view of the current problem that it is difficult to efficiently detect hidden memory execution, the present invention aims to provide a hidden memory execution detection method, which obtains the historical executable target memory address information of each process and utilizes the characteristic that the target memory address information should have executable attributes. Once it is detected that the current memory attributes of any target memory address information that should have executable attributes do not include executable attributes, it means that the target memory address information is the hidden memory execution address. In this way, there is no need to perform a full memory scan, and only the current memory attributes of the target memory address information need to be detected to achieve efficient detection of hidden memory execution, thereby timely discovering potential security risks. At the same time, there is no need to rely on processor hardware support, and it has strong versatility and compatibility.

[0072] Reference Figure 1 , shows a flowchart of a hidden memory execution detection method of the present invention, the method may include the following steps:

[0073] S101: For any process in the current system, obtain at least one target memory address information of the process.

[0074] It should be noted that the target memory address information is historically executable memory address information. That is, for any memory address information of a process, as long as the memory address information once has an executable attribute, the memory address information is the target memory address information.

[0075] S102: Acquire current memory attributes of each target memory address information.

[0076] In this implementation, each target memory address information may be scanned by a system built-in function or system monitoring tool, or third-party security software to obtain the current memory attribute of each target memory address information.

[0077] Exemplarily, when the current system is a Windows system, the VirtualQuery function can be used. This function is a Windows API function used to query the protection attributes of a specified memory area, such as whether it is readable, writable, or executable. In a specific implementation, the VirtualQuery function can be used to query the protection attributes of each target memory address information. The VirtualQuery function will return a MEMORY_BASIC_INFORMATION structure, which contains the current memory attributes of the target memory address information. Alternatively, use system monitoring tools, such as XMeters for Linux systems or "Resource Monitor" and "Performance Monitor" for Windows systems. These tools can provide real-time monitoring and analysis of memory usage to obtain the current memory attributes of each target memory address information.

[0078] S103: Determine the target memory address information whose current memory attribute does not include the executable attribute as the hidden memory execution address.

[0079] In this embodiment, based on the characteristic that the target memory address information should have executable attributes, once it is detected that the current memory attributes of any target memory address information that should have executable attributes do not include executable attributes, it means that the target memory address information has been modified by the attacker through various memory hiding methods, and the target memory address information can be judged as a hidden memory execution address.

[0080] For example, a process in the current system includes three historically executable target memory address information, namely A, B, and C. When checking the current memory attributes of the three target memory address information, it is found that only the current memory attributes of A and C include executable attributes, and the current memory attribute of B does not include executable attributes, which means that the memory attribute of B has been modified, and B is determined to be a hidden memory execution address.

[0081] S104: Warning the memory indicated by the hidden memory execution address.

[0082] In this embodiment, after any hidden memory execution address is determined, the memory indicated by the hidden memory execution address is read and the binary information content is executed to alert the memory segment.

[0083] In a specific implementation, by reading the hidden memory, it is possible to determine whether there is malicious code in the hidden memory and the type of the malicious code, and to issue a targeted warning according to the type of the malicious code.

[0084] In this embodiment, by obtaining the historical executable target memory address information of each process, and using the characteristic that the target memory address information should have executable attributes, once it is detected that the current memory attribute of any target memory address information that should have executable attributes does not include executable attributes, it means that the target memory address information is a hidden memory execution address. In this way, there is no need to perform a full memory scan, only the current memory attribute of the target memory address information needs to be detected, and efficient detection of hidden memory execution can be achieved, thereby timely discovering potential security risks. At the same time, there is no need to rely on processor hardware support, and it has strong versatility and compatibility.

[0085] In a feasible implementation manner, the step of obtaining at least one target memory address information of a process in S101 may specifically include the following sub-steps:

[0086] S101-1: Obtain bitmap information of the control flow graph of the process.

[0087] It should be noted that the Control Flow Graph (CFG) is a memory protection mechanism in the Windows operating system that is used to prevent attacks against control flow, such as ROP (Return-Oriented Programming) attacks. By verifying the control flow during program execution, the intrusion of malicious code can be effectively reduced. CFG will record all historical executable memory addresses.

[0088] It should be noted that the bitmap information of CFG, namely CfgBitMap, is a key component for implementing the control flow protection mechanism in the Windows operating system. It is a bitmap used to store information about the starting positions of all functions in the process space. In the CFG mechanism, CfgBitMap is used to verify whether the target address of the indirect call is a known and valid function start address. The working principle of CfgBitMap is: in the process space, the state of each 8 bytes corresponds to a bit in CfgBitMap. If there is a function start address in each group of 8 bytes, the corresponding bit in CfgBitMap is set to 1, indicating that the address is a valid function start address; otherwise, the bit is set to 0. In this way, when the program executes an indirect call, the operating system will check whether the corresponding bit of the target address in CfgBitMap is 1 to confirm whether the address is a valid function start address.

[0089] In this implementation, based on the characteristics of CFG, theoretically all addresses reserved in CfgBitMap have executable attributes.

[0090] In a specific implementation, S101-1 may specifically include the following sub-steps:

[0091] S101-1-1: Obtain access rights to the process.

[0092] In this embodiment, due to the protection mechanism of the process, the process information can be read only after the access rights of the process are obtained. Therefore, the reading of the process information can be achieved by obtaining the access rights.

[0093] In the specific implementation, when opening a process, it is required to open the process with PROCESS_VM_READ|PROCESS_QUERY_INFORMATION permissions to obtain the process handle. PROCESS_VM_READ and PROCESS_QUERY_INFORMATION are two specific access permission flags that are used to control access to the process. These flags are usually used when calling functions such as OpenProcess to request specific operation permissions for the target process.

[0094] S101-1-2: Based on the access rights, obtain the process handle of the process.

[0095] It should be noted that a process handle is an identifier that uniquely identifies a process in the system. Each process is assigned a unique handle value when it is created, and this value is unique across the entire system. The process handle is used to reference the process, especially when operations need to be performed on the process (such as querying information, sending signals, terminating the process, etc.).

[0096] S101-1-3: Based on the process handle, obtain the bitmap information of the control flow graph of the process.

[0097] In this implementation, the CfgBitMap of the process can be read through the process handle, and the CfgBitMap stores at least one target memory address information of the process.

[0098] S101 - 2: Determine at least one target memory address information of the process based on the bitmap information.

[0099] In this embodiment, by reading the CfgBitMap of the process, all historical executable target memory address information of the process can be obtained, and then using CFG control flow protection to save all executable memory address characteristics, it is possible to achieve efficient detection of hidden memory execution.

[0100] In a specific implementation, S101-2 may specifically include the following sub-steps:

[0101] S101-2-1: Verify the address reliability of the bitmap information.

[0102] In this implementation, after the CfgBitMap is acquired, the reliability of the CfgBitMap needs to be verified to ensure the reliability of the address memory stored in the CfgBitMap.

[0103] In a specific implementation, it can be determined whether the address memory of the bitmap information is in a memory mapping state; if the address memory of the bitmap information is in a memory mapping state, it is determined that the address reliability verification is passed.

[0104] In this embodiment, it is possible to determine whether the address memory of the bitmap information is in a memory mapping state by obtaining MEM_MAPPED. Specifically, if the address memory of the bitmap information is MEM_MAPPED, it is determined that the acquisition is normal and the address reliability verification is passed.

[0105] It should be noted that MEM_MAPPED is a memory area type identifier used in the Windows operating system, which is used to describe a specific area in virtual memory. When a memory area is marked as MEM_MAPPED, it means that the area is mapped to a file or object. This usually happens when using memory-mapped files. Memory-mapped files are a technology that allows developers to map file contents directly to the process address space, so that file data can be accessed as efficiently as accessing memory.

[0106] S101-2-2: When the address reliability verification passes, obtain the minimum memory address and the maximum memory address in the address space of the process.

[0107] In this implementation, after the address reliability verification is passed, the minimum memory address and the maximum memory address in the address space of the process are read.

[0108] In the specific implementation, the GetSystemInfo function can be used to obtain the maximum virtual memory address accessible to the user layer. The returned structure SYSTEM_INFO contains lpMaximumApplicationAddress, which represents the maximum memory address of the process.

[0109] It should be noted that GetSystemInfo is a Windows API function that is used to retrieve information about the current system. This function stores system information in a SYSTEM_INFO structure, which contains various information about the system, such as processor architecture, number of processors, memory address space limit, page size, etc. lpMaximumApplicationAddress is a member of the SYSTEM_INFO structure, which obtains information about the current computer system through the GetSystemInfo function. lpMaximumApplicationAddress is a pointer to the highest memory address that applications and dynamic link libraries (DLLs) can access. This address defines the upper limit of the addressable memory space in user mode.

[0110] It should be noted that the minimum memory address can be set to 0, and then the process memory is traversed from 0 until the maximum memory address.

[0111] S101-2-3: Traverse the address space in order from the smallest memory address to the largest memory address to obtain at least one target memory address information of the process.

[0112] In this implementation, the process memory may be traversed starting from the minimum memory address, all CfgEntry information of the current process may be acquired cyclically, and based on the CfgEntry information, it may be determined whether the memory is executable.

[0113] In the specific implementation, CfgEntry can be obtained in the following ways:

[0114] CfgEntry=CfgBitMap+((ULONG_PTR)VA>>CFG_INDEX_SHIFT);

[0115] That is, CfgEntry is calculated as the base address of CfgBitMap plus the result of VA shifted right by CFG_INDEX_SHIFT bits.

[0116] Among them, VA is a variable, representing the virtual address (Virtual Address), VA starts from 0, and the maximum value of VA is lpMaximumApplicationAddress, that is, the maximum memory address; ULONG_PTR is a data type, usually used to represent pointers or large integers; >> CFG_INDEX_SHIFT represents a right shift operation, CFG_INDEX_SHIFT is a macro or constant that defines the number of bits that VA needs to be shifted right. The right shift operation is used to extract the part used to index the control flow graph entry from VA.

[0117] In a specific implementation, for the traversed current memory address information, it is determined whether the current memory address information is in a committed state; if the current memory address information is in a committed state, the current memory address information is determined as the target memory address information.

[0118] In the specific implementation, it can be determined whether the memory state of CfgEntry is in the committed state of MEM_COMMIT; if so, it indicates that the CfgEntry is valid, and all the memory address information contained in the traversed CfgEntry is determined as the target memory address information. Then the memory state of all the target memory address information contained in CfgEntry is traversed. In theory, all the memory address information contained in CfgEntry contains the executable attribute PAGE_EXECUTE_FLAGS. If an address does not contain the executable attribute, the memory address is the memory attribute modified by the attacker through various memory hiding methods, and the memory can be determined to be a hidden memory execution address.

[0119] For ease of understanding, the following combination Figure 2 The hidden memory execution detection method provided by the embodiment of the present invention is explained. Figure 2 The figure shows the overall flow chart of the hidden memory execution detection method provided by the embodiment of the present invention.

[0120] In this implementation, first, the GetSystemlnfo function is used to obtain the largest virtual memory address accessible to the user layer; all processes are traversed to obtain all process numbers of the current system; the process handle is opened through the process number, and the CFG memory attribute information of all processes is traversed; the memory address information saved in the process CfgBitMap is read through the process handle; it is determined whether the memory address information attribute saved in CfgBitMap has an executable attribute, and if it does not contain an executable attribute, it is a hidden memory execution; the hidden memory execution binary information content is read, and an alarm is issued for this segment of memory.

[0121] For ease of understanding, the following combination Figure 3 The hidden memory execution detection method provided by the embodiment of the present invention is explained. Figure 3 A schematic diagram of the reading process of CfgBitMap is shown.

[0122] In this embodiment, the process CfgBitMap information is first obtained, and then the process address space is traversed through CfgBitMap to determine whether the current address space is the maximum address space; if it is the maximum address space, the traversal ends; if it is not the maximum address space, the process CfgEntry information is read to determine whether the CfgEntry memory is in the MEM COMMIT state; if it is in the MEM COMMIT state, the address attribute contained in the currently traversed CfgEntry is obtained to determine whether it contains executable attributes; if it contains executable attributes, RegionSize*64, and continue to traverse the next CfgEntry information; if it does not contain executable attributes, the address is added to the hidden memory execution address list.

[0123] A hidden memory execution detection method provided by an embodiment of the present invention has the following advantages:

[0124] (1) The present invention detects hidden memory execution by obtaining the memory address attribute anomaly recorded in CfgBitMap. There is no need to scan the binary information actually stored in the memory. Only the memory attribute information needs to be obtained. Compared with the memory scanning method, the performance overhead is small and the detection efficiency is high. At the same time, hidden memory execution can be detected.

[0125] (2) The present invention utilizes the execution protection feature of the CFG control flow of the Windows operating system. Compared with the hardware instruction tracking method, it does not require processor hardware support and has stronger versatility.

[0126] (3) The present invention does not require function hooking, but uses the system CFG feature to obtain all executable memory addresses, with higher coverage, no need for function hooking and no need to modify the detected program, and has better compatibility and stability.

[0127] In the second aspect, based on the same inventive concept, refer to Figure 4 , an embodiment of the present invention provides a hidden memory execution detection device 400, the hidden memory execution detection device 400 comprising:

[0128] The first acquisition module 401 is used to acquire at least one target memory address information of any process in the current system;

[0129] The second acquisition module 402 is used to acquire the current memory attribute of each target memory address information;

[0130] A determination module 403, configured to determine the target memory address information whose current memory attribute does not include an executable attribute as a hidden memory execution address;

[0131] The warning module 404 is used to warn the memory indicated by the hidden memory execution address.

[0132] In one embodiment of the present invention, the first acquisition module 401 includes:

[0133] A bitmap information acquisition submodule, used to acquire the bitmap information of the control flow graph of the process;

[0134] The address information acquisition submodule is used to determine at least one target memory address information of the process based on the bitmap information.

[0135] In one embodiment of the present invention, the bitmap information acquisition submodule includes:

[0136] An access permission obtaining unit, used to obtain access permissions of a process;

[0137] A process handle acquisition unit, used for acquiring a process handle of a process based on access rights;

[0138] The bitmap information acquisition unit is used to acquire the bitmap information of the control flow graph of the process based on the process handle.

[0139] In one embodiment of the present invention, the address information acquisition submodule includes:

[0140] A reliability verification unit, used for performing address reliability verification on the bitmap information;

[0141] An address acquisition unit, used for acquiring the minimum memory address and the maximum memory address in the address space of the process when the address reliability verification is passed;

[0142] The address traversal unit is used to traverse the address space in order from the smallest memory address to the largest memory address to obtain at least one target memory address information of the process.

[0143] In one embodiment of the present invention, the reliability verification unit includes:

[0144] A first state determination subunit, used to determine whether the address memory of the bitmap information is in a memory mapping state;

[0145] The verification pass subunit is used to determine that the address reliability verification has passed when the address memory of the bitmap information is in a memory mapping state.

[0146] In one embodiment of the present invention, the address traversal unit includes:

[0147] A second state determination subunit is used to determine whether the current memory address information is in a submitted state according to the traversed current memory address information;

[0148] The address information determination subunit is used to determine the current memory address information as the target memory address information when the current memory address information is in a committed state.

[0149] It should be noted that the specific implementation of the hidden memory execution detection device 400 in the embodiment of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the embodiment of the present invention, and will not be repeated here.

[0150] Based on the same inventive concept, Figure 5 An embodiment of the present invention further provides an electronic device 500, comprising a memory 501, a processor 502, and a computer program stored in the memory 501 and executable on the processor 502, which, when executed by the processor, implements the steps in the hidden memory execution detection method of any of the above embodiments.

[0151] It should be noted that the specific implementation of the electronic device 500 in the embodiment of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the embodiment of the present invention, and will not be repeated here.

[0152] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the hidden memory execution detection method of any of the above embodiments are implemented.

[0153] It should be noted that the specific implementation of the computer-readable storage medium in the embodiment of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the embodiment of the present invention, and will not be repeated here.

[0154] Based on the same inventive concept, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps in the hidden memory execution detection method of any of the above embodiments.

[0155] It should be noted that the specific implementation of the computer program product in the embodiment of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the embodiment of the present invention, and will not be repeated here.

[0156] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0157] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0162] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0163] The above is a detailed introduction to a hidden memory execution detection method, device, electronic device, storage medium and program product provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technicians in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A hidden memory execution detection method, characterized in that: The method comprises: For any process of the current system, obtaining at least one target memory address information of the process; the target memory address information is historical executable memory address information; Obtaining current memory attributes of each of the target memory address information; Determine the target memory address information where the current memory attribute does not include an executable attribute as a hidden memory execution address; A warning is issued to the memory indicated by the hidden memory execution address.

2. The hidden memory execution detection method according to claim 1, characterized in that: Obtaining at least one target memory address information of the process, including: Obtaining bitmap information of a control flow graph of the process; Based on the bitmap information, at least one target memory address information of the process is determined.

3. The hidden memory execution detection method according to claim 2, characterized in that: Obtaining bitmap information of the control flow graph of the process, including: Obtaining access rights for the process; Based on the access permission, obtaining a process handle of the process; Based on the process handle, bitmap information of a control flow graph of the process is obtained.

4. The hidden memory execution detection method according to claim 2, characterized in that: Determining at least one target memory address information of the process based on the bitmap information includes: Performing address reliability verification on the bitmap information; When the address reliability verification is passed, obtaining the minimum memory address and the maximum memory address in the address space of the process; The address space is traversed in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information of the process.

5. The hidden memory execution detection method according to claim 4, characterized in that: Performing address reliability verification on the bitmap information includes: Determine whether the address memory of the bitmap information is in a memory mapping state; When the address memory of the bitmap information is in a memory mapping state, it is determined that the address reliability verification passes.

6. The hidden memory execution detection method according to claim 4, characterized in that: Traversing the address space to obtain at least one target memory address information of the process includes: For the traversed current memory address information, determine whether the current memory address information is in a submitted state; When the current memory address information is in the committed state, the current memory address information is determined as the target memory address information.

7. A hidden memory execution detection device, characterized in that: The device comprises: A first acquisition module, used for acquiring at least one target memory address information of any process in the current system; A second acquisition module is used to acquire the current memory attribute of each target memory address information; A determination module, configured to determine the target memory address information where the current memory attribute does not include an executable attribute as a hidden memory execution address; The warning module is used to warn the memory indicated by the hidden memory execution address.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the hidden memory execution detection method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the hidden memory execution detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps in the hidden memory execution detection method described in any one of claims 1 to 6 are implemented.

Images