Advanced killing-free attack method, device and equipment based on GPU (Graphics Processing Unit) memory loading, storage medium and program product

Abstract

The invention discloses an advanced killing-free attack method, device and equipment based on GPU memory loading, a storage medium and a program product, and relates to the technical field of information security. The method comprises the following steps: initializing a CUDA context, calling a hook function to redirect calling of an original function to a target function, transferring an attack-free file into a GPU for storage after hanging up a thread, transferring the attack-free file into a host for storage by calling an original sleep function, and transferring the attack-free file into the host for storage by utilizing the computing power and the storage space of the GPU. By moving and executing the malicious code in the GPU storage, the malicious code is injected into the memory space of the legal process, so that the malicious code is hidden in the memory and executed in the context of the legal process, and the killing-free attack method disclosed by the invention can bypass the traditional file system, memory scanning and static detection technologies; the technical problem that in the prior art, a killing-free attack method is not high in concealment in dynamic analysis is solved, and the technical effects that malicious codes are high in concealment and low in interception rate are achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an advanced anti-killing attack method, device, equipment, storage medium and program product based on GPU memory loading. Background Art

[0002] In the field of malware, there are various technologies and methods to evade traditional security detection and protection mechanisms. Among them, anti-killing technology is a common method, which refers to the process in which malware or malicious code bypasses security defense measures through various technical means, allowing it to be secretly executed in the infected system and avoid detection and interception. It aims to enable malware to effectively hide and disguise itself before being detected and blocked.

[0003] Existing anti-virus attack methods usually use dynamic generation technology to dynamically generate shellcode in memory to avoid writing the complete shellcode to disk, thereby reducing the risk of being discovered by antivirus software. Memory encryption technology can also be used to encrypt shellcode in the executable memory area and decrypt it when needed to avoid antivirus software's memory scanning. Or through reflective DLL injection and shellcode memory loading, anti-virus attacks can be carried out by detecting memory allocation anomalies or program behavior deviations to trigger memory scanning.

[0004] However, in the process of implementing the technical solution of the invention in the embodiment of the present application, the inventor of the present application found that the above technology has at least the following technical problems: in dynamic analysis, memory scanning can directly access and analyze the memory state at runtime, identify abnormal memory allocation patterns, the existence of injected code and malicious behavior. Since dynamic analysis can monitor and analyze activities in memory in real time, it can more effectively identify malicious code and abnormal behavior hidden in legitimate processes, making the existing anti-killing attack method less concealed and more interceptive in dynamic analysis. Summary of the invention

[0005] The embodiments of the present application solve the technical problem that the anti-killing attack method in the prior art is not highly concealed in dynamic analysis by providing an advanced anti-killing attack method, device, equipment, storage medium and program product based on GPU memory loading, and achieve the technical effect of making malicious code highly concealed and having a low interception rate.

[0006] In a first aspect, an embodiment of the present application provides an advanced anti-killing attack method based on GPU memory loading, comprising the following steps:

[0007] Obtaining GPU resources and the GPU resource configuration strategy;

[0008] According to the created hook function, redirecting the call of the original function to the target function, wherein the original function at least includes an original heap allocation function and an original sleep function, and the target function at least includes a pre-created target heap allocation function and a target sleep function;

[0009] Suspend all threads in the current process and move the kill-free attack file to GPU storage, where the kill-free attack file is used to perform the kill-free attack;

[0010] Resuming the calling of the original sleep function, and when the original sleep function is called, moving the anti-killing attack file from the GPU storage to the host;

[0011] Resume all threads in the current process.

[0012] In a second aspect, an embodiment of the present application provides an advanced anti-kill attack device based on GPU memory loading, including:

[0013] An acquisition module, used to acquire GPU resources and the GPU resource configuration strategy;

[0014] A redirection module, used for redirecting the call of the original function to the target function according to the created hook function, wherein the original function at least includes an original heap allocation function and an original sleep function, and the target function at least includes a pre-created target heap allocation function and a target sleep function;

[0015] A moving module, used to suspend all threads in the current process and move the kill-free attack file to GPU storage, where the kill-free attack file is used to perform the kill-free attack;

[0016] A moving module, used to restore the call of the original sleep function, and when the original sleep function is called, move the anti-killing attack file from the GPU storage to the host;

[0017] The recovery module is used to resume all threads in the current process.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0019] processor;

[0020] A memory, configured to store instructions executable by the processor;

[0021] The processor is configured to execute the instructions to implement the advanced anti-killing attack method based on GPU memory loading.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of a terminal, the terminal is enabled to execute the advanced anti-killing attack method based on GPU memory loading.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the advanced anti-killing attack method based on GPU memory loading.

[0024] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: by initializing the CUDA context, calling the hook function to redirect the call of the original function to the target function, moving the anti-kill attack file into the GPU storage after suspending the thread, and moving the anti-kill attack file into the host storage by calling the original sleep function, by utilizing the computing power and storage space of the GPU, by moving and executing the malicious code in the GPU storage, the malicious code is injected into the memory space of the legitimate process, so that the malicious code is hidden in the memory and executed in the context of the legitimate process, so that the anti-kill attack method of the present application can bypass the traditional file system, memory scanning and static detection technology, solves the technical problem that the anti-kill attack method in the prior art is not highly concealed in dynamic analysis, and achieves the technical effect of making the malicious code highly concealed and having a low interception rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of an advanced anti-killing attack method based on GPU memory loading provided in at least one embodiment of the present application;

[0026] Figure 2 An exemplary flow chart of an advanced anti-kill attack method based on GPU memory loading provided by at least one embodiment of the present application;

[0027] Figure 3 A flowchart of a method for obtaining GPU resources and GPU resource configuration strategy provided in at least one embodiment of the present application;

[0028] Figure 4 A flow chart of a method for redirecting a call of an original function to a target function provided in at least one embodiment of the present application;

[0029] Figure 5 A flowchart of a method for moving an anti-killing attack file to GPU storage provided in at least one embodiment of the present application;

[0030] Figure 6 A flowchart of a method for moving an anti-killing attack file from a GPU storage to a host provided in at least one embodiment of the present application;

[0031] Figure 7 A schematic diagram of the structure of an advanced anti-kill attack device based on GPU memory loading provided by at least one embodiment of the present application;

[0032] Figure 8 A module diagram of an electronic device provided for at least one embodiment of the present application. DETAILED DESCRIPTION

[0033] The embodiment of the present application provides an advanced anti-killing attack method based on GPU memory loading, and designs a technical solution that can bypass the current mainstream anti-virus software layer-by-layer detection through steps such as initializing CUDA context, creating hooks, suspending threads, moving DLL to GPU storage, calling the original Sleep function, and moving DLL back from GPU storage, thereby solving the shortcomings of the current existing attack solutions. The technical problem of low concealment and high interception of the anti-killing attack method in the prior art against the dynamic analysis detection method is solved, and the technical effect of high concealment and low interception is achieved by using CPU memory loading in the dynamic analysis detection method.

[0034] In the field of malware, there are various technologies and methods to evade traditional security detection and protection mechanisms. Among them, anti-killing technology is a common method designed to enable malware to effectively hide and disguise itself before being detected and blocked.

[0035] The reasons why existing anti-killing technology solutions are detected mainly include the detection of characteristic patterns, the detection of behavioral characteristics, the bypassing of anti-debugging and anti-virtualization technologies, static analysis and dynamic analysis, network communication and domain name blacklists, as well as update and adaptability issues. In order to improve the effectiveness of anti-killing technology, researchers need to continuously innovate and improve anti-killing technology to cope with new detection methods and defense measures. The possible reasons why existing anti-killing technology solutions are detected include but are not limited to:

[0036] Detection of characteristic patterns. Antivirus software usually uses characteristic patterns to detect known malicious code. If the anti-virus technology solution fails to successfully hide or modify the characteristic patterns of the malicious code, the antivirus software may recognize these characteristics and detect them.

[0037] Detection of behavioral characteristics: In addition to characteristic patterns, antivirus software can also detect malicious code by analyzing its behavioral characteristics. For example, some antivirus technology solutions may attempt to bypass the operating system's security mechanisms, modify system files or registry entries, etc. These abnormal behaviors may be detected by antivirus software.

[0038] Bypassing anti-debugging and anti-virtualization technologies: Some anti-virus evasion solutions may use anti-debugging and anti-virtualization technologies to counter reverse engineering and dynamic analysis by security analysts. However, anti-virus software and security tools are also constantly evolving and may adapt and bypass these anti-debugging and anti-virtualization technologies to detect anti-virus evasion technologies.

[0039] Static analysis and dynamic analysis: Antivirus software and security tools use static analysis and dynamic analysis to detect malicious code. Static analysis involves static scanning and analysis of files, while dynamic analysis involves executing malicious code in a controlled environment and monitoring its behavior. If the anti-killing technology solution cannot effectively deceive these analysis methods, the malicious code may be detected. In dynamic analysis, memory scanning is used as a security defense technology to detect and find the presence of malicious code, malicious behavior, or abnormal activity in the system's memory. Memory scanning is often used to detect malicious processes, malicious modules, or malicious injections that are already running in the system's memory, as well as to detect malicious code or malicious data structures that have been loaded into the system's memory.

[0040] Network communications and domain blacklists: Some anti-virus solutions may rely on communication with remote servers to receive instructions or download additional malicious components. Antivirus software and network defense mechanisms can monitor and analyze network traffic and detect and block based on domain blacklists or malicious IP addresses. If the network communications used by anti-virus solutions are detected or blocked, malicious behavior may be exposed.

[0041] Updates and adaptability: Antivirus technology is an evolving and changing field, and antivirus software and security tools are also constantly updated and improved. When new antivirus solutions emerge, antivirus software may be updated to identify and block these new threats. Therefore, when antivirus solutions are not updated in time or cannot adapt to new defenses, malicious code is easy to detect.

[0042] Among the detection technologies mentioned above, memory scanning in dynamic analysis is the most effective and the most difficult to bypass detection method. Existing technologies include memory injection, encryption and other methods to combat it, but the effects are not good.

[0043] Therefore, the present application provides an advanced anti-kill attack method based on GPU memory loading, which has higher concealment and the ability to resist anti-debugging and anti-virtualization technologies. Through the steps of initializing CUDA context, creating hooks, suspending threads, moving DLL to GPU storage, calling the original Sleep function and moving DLL back from GPU storage, it is possible to achieve anti-kill in the target system and improve the success rate and concealment of the attack, thereby solving the technical problems existing in the prior art.

[0044] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0045] Embodiment 1

[0046] Please refer to Figure 1 and Figure 2 The embodiment of the present application provides an advanced anti-killing attack method based on GPU memory loading, comprising the following steps:

[0047] S10. Obtain GPU resources and GPU resource configuration strategy.

[0048] Specifically, the purpose of obtaining GPU resources and GPU resource configuration policies is to manage and maintain all states and resources required for CUDA programs to execute on GPU devices. GPU resources include at least device memory, computing resources, streams, and events, which are managed through the CUDA driver. GPU resource configuration policies refer to policies for allocating and scheduling GPU resources, which are used to optimize program execution efficiency and system throughput.

[0049] Exemplarily, GPU resources and GPU resource configuration strategies can be obtained by initializing the CUDA context. The CUDA context is a runtime environment for managing and executing CUDA operations, and is an important component for communication and coordination between CUDA programs and GPUs. By initializing the CUDA context, the program can use the computing power of the GPU for parallel computing and accelerated tasks. The CUDA context contains the status and resource information of the GPU device, including the index of the GPU device, the current device memory allocation, the execution configuration of the CUDA kernel function, etc. It provides a programming model that enables the program to distribute tasks to the GPU and utilize its parallel computing capabilities. In a CUDA program, by initializing the CUDA context, the program can communicate with the GPU and execute the CUDA kernel function. Through the CUDA context, the program can manage device memory, start parallel computing tasks, perform data transfer and other operations. The creation and destruction of the CUDA context are completed by the API functions provided by the CUDA runtime library.

[0050] S20. According to the created hook function, redirect the call of the original function to the target function, wherein the original function at least includes an original heap allocation function and an original sleep function, and the target function at least includes a pre-created target heap allocation function and a target sleep function.

[0051] Specifically, the hook function is used to redirect the call of the original function to the target function, the original heap allocation function refers to the function used to allocate memory blocks from the specified heap, and the original sleep function is used to put the current thread into a sleep state for a period of time. In an anti-killing attack, the sleep function is used to hide the execution time of the malicious code in the anti-killing attack file to avoid being detected by the real-time monitoring system. The target heap allocation function and the target sleep function are pre-created functions. The target sleep function is used to ensure that when the malicious code is executed, the memory allocation behavior is more concealed to avoid being detected by security software. The target sleep function is used to make the thread's sleep behavior more concealed when the malicious code is executed to avoid being detected by security software.

[0052] Exemplarily, the original heap allocation function refers to the RtlAllocateHeap function, the original sleep function refers to the Sleep function, the target heap allocation function refers to the HookedHeapAlloc function, and the target sleep function refers to the HookedSleep function. By calling MH_Initialize to initialize the MinHook library, and using MH_CreateHookApiEx to create a hook to intercept the calls to the RtlAllocateHeap and Sleep functions, through these function calls, the program completes the hook operation of the RtlAllocateHeap function and the Sleep function at the beginning of the main function, and creates the target heap allocation function and the target sleep function. Afterwards, when the program calls the original heap allocation function and the original sleep function, the hook function will actually be executed, that is, the target allocation function HookedHeapAlloc and the target sleep function HookedSleep. By using the Minhook library to create a hook and intercept the calls to the original heap allocation function and the original sleep function, it is possible to interfere with the call chain, so that the malicious code in the anti-killing attack file can control and modify the function, and achieve the technical effect of hiding the existence and true behavior of the anti-killing attack file.

[0053] S30: Suspend all threads in the current process and move the kill-free attack file to GPU storage, where the kill-free attack file is used to perform the kill-free attack.

[0054] Specifically, by suspending all threads in the current process, it is ensured that no other threads interfere or access shared resources when executing subsequent operations, and other threads are prevented from interfering with the execution of the anti-kill attack, ensuring the concealment and effectiveness of the process of moving the anti-kill attack file to the GPU storage. Moving the anti-kill attack file to the GPU storage refers to moving the anti-kill attack file to the GPU memory for storage. GPU memory is also called graphics memory, which refers to the high-speed memory dedicated to the graphics processing unit (GPU) for storing graphics data and data required for GPU calculations. It is an independent storage space separated from the host memory (CPU memory). The anti-kill attack file at least contains malicious code for anti-kill attacks. Since the GPU has high bandwidth and parallel processing capabilities, using the GPU to store anti-kill attack files can make full use of the GPU's computing power and storage space. By moving and executing the anti-kill attack file in the GPU storage, it can bypass the traditional file system and memory scanning, increasing the difficulty of detecting and intercepting malicious code.

[0055] Exemplarily, the DoSuspendThreads function is called to suspend all threads in the current process, including the current thread, to ensure that no other threads interfere with or access shared resources when performing subsequent operations. The anti-kill attack file is the beacon.dll file. Beacon refers to a technology or mechanism for establishing and maintaining a secret communication channel with an attacker, which can be used in malware, penetration testing tools, and persistent attacks. The beacon.dll file is moved to the GPU storage by calling the MoveDLLToGPUStrorage function and returns a ULONG_PTR type value storageGPU. The MoveDLLToGPUStrorage function can also obtain the header size and CUDAAPI table structure by passing pointers to the structure &SizeOfHeaders and &Api.

[0056] S40, resuming the call of the original sleep function, and when the original sleep function is called, moving the anti-kill attack file from the GPU storage to the host.

[0057] Specifically, the sleep function is implemented by restoring the original sleep function call. The sleep function means that when the backdoor program is in sleep mode, it stops sending heartbeat signals or command requests to the control server, thereby reducing the frequency of external communication and avoiding suspicion from system administrators or security defense tools, because frequent communication with the control server may trigger alarms of abnormal network activities. When the original sleep function is called, the anti-killing attack file is moved from the GPU to the host, ensuring the concealment of the anti-killing attack file and facilitating subsequent operations and execution on the host.

[0058] Exemplarily, the original sleep function is called by calling OldSleep(dwMilliseconds) to implement the sleep function, and the kill-free attack file moved to the GPU storage is moved back to the host storage by calling the MoveDLLFromGPUStrorage function.

[0059] S50. Restore all threads in the current process.

[0060] Specifically, by resuming all threads in the current process, all threads are put back into the ready state, so that the threads can continue to execute. Exemplarily, resuming all threads in the current process can be achieved by calling the DoResumeThreads function, and all threads include the current thread. By suspending all threads in the current process, including the current thread, and resuming these threads when needed, a controlled environment can be created to prevent other threads from interfering with or accessing shared resources. This technology can provide better concealment and control for malicious code.

[0061] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0062] The embodiment of the present application initializes the CUDA context, calls the hook function to redirect the call of the original function to the target function, moves the anti-kill attack file into the GPU storage after suspending the thread, and moves the anti-kill attack file into the host storage by calling the original sleep function. By utilizing the computing power and storage space of the GPU, the malicious code is moved and executed in the GPU storage, and the malicious code is injected into the memory space of the legitimate process, so that the malicious code is hidden in the memory and executed in the context of the legitimate process. The anti-kill attack method of the present application can bypass the traditional file system, memory scanning and static detection technology, solves the technical problem that the anti-kill attack method in the prior art is not highly concealed in dynamic analysis, and achieves the technical effect of making the malicious code highly concealed and having a low interception rate.

[0063] See also Figure 3 , obtain GPU resources and GPU resource configuration strategies, including:

[0064] S11. Load a dynamic link library file and parse a function address in the dynamic link library file, wherein the dynamic link library file is used to support CUDA technology.

[0065] Specifically, the dynamic link library file is a CUDA support file used to manage the communication between the GPU and the CPU and ensure that the CUDA application can run normally; the function address is used to implement dynamic linking, and the function call in the dynamic link library file is implemented by parsing the function address in the dynamic link library.

[0066] S12. Store the function address in the NVIDIAAPI structure.

[0067] Specifically, by storing the function address in the NVIDIAAPI structure, it can be ensured that the CUDA application can correctly call and use the functions provided by the CUDA driver to achieve control and operation of the GPU.

[0068] S13. Obtain the number of GPU devices and the index value of the last GPU device.

[0069] S14. Store an index value, where the index value is used to specify the GPU device to which the CUDA context is to be attached.

[0070] Specifically, by determining the number of GPU devices and the index value of the last GPU device, the GPU device to which the CUDA context is to be attached is specified, ensuring that all CUDA operations are performed on the specified device, thereby avoiding unnecessary cross-device data transmission and improving program execution efficiency.

[0071] S15. After initializing the CUDA driver API, create a CUDA context and attach the CUDA context to the corresponding GPU device.

[0072] Specifically, after the CUDA driver API is initialized, the CUDA context is associated with the corresponding GPU device through the operations of initializing CUDA, creating a CUDA context, and attaching the CUDA context to the corresponding GPU device.

[0073] Exemplarily, the NVIDIA API table is first initialized by calling the InitNvidiaCudaAPITable function for communication with the GPU. The InitNvidiaCudaAPITable function is used to load a dynamic link library named nvcuda.dll and parse the function addresses therein, and then store these function addresses in the corresponding member variables in the NVIDIA_API_TABLE structure. These function addresses can be used in subsequent operations to communicate with the GPU. After successfully loading nvcuda.dll and parsing the functions related to nvcuda.dll, CUDA is initialized using the CudaInit function, and the parameter 0 is passed to indicate the use of the default initialization. Next, the CudaGetDeviceCount function is called to obtain the number of GPU devices and check whether it is successfully obtained. Then, the CudaGetDevice function is called to obtain the index of the last GPU device and store the index in the Device variable. Finally, the CudaCreateContext function is called to create a CUDA context and store the context in the ctx variable. If any error occurs in the above process, the function returns NULL to indicate that the initialization failed. Otherwise, it returns the created CUDA context.

[0074] For example, the corresponding source code is as follows:

[0075] CUDA_CONTEXT initCuda(NVIDIA_API_TABLE*Api, CUDA_CONTEXT*ctx){

[0076] int DeviceCount = 0;

[0077] INT Device = 0;

[0078] / / Initialize NVIDIA API table

[0079] if(!InitNvidiacudaAPITable(Api))

[0080] return NULL;

[0081] / / Use CUDA initialization function to initialize CUDA

[0082] if(Api->CudaInit(0)!=CUDA_SUCCESS)

[0083] return NULL;

[0084] / / Get the number of GPU devices

[0085] if(Api->CudaGetDeviceCount(&DeviceCount)!=CUDA_SUCCESS||Devicecount==0)

[0086] return NULL;

[0087] / / Get the index of the last GPU device

[0088] if(Api->CudaGetDevice(&Device, DeviceCount-1)!=CUDA_SUCCESS)

[0089] return NULL;

[0090] / / Create CUDA context

[0091] if(Api->CudaCreatecontext(ctx, 0, Device)! = CUDA_SUCCESS)

[0092] return NULL;

[0093] / / Return the created CUDA context

[0094] return Context;

[0095] }

[0096] BOOL InitNvidiacudaAPITable(PNVIDIA_API_TABLE API)

[0097] {

[0098] / / Check if it has been initialized

[0099] if(Api->CudaInit){

[0100] return TRUE;

[0101] }

[0102] / / Load nvcuda.dl1 dynamic link library

[0103] Api->NvidiaLibary=LoadlibraryW(L"nvcuda.dll");

[0104] if(Api->NvidiaLibary==NULL)

[0105] return FALSE:

[0106] / / Parse the functions in nvcuda.d11 and store the function addresses in the corresponding member variables in the NVIDIA_API_TABLE structure

[0107] Api->CudaCreateContext=(CUDACREATECONTEXT)GetProcAddress(Api->Nvidialibary, "cuctxCreate_v2");

[0108] Api->CudaGetDevice=(CUDAGETDEVICE)GetProcAddress(Api->Nvidialibary, "cuDeviceGet");

[0109] Api->CudaGetDeviceCount=(CUDAGETDEVICECOUNT)GetProcAddres(Api->NvidiaLibary, "cuDeviceGetCount");

[0110] Api->CudaInit=(CUDAINIT)GetProcAddress(Api->NvidiaLibary, "cuInit");

[0111] Api->CudaMemoryAllocate=(CUDAMEMORYALLOCATE)GetProcAddre ss(Api->NvidiaLibary, "cuMemAlloc_v2");

[0112] Api->CudaMemoryCopyToDevice=(CUDAMEMORYCOPYTODEVICE)GetProcAddress(Api->NvidiaLibary, "cuMemcpyHtoD_v2");

[0113] Api->CudaMemoryCopyToHost=(CUDAMEMORYCOPYTOHOST)GetPr ocAddress(Api->NvidiaLibary, "cuMemcpyDtoH_v2");

[0114] Api->CudaMemoryFree=(CUDAMENORYFREE)GetProcAddress(Api->NvidiaLibary, "cuMemFree_v2");

[0115] Api->CudaDestroyContext=(CUDADESTROYCONTEXT)GetProcAddress(Api->NvidiaLibary, "cuctxDestroy");

[0116] / / Check if the function address is successfully obtained

[0117] If(!Ap1->cudacreatecontext||!Api->CudaGetDevice||!Api->CudaGetDeviceCount||!Api->CudaInit||!Api->CudaDestroyContext)

[0118] return FALSE;

[0119] If(!Api->CudaMemoryAllocate||!Api->CudaMemoryCopyToDevice||!Api->CudaMemoryCopyToHost||!Api->CudaMemoryFree)

[0120] return FALSE;

[0121] / / Initialization successful

[0122] return TRUE;

[0123] See also Figure 4 , according to the created hook function, redirect the call of the original function to the target function, including:

[0124] S21. Initialize the API hook library and create a hook function through the API hook library.

[0125] S22. Redirect the call of the original function to the target function through the hook function.

[0126] S23. Save the address of the original function.

[0127] Specifically, the initialization of the API hook library can create a redirection environment to ensure that the API call can be intercepted and modified using the hook function without modifying the original code. The hook function can be a custom function that intercepts the original function and redirects the call of the original function to the target function. By saving the address of the original function, it is ensured that the original function can be called when needed. By creating and calling the hook function to interfere with the call chain, intercept the original function, and redirect the call of the original function to the target function, the malicious code in the anti-killing attack file can control and modify the function, which has the effect of hiding the anti-killing attack file and its behavior.

[0128] Exemplarily, the original heap allocation function refers to the RtlAllocateHeap function, the original sleep function refers to the Sleep function, the target heap allocation function refers to the HookedHeapAlloc function, and the target sleep function refers to the HookedSleep function. First, the API hook library is initialized by calling MH_Initialize. The API hook library is the Minhook library. MH_Initialize is the initialization function of the Minhook library. It is responsible for initializing the internal data structure and resources of the hook library. If the initialization is successful, the function returns MH_OK, otherwise jumps to the EXIT_ROUTINE label for error handling.

[0129] Next, create a hook function through MH_CreateHookApiEx(L"ntdll.dll", "RtlAllocateHeap", &HookedHeapAlloc, &OldHeapAlloc). Use the function MH_CreateHookApiEx provided by the Minhook library to create a hook, intercept the RtlAllocateHeap function in ntdll.dll, and replace it with the HookedHeapAlloc function. At the same time, it saves the address of the original RtlAllocateHeap function in the OldHeapAlloc variable. If the hook is created successfully, the function returns MH_OK, otherwise jumps to the EXIT_ROUTINE label for error handling. Create another hook function call through MH_CreateHookApiEx(L"kernel32.dll", "Sleep", &HookedSleep, &OldSleep), and use the MH_CreateHookApiEx function of the Minhook library to create a hook, intercept the Sleep function in kernel32.dll, and replace it with the HookedSleep function. At the same time, it saves the address of the original Sleep function in the OldSleep variable. If the hook is created successfully, the function returns MH_OK, otherwise it jumps to the EXIT_ROUTINE label for error handling.

[0130] Finally, the function to enable hooks is called via MH_EnableHook(MH_ALL_HOOKS). It uses the MH_EnableHook function of the Minhook library to enable all previously created hooks. If the hook is enabled successfully, the function returns MH_OK, otherwise it jumps to the EXIT_ROUTINE label for error handling.

[0131] For example, the corresponding source code is as follows:

[0132] If(MH_Initialize()!=MH_OK)

[0133] goto EXIT_ROUTINE;

[0134] If(MH_CreateHookApiEx(L"ntd1l.dll","RtlAllocateHeap",&HookedHeapAlloc,&OldHeapAlloc)!=MH_OK)

[0135] goto EXIT_ROUTINE;

[0136] If(MH_CreateHookApiEx(L"kernel32.d11","sleep",&Hookedsleep,&0ldsleep)!=MH_OK)

[0137] goto EXIT_ROUTINE;

[0138] If(MH_EnableHook(MH_ALL_HOOKS)!=MH_OK)

[0139] goto EXIT_ROUTINE;

[0140] See also Figure 5 , suspend all threads in the current process and move the anti-kill attack file to GPU storage, including:

[0141] S31, obtaining header information of the anti-killing attack file, where the header information includes DOS header information and NT header information.

[0142] S32: Determine the GPU storage space for the anti-killing attack file.

[0143] S33, copying the header information and section information of the anti-killing attack file to the GPU storage space.

[0144] S34. Map the heap memory of the anti-killing attack file to the GPU storage space, and determine the heap memory mapping information. The heap memory mapping information refers to the mapping association information between the storage address and the original address. The storage address refers to the storage address of the anti-killing attack file in the GPU storage space. The original address refers to the storage address of the anti-killing attack file before it is moved to the GPU storage space.

[0145] S35. In the original address, clear the anti-killing attack file, the header information and the section information of the anti-killing attack file.

[0146] Specifically, the header information of the anti-kill attack file is used to describe the basic structure and attributes of the file. By obtaining the header information of the anti-kill attack file, the structure and content of the anti-kill attack file can be understood, and basic data can be provided for moving the anti-kill attack file to the GPU storage space. The GPU storage space is determined according to the image size and heap mapping size of the anti-kill attack file. Determining the GPU storage space of the anti-kill attack file can ensure that the GPU has sufficient storage space to process the anti-kill attack file. By copying the header information and section information of the anti-kill attack file to the GPU storage space, it can ensure that key information can be efficiently accessed and processed, and it can also simplify the management process of the anti-kill attack file to ensure consistency and integrity. The heap memory mapping information is used to determine the storage location by the original storage address when the anti-kill attack file is moved into the host storage. After the anti-kill attack file is copied to the GPU storage space, the anti-kill attack file is prevented from being discovered and analyzed through the zeroing operation, thereby improving the concealment.

[0147] For example, first, the DOS header and NT header information of the anti-kill attack file are obtained by using the GetNTHeaders function and the PIMAGE_DOS_HEADER structure. Then, GPU storage is allocated for the anti-kill attack file, and a GPU storage space is allocated for the anti-kill attack file by calling the RtlAllocateGpuMemory function. The size of the GPU storage space is the image size of the anti-kill attack file plus the mapping size of the heapMap. The heapMap is used to track and manage GPU memory allocation and release. The mapping size of the heapMap refers to the heap mapping size used to manage memory allocation.

[0148] Then, by calling the Api->CudaMemoryCopyToDevice function, the header information of the anti-killing attack file is copied to the previously allocated GPU storage space. First, all sections of the anti-killing attack file are looped through, and the content of each section is copied to the GPU storage space in turn. At the same time, the original content of the section is cleared to ensure that no copy is left in the host storage. By traversing the mappings in the heapMap, the content of each mapping is copied to the GPU storage space, and the storage address is mapped and associated with the original address.

[0149] Finally, the content of the original address and the header information of the anti-killing attack file are cleared to ensure that no copy is left in the host storage. The address of the GPU storage space is used as the return value of the function.

[0150] For example, the corresponding source code is as follows:

[0151] ULONG_PTR MoveDLLTOGPUStrorage(HMODULE dll,PDWORD SizeOfHeaders,PNVIDIA_API_TABLE Api){

[0152] DWORD oldProtect;

[0153] PIMAGE_DOS_HEADER dosHeader=(PIMAGE_DOS_HEADER)dll;

[0154] PIMAGE_NT_HEADERS NTheader=GetNTHeaders((HMODULE)dll);

[0155] ULONG_PTR storage=RtIAllocateGpuMemory(Api,NTheader->OptionalHeader.SizeofImage+mapsize(heapMap));

[0156] printf("RtlAllocateGpuMemory:%08x\n",storage);

[0157] *SizeOfHeaders=(DWORD)(dosHeader->e_Ifanew+NTheader->0ptionalHeader.SizeOfHeaders);

[0158] Api->CudaMemorycopyToDevice(storage,dll,dosHeader->e_Ifanew+NTheader->OptionalHeader.SizeOfHeaders);

[0159] PIMAGE_SECTION_HEADERsection=IMAGE_FIRST_SECTION(NTheader);

[0160] for(int i=0;i <ntheader->FileHeader.Numberofsections;i++,section++)

[0161] {

[0162] DWORD Sectionsize=section->Misc.Virtualsize;

[0163] printf("setion:%s-Virtaldress%08x-Virtualsize%d-Moved to%08x\n”,setion->Name,(SIZE_T)dll+section->VitualAddress,Sectionsize,(ULONG_PTR)((SIZE_T)storge+setion->VitualAddress));

[0164] ULONG_PTRdst=(ULONG_PTR)((SIZE_T)storage+section->VirtualAddress);

[0165] Api->CudaMemoryCopyToDevice(dst,(byte*)dll+section->VirtualAddress,Sectionsize);

[0166] Virtualprotect((LPVOID)((SIZE_T)dll+section->VirtualAddress),Sectionsize,PAGE_READMRITE,&oldprotect);

[0167] memset((LPVOID)((SIZE_T)dll+section->VirtualAddress),0,Sectionsize);

[0168] Virtualprotect((LPVOID)((SIZE_T)dll+section->VirtualAdress),Sectionsize,oldProtect,&oldProtect);

[0169] }

[0170] ULONG_PTR

[0171] dst=(ULONG_PTR)((SIZE_T)storage+NTheader->OptionalHeader.SizeOfImage);for(auto it=heapMap.cbegin();it!=heapMap.cend();++it)

[0172] {

[0173] printf("Moved%08x to%08x\n",it->first,dst);

[0174] heapLocationMap[(LPVOID)dst]=it->first;

[0175] Api->CudaMemoryCopyToDevice((ULONG_PTR)dst,it->first,it->second);

[0176] memset(it->first,0,it->second); / / zero out

[0177] dst=(ULONG_PTR)((SIZE_T)dst+it->second);

[0178] }

[0179] VirtualProtect((LPVOID)dl1,dosHeader->e_Ifanew+NTheader->OptionalHeader.SizeOfHeaders,PAGE_READWRITE,&oldprotect);

[0180] memset((LPVOID)dll,0,dosHeader->e_Ifanew+NTheader->0ptionalHeader.SizeOfHeaders);

[0181] VirtualProtect((LPVOID)dll,dosHeader->e_lfanew+NTheader->OptionalHeader.SizeOfHeaders,oldProtect,&oldProtect);

[0182] return storage;

[0183] }

[0184] See also Figure 6 , and when the original sleep function is called, move the anti-killing attack file from the GPU storage to the host, including:

[0185] S41. Set the memory page where the header information of the anti-killing attack file is located to be writable.

[0186] S42: copy the header information and section information of the anti-killing attack file to the host storage, and restore the original protection attribute of the memory page.

[0187] S43, copying the heap memory mapping information to the host for storage.

[0188] S44. Clear the heap memory mapping information in the GPU storage space to release the GPU storage space.

[0189] Specifically, by modifying the protection attribute of the memory page, the memory page where the header information of the anti-killing attack file is located is set to be writable, ensuring that the header information and section information of the anti-killing attack file can be copied to the host storage, and by restoring the original protection attribute of the memory page, the security and stability of the system can be guaranteed. By moving the anti-killing attack file to the host, the malicious code in the anti-killing attack file can run normally.

[0190] Exemplarily, by setting memory protection and copying the DLL header to the host storage: set the memory page where the DLL header is located to be writable by calling the VirtualProtect function, and use the Api->CudaMemoryCopyToHost function to copy the DLL header content previously stored on the GPU back to the host storage. Get DLL header information: Get the DOS header and NT header information of the DLL file by using the GetNTHeaders function and the PIMAGE_DOS_HEADER structure. Copy all sections to the host storage: Loop through all sections of the DLL and copy the content of each section from the GPU storage back to the host storage in turn. First, set the memory page of the section to be writable by calling the VirtualProtect function, and use the Api->CudaMemoryCopyToHost function to copy the content of the section back to the host storage. Then, restore the original protection attributes of the memory page. Copy the heap memory map to the host storage: copy the heap memory map content previously stored on the GPU back to the host storage by traversing the heapLocationMap. Use the Api->CudaMemoryCopyToHost function to copy the data from the GPU storage to the host storage. Clear the heap memory map: Clear the heapLocationMap. Release GPU storage: Use the Api->CudaMemoryFree function to release the previously allocated GPU storage space.

[0191] In general, the function of this function is to copy the DLL file and its related sections and heap memory mapping previously moved to the GPU storage back to the host storage for subsequent operations and execution on the host. This process is the opposite of the MoveDLLToGPUStrorage function, which is used to move data from GPU storage back to host storage.

[0192] For example, the corresponding source code is as follows:

[0193] VOID MoveDLLFromGPUStrorage(HMODULE dl1, ULONG_PTR storage, DWORDSizeofHeaders, PNVIDIA_API_TABLE Api){

[0194] DWORD oldProtect;

[0195] VirtualProtect((LPVOID)dll, SizeOfHeaders, PAGE_READWRITE, &oldProtect);

[0196] Api->CudaMemoryCopyToHost((PVOID)dll,storage,SizeOfHeaders);

[0197] VirtualProtect((LPVOID)dll,SizeOfHeaders,oldProtect,&oldProtect);

[0198] PIMAGE_DOS_HEADER dosHeader=(PIMAGE_DOS_HEADER)dll;

[0199] PIMAGE_NT_HEADERS NTheader=GetNTHeaders((HMODULE)dll);

[0200] PIMAGE_SECTION_HEADERsection=IMAGE_FIRST_SECTION(NTheader);

[0201] for(int i=0;i <ntheader->FileHeader.NumberofSections;i++,section++)

[0202] {

[0203] DWORD SectionSize=section->Misc.Virtualsize;

[0204] printf("setion:%s-Virtaldress%08x-Virtualsize%d-Moved from%08x\n”,setion->Name,(SIZE_T)dll+section->VitualAddress,Sectionsize,(ULONG_PTR)((SIZE_T)storge+setion->VitualAddress));

[0205] LPVOID dst=(void*)((SIZE_T)dll+section->VirtualAddress);

[0206] VirtualProtect(dst,Sectionsize,PAGE_READWRITE,&oldProtect);

[0207] Api->CudaMemoryCopyToHost((PVOID)dst,storage+section->VirtualAddress,Sectionsize);

[0208] VirtualProtect(dst,Sectionsize,oldProtect,&oldProtect);

[0209] }

[0210] for(auto it=heapLocationMap.cbegin();it!=heapLocationMap.cend();

[0211] ++it)

[0212] {

[0213] printf("Moved%08x to%08x\n",it->first,it->second);

[0214] Api->CudaMemoryCopyToHost((PVOID)it->second, (ULONG_PTR)it->first, heapMap[it->second]);

[0215] }

[0216] heapLocationMap.clear();

[0217] Api->CudaMemoryFree(storage);

[0218] }

[0219] Embodiment 2

[0220] See also Figure 7 The embodiment of the present application also discloses an advanced anti-kill attack device based on GPU memory loading, including:

[0221] The acquisition module 510 is used to acquire GPU resources and GPU resource configuration strategies.

[0222] The redirection module 520 is used to redirect the call of the original function to the target function according to the created hook function, wherein the original function at least includes the original heap allocation function and the original sleep function, and the target function at least includes the pre-created target heap allocation function and the target sleep function.

[0223] The moving module 530 is used to suspend all threads in the current process and move the kill-free attack file to the GPU storage, where the kill-free attack file is used to perform the kill-free attack.

[0224] The transfer module 540 is used to restore the call of the original sleep function, and when the original sleep function is called, move the anti-killing attack file from the GPU storage to the host.

[0225] The recovery module 550 is used to recover all threads in the current process.

[0226] In some embodiments, the acquisition module 510 specifically includes:

[0227] The loading unit is used to load a dynamic link library file and parse the function address in the dynamic link library file, wherein the dynamic link library file is used to support CUDA technology.

[0228] The first storage unit is used to store the function address in the NVIDIA API structure.

[0229] The attachment unit is used to create a CUDA context and attach the CUDA context to the corresponding GPU device after the CUDA driver API is initialized.

[0230] In some embodiments, the redirection module 520 specifically includes:

[0231] Create a unit to initialize the API hook library and create hook functions through the API hook library.

[0232] The redirection unit is used to redirect the call of the original function to the target function through the hook function.

[0233] The saving unit is used to save the address of the original function.

[0234] In some embodiments, the mobile module 530 specifically includes:

[0235] The first acquisition unit is used to acquire header information of the anti-killing attack file, where the header information includes DOS header information and NT header information.

[0236] A determination unit is used to determine the GPU storage space of the anti-killing attack file.

[0237] The second storage unit is used to copy the header information and section information of the anti-killing attack file to the GPU storage space.

[0238] A mapping unit is used to map the heap memory of the anti-killing attack file to the GPU storage space and determine the heap memory mapping information. The heap memory mapping information refers to the mapping association information between the storage address and the original address. The storage address refers to the storage address of the anti-killing attack file in the GPU storage space. The original address refers to the storage address of the anti-killing attack file before it is moved to the GPU storage space.

[0239] The clearing unit is used to clear the anti-killing attack file, the header information and the section information of the anti-killing attack file at the original address.

[0240] In some embodiments, the moving module 540 specifically includes:

[0241] The setting unit is used to set the memory page where the header information of the anti-killing attack file is located to be writable.

[0242] The copy unit is used to copy the header information and section information of the anti-killing attack file to the host storage and restore the original protection attributes of the memory page.

[0243] The third storage unit is used to copy the heap memory mapping information to the host for storage.

[0244] The clearing unit is used to clear the heap memory mapping information in the GPU storage space and release the GPU storage space.

[0245] In some embodiments, the acquisition module 510 further includes:

[0246] The second acquisition unit is used to acquire the number of GPU devices and the index value of the last GPU device.

[0247] The fourth storage unit is used to store an index value, where the index value is used to specify the GPU device to which the CUDA context is to be attached.

[0248] Embodiment 3

[0249] See also Figure 8 , the embodiment of the present application further provides an electronic device, including:

[0250] processor.

[0251] A memory is used to store processor executable instructions.

[0252] The processor is configured to execute instructions to implement any advanced anti-killing attack method based on GPU memory loading.

[0253] In this embodiment, the computer device includes a processor, a memory, and a network interface connected via a system bus.

[0254] The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data samples. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, any advanced anti-killing attack method based on GPU memory loading is implemented.

[0255] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0256] Embodiment 4

[0257] The embodiment of the present application also provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of the terminal, the terminal is enabled to execute any advanced anti-killing attack method based on GPU memory loading.

[0258] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0259] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0260] Embodiment 5

[0261] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements any advanced anti-killing attack method based on GPU memory loading.

[0262] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0263] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0264] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0265] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0266] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0267] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An advanced anti-killing attack method based on GPU memory loading, characterized in that: The steps include: Obtaining GPU resources and the GPU resource configuration strategy; According to the created hook function, redirecting the call of the original function to the target function, wherein the original function at least includes an original heap allocation function and an original sleep function, and the target function at least includes a pre-created target heap allocation function and a target sleep function; Suspend all threads in the current process and move the kill-free attack file to GPU storage, where the kill-free attack file is used to perform the kill-free attack; Resuming the calling of the original sleep function, and when the original sleep function is called, moving the anti-killing attack file from the GPU storage to the host; Resume all threads in the current process.

2. The method according to claim 1, characterized in that The obtaining of GPU resources and the GPU resource configuration strategy specifically include: Loading a dynamic link library file and parsing a function address in the dynamic link library file, wherein the dynamic link library file is used to support CUDA technology; Storing the function address in an NVIDIA API structure; After the CUDA driver API is initialized, a CUDA context is created and attached to the corresponding GPU device.

3. The method according to claim 2, characterized in that The method of redirecting the call of the original function to the target function according to the created hook function specifically includes: Initialize the API hook library, and create the hook function through the API hook library; Redirecting the call of the original function to the target function through the hook function; The address of the original function is saved.

4. The method according to claim 3, characterized in that The method of suspending all threads in the current process and moving the anti-killing attack file to GPU storage specifically includes: Obtaining header information of the anti-killing attack file, wherein the header information includes DOS header information and NT header information; Determine the GPU storage space of the anti-killing attack file; Copying the header information and section information of the anti-killing attack file to the GPU storage space; Mapping the heap memory of the anti-killing attack file to the GPU storage space, determining heap memory mapping information, wherein the heap memory mapping information refers to mapping association information between a storage address and an original address, the storage address refers to the storage address of the anti-killing attack file in the GPU storage space, and the original address refers to the storage address of the anti-killing attack file before it is moved to the GPU storage space; In the original address, the anti-killing attack file, the header information and the section information of the anti-killing attack file are cleared.

5. The method according to claim 4, characterized in that The restoring the calling of the original sleep function and moving the anti-kill attack file from the GPU storage to the host when the original sleep function is called specifically includes: Setting the memory page where the header information of the anti-killing attack file is located to be writable; Copy the header information and section information of the anti-killing attack file to the host storage, and restore the original protection attribute of the memory page; Copying the heap memory mapping information to a host for storage; Clear the heap memory mapping information in the GPU storage space to release the GPU storage space.

6. The method according to claim 5, characterized in that After the CUDA driver API is initialized, a CUDA context is created, and before the CUDA context is attached to the corresponding GPU device, the method further includes: Get the number of GPU devices and the index value of the last GPU device; The index value is stored, where the index value is used to specify the GPU device to which the CUDA context is to be attached.

7. An advanced anti-kill attack device based on GPU memory loading, characterized in that: include: An acquisition module, used to acquire GPU resources and the GPU resource configuration strategy; A redirection module, used for redirecting the call of the original function to the target function according to the created hook function, wherein the original function at least includes an original heap allocation function and an original sleep function, and the target function at least includes a pre-created target heap allocation function and a target sleep function; A moving module, used to suspend all threads in the current process and move the kill-free attack file to GPU storage, where the kill-free attack file is used to perform the kill-free attack; A moving module, used to restore the call of the original sleep function, and when the original sleep function is called, move the anti-killing attack file from the GPU storage to the host; The recovery module is used to resume all threads in the current process.

8. An electronic device, characterized in that: include: processor; A memory, configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the advanced anti-killing attack method based on GPU memory loading as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of a terminal, the terminal is enabled to execute the advanced anti-killing attack method based on GPU memory loading as described in any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the advanced anti-killing attack method based on GPU memory loading is implemented as claimed in any one of claims 1 to 6.

Images