Function library isolation method and related device

Abstract

The invention provides a function library isolation method and a related device, which are used for improving the security of a function library. Determining a plurality of shared memory spaces of the main program and the plurality of function libraries; generating a program dependency graph (PDG) according to the plurality of shared memory spaces, the main program and the plurality of function libraries, the PDG comprising a plurality of function nodes and a plurality of variable nodes, each function node representing a function in the main program or the plurality of function libraries, and each variable node representing a variable defined by the main program or the plurality of function libraries, each variable node comprises domain information, and the domain information is used for indicating a shared memory space to which a variable belongs; determining the variable node having the dependency relationship with the library function node as a shared variable node; a memory allocation function adopted by the shared variable is configured to be a target memory allocation function, the target memory allocation function is used for storing the shared variable to a target shared memory space, and the target shared memory space is the shared memory space indicated by the domain information of the shared object node.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for isolating a function library and a related device. Background Art

[0002] As software development becomes more and more complex, the use of ready-made function libraries in applications has become an indispensable part. Although the use of function libraries can improve the efficiency of software development, it also brings security issues. Once a function library has a security vulnerability, the main program and operating system using the function library will face security threats. Isolating the function library can effectively solve this problem.

[0003] See also Figure 1 , Figure 1 The following is a schematic diagram of the existing isolation function library scenario. Figure 1 As shown, the main program is configured in shared memory space 1, and multiple function libraries (function library 1, function library 2, and function library 3) required by the main program are configured in shared memory space 2, thereby realizing data sharing between the main program and the function libraries while limiting the access of the function libraries (function library 1, function library 2, and function library 3) to the main program and system resources, thereby ensuring the security of the entire main program and operating system.

[0004] In actual applications, different function libraries have different risk levels. Since multiple function libraries are configured in the same shared memory space, the high-risk function library may call the low-risk function library, thereby posing a security risk to the main program and the operating system. Summary of the invention

[0005] The present application provides a method for isolating a function library and a related device, which are used to improve the security of using the function library.

[0006] In the first aspect, the present application provides a method for isolating a function library. During the static compilation process of the main program, the main program needs to link multiple function libraries. In the present application, it is necessary to configure multiple shared memory spaces in advance for the multiple function libraries linked to the main program, so that each function library communicates with the main program only through a shared memory space allocated to it. In practical applications, different shared memory spaces can be configured for each function library. In other words, the number of function libraries is equal to the number of shared memory spaces, that is, each function library corresponds to one shared memory space; or, one shared memory space can be configured for multiple function libraries. In other words, the number of shared memory spaces is less than the number of function libraries.

[0007] Then, a program dependency graph (PDG) is generated based on multiple shared memory spaces, the main program, and multiple function libraries. The PDG in this application includes multiple function nodes and multiple variable nodes, each function node represents a function in the main program or multiple function libraries, and each variable node represents a variable defined by the main program or multiple function libraries.

[0008] Starting from the library function node in the PDG, various dependencies are traversed layer by layer, such as data, ctrl or param, so as to determine the variable nodes that have dependencies with the library function node as shared variable nodes. Each library function node represents a function in multiple function libraries. In practical applications, the attribute of the shared variable can be set to shared in the source code of the shared variable corresponding to the shared variable node.

[0009] After the shared variable nodes are determined, it is possible to clearly know which variables are shared variables, so that the shared variables generated during the program running process can be stored in the shared memory space to which the shared variables belong, wherein the shared variables are the variables represented by the shared variable nodes.

[0010] In the existing isolation function library technology, only standard memory allocation functions such as malloc can be applied. If the main program or function library uses a custom memory allocation function, the existing isolation function library technology cannot be applied. Next, in this application, after the shared variable is determined, the memory allocation function used by the shared variable can be configured as the target memory allocation function. Specifically, first obtain the source code of the shared variable, and then update the memory allocation function used by the source code of the shared variable to the target memory allocation function. Among them, the target memory allocation function is used to store the shared variable in the target shared memory space, and the target shared memory space is the shared memory space indicated by the domain information of the shared object node. Exemplarily, if the domain information of a shared variable node carries the identification of shared memory space 1, it means that the shared variable corresponding to the shared variable node should be stored in shared memory space 1.

[0011] In the present application, the shared variables of each function library can only access the shared memory space to which they belong, thereby achieving data sharing between the main program and the function library while avoiding mutual access between function libraries from different shared memory spaces, reducing the threat posed by high-risk function libraries and improving the security of using function libraries.

[0012] Based on the first aspect, in an optional implementation, the variable node in the present application, based on the existing PDG (including value, type and function name), the variable node also includes domain information, and optionally, the variable node also includes variable type information and source code information corresponding to the variable. The variable type information indicates whether the variable belongs to a stack variable, a heap variable or a static variable, and the source code information is used to indicate the data type of the variable (for example, an integer variable, a string variable or a pointer variable).

[0013] Based on the first aspect, in an optional implementation, the source code information in the variable node can also be used to identify and determine the shared variable node. Specifically, in the above-mentioned variable nodes that have a dependency relationship with the library function node, integer variables, string variables or floating-point variables may also be included. In practical applications, it is meaningless to share variables of these data types. Therefore, in the present application, these variable nodes that have a dependency relationship with the library function node can be further screened, that is, the data types of these variable nodes are identified through the source code information of these variable nodes (used to indicate the data type of the variable), so that only the variable nodes whose data type is a pointer variable are determined as shared variable nodes. In other words, the shared variable node in the present application is a variable node whose source code information indicates that the data type of the variable is a pointer variable and has a dependency relationship with the library function node.

[0014] Based on the first aspect, in an optional implementation, the variable node in the present application also includes variable type information corresponding to the variable, wherein the variable type information indicates that the variable belongs to a stack variable, a heap variable or a static variable. Through the variable type information of each shared variable, the target memory allocation function can implement different storage strategies for shared variables of different variable types as indicated by the variable type information. Specifically, the target memory allocation function stores shared variables of stack variable type to the stack space of the target shared memory space, stores shared variables of heap variable type to the heap space of the target shared memory space, and stores shared variables of static variable type to the static space of the target shared memory space. Thereby improving the efficiency of the isolation function library.

[0015] Based on the first aspect, in an optional implementation, a specific process for generating the PDG of this application is provided: after configuring multiple shared memory spaces, generating configuration information corresponding to the multiple shared memory spaces, the configuration information indicates the configuration status of the multiple shared memory spaces in this application. Optionally, the configuration information indicates the shared memory space to which each function library belongs, and the configuration information includes a shared memory space identifier corresponding to each function library and a memory address corresponding to each shared memory space identifier. Then, based on the source code of the main program, the IR instructions corresponding to the main program are generated, and based on the source code of the multiple function libraries, the IR instructions corresponding to the multiple function libraries are generated. Finally, the special PDG provided by this application is generated by combining the above-mentioned configuration information, the IR instructions corresponding to the main program, and the IR instructions corresponding to the multiple function libraries.

[0016] Based on the first aspect, in an optional implementation, the initial memory allocation function of the shared variable does not support allocating the shared variable to a specified shared memory space. In other words, the initial memory allocation function of the shared variable does not support library isolation technology. Therefore, it is necessary to first identify the memory allocation function of the shared variable, and then update the memory allocation function used by the source code of the shared variable to a target memory allocation function, which can support storing the shared variable in the target shared memory space.

[0017] Based on the first aspect, in an optional implementation, in the source code of the shared variable, the attribute of the shared variable has been set to shared, and the memory allocation function used in the source code of the shared variable is updated to the target memory allocation function. Therefore, the updated source code of the shared variable will be used to compile into executable codes corresponding to the main program and multiple function libraries. During the running of the executable code, the shared variable will be stored in the shared memory space to which it belongs.

[0018] Based on the first aspect, in an optional implementation, before generating the executable codes corresponding to the main program and multiple function libraries, pointer variables for indirect calls (e.g., calls through library function pointers, etc.) can be obtained, and the machine codes of these pointer variables are further disassembled to determine whether the pointer variable performs a dereference operation on the function library. If a dereference operation is performed, the pointer variable is identified as a shared variable, and if no dereference operation is performed, the pointer variable is not identified as a shared variable, thereby effectively reducing the number of shared variables that need to be identified, and reducing the number of shared object misidentifications, thereby further improving the accuracy of identifying shared variables.

[0019] Based on the first aspect, in an optional implementation, a connection is established between the function node and the variable node. Specifically, by traversing the function parameters, the function nodes and the variable nodes with a dependency relationship are connected by edges, so as to facilitate the search for the variable node.

[0020] Based on the first aspect, in an optional implementation, the domain information includes a shared memory space identifier, each shared memory space identifier indicates a memory address of a shared memory space. In actual applications, if a variable node does not belong to any shared memory space, the domain information of the variable node can be empty or default information.

[0021] Based on the first aspect, in an optional implementation, the configuration information includes a shared memory space identifier corresponding to each function library and a memory address of the shared memory space corresponding to each shared memory space identifier.

[0022] In a second aspect, the present application provides a function library isolation device, comprising:

[0023] A determination unit, used for determining a plurality of shared memory spaces between a main program and a plurality of function libraries, each shared memory space being used for the main function to communicate with at least one function library;

[0024] A generating unit, used for generating a program dependency graph PDG according to multiple shared memory spaces, a main program and multiple function libraries, wherein the PDG includes multiple function nodes and multiple variable nodes, each function node represents a function in the main program or multiple function libraries, each variable node represents a variable defined by the main program or multiple function libraries, and each variable node includes domain information of the variable, wherein the domain information is used for indicating the shared memory space to which the variable belongs;

[0025] The determination unit is further used to determine a variable node having a dependency relationship with a library function node as a shared variable node, wherein the library function node represents a function in a plurality of function libraries;

[0026] The configuration unit is used to configure the memory allocation function used by the shared variable as a target memory allocation function, the target memory allocation function is used to store the shared variable in a target shared memory space, the target shared memory space is the shared memory space indicated by the domain information of the shared object node, and the shared variable is the variable represented by the shared variable node.

[0027] Based on the second aspect, in an optional implementation, the variable node includes variable type information of the variable, the variable type information indicates that the variable belongs to a stack variable, a heap variable or a static variable, and the variable type information is used by the target memory allocation function to store the shared variable in the stack space, heap space or static space of the target shared memory space.

[0028] Based on the second aspect, in an optional implementation, the target memory allocation function is specifically used to store shared variables of stack variable type in the stack space of the target shared memory space, store shared variables of heap variable type in the heap space of the target shared memory space, and store shared variables of static variable type in the static space of the target shared memory space.

[0029] Based on the second aspect, in an optional implementation, the variable node includes source code information corresponding to the variable, and the source code information is used to indicate a data type of the variable.

[0030] Based on the second aspect, in an optional implementation, the shared variable node is a variable node in which the data type of the variable indicated by the source code information is a pointer variable.

[0031] Based on the second aspect, in an optional implementation manner, the generating unit is specifically configured to:

[0032] Acquire configuration information corresponding to multiple shared memory spaces, where the configuration information indicates the shared memory space to which each function library belongs; generate IR instructions corresponding to the main program and IR instructions corresponding to the function library; and generate PDG according to the configuration information, the IR instructions corresponding to the main program, and the IR instructions corresponding to the function library.

[0033] Based on the second aspect, in an optional implementation manner, the configuration unit is specifically configured to:

[0034] Obtain the source code of the shared variable; update the memory allocation function used in the source code of the shared variable to the target memory allocation function.

[0035] Based on the second aspect, in an optional implementation manner, the generating unit is further configured to:

[0036] Generate executable codes corresponding to the main program and multiple function libraries, and the executable codes include source codes of the updated shared variables.

[0037] Based on the second aspect, in an optional implementation, the shared variable is a pointer variable that performs a dereference operation on the function library.

[0038] Based on the second aspect, in an optional implementation, in the PDG, function nodes and shared variable nodes having dependency relationships are connected via edges.

[0039] Based on the second aspect, in an optional implementation manner, the domain information includes shared memory space identifiers, and each shared memory space identifier indicates a memory address of a shared memory space.

[0040] Based on the second aspect, in an optional implementation, the configuration information includes a shared memory space identifier corresponding to each function library and a memory address of the shared memory space corresponding to each shared memory space identifier.

[0041] The information interaction and execution process and other contents of the embodiment shown in this aspect are based on the same concept as the embodiment shown in the first aspect. Therefore, for the description of the beneficial effects shown in this aspect, please refer to the above-mentioned first aspect, and the details will not be repeated here.

[0042] In a third aspect, an embodiment of the present application provides a computing device, comprising: a processor, the processor is coupled to a memory, the memory is used to store instructions, when the instructions are executed by the processor, the device implements the method in the above-mentioned first aspect, or any possible implementation of the first aspect.

[0043] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having instructions stored thereon, which, when executed, causes a computer to execute the method in the above-mentioned first aspect, or any possible implementation of the first aspect.

[0044] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, it enables the computer to execute the method in the above-mentioned first aspect or any possible implementation manner of the first aspect.

[0045] In a sixth aspect, an embodiment of the present application provides a chip, comprising: a processor, the processor is coupled to a memory, the memory is used to store instructions, and when the instructions are executed by the processor, the chip implements the method in the above-mentioned first aspect and any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0047] Figure 1 A schematic diagram of the scenario of the existing isolation function library;

[0048] Figure 2 Schematic diagram of the scenario of linking the function library to the main program;

[0049] Figure 3 A schematic diagram of a scenario of isolating a function library in an embodiment of the present application;

[0050] Figure 4Schematic diagram of the process of isolating a function library in an embodiment of the present application;

[0051] Figure 5 This is another schematic diagram of isolating a function library in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the structure of the PDG provided in the embodiment of the present application;

[0053] Figure 7 A schematic diagram of an algorithm for identifying shared variable nodes provided in an embodiment of the present application;

[0054] Figure 8 A schematic diagram comparing the isolation method of the function library of the embodiment of the present application with the isolation method of the existing function library;

[0055] Fig. 9 A schematic diagram of the structure of a function library isolation device provided in an embodiment of the present application;

[0056] Fig.10 A schematic diagram of a logical structure of a computing device 30 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The embodiments of the present application provide a method for isolating a function library and a related device, which are used to improve the security of using the function library.

[0058] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation mode of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the embodiments of the present application. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0059] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0060] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0061] Some nouns or terms used in the embodiments of the present application are explained below, and these nouns or terms are also considered as part of the content of the invention.

[0062] Program Dependence Graph: The Program Dependence Graph (PDG) builds a directed graph for each function of a program through strictly defined data constraints and control constraints. In the program dependency graph, nodes represent program statements and edges represent the interdependencies between program statements.

[0063] LLVM: LLVM is a compiler framework system written in C++. It is used to optimize the compile time, link time, run time, and idle time of programs written in any programming language. It is open to developers and compatible with existing scripts.

[0064] IR instructions: IR instructions are an intermediate representation in LLVM, used to represent the control flow, data flow, memory access, etc. of the program. In LLVM, each IR instruction has a unique opcode (opcode) to identify the type of the instruction. Each opcode corresponds to a set of possible operands (operands), which can be constants, registers, or results of other instructions. In LLVM's IR instructions, all data types are defined based on the LLVM type system. These data types include integers, floating-point numbers, pointers, arrays, structures, etc. Each data type has its own properties, such as bit width and alignment, etc. In IR, each value has a type, which can be explicitly specified or inferred from the operands of the instruction. LLVM's IR instructions are very rich, including arithmetic, logic, comparison, conversion, and control flow, etc. They can be used to express complex program structures. At the same time, IR instructions can also be optimized by LLVM's optimizer to generate efficient target code.

[0065] Next, the application scenarios involved in the embodiments of the present application are introduced in conjunction with the accompanying drawings.

[0066] As software development becomes more and more complex, the use of ready-made function libraries in applications has become an essential part. Although the use of function libraries can improve the efficiency of software development, it can also bring security issues. Figure 2 , Figure 2 This is a schematic diagram of the scenario of linking the function library to the main program. Figure 2 As shown in the figure, the main program shares the same memory space with multiple linked function libraries (function library 1, function library 2 and function library 3). Therefore, once a function library (function library 1, function library 2 or function library 3) has a security vulnerability, the main program and the operating system using the function library will face security threats.

[0067] See also Figure 1 , Figure 1 The following is a schematic diagram of the existing isolation function library scenario. Figure 1 As shown, multiple function libraries (function library 1, function library 2 and function library 3) required by the main program are configured in the shared memory space 1, so as to realize data sharing between the main program and the function libraries, while limiting the access of the function libraries (function library 1, function library 2 and function library 3) to the main program and system resources, thereby ensuring the security of the entire main program and the operating system.

[0068] In actual applications, different function libraries have different risk levels. Since multiple function libraries are configured in the same shared memory space, the high-risk function library may call the low-risk function library, thereby posing a security risk to the main program and the operating system.

[0069] On the other hand, in the current scenario of isolating function libraries, shared variables are mainly identified through IR instructions generated by the source code of the main program and the function library. However, variables of different data types (such as string variables, integer variables, and pointer variables) are all represented as pointer variables at the IR instruction level, so these variables will be identified as shared variables, making the identification accuracy of shared variables low.

[0070] In view of this, the embodiment of the present application provides a method for isolating a function library and a related device, which are used to improve the security of the main program linking the function library. Figure 3 , Figure 3 Schematic diagram of a scenario of isolating function libraries in the embodiment of the present application. In the embodiment of the present application, multiple function libraries (such as Figure 3 Different shared memory spaces are configured for function library 1, function library 2, and function library 3 in the example. Figure 3 As shown, in the isolation method of the function library provided in the embodiment of the present application, the function library 1 communicates with the main program through the shared memory space 1, the function library 2 communicates with the main program through the shared memory space 2, and the function library 3 communicates with the main program through the shared memory space 3. Thus, each function library communicates with the main program only through the shared memory space allocated to it, thereby realizing data sharing between the main program and the function library, avoiding mutual access between function libraries from different shared memory spaces, reducing the threat of high-risk function libraries to the main program and the operating system, and improving the security of the main program and the operating system.

[0071] See also Figure 4 , Figure 4 FIG. 1 is a flow chart of the isolation method of the function library in the embodiment of the present application. Figure 4 As shown,

[0072] 101. Determine multiple shared memory spaces between the main program and multiple function libraries.

[0073] During the static compilation of the main program, the main program needs to link multiple function libraries. In the embodiment of the present application, multiple shared memory spaces need to be configured in advance for the multiple function libraries linked to the main program, so that each function library can communicate with the main program only through a shared memory space allocated to it.

[0074] In actual applications, different shared memory spaces can be configured for each library. In other words, the number of libraries is equal to the number of shared memory spaces, that is, each library corresponds to a shared memory space. For details, see Figure 3Alternatively, one shared memory space can be allocated to multiple libraries. In other words, the number of shared memory spaces is smaller than the number of libraries. Figure 5 , Figure 5 FIG. 1 is another schematic diagram of isolating a function library in an embodiment of the present application. Figure 5 As shown in the figure, the main program links 4 function libraries, and the number of shared memory spaces is 3. Among them, shared memory space 1 is configured for function library 1 and function library 2, shared memory space 2 is configured for function library 3, and shared memory space 3 is configured for function library 4. Therefore, function library 1, function library 2 and the main program communicate through shared memory space 1, function library 3 and the main program communicate through shared memory space 2, and function library 4 and the main program communicate through shared memory space 3.

[0075] The function library isolation method in the embodiment of the present application is suitable for isolating dynamic libraries.

[0076] 102. Generate a program dependency graph (PDG) based on multiple shared memory spaces, a main program and multiple function libraries.

[0077] In the existing PDG, functions in programs and function libraries are represented as nodes in the PDG, and nodes are connected by edges, which represent the mutual dependencies between functions. Function nodes in the existing PDG include triples such as value, type, and function name, which are used to represent a function. The embodiment of the present application provides a special PDG structure, through which shared variables between the main program and the function library can be identified.

[0078] Next, the construction method of the special PDG in the embodiment of the present application is introduced.

[0079] In the existing method for constructing the PDG structure, the IR instructions are compiled based on the source code of the main program and the function library, and the PDG is generated by the obtained IR instructions. In the method for constructing the special PDG of the embodiment of the present application, after configuring multiple shared memory spaces, configuration information corresponding to multiple shared memory spaces is generated, and the configuration information indicates the configuration of multiple shared memory spaces in the embodiment of the present application. In a possible implementation, the configuration information indicates the shared memory space to which each function library belongs, and the configuration information includes the shared memory space identifier corresponding to each function library and the memory address corresponding to each shared memory space identifier. Then, the IR instructions corresponding to the main program are generated based on the source code of the main program, and the IR instructions corresponding to multiple function libraries are generated based on the source code of multiple function libraries. Finally, the special PDG provided by the embodiment of the present application is generated by combining the above configuration information, the IR instructions corresponding to the main program, and the IR instructions corresponding to multiple function libraries. Among them, the PDG in the embodiment of the present application includes multiple function nodes and multiple variable nodes, each function node represents a function in the main program or multiple function libraries, and each variable node represents a variable defined by the main program or multiple function libraries. Specifically, in actual applications, you can use methods such as getGlobalList and getFunctionList in LLVM Pass to obtain the global variable list, function list, and parameter list, and combine them with the configuration information of the shared memory space to establish corresponding variable nodes for these variables in PDG.

[0080] Furthermore, in order to facilitate the search for variable nodes, it is necessary to establish a connection between function nodes and variable nodes. Specifically, by traversing the function parameters, the function nodes with dependencies are connected to the variable nodes. The relationship between the function nodes of PDG and other nodes can be established by traversing the ir instruction, finding instruction types such as ReturnInst, GetElementPtrInst, etc., and establishing the corresponding edge relationship.

[0081] In practical applications, there are 67 existing IR instructions in LLVM, and different instructions have different dependencies. Customizing dependencies for each instruction may complicate the data flow of the program, making program analysis difficult. Therefore, in an embodiment of the present application, the 67 IR instructions of LLVM can be analyzed, classified and divided according to functional logic, and edge relationships can be established to simplify the data flow.

[0082] Since the configuration information corresponding to multiple shared memory spaces is introduced in the process of generating PDG, the configuration information can be reflected in the variable node in the PDG provided in the embodiment of the present application. Specifically, each variable node includes domain information of the variable, and the domain information is used to indicate the shared memory space to which the variable belongs. In a possible implementation, the domain information includes a shared memory space identifier, and each shared memory space identifier indicates the memory address of a shared memory space. In actual applications, if a variable node does not belong to any shared memory space, the domain information of the variable node can be empty or default information.

[0083] See also Figure 6 , Figure 6 A schematic diagram of the structure of the PDG provided in the embodiment of the present application. Figure 6 As shown, the variable node in the embodiment of the present application, based on the existing PDG (including value value, type type and function name function), the variable node also includes domain information, and optionally, the variable node also includes variable type information and source code information corresponding to the variable. Among them, the variable type information indicates that the variable belongs to a stack variable, a heap variable or a static variable, and the source code information is used to indicate the data type of the variable (for example, an integer variable, a string variable or a pointer variable).

[0084] 103. Determine that the variable nodes that have a dependency relationship with the library function nodes are shared variable nodes.

[0085] Starting from the library function node in the PDG, various dependency relationships, such as data, ctrl or param, are traversed layer by layer, so that the variable nodes that have a dependency relationship with the library function node are determined as shared variable nodes. In other words, the variable nodes that have an edge connection relationship with the library function node are determined as shared variable nodes. Each library function node represents a function in multiple function libraries. In practical applications, the attribute of the shared variable can be set to shared in the source code of the shared variable corresponding to the shared variable node.

[0086] In order to better implement the present invention, the embodiment of the present application also provides a matching algorithm for identifying and determining shared variable nodes, thereby improving the accuracy of identifying shared variable nodes. Figure 7 , Figure 7 This is a schematic diagram of an algorithm for identifying shared variable nodes provided in an embodiment of the present application. Figure 7As shown, the source code information in the variable node can also be used to identify and determine the shared variable node. Specifically, in the above-mentioned variable nodes that have a dependency relationship with the library function node, integer variables, string variables or floating-point variables may also be included. In practical applications, it is meaningless to share variables of these data types. Therefore, in the embodiment of the present application, these variable nodes that have a dependency relationship with the library function node can be further screened, that is, through the source code information of these variable nodes (used to indicate the data type of the variable), the data type of these variable nodes is identified, thereby, only the variable nodes whose data type is a pointer variable are determined as shared variable nodes. In other words, the shared variable node in the embodiment of the present application is a variable node that the source code information indicates that the data type of the variable is a pointer variable, and has a dependency relationship with the library function node.

[0087] 104. Configure the memory allocation function used by the shared variable as the target memory allocation function.

[0088] After the shared variable nodes are determined, it is possible to clearly know which variables are shared variables, so that the shared variables generated during the program running process can be stored in the shared memory space to which the shared variables belong, wherein the shared variables are the variables represented by the shared variable nodes.

[0089] In the existing isolation function library technology, only standard memory allocation functions such as malloc can be applied. If the main program or function library uses a custom memory allocation function, the existing isolation function library technology cannot be applied. Next, in an embodiment of the present application, after the shared variable is determined, the memory allocation function used by the shared variable can be configured as a target memory allocation function. Specifically, first obtain the source code of the shared variable, and then update the memory allocation function used by the source code of the shared variable to the target memory allocation function. Among them, the target memory allocation function is used to store the shared variable in the target shared memory space, and the target shared memory space is the shared memory space indicated by the domain information of the shared object node. Exemplarily, if the domain information of a shared variable node carries the identification of shared memory space 1, it means that the shared variable corresponding to the shared variable node should be stored in shared memory space 1.

[0090] In practical applications, for safe memory allocation functions such as malloc_s or free_s, you can modify their source code, change the memory management structure (main_arena) of memory allocation, and point the main_arena address to the shared memory space to achieve safe reallocation of memory space.

[0091] In the embodiment of the present application, the shared variables of each function library can only access the shared memory space to which they belong, thereby achieving data sharing between the main program and the function library while avoiding mutual access between function libraries from different shared memory spaces, reducing the threat posed by high-risk function libraries, and improving the security of using function libraries.

[0092] On the other hand, it can be seen from the above that the variable node also includes the variable type information corresponding to the variable, wherein the variable type information indicates that the variable belongs to a stack variable, a heap variable or a static variable. Through the variable type information of each shared variable, the target memory allocation function can implement different storage strategies for shared variables of different variable types as indicated by the variable type information. Specifically, the target memory allocation function stores the shared variables of the stack variable type in the stack space of the target shared memory space, stores the shared variables of the heap variable type in the heap space of the target shared memory space, and stores the shared variables of the static variable type in the static space of the target shared memory space. Thereby improving the efficiency of the isolation function library.

[0093] 105. Generate executable codes corresponding to the main program and multiple function libraries.

[0094] As can be seen from the above, in the source code of the shared variable, the attribute of the shared variable has been set to shared, and the memory allocation function used in the source code of the shared variable has been updated to the target memory allocation function. Therefore, the updated source code of the shared variable will be used to compile into the executable code corresponding to the main program and multiple function libraries. During the running of the executable code, the shared variables will be stored in the shared memory space to which they belong. Specifically, static variables will be stored in the shared memory space to which they belong when the function is initialized. For heap variables and stack variables, it is necessary to map the heap variables and stack variables to the shared memory space when the executable code is running.

[0095] In a possible implementation, before generating the executable codes corresponding to the main program and multiple function libraries, the pointer variables of indirect calls (for example, calls through library function pointers, etc.) can be obtained, and the machine codes of these pointer variables are further disassembled to determine whether the pointer variables perform a dereference operation on the function library. If the dereference operation is performed, the pointer variable is identified as a shared variable, and if the dereference operation is not performed, the pointer variable is not identified as a shared variable, thereby effectively reducing the number of shared variables that need to be identified, and reducing the number of shared object misidentifications, thereby further improving the accuracy of identifying shared variables.

[0096] The isolation method of the function library in the embodiment of the present application can be implemented in the form of scripts and software, which can implement the algorithm for building PDG, the algorithm for multi-domain isolation, the algorithm for accurately identifying shared objects, and the algorithm for customizing memory allocation functions in the embodiment of the present application. Exemplarily, it can be implemented in the vehicle system, the terminal system (smartphones, etc.), the exchange and storage devices, etc.

[0097] Exemplarily, assuming that the program files on the operating system include a main program and multiple function libraries (libxml.so, zlib.so, libssl.so), if Figure 1 The existing isolation method shown, the hacker can obtain the password information. In the isolation environment constructed by the isolation method based on the function library provided in the embodiment of the present application, libssl.so can be placed in shared memory space 1, and libxml.so and zlib.so can be placed in shared memory space 2. In this scenario, if a hacker uses nmap-sV--script=ssl-heartbleed 1.1.1.2 to test the vulnerability of libssl.so, try to obtain the password information stored in the libxml program. When using the isolation method based on the function library provided in the embodiment of the present application, the libssl library with the Heartbleed vulnerability is placed in a shared memory space 1 separately, and the libxml library with sensitive information is stored in shared memory space 2. When the hacker uses the Heartbleed vulnerability in domain 2 to steal the sensitive information of password, it returns empty. Because the password is placed in shared memory space 2, it has been isolated by shared memory space 2. The hacker will not be able to obtain the password information stored in the shared memory space 2. It can be seen that the isolation method of the function library provided in the embodiment of the present application successfully prevents attacks that steal sensitive information through library vulnerabilities.

[0098] For example, assume that the program files on the operating system include a main program and multiple function libraries (libxml2.so, zlib.so, libssl.so). Suppose a hacker uses the following PoC to attack the libxml2.so (version < 2.9.14) library, which has a CVE-2022-29824 vulnerability (a buffer overflow vulnerability).

[0099] PoC attack: / xmllint --huge --xpath ' / test[string-length()<\"4\"]' / tmp / poc.xml

[0100] If adopted Figure 1In the existing isolation method shown, hackers can successfully overflow into the main program and obtain the resources of the main program by using the misidentified shared variables. However, in the isolation environment constructed by the isolation method of the function library provided in the embodiment of the present application, the shared variables will not be able to overflow into the main program, thus ensuring the security of the main program.

[0101] See also Figure 8 , Figure 8 Schematic diagram of the comparison between the isolation method of the function library of the embodiment of the present application and the isolation method of the existing function library. Figure 8 As shown, on the one hand, the isolation method of the existing function library does not support the configuration of multiple shared memory spaces, while the isolation method of the function library of the embodiment of the present application can configure multiple shared memory spaces; on the other hand, in the isolation method of the existing function library, the recognition accuracy of shared variables is low, while the isolation method of the embodiment of the present application greatly improves the recognition accuracy of shared variables; on the other hand, in the isolation method of the existing function library, it is impossible to support customized memory allocation functions, while the isolation method of the function library of the embodiment of the present application can support customized memory allocation functions.

[0102] Accordingly, the present application also provides a related device for implementing the above solution. Fig. 9 , Fig. 9 A schematic diagram of a structure of a function library isolation device provided in an embodiment of the present application. Fig. 9 As shown, the function library isolation device includes:

[0103] A determining unit 201 is used to determine a plurality of shared memory spaces between a main program and a plurality of function libraries, each shared memory space being used for the main program to communicate with at least one function library;

[0104] A generating unit 202 is used to generate a program dependency graph PDG according to multiple shared memory spaces, a main program and multiple function libraries, wherein the PDG includes multiple function nodes and multiple variable nodes, each function node represents a function in the main program or multiple function libraries, each variable node represents a variable defined by the main program or multiple function libraries, and each variable node includes domain information of the variable, and the domain information is used to indicate the shared memory space to which the variable belongs;

[0105] The determining unit 201 is further used to determine a variable node having a dependency relationship with a library function node as a shared variable node, wherein the library function node represents a function in a plurality of function libraries;

[0106] The configuration unit 203 is used to configure the memory allocation function used by the shared variable as a target memory allocation function, where the target memory allocation function is used to store the shared variable in a target shared memory space, where the target shared memory space is the shared memory space indicated by the domain information of the shared object node, and the shared variable is the variable represented by the shared variable node.

[0107] In one possible design, the variable node includes variable type information of the variable, the variable type information indicates whether the variable is a stack variable, a heap variable or a static variable, and the variable type information is used by the target memory allocation function to store the shared variable in the stack space, heap space or static space of the target shared memory space.

[0108] In one possible design, the target memory allocation function is specifically used to store shared variables of stack variable type in the stack space of the target shared memory space, store shared variables of heap variable type in the heap space of the target shared memory space, and store shared variables of static variable type in the static space of the target shared memory space.

[0109] In a possible design, the variable node includes source code information corresponding to the variable, and the source code information is used to indicate the data type of the variable.

[0110] In a possible design, the shared variable node is a variable node whose source code information indicates that the data type of the variable is a pointer variable.

[0111] In a possible design, the generating unit 202 is specifically configured to:

[0112] Acquire configuration information corresponding to multiple shared memory spaces, where the configuration information indicates the shared memory space to which each function library belongs; generate IR instructions corresponding to the main program and IR instructions corresponding to the function library; and generate PDG according to the configuration information, the IR instructions corresponding to the main program, and the IR instructions corresponding to the function library.

[0113] In a possible design, the configuration unit 203 is specifically configured to:

[0114] Obtain the source code of the shared variable; update the memory allocation function used in the source code of the shared variable to the target memory allocation function.

[0115] In a possible design, the generating unit 202 is further configured to:

[0116] Generate executable codes corresponding to the main program and multiple function libraries, and the executable codes include source codes of the updated shared variables.

[0117] In a possible design, the shared variable is a pointer variable that performs a dereference operation on a function library.

[0118] In a possible design, in the PDG, function nodes and shared variable nodes with dependencies are connected via edges.

[0119] In a possible design, the domain information includes shared memory space identifiers, and each shared memory space identifier indicates a memory address of a shared memory space.

[0120] In a possible design, the configuration information includes a shared memory space identifier corresponding to each function library and a memory address of the shared memory space corresponding to each shared memory space identifier.

[0121] It should be noted that the information interaction, execution process, etc. between the modules / units in the function library isolation device are the same as those in this application. Figure 4 The corresponding method embodiments are based on the same concept. For specific contents, please refer to the description in the method embodiments shown above in this application, which will not be repeated here.

[0122] See also Fig.10 , Fig.10 A schematic diagram of a logical structure of a computing device 30 provided in an embodiment of the present application. The computing device 30 may be deployed with Fig. 9 The function library isolation device described in the corresponding embodiment is used to implement Figure 4 The computer device 30 includes a memory 301 , a processor 302 , a communication interface 303 and a bus 304 . The memory 301 , the processor 302 , and the communication interface 303 are connected to each other through the bus 304 .

[0123] The memory 301 may be a read only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM). The memory 301 may store a program. When the program stored in the memory 301 is executed by the processor 302, the processor 302 and the communication interface 303 are used to execute steps 101-105 of the above data processing method embodiment.

[0124] The processor 302 may be a central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components or any combination thereof, for executing related programs to implement one or more steps of steps 101-105 of the data processing method embodiment in the present application. The steps of the data processing method disclosed in the embodiment of the present application may be executed by a compiler and an executor, wherein the compiler and the executor may be executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 301, and the processor 302 reads the information in the memory 301, and executes one or more steps of steps 101-105 of the data processing method embodiment in the present application in combination with its hardware.

[0125] The communication interface 303 uses a transceiver device such as but not limited to a transceiver to implement communication between the computer device 30 and other devices or a communication network.

[0126] The bus 304 can realize the path for transmitting information between the various components of the computer device 30 (for example, the memory 301, the processor 302 and the communication interface 303). The bus 304 can be a peripheral component interconnect standard (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0127] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the above-mentioned Figure 4 The illustrated embodiments describe the method.

[0128] The present application also provides a computer-readable storage medium. The computer-readable storage medium may be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above application to execute the above application. Figure 4 The illustrated embodiments describe the method.

[0129] The communication device provided in the embodiment of the present application may be a chip, which includes: a processing unit and a communication unit. The processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. The processing unit may execute the computer execution instructions stored in the storage unit to enable the chip to execute the above Figure 4 Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit located outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0130] It should be further noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the device embodiment drawings provided in the embodiments of the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0131] Through the description of the above implementation mode, the technicians in the field can clearly understand that the embodiments of the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented with corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the embodiments of the present application, software program implementation is a better implementation method in more cases. Based on such an understanding, the technical solution of the embodiments of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0132] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0133] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for isolating a function library, characterized in that: The method comprises: Determine a plurality of shared memory spaces between a main program and a plurality of function libraries, each of the shared memory spaces being used for the main program to communicate with at least one of the function libraries; Generate a program dependency graph PDG according to the multiple shared memory spaces, the main program and the multiple function libraries, the PDG includes multiple function nodes and multiple variable nodes, each of the function nodes represents a function in the main program or the multiple function libraries, each of the variable nodes represents a variable defined by the main program or the multiple function libraries, and each of the variable nodes includes domain information of the variable, and the domain information is used to indicate the shared memory space to which the variable belongs; Determine a variable node that has a dependency relationship with a library function node as a shared variable node, wherein the library function node represents a function in the multiple function libraries; The memory allocation function used by the shared variable is configured as a target memory allocation function, wherein the target memory allocation function is used to store the shared variable in a target shared memory space, wherein the target shared memory space is the shared memory space indicated by the domain information of the shared object node, and the shared variable is the variable represented by the shared variable node.

2. The method according to claim 1, characterized in that The variable node includes variable type information of the variable, the variable type information indicating that the variable is a stack variable, a heap variable or a static variable, and the variable type information is used by the target memory allocation function to store the shared variable in the stack space, heap space or static space of the target shared memory space.

3. The method according to claim 2, characterized in that The target memory allocation function is specifically used to store shared variables of stack variable type into the stack space of the target shared memory space, store shared variables of heap variable type into the heap space of the target shared memory space, and store shared variables of static variable type into the static space of the target shared memory space.

4. The method according to any one of claims 1 to 3, characterized in that The variable node includes source code information corresponding to the variable, and the source code information is used to indicate the data type of the variable.

5. The method according to claim 4, characterized in that The shared variable node is a variable node whose source code information indicates that the data type of the variable is a pointer variable.

6. The method according to any one of claims 1 to 5, characterized in that The generating a program dependency graph PDG according to the multiple shared memory spaces, the main program and the multiple function libraries comprises: Acquire configuration information corresponding to the multiple shared memory spaces, wherein the configuration information indicates the shared memory space to which each of the function libraries belongs; Generate IR instructions corresponding to the main program and IR instructions corresponding to the function library; Generate PDG according to the configuration information, the IR instructions corresponding to the main program and the IR instructions corresponding to the function library.

7. The method according to any one of claims 1 to 6, characterized in that The step of configuring the memory allocation function used by the shared variable as the target memory allocation function includes: Get the source code of the shared variable; The memory allocation function used by the source code of the shared variable is updated to the target memory allocation function.

8. The method according to claim 7, characterized in that The method further comprises: Generate executable codes corresponding to the main program and the multiple function libraries, wherein the executable codes include updated source codes of the shared variables.

9. The method according to any one of claims 1 to 8, characterized in that The shared variable is a pointer variable that performs a dereference operation on the function library.

10. The method according to any one of claims 1 to 9, characterized in that In the PDG, the function nodes and the shared variable nodes having a dependency relationship are connected via edges.

11. The method according to any one of claims 1 to 10, characterized in that The domain information includes a shared memory space identifier, and each of the shared memory space identifiers indicates a memory address of the shared memory space.

12. The method according to claim 6, characterized in that The configuration information includes a shared memory space identifier corresponding to each function library and a memory address of the shared memory space corresponding to each shared memory space identifier.

13. A function library isolation device, characterized in that: The function library isolation device comprises: A determining unit, used for determining a plurality of shared memory spaces between a main program and a plurality of function libraries, each of the shared memory spaces being used for the main program to communicate with at least one of the function libraries; A generating unit, configured to generate a program dependency graph PDG according to the multiple shared memory spaces, the main program and the multiple function libraries, wherein the PDG includes multiple function nodes and multiple variable nodes, each of the function nodes represents a function in the main program or the multiple function libraries, each of the variable nodes represents a variable defined by the main program or the multiple function libraries, and each of the variable nodes includes domain information of the variable, wherein the domain information is used to indicate the shared memory space to which the variable belongs; The determining unit is further used to determine a variable node having a dependency relationship with a library function node as a shared variable node, wherein the library function node represents a function in the plurality of function libraries; A configuration unit is used to configure the memory allocation function used by the shared variable as a target memory allocation function, wherein the target memory allocation function is used to store the shared variable in a target shared memory space, wherein the target shared memory space is the shared memory space indicated by the domain information of the shared object node, and the shared variable is the variable represented by the shared variable node.

14. The function library isolation device according to claim 13, characterized in that: The variable node includes variable type information of the variable, the variable type information indicating that the variable is a stack variable, a heap variable or a static variable, and the variable type information is used by the target memory allocation function to store the shared variable in the stack space, heap space or static space of the target shared memory space.

15. The function library isolation device according to claim 14, characterized in that: The target memory allocation function is specifically used to store shared variables of stack variable type into the stack space of the target shared memory space, store shared variables of heap variable type into the heap space of the target shared memory space, and store shared variables of static variable type into the static space of the target shared memory space.

16. The function library isolation device according to any one of claims 13 to 15, characterized in that: The variable node includes source code information corresponding to the variable, and the source code information is used to indicate the data type of the variable.

17. The function library isolation device according to claim 16, characterized in that: The shared variable node is a variable node whose source code information indicates that the data type of the variable is a pointer variable.

18. The function library isolation device according to any one of claims 13 to 17, characterized in that: The generating unit is specifically used for: Obtain configuration information corresponding to the multiple shared memory spaces, the configuration information indicating the shared memory space to which each of the function libraries belongs; generate IR instructions corresponding to the main program and IR instructions corresponding to the function library; generate PDG according to the configuration information, the IR instructions corresponding to the main program and the IR instructions corresponding to the function library.

19. The function library isolation device according to any one of claims 13 to 18, characterized in that: The configuration unit is specifically used for: Acquire the source code of the shared variable; and update the memory allocation function used by the source code of the shared variable to the target memory allocation function.

20. The function library isolation device according to claim 19, characterized in that: The generating unit is further used for: Generate executable codes corresponding to the main program and the multiple function libraries, wherein the executable codes include updated source codes of the shared variables.

21. The function library isolation device according to any one of claims 13 to 20, characterized in that: The shared variable is a pointer variable that performs a dereference operation on the function library.

22. The function library isolation device according to any one of claims 13 to 21, characterized in that: In the PDG, the function nodes and the shared variable nodes having a dependency relationship are connected via edges.

23. The function library isolation device according to any one of claims 13 to 22, characterized in that: The domain information includes a shared memory space identifier, and each of the shared memory space identifiers indicates a memory address of the shared memory space.

24. The function library isolation device according to claim 18, characterized in that: The configuration information includes a shared memory space identifier corresponding to each function library and a memory address of the shared memory space corresponding to each shared memory space identifier.

25. A computing device, characterized in that comprising a processor coupled to a memory, The memory is used to store instructions; The processor is configured to execute instructions in the memory so that the computing device performs the method according to any one of claims 1 to 12.

26. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

27. A computer program product, characterized in that The computer program product stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images