Memory hiding execution detection method and device, electronic equipment, storage medium and program product

Abstract

This invention provides a method, apparatus, electronic device, storage medium, and program product for detecting hidden memory execution, belonging to the field of network security technology. The embodiments of this invention first acquire at least one target memory address information for any process in the current system, where the target memory address information is historically executable memory address information; then, the current memory attributes of each target memory address information are acquired, and the target memory address information whose current memory attributes do not include executable attributes is determined as the hidden memory execution address; finally, a warning is issued for the memory indicated by the hidden memory execution address. This invention does not require a full memory scan; it only needs to detect the current memory attributes of target memory address information with executable attributes to achieve efficient detection of hidden memory execution, thereby promptly identifying potential security risks. Furthermore, it does not rely on processor hardware support and has strong versatility and compatibility.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, storage medium, and program product for detecting hidden memory execution. Background Technology

[0002] Fileless attacks are attack methods that do not write executable files to the disk, allowing attackers to compromise systems protected by antivirus and application whitelisting policies, thereby bypassing conventional detection methods. Fileless attacks are generally achieved through memory execution.

[0003] Hidden memory execution is a technique used by attackers to evade endpoint security software's scans of executable memory, achieving memory-based evasion. This technique typically involves modifying memory attributes at runtime, specifically removing the executable attribute from memory, thereby bypassing endpoint security software's memory scans.

[0004] Endpoint security software typically combats fileless attacks by scanning process memory. Because the memory address space is huge, it usually only scans memory spaces whose memory attributes contain executable data. To avoid being scanned, attackers modify the execution memory attributes of malicious code and then encrypt the malicious code memory to hide the memory and evade detection.

[0005] Therefore, how to effectively detect execution in hidden memory is a technical problem that urgently needs to be solved. Summary of the Invention

[0006] This invention provides a method, apparatus, electronic device, storage medium, and program product for detecting hidden memory execution, in order to solve the current problem of difficulty in detecting hidden memory execution.

[0007] To solve the above problems, the present invention adopts the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a method for detecting hidden memory execution, the method comprising:

[0009] For any process in the current system, obtain at least one target memory address information for the process; the target memory address information is historical executable memory address information;

[0010] Obtain the current memory attributes of each of the target memory addresses;

[0011] The target memory address information whose current memory attributes do not include executable attributes is determined as the hidden memory execution address;

[0012] A warning is issued regarding the memory indicated by the execution address of the hidden memory.

[0013] In one embodiment of the present invention, obtaining at least one target memory address information of the process includes:

[0014] Obtain the bitmap information of the control flow graph of the process;

[0015] Based on the bitmap information, at least one target memory address information of the process is determined.

[0016] In one embodiment of the present invention, obtaining the bitmap information of the control flow graph of the process includes:

[0017] Obtain access permissions to the process;

[0018] Based on the access permissions, obtain the process handle of the process;

[0019] Based on the process handle, obtain the bitmap information of the process's control flow graph.

[0020] In one embodiment of the present invention, determining at least one target memory address information of the process based on the bitmap information includes:

[0021] The address reliability of the bitmap information is verified.

[0022] If the address reliability verification passes, obtain the minimum and maximum memory addresses in the address space of the process;

[0023] The address space is traversed in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information for the process.

[0024] In one embodiment of the present invention, address reliability verification of the bitmap information includes:

[0025] Determine whether the memory address of the bitmap information is in a memory-mapped state;

[0026] If the address memory of the bitmap information is in a memory-mapped state, the address reliability verification is deemed successful.

[0027] In one embodiment of the present invention, traversing the address space to obtain at least one target memory address information of the process includes:

[0028] For the current memory address information encountered during traversal, determine whether the current memory address information is in a committed state;

[0029] If the current memory address information is in the submitted state, the current memory address information is determined as the target memory address information.

[0030] Secondly, based on the same inventive concept, embodiments of the present invention provide a hidden memory execution detection device, the device comprising:

[0031] The first acquisition module is used to acquire at least one target memory address information of any process in the current system.

[0032] The second acquisition module is used to acquire the current memory attributes of each of the target memory address information;

[0033] The determination module is used to determine the target memory address information whose current memory attributes do not include executable attributes as the hidden memory execution address;

[0034] The warning module is used to issue a warning about the memory indicated by the execution address of the hidden memory.

[0035] In one embodiment of the present invention, the first acquisition module includes:

[0036] The bitmap information acquisition submodule is used to acquire bitmap information of the control flow graph of the process;

[0037] The address information acquisition submodule is used to determine at least one target memory address information of the process based on the bitmap information.

[0038] In one embodiment of the present invention, the bitmap information acquisition submodule includes:

[0039] Access permission acquisition unit, used to acquire access permissions of the process;

[0040] A process handle acquisition unit is used to acquire the process handle of the process based on the access permissions.

[0041] The bitmap information acquisition unit is used to acquire bitmap information of the control flow graph of the process based on the process handle.

[0042] In one embodiment of the present invention, the address information acquisition submodule includes:

[0043] A reliability verification unit is used to perform address reliability verification on the bitmap information;

[0044] The address acquisition unit is used to acquire the minimum memory address and the maximum memory address in the address space of the process if the address reliability verification is passed.

[0045] The address traversal unit is used to traverse the address space in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information of the process.

[0046] In one embodiment of the present invention, the reliability verification unit includes:

[0047] The first state determination subunit is used to determine whether the address memory of the bitmap information is in a memory-mapped state.

[0048] The verification unit is used to determine that the address reliability verification is passed when the address memory of the bitmap information is in a memory-mapped state.

[0049] In one embodiment of the present invention, the address traversal unit includes:

[0050] The second state determination subunit is used to determine whether the current memory address information is in a committed state based on the current memory address information traversed.

[0051] The address information determination subunit is used to determine the current memory address information as the target memory address information when the current memory address information is in the submitted state.

[0052] Thirdly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing, implements the hidden memory execution detection method as described in the first aspect of the present invention.

[0053] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the hidden memory execution detection method as described in the first aspect of the present invention.

[0054] Fifthly, embodiments of the present invention provide a computer program product, including a computer program / instructions, which are implemented by a processor as the steps in the hidden memory execution detection method described in the first aspect of the present invention.

[0055] Compared with the prior art, the present invention has the following advantages:

[0056] This invention provides a method for detecting hidden memory execution. First, for any process in the current system, at least one target memory address is obtained. This target memory address information is historically executable memory address information. Then, the current memory attributes of each target memory address are obtained, and the target memory address information whose current memory attributes do not include executable attributes is determined as the hidden memory execution address. Finally, a warning is issued for the memory indicated by the hidden memory execution address. This invention obtains historically executable target memory address information for each process. Once it detects that the current memory attributes of any target memory address information that should have executable attributes do not include executable attributes, it indicates that the target memory address information is the hidden memory execution address. Thus, without performing a full memory scan, only the current memory attributes of the target memory address information need to be detected to achieve efficient detection of hidden memory execution, thereby promptly identifying potential security risks. Furthermore, it does not rely on processor hardware support and has strong versatility and compatibility. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of the steps of a hidden memory execution detection method in one embodiment of the present invention.

[0059] Figure 2 This is a schematic diagram of the overall process of a hidden memory execution detection method in one embodiment of the present invention.

[0060] Figure 3 This is a schematic diagram of the reading process of CfgBitMap in one embodiment of the present invention.

[0061] Figure 4 This is a schematic diagram of the functional modules of a hidden memory execution detection device according to an embodiment of the present invention.

[0062] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] It's important to note that hidden memory execution is a technique used by attackers to evade endpoint security software's scans of executable memory, achieving memory-based evasion. Endpoint security software typically combats fileless attacks by scanning process memory. Because the memory address space is vast, it generally only scans memory spaces whose attributes contain executable information. To avoid being scanned, attackers use exception handling and hooked function calls to obtain execution opportunities, then modify the malicious code's execution memory attributes, and finally encrypt the malicious code's memory to hide it and evade detection.

[0065] In related technologies, a method and system for vulnerability detection have been proposed. This method hooks functions called during machine code execution; obtains the function's return address; and checks whether the function's entry instruction is a normal call instruction (CALL) based on the return address. If not, a vulnerability is detected. This method is mainly used to detect memory execution behavior based on vulnerability attacks. It relies on function hooking, but attackers can use hooking countermeasures to disable the hooks, making them undetectable. Furthermore, if the memory execution code does not call the hooked function, it cannot be detected either, resulting in limited coverage.

[0066] In related technologies, a processor-based memory malware detection method has been proposed, including: a) initializing the Intel processor tracing function in the driver module; b) monitoring the code execution path of the target process; c) decoding the buffer to obtain the complete virtual address of the execution path; d) performing malware detection on memory pages; e) determining whether the code belongs to trusted memory code; and f) detecting memory code API call records and COM interface call records, and matching them with an abnormal behavior knowledge base. This method can detect memory code execution in fileless attacks, packed malware, and shellcode execution during vulnerability exploitation. However, this method heavily relies on the processor's tracing hardware characteristics, limiting its applicability, and recording all code execution paths incurs significant performance overhead.

[0067] Therefore, current detection methods still have the following shortcomings:

[0068] (1) No executable memory address space was detected. Because the memory address space is huge, due to performance overhead, memory scanning methods generally only scan memory spaces with executable attributes and cannot detect hidden memory code execution by modifying memory attributes.

[0069] (2) It is easily bypassed and has low coverage. The method of hooking functions and then detecting the function return address instruction is easily detected by attackers. Attackers can detect function hooks by checking the integrity of the function code segment. If the attack code does not call the hooked function, it cannot be detected. At the same time, the function hooking method requires modification of instruction execution for detection, which is intrusive and can easily cause process instability.

[0070] (3) It relies on the characteristics of the processor hardware and has a large performance overhead. Detecting memory execution by instruction tracing is highly dependent on the characteristics of the processor hardware, and the performance overhead of tracing all instruction execution is large, which is not applicable in many scenarios.

[0071] To address the current difficulty in efficiently detecting hidden memory execution, this invention aims to provide a method for detecting hidden memory execution. This method acquires historical executable target memory address information for each process and leverages the characteristic that this target memory address information should possess executable attributes. If the current memory attributes of any target memory address that should possess executable attributes do not include the executable attribute, then this target memory address is considered a hidden memory execution address. Thus, without performing a full memory scan, only the current memory attributes of the target memory address information are needed to efficiently detect hidden memory execution, thereby promptly identifying potential security risks. Furthermore, this method does not rely on processor hardware support and has strong versatility and compatibility.

[0072] Reference Figure 1 The diagram illustrates a flowchart of a method for detecting hidden memory execution according to the present invention. The method may include the following steps:

[0073] S101: For any process in the current system, obtain at least one target memory address information of the process.

[0074] It should be noted that the target memory address information refers to historically executable memory address information. In other words, for any memory address of a process, as long as that memory address has ever had executable attributes, then that memory address is the target memory address information.

[0075] S102: Obtain the current memory attributes of each target memory address.

[0076] In this embodiment, the system's built-in functions, system monitoring tools, or third-party security software can be used to scan the memory address information of each target to obtain the current memory attributes of each target memory address.

[0077] For example, on a Windows system, the VirtualQuery function can be used. This function, one of eleven Windows API functions, is used to query the protection attributes of a specified memory region, such as whether it is readable, writable, or executable. In a specific implementation, the VirtualQuery function can be used to query the protection attributes of each target memory address. The VirtualQuery function returns a MEMORY_BASIC_INFORMATION structure, which contains the current memory attributes of the target memory address. Alternatively, system monitoring tools, such as XMeters on Linux or Resource Monitor and Performance Monitor on Windows, can be used. These tools provide real-time monitoring and analysis of memory usage to obtain the current memory attributes of each target memory address.

[0078] S103: Determine the target memory address information whose current memory attributes do not include the executable attribute as the hidden memory execution address.

[0079] In this embodiment, based on the characteristic that target memory address information should have executable attributes, once it is detected that the current memory attribute of any target memory address information that should have executable attributes does not include executable attributes, it indicates that the target memory address information has been modified by the attacker through various memory hiding methods, and it can be determined that the target memory address information is a hidden memory execution address.

[0080] For example, a process in the current system includes three historical executable target memory addresses: A, B, and C. Examining the current memory attributes of these three target memory addresses reveals that only A and C have executable attributes, while B does not. This indicates that B's memory attributes have been modified, confirming B as a hidden execution address.

[0081] S104: Issue a warning regarding the memory specified by the hidden memory execution address.

[0082] In this embodiment, after determining any hidden memory execution address, the memory indicated by the hidden memory execution address is read, and the binary information content is executed to alert the memory segment.

[0083] In practice, by reading hidden memory, it is possible to determine whether malicious code exists in the hidden memory and the type of malicious code, and to issue targeted warnings based on the type of malicious code.

[0084] In this embodiment, by acquiring the historical executable target memory address information of each process and utilizing the characteristic that this target memory address information should have executable attributes, if it is detected that the current memory attributes of any target memory address information that should have executable attributes do not include executable attributes, it indicates that this target memory address information is the hidden memory execution address. Thus, without performing a full memory scan, only the current memory attributes of the target memory address information need to be detected to achieve efficient detection of hidden memory execution, thereby promptly identifying potential security risks. Furthermore, it does not rely on processor hardware support and has strong versatility and compatibility.

[0085] In one feasible implementation, the step of obtaining at least one target memory address information of the process in S101 may specifically include the following sub-steps:

[0086] S101-1: Obtain bitmap information of the process's control flow graph.

[0087] It's important to note that the Control Flow Graph (CFG) is a memory protection mechanism in the Windows operating system used to prevent attacks targeting control flow, such as Return-Oriented Programming (ROP) attacks. By verifying the control flow during program execution, it can effectively reduce the intrusion of malicious code. The CFG records all historical executable memory addresses.

[0088] It's important to note that the bitmap information in CFG, namely CfgBitMap, is a key component in the Windows operating system's control flow protection mechanism. It's a bitmap used to store information about the starting addresses of all functions within the process space. In the CFG mechanism, CfgBitMap is used to verify whether the target address of an indirect call is a known and valid function starting address. CfgBitMap works as follows: within the process space, every 8 bytes of state corresponds to one bit in CfgBitMap. If a function's starting address is present in each group of 8 bytes, the corresponding bit in CfgBitMap is set to 1, indicating that the address is a valid function starting address; otherwise, the bit is set to 0. Thus, when a program executes an indirect call, the operating system checks whether the corresponding bit in CfgBitMap for the target address is 1 to confirm whether the address is a valid function starting address.

[0089] In this implementation, based on the characteristics of CFG, theoretically all addresses stored in CfgBitMap have executable properties.

[0090] In a specific implementation, S101-1 may include the following sub-steps:

[0091] S101-1-1: Obtain access permissions for the process.

[0092] In this embodiment, due to the process protection mechanism, process information can only be read after obtaining access permissions to the process. Therefore, by obtaining access permissions, it is possible to read process information.

[0093] In practice, opening a process requires the PROCESS_VM_READ|PROCESS_QUERY_INFORMATION permissions to obtain a process handle. PROCESS_VM_READ and PROCESS_QUERY_INFORMATION are two specific access permission flags used to control access to a process. These flags are typically used when calling functions such as OpenProcess to request specific operational permissions for the target process.

[0094] S101-1-2: Obtain the process handle of a process based on access permissions.

[0095] It's important to note that a process handle is an identifier used to uniquely identify a process in a system. Each process is assigned a unique handle value upon creation, and this value is unique across the entire system. Process handles are used to reference processes, especially when operations need to be performed on the process (such as querying information, sending signals, terminating the process, etc.).

[0096] S101-1-3: Obtain bitmap information of the process's control flow graph based on the process handle.

[0097] In this embodiment, the CfgBitMap of a process can be read through the process handle. The CfgBitMap stores at least one target memory address information of the process.

[0098] S101-2: Determine at least one target memory address information for the process based on bitmap information.

[0099] In this embodiment, by reading the process's CfgBitMap, it is possible to obtain all historical executable target memory address information of the process. Then, by utilizing the characteristic that CFG control flow protection will save all executable memory addresses, it is possible to achieve efficient detection of hidden memory execution.

[0100] In a specific implementation, S101-2 may include the following sub-steps:

[0101] S101-2-1: Verify the address reliability of bitmap information.

[0102] In this embodiment, after obtaining CfgBitMap, it is necessary to perform reliability verification on CfgBitMap to ensure the reliability of the memory addresses stored in CfgBitMap.

[0103] In the specific implementation, it can be determined whether the address memory of the bitmap information is in a memory-mapped state; if the address memory of the bitmap information is in a memory-mapped state, the address reliability verification is confirmed to be successful.

[0104] In this embodiment, the memory address of the bitmap information can be determined to be in a memory-mapped state by obtaining MEM_MAPPED. Specifically, if the memory address of the bitmap information is MEM_MAPPED, the acquisition is considered normal and the address reliability verification is successful.

[0105] It's important to note that MEM_MAPPED is a memory region type identifier used in the Windows operating system to describe a specific region in virtual memory. When a memory region is marked as MEM_MAPPED, it means that the region is mapped to a file or object. This typically occurs when using memory-mapped files, a technique that allows developers to directly map file contents into the process's address space, enabling efficient access to file data as if it were memory.

[0106] S101-2-2: If the address reliability verification passes, obtain the minimum and maximum memory addresses in the process's address space.

[0107] In this embodiment, after the address reliability verification is passed, the minimum and maximum memory addresses in the process's address space will be read.

[0108] In a practical implementation, the GetSystemInfo function can be used to obtain the maximum virtual memory address accessible to the user layer. The returned SYSTEM_INFO structure contains lpMaximumApplicationAddress, which represents the maximum memory address of the process.

[0109] It's important to note that `GetSystemInfo` is a Windows API function used to retrieve information about the current system. This function stores system information in a `SYSTEM_INFO` structure, which contains various information about the system, such as processor architecture, number of processors, memory address space limits, and page size. `lpMaximumApplicationAddress` is a member of the `SYSTEM_INFO` structure, which uses the `GetSystemInfo` function to obtain information about the current computer system. `lpMaximumApplicationAddress` is a pointer to the highest memory address that applications and dynamic link libraries (DLLs) can access. This address defines the upper limit of the addressable memory space in user mode.

[0110] It should be noted that the minimum memory address can be set to 0, and then the process memory can be traversed from 0 until the maximum memory address.

[0111] S101-2-3: Traverse the address space in order from the smallest memory address to the largest memory address to obtain at least one target memory address information of the process.

[0112] In this implementation, the process memory can be traversed starting from the smallest memory address, and all CfgEntry information of the current process can be obtained in a loop. Based on the CfgEntry information, it can be determined whether the memory has been executable.

[0113] In the specific implementation, CfgEntry can be obtained in the following ways:

[0114] CfgEntry=CfgBitMap+((ULONG_PTR)VA>>CFG_INDEX_SHIFT);

[0115] That is, CfgEntry is calculated as the base address of CfgBitMap plus the result of shifting VA right by CFG_INDEX_SHIFT bits.

[0116] Here, VA is a variable representing a virtual address, starting from 0, with a maximum value of lpMaximumApplicationAddress, i.e., the maximum memory address; ULONG_PTR is a data type, typically used to represent pointers or large integers; >>CFG_INDEX_SHIFT represents a right shift operation, a macro or constant defining the number of bits to shift VA to the right. The right shift operation is used to extract the portion from VA used to index control flow graph entries.

[0117] In the specific implementation, for the current memory address information that has been traversed, it is determined whether the current memory address information is in a committed state; if the current memory address information is in a committed state, the current memory address information is determined as the target memory address information.

[0118] In the specific implementation, we can determine whether the CfgEntry memory state is MEM_COMMIT (committed). If so, it indicates that the CfgEntry is valid, and all memory address information contained in the traversed CfgEntry is identified as the target memory address information. Then, we iterate through the memory states of all target memory address information contained in the CfgEntry. Theoretically, all memory address information contained in the CfgEntry should contain the executable attribute PAGE_EXECUTE_FLAGS. If an address does not contain the executable attribute, then the attacker has modified the memory attributes through various memory hiding methods, and this memory can be identified as a hidden memory execution address.

[0119] For ease of understanding, the following is combined with Figure 2 The hidden memory execution detection method provided in the embodiments of the present invention will be explained and described. Figure 2 A schematic diagram of the overall process of the hidden memory execution detection method provided in an embodiment of the present invention is shown.

[0120] In this implementation, the largest virtual memory address accessible to the user layer is first obtained using the GetSystemInformation function; all processes are traversed to obtain the process IDs of all processes in the current system; process handles are opened using the process IDs, and the CFG memory attribute information of all processes is traversed; the memory address information stored in the process's CfgBitMap is read using the process handle; it is determined whether the memory address information stored in CfgBitMap has an executable attribute; if it does not contain an executable attribute, it is considered hidden memory execution; the hidden memory execution binary information content is read, and an alarm is triggered for that memory segment.

[0121] For ease of understanding, the following is combined with Figure 3 The hidden memory execution detection method provided in the embodiments of the present invention will be explained and described. Figure 3 The diagram illustrates the reading process of CfgBitMap.

[0122] In this implementation, the process CfgBitMap information is first obtained, and then the process address space is traversed through CfgBitMap to determine if the current address space is the maximum address space. If it is the maximum address space, the traversal ends. If it is not the maximum address space, the process CfgEntry information is read to determine if the CfgEntry memory is in the MEM COMMIT state. If it is in the MEM COMMIT state, the address attributes contained in the currently traversed CfgEntry are obtained to determine if they contain executable attributes. If they contain executable attributes, RegionSize is multiplied by 64, and the traversal of the next CfgEntry information continues. If they do not contain executable attributes, the address is added to the hidden memory execution address list.

[0123] The hidden memory execution detection method provided in this embodiment of the invention has the following advantages:

[0124] (1) This invention detects hidden memory execution by obtaining the memory address attribute abnormality recorded in CfgBitMap. It does not require scanning the actual binary information stored in memory, but only needs to obtain the memory attribute information. Compared with the memory scanning method, it has low performance overhead and high detection efficiency, and can detect hidden memory execution.

[0125] (2) This invention utilizes the execution protection feature of the CFG control flow in the Windows operating system. Compared with the hardware instruction tracing method, it does not require processor hardware support and has stronger versatility.

[0126] (3) This invention does not require function hooking, but uses the system CFG feature to obtain all executable memory addresses, resulting in higher coverage. It does not require function hooking or modification of the detected program, thus having better compatibility and greater stability.

[0127] Secondly, based on the same inventive concept, and referring to... Figure 4 This invention provides a hidden memory execution detection device 400, which includes:

[0128] The first acquisition module 401 is used to acquire at least one target memory address information of any process in the current system.

[0129] The second acquisition module 402 is used to acquire the current memory attributes of each target memory address information;

[0130] The determination module 403 is used to determine the target memory address information whose current memory attributes do not include executable attributes as the hidden memory execution address;

[0131] Warning module 404 is used to issue a warning about the memory indicated by the hidden memory execution address.

[0132] In one embodiment of the present invention, the first acquisition module 401 includes:

[0133] The bitmap information acquisition submodule is used to acquire bitmap information of the process's control flow graph;

[0134] The address information acquisition submodule is used to determine at least one target memory address of a process based on bitmap information.

[0135] In one embodiment of the present invention, the bitmap information acquisition submodule includes:

[0136] Access permission acquisition unit, used to acquire access permissions for a process;

[0137] The process handle acquisition unit is used to acquire the process handle of a process based on access permissions.

[0138] The bitmap information acquisition unit is used to acquire bitmap information of the control flow graph of a process based on the process handle.

[0139] In one embodiment of the present invention, the address information acquisition submodule includes:

[0140] The reliability verification unit is used to verify the address reliability of the bitmap information.

[0141] The address acquisition unit is used to acquire the minimum and maximum memory addresses in the process's address space, provided that the address reliability verification has passed.

[0142] The address traversal unit is used to traverse the address space in order from the smallest memory address to the largest memory address to obtain at least one target memory address information of the process.

[0143] In one embodiment of the present invention, the reliability verification unit includes:

[0144] The first state determination subunit is used to determine whether the address memory of the bitmap information is in a memory-mapped state.

[0145] The verification passed subunit is used to determine if the address reliability verification is passed when the address memory of the bitmap information is in a memory-mapped state.

[0146] In one embodiment of the present invention, the address traversal unit includes:

[0147] The second state determination subunit is used to determine whether the current memory address information is in the committed state based on the current memory address information traversed.

[0148] The address information determination subunit is used to determine the current memory address information as the target memory address information when the current memory address information is in the submitted state.

[0149] It should be noted that the specific implementation of the hidden memory execution detection device 400 in this embodiment refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the present invention, and will not be repeated here.

[0150] Based on the same inventive concept, referring to Figure 5 The present invention also provides an electronic device 500, including a memory 501, a processor 502, and a computer program stored in the memory 501 and executable on the processor 502. When executed by the processor, the program implements the steps in the hidden memory execution detection method of any of the above embodiments.

[0151] It should be noted that the specific implementation of the electronic device 500 in this embodiment refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the present invention, and will not be repeated here.

[0152] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the hidden memory execution detection method of any of the above embodiments.

[0153] It should be noted that the specific implementation of the computer-readable storage medium in the embodiments of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the present invention, and will not be repeated here.

[0154] Based on the same inventive concept, embodiments of the present invention provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps in the hidden memory execution detection method of any of the above embodiments.

[0155] It should be noted that the specific implementation of the computer program product of the present invention refers to the specific implementation of the hidden memory execution detection method proposed in the first aspect of the present invention, and will not be repeated here.

[0156] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0157] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0159] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0161] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0162] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the element.

[0163] The foregoing has provided a detailed description of the hidden memory execution detection method, apparatus, electronic device, storage medium, and program product provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for detecting hidden memory execution, characterized in that, The method includes: For any process in the current system, obtain at least one target memory address information for the process; the target memory address information is historical executable memory address information; Obtain the current memory attributes of each of the target memory addresses; The target memory address information whose current memory attributes do not include executable attributes is determined as the hidden memory execution address; A warning is issued regarding the memory accessed by the address indicated by the hidden memory execution; Obtaining at least one target memory address information of the process includes: Obtain the bitmap information of the control flow graph of the process; Based on the bitmap information, at least one target memory address information of the process is determined; Obtaining the bitmap information of the control flow graph of the process includes: Obtain access permissions to the process; Based on the access permissions, obtain the process handle of the process; Based on the process handle, obtain the bitmap information of the control flow graph of the process; Based on the bitmap information, determining at least one target memory address information for the process includes: The address reliability of the bitmap information is verified. If the address reliability verification passes, obtain the minimum and maximum memory addresses in the address space of the process; The address space is traversed in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information for the process.

2. The hidden memory execution detection method according to claim 1, characterized in that, The address reliability of the bitmap information is verified, including: Determine whether the memory address of the bitmap information is in a memory-mapped state; If the address memory of the bitmap information is in a memory-mapped state, the address reliability verification is deemed successful.

3. The hidden memory execution detection method according to claim 1, characterized in that, Traverse the address space to obtain at least one target memory address information of the process, including: For the current memory address information encountered during traversal, determine whether the current memory address information is in a committed state; If the current memory address information is in the submitted state, the current memory address information is determined as the target memory address information.

4. A hidden memory execution detection device, characterized in that, The device includes: The first acquisition module is used to acquire at least one target memory address information of any process in the current system. The second acquisition module is used to acquire the current memory attributes of each of the target memory address information; The determination module is used to determine the target memory address information whose current memory attributes do not include executable attributes as the hidden memory execution address; The warning module is used to issue a warning about the memory indicated by the execution address of the hidden memory; The first acquisition module includes: The bitmap information acquisition submodule is used to acquire bitmap information of the control flow graph of the process; The address information acquisition submodule is used to determine at least one target memory address information of the process based on the bitmap information. The bitmap information acquisition submodule includes: Access permission acquisition unit, used to acquire access permissions of the process; A process handle acquisition unit is used to acquire the process handle of the process based on the access permissions. The bitmap information acquisition unit is used to acquire bitmap information of the control flow graph of the process based on the process handle; The address information acquisition submodule includes: A reliability verification unit is used to perform address reliability verification on the bitmap information; The address acquisition unit is used to acquire the minimum memory address and the maximum memory address in the address space of the process if the address reliability verification is passed. The address traversal unit is used to traverse the address space in order from the minimum memory address to the maximum memory address to obtain at least one target memory address information of the process.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the hidden memory execution detection method according to any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the hidden memory execution detection method as described in any one of claims 1-3.

7. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps in the hidden memory execution detection method according to any one of claims 1-3.

Images