ELF program randomized heap address tracking modification method and system based on eBPF

Abstract

The invention relates to the technical field of operating system kernel monitoring, and discloses an eBPF-based ELF program randomized heap address tracking modification method and system, and the method comprises the steps: determining and uploading an eBPF program to a kernel space in a user space; the eBPF program is executed in the kernel space, a random heap address returned when the ELF program calls the target function is obtained through a preset tracking mechanism in the eBPF program, and the random heap address is sent to the user space; and when the kernel space obtains the random address to be replaced uploaded by the user space, modifying the random heap address into the random address to be replaced through the eBPF program. According to the method provided by the embodiment of the invention, the random heap address generated by the objective function of the ELF program can be tracked in real time in the kernel space through the eBPF method, so that the debugging complexity and the time cost are reduced, and the efficiency of a developer in debugging and analyzing the memory layout is greatly improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of operating system kernel monitoring, and in particular to an eBPF-based ELF program randomized heap address tracking and modification method and system. Background Art

[0002] With the continuous development of information security, current operating systems have gradually adopted Address Space Layout Randomization (ASLR) technology to improve system security. ASLR technology can randomize the memory address of the process, making it difficult for attackers to predict the memory layout.

[0003] However, there is no effective way to track and modify the random addresses generated by ASLR in the related art, which increases the complexity and time cost of debugging the operating system. Therefore, how to track and modify the random addresses generated by ASLR to reduce the complexity and time cost of debugging the operating system has become a problem that needs to be solved. Summary of the invention

[0004] In view of this, the present disclosure provides an eBPF-based ELF program randomized heap address tracking and modification method and system to solve the problem of how to track and modify the random addresses generated by ASLR to reduce the complexity and time cost of debugging the operating system.

[0005] On the one hand, the present disclosure provides an eBPF-based ELF program randomized heap address tracking and modification method, the method comprising: determining and uploading an eBPF program to a kernel space based on preset information in a user space; executing the eBPF program in the kernel space, obtaining a random heap address returned when the ELF program calls a target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return a random heap address; when the kernel space obtains the random address to be replaced uploaded by the user space, modifying the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program.

[0006] On the other hand, the present disclosure also provides a tracking and modification system, which includes an eBPF program determination module, a heap address tracking module and a heap address modification module, wherein: the eBPF program determination module is used to determine and upload the eBPF program to the kernel space based on preset information in the user space; the heap address tracking module is used to execute the eBPF program in the kernel space, obtain the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is used to generate and return the random heap address; the heap address modification module is used to modify the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program when the kernel space obtains the random address to be replaced uploaded by the user space.

[0007] On the other hand, the present disclosure further provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to implement the above-mentioned ELF program randomized heap address tracking and modification method based on eBPF.

[0008] On the other hand, the present disclosure further provides a computer program product, including computer instructions, which are used to enable a computer to execute the above-mentioned ELF program randomized heap address tracking and modification method based on eBPF.

[0009] Through the eBPF-based ELF program randomized heap address tracking and modification method and system of the above-mentioned embodiment of the present invention, through the eBPF-based method, the random heap address generated by the target function during the execution of the ELF program can be tracked in real time in the kernel space, avoiding the tedious manual tracking of memory addresses in traditional methods, reducing the complexity and time cost of debugging, and greatly improving the efficiency of developers in debugging and analyzing memory layout.

[0010] In addition, by dynamically modifying the random heap address returned when the ELF program is executed in the kernel space, flexible memory management and debugging functions can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0012] Figure 1 It is a flowchart of a method for tracking and modifying randomized heap addresses of ELF programs based on eBPF provided by an embodiment of the present disclosure;

[0013] Figure 2 It is a schematic diagram of the rch_randomize_brk function call flow of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0014] Figure 3 It is a schematic diagram of a return value acquisition process of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0015] Figure 4 It is a user space execution flow diagram of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0016] Figure 5 is a structural diagram of a tracking and modification system provided by an embodiment of the present disclosure;

[0017] Figure 6 It is a structural diagram of another tracking and modification system provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] With the continuous development of information security, current operating systems have gradually adopted ASLR technology to improve system security. ASLR technology can randomize the memory address of the process, making it difficult for attackers to predict the memory layout.

[0019] However, there is no effective way to track and modify the random addresses generated by ASLR in the related art, which may cause the following problems:

[0020] 1. Since the memory address changes randomly each time it is loaded, developers cannot stably track and locate specific memory locations during debugging. Especially when watchpoints or breakpoints need to be set, new addresses need to be found each time the program is started, which increases the complexity and time cost of debugging.

[0021] 2. During the automated testing process, it is impossible to stably test and verify specific memory addresses, resulting in low execution efficiency of test cases, which in turn affects the vulnerability repair and verification process and reduces the security of the operating system.

[0022] To solve the above problems, various embodiments of the present disclosure provide an ELF program randomized heap address tracking and modification method based on eBPF, the method comprising: determining and uploading the eBPF program to the kernel space based on preset information in the user space; executing the eBPF program in the kernel space, obtaining the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return the random heap address; when the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program.

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0024] Please refer to Figure 1 , Figure 1 The present invention provides a flow chart of a method for tracking and modifying randomized heap addresses of ELF programs based on eBPF, which is applied to a LINUX operating system. The flow of the method may include the following steps:

[0025] Step S101, determining in user space based on preset information and uploading the eBPF program to kernel space.

[0026] In this embodiment, the user space may refer to a memory area running outside the operating system, in which user applications and other non-core codes run.

[0027] Kernel space refers to the memory area of ​​the core part of the operating system. Kernel code and drivers can run in the kernel space. The kernel space is responsible for managing system resources, such as process scheduling, memory management, hardware device access, etc.

[0028] Furthermore, the user space and the kernel space may interact through an operating system interface (such as a system call). Here, the system call may be a preset interface provided by the operating system, and the system call may allow a program in the user space to request the kernel space to perform an operation or service.

[0029] As an example, the functions of the system call may include, but are not limited to: process management, memory management, file reading and writing. Among them, process management may include fork(), exit(), etc., and memory management may include malloc(), mmap(), etc.

[0030] Furthermore, the Extended Berkeley Packet Filter (eBPF) program determined in the user space can be a non-invasive high-performance tool executed in the kernel space, which can allow users to safely execute custom programs in the kernel space. The functions of the eBPF program may include at least one of the following: event tracing, security monitoring, dynamic instrumentation, etc. Among them, the non-invasiveness of the eBPF program may mean that the eBPF program does not modify the kernel source code and does not require the kernel to be recompiled.

[0031] In this embodiment, the role of the eBPF program determined and uploaded in the user space based on preset information can be dynamic instrumentation, that is, tracking and modifying the randomized heap address during process initialization.

[0032] In one possible implementation, the preset information of the eBPF program may refer to at least one configuration and / or parameter determined for the eBPF program in the user space, and the preset information may be customized by the user.

[0033] As an example, the preset information may include at least one of the following: filtering conditions, target function, and random address to be replaced; wherein the target function may refer to a kernel function to be mounted by the eBPF program defined by the user, and when the process is executed, the eBPF program may be mounted to a characteristic event point of the target function.

[0034] Furthermore, the eBPF program can be uploaded to the kernel space by loading it into the kernel space through the bpf() system call. After being uploaded to the kernel space, the eBPF program can reside in the kernel space until it is manually uninstalled by the user.

[0035] Step S102, executing the eBPF program in the kernel space, obtaining the random heap address returned when the ELF program calls the target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space.

[0036] In this embodiment, the target function is used to generate and return a random heap address.

[0037] In one possible implementation, the eBPF program is mounted to the return point of the target function through a preset tracing mechanism. When the ELF program calls the target function and completes execution and is ready to return, the preset tracing mechanism triggers the eBPF program, so that the eBPF program obtains the return value (random heap address) of the target function.

[0038] Among them, the executable and linkable format (ELF) program may refer to a standard file format used in the LINUX system, and the ELF file may contain executable code, data, symbol table and other contents of the program.

[0039] Further, the random heap address may refer to the starting address of the heap memory area randomly assigned to by the kernel space based on the ASLR technology when the ELF program is executed. For example, for ELF program A, assuming that there is no ASLR technology, the address of the heap memory may be fixed at 0x7fffb000, that is, 0x7fffb000 is allocated as the starting address of the heap memory of program A every time. When using the ASLR technology, the heap memory of program A is randomly allocated every time it is started, which may be 0x7fffb000 or 0x7fffc000 to improve the security of the LINUX system.

[0040] In a possible implementation, the random heap address can be sent to the user space by storing the random heap address in BPFMap in the kernel space and obtaining the random heap address through the bpf() system call in the user space.

[0041] Furthermore, after the user space obtains the random heap address space, the random heap address can be displayed in the user space, so that the tester can further analyze the memory layout of the LINUX system and perform debugging based on the random heap address space.

[0042] Step S103, when the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program.

[0043] In this embodiment, the random address to be replaced may be a fixed address preset by a user based on demand, or may be an address dynamically calculated according to preset conditions.

[0044] The method of uploading the random address to be replaced from the user space to the kernel space can be the above-mentioned BPF Map, or it can be other interaction mechanisms between the kernel space and the user space, which is not specifically limited here. For example, a system call can be used to update the random address to be replaced to the BPF hash table. The hash table can use the process ID or user ID as the key and store the random address to be replaced as the value. Among them, the process ID (Process Identifier, PID) can be a unique identifier assigned by the operating system to each running process, which is used to distinguish different processes. The user ID (User Identifier, UID) can be a unique identifier assigned by the operating system to each user, which is used to distinguish different user identities.

[0045] In a possible implementation, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced by the eBPF program, which may include:

[0046] When the ELF program calls the target function, the eBPF program is triggered according to the preset tracking mechanism, so that the eBPF program obtains the returned random heap address, modifies the random heap address to the random address to be replaced, and sends the modified random address to be replaced to the user space.

[0047] Here, by modifying the random heap address in the kernel space in the user space, the tester does not need to re-search the address every time the system starts, and can simulate the difference in memory layout by modifying the heap address, making it easier to find potential problems and reducing the complexity of debugging.

[0048] In the above-mentioned randomized heap address tracking and modification method and system of the ELF program based on eBPF disclosed in the present invention, the random heap address generated by the target function during the execution of the ELF program can be tracked in real time in the kernel space through the method based on eBPF, avoiding the tedious manual tracking of memory addresses in traditional methods, reducing the complexity and time cost of debugging, and greatly improving the efficiency of developers in debugging and analyzing memory layout. Using this method, the random heap address can be dynamically replaced by the eBPF program, which can avoid the trouble of re-finding the address every time debugging, significantly simplifying the debugging process, saving debugging time and energy. By modifying the heap address, the layout of the heap can be dynamically adjusted according to specific needs to ensure that different program instances run under different memory layouts, avoid memory address conflicts, and improve the flexibility and security of the system.

[0049] In a possible implementation of step S101, determining in the user space based on preset information and uploading the eBPF program to the kernel space includes:

[0050] Determine in user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced;

[0051] When the eBPF program needs to be filtered, set the filtering conditions of the eBPF program, which include process ID and user ID;

[0052] When the eBPF program needs to replace the random heap address, the random address to be replaced is passed to the eBPF program;

[0053] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

[0054] In this embodiment, filtering may refer to an operation of enabling the eBPF program to monitor only a target process or a target user.

[0055] For example, before the eBPF program is uploaded to the kernel space, the user ID is set to 3 in the eBPF program, so that the eBPF program only tracks the user process with user ID = 3 in the kernel space and skips other user processes that do not meet the user ID = 3.

[0056] In a possible implementation, when an eBPF program needs to be filtered, setting the filtering conditions of the eBPF program may include:

[0057] When it is determined that the eBPF program needs to be filtered based on user needs, the process ID and the user ID are set to positive numbers in the filtering conditions of the eBPF program.

[0058] Here, when it is determined that the eBPF program does not need to be filtered, the process ID and user ID can be defaulted to -1, which means that the heap addresses of all processes and users will be tracked by the eBPF program.

[0059] In a possible implementation, based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call, which may include:

[0060] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the eBPF program is configured in the user space. After the configuration is completed, the eBPF program is uploaded to the kernel space through the system call bpf().

[0061] In the above-mentioned ELF program randomized heap address tracking and modification method and system based on eBPF disclosed in the present invention, through the eBPF program, it is possible to flexibly control whether to track and modify the heap address of a specific process, so that the user can decide whether to filter the process and whether to modify the heap address according to their own needs, thereby increasing the flexibility and efficiency of debugging, testing and security analysis. Through filtering conditions based on process ID and user ID, users can accurately select processes that need to monitor and modify the heap address, thereby avoiding indiscriminate operations on all processes, reducing the consumption of system resources, and improving the execution efficiency of the program.

[0062] In a possible implementation manner of the above embodiment, the preset tracing mechanism is Kretprobe, and the target function is the arch_randomize_brk function.

[0063] In this embodiment, Kretprobe can be a tracking point, which is a probe mechanism in eBPF technology. Kretprobe can allow users to set tracking points at the return point of the kernel function, so that Kretprobe is triggered when the kernel function is executed and ready to return, and the return value of the function is obtained. In addition, Kretprobe can also support users to modify the return value of the function.

[0064] Furthermore, the arch_randomize_brk function may be a key function for implementing ASLR in the LINUX kernel space, which is called when the process allocates memory and generates and returns a randomized heap address through a random number generator.

[0065] In a possible implementation, Kretprobe is triggered when the arch_randomize_brk function is executed and returns a random heap address, and the return value of the function (ie, the random heap address) is obtained.

[0066] As an example, Figure 2 As shown, Figure 2 The figure is a schematic diagram of the rch_randomize_brk function call flow of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure, wherein:

[0067] When the user enters a command in the command line, the operating system needs to start the corresponding program to execute the command; the kernel space executes the execve system call, traverses the configured executable program loader list, calls the load_binary method, and loads the executable program corresponding to the command; when the executable program is in ELF format, the binfmt_elf module is called to handle the loading process of the executable program; the load_elf_binary method is used in the binfmt_elf module to parse the ELF program and load it into the memory; during the loading process of the ELF program, the kernel space calls the arch_randomize_brk function to randomize the heap address.

[0068] In the above-mentioned ELF program randomized heap address tracking and modification method and system based on eBPF disclosed in the present invention, by combining the eBPF program with Kretprobe, developers can accurately obtain the random heap address after the target function is executed, so that the heap address can be tracked, analyzed and modified flexibly. By monitoring the return value of the arch_randomize_brk function through Kretprobe, security researchers can accurately capture the randomization process of the heap address, analyze its effectiveness in attack prevention, and improve the security research efficiency of developers.

[0069] In a possible implementation of the above embodiment, the eBPF program is executed in the kernel space, and the random heap address returned when the ELF program calls the target function is obtained through a preset tracking mechanism in the eBPF program, and the random heap address is sent to the user space, which is implemented based on the following steps:

[0070] When a process with an ELF program in the kernel space calls the arch_randomize_brk function, the Kretprobe mounted on the arch_randomize_brk function is triggered, so that the eBPF program obtains the return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; the eBPF program obtains at least one of the target process ID, target user ID, process name or stack information according to the Kretprobe;

[0071] According to the target process ID and target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

[0072] In this embodiment, the eBPF program can also obtain the target process ID, target user ID, process name and stack information according to Kretprobe; the stack information can refer to data and context information related to the process stack. For example, the stack information can include but is not limited to: stack pointer, stack bottom and stack top.

[0073] In a possible implementation, determining whether the process satisfies the filtering condition of the eBPF program according to the target process ID and the target user ID, and if so, sending the return value of the process to the user space may include:

[0074] Determine whether the process ID and / or user ID in the filtering condition of the eBPF program is a positive number; when the process ID and / or user ID is a positive number, it indicates that the eBPF program has enabled filtering;

[0075] When the process ID is a positive number, when the process ID is equal to the target process ID, the return value of the process is sent to the user space;

[0076] When the user ID is a positive number, when the user ID is equal to the target user ID, the return value of the process is sent to the user space.

[0077] Among them, if the process ID is a positive number, it can be determined that the eBPF program has enabled process filtering. If the user ID is a positive number, it can be determined that the eBPF program has enabled user filtering. If both the process ID and the user ID are positive numbers, it can be determined that the eBPF program has enabled process filtering and user filtering.

[0078] Furthermore, when the process ID is a positive number and the process ID is equal to the target process ID, it is determined whether the user ID is a positive number; when the user ID is not a positive number, the return value of the process is sent to the user space.

[0079] When the user ID is a positive number, continue to determine whether the user ID is equal to the target user ID; when the user ID is equal to the target user ID, send the return value of the process to the user space; when the user ID is not equal to the target user ID, skip the current process.

[0080] Furthermore, when the process ID is a negative number, it is determined whether the user ID is a positive number; when the user ID is a negative number, the return value of the process is sent to the user space;

[0081] When the user ID is a positive number, continue to determine whether the user ID is equal to the target user ID; when the user ID is equal to the target user ID, send the return value of the process to the user space; when the user ID is not equal to the target user ID, skip the current process.

[0082] In the above-mentioned ELF program randomized heap address tracking and modification method and system based on eBPF disclosed in the present invention, by judging the positive and negative values ​​of the process ID and the user ID, the user can control whether to enable the filtering mechanism, and can also achieve more refined process screening by matching the process ID and the user ID at the same time, thereby improving the flexibility of the system. Through multi-level filtering logic, it can be ensured that only processes that meet both the process and user conditions will be processed, thereby achieving more efficient and accurate monitoring.

[0083] In one embodiment, please refer to Figure 3 , Figure 3 The present invention provides a schematic diagram of a return value acquisition process of an eBPF-based ELF program randomized heap address tracking and modification method, which includes the following steps:

[0084] Step S301, obtaining the PID and UID of the eBPF program;

[0085] Here, PID refers to the process ID and user ID in the filter conditions of the eBPF program;

[0086] Step S302, determine if PID>0? If yes, go to step S303, if not, go to step S302;

[0087] Here, by judging whether PID is greater than 0, it is determined whether the eBPF program has enabled process filtering in filtering;

[0088] Step S303, determine if PID = target PID? If so, go to step S304, if not, skip the current process and end the process;

[0089] Here, it is determined whether the target PID of the current process meets the filtering conditions;

[0090] Step S304, determine if UID>0? If yes, proceed to step S305, if not, proceed to step S306;

[0091] Here, by judging whether the UID is greater than 0, it is determined whether the eBPF program has enabled user filtering in filtering;

[0092] Step S305, determine if UID = target UID? If so, go to step S306, if not, skip the current process and end the process;

[0093] Step S306, sending the return value of the process to the user space;

[0094] Here, the return value of the current process is sent to the user space, and the return value includes a random heap address.

[0095] In one embodiment, please refer to Figure 4 , Figure 4 The following is a user space execution flow diagram of a method for randomizing heap address tracking and modification of an ELF program based on eBPF provided by an embodiment of the present disclosure, which includes the following steps:

[0096] Step S401, starting the user space;

[0097] Step S402, determine whether filtering is required; if so, proceed to step S403, if not, proceed to step S404;

[0098] Step S403, setting UID and / or PID;

[0099] Step S404, determine whether to modify the random heap address; if so, proceed to step S405, if not, proceed to step S406;

[0100] Step S405, setting the random heap address to be replaced;

[0101] Step S406, start and upload the eBPF program;

[0102] Step S407, receiving the return value of the kernel space.

[0103] In one embodiment, a tracking and modification system 500 is provided, and the tracking and modification system 500 corresponds to the randomized heap address tracking and modification method of the ELF program based on eBPF in the above embodiment. Figure 5 As shown, the tracking and modification system 500 includes an eBPF program determination module 501, a heap address tracking module 502 and a heap address modification module 503, wherein each functional module is described in detail as follows:

[0104] An eBPF program determination module 501 is used to determine and upload the eBPF program to the kernel space based on preset information in the user space;

[0105] The heap address tracking module 502 is used to execute the eBPF program in the kernel space, obtain the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is used to generate and return the random heap address;

[0106] The heap address modification module 503 is used to modify the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program when the kernel space obtains the random address to be replaced uploaded by the user space.

[0107] In one embodiment, the eBPF program determination module 501 is used to determine in the user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced;

[0108] When the eBPF program needs to be filtered, setting filtering conditions for the eBPF program, wherein the filtering conditions include a process ID and a user ID;

[0109] When the eBPF program needs to replace the random heap address, the random address to be replaced is passed to the eBPF program;

[0110] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

[0111] In one embodiment, the preset tracing mechanism is Kretprobe, and the target function is the arch_randomize_brk function.

[0112] In one embodiment, the heap address tracking module 502 is used to trigger the Kretprobe mounted on the arch_randomize_brk function when the process of the ELF program in the kernel space calls the arch_randomize_brk function, so that the eBPF program obtains the return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes the random heap address; the eBPF program obtains at least one of the target process ID, the target user ID, the process name or the stack information according to the Kretprobe;

[0113] According to the target process ID and target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

[0114] In one embodiment, the heap address tracking module 502 is used to determine whether the process ID and / or the user ID in the filtering condition of the eBPF program is a positive number; when the process ID and / or the user ID is a positive number, it indicates that the eBPF program has enabled filtering;

[0115] When the process ID is a positive number, when the process ID is equal to the target process ID, the return value of the process is sent to the user space;

[0116] When the user ID is a positive number, when the user ID is equal to the target user ID, the return value of the process is sent to the user space.

[0117] It should be noted that: the tracking and modification system provided in the above embodiment only uses the division of the above program modules as an example to illustrate when implementing the corresponding ELF program randomized heap address tracking and modification method based on eBPF. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the above system can be divided into different program modules to complete all or part of the above-described processing. In addition, the system provided in the above embodiment and the corresponding Figure 1 The embodiments of the method shown belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0118] The present disclosure also provides a computer device having the above Figure 5 The track modification system shown.

[0119] See also Figure 6 , Figure 6 is a schematic diagram of the structure of another tracking modification system provided by an embodiment of the present disclosure, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0120] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0121] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0122] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0124] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0125] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0126] The computer device also includes a communication interface for the computer device to communicate with other devices or a communication network.

[0127] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0128] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0129] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A randomized heap address tracking and modification method for ELF programs based on eBPF, characterized in that: The method comprises: Determine and upload the eBPF program to the kernel space based on preset information in the user space; Executing the eBPF program in the kernel space, obtaining a random heap address returned when the ELF program calls a target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return a random heap address; When the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program.

2. The method according to claim 1, characterized in that: Determining and uploading the eBPF program to the kernel space based on preset information in the user space includes: Determine in user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced; When the eBPF program needs to be filtered, setting filtering conditions for the eBPF program, wherein the filtering conditions include a process ID and a user ID; When the eBPF program needs to replace the random heap address, passing the random address to be replaced to the eBPF program; Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

3. The method according to claim 1, characterized in that The preset tracking mechanism is Kretprobe, and the target function is the arch_randomize_brk function.

4. The method according to any one of claims 2 to 3, characterized in that: Executing the eBPF program in the kernel space, obtaining the random heap address returned when the ELF program calls the target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space is implemented based on the following steps: When a process with an ELF program in the kernel space calls the arch_randomize_brk function, a Kretprobe mounted on the arch_randomize_brk function is triggered, so that the eBPF program obtains a return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; the eBPF program obtains at least one of a target process ID, a target user ID, a process name, or stack information according to the Kretprobe; According to the target process ID and the target user ID, determine whether the process meets the filtering condition of the eBPF program. If so, send the return value of the process to the user space.

5. The method according to claim 4, characterized in that The determining, according to the target process ID and the target user ID, whether the process satisfies the filtering condition of the eBPF program, and if so, sending the return value of the process to the user space includes: Determine whether the process ID and / or the user ID in the filtering condition of the eBPF program is a positive number; when the process ID and / or the user ID is a positive number, it indicates that the eBPF program has enabled filtering; When the process ID is a positive number, when the process ID is equal to the target process ID, the return value of the process is sent to the user space; In the case where the user ID is a positive number, when the user ID is equal to the target user ID, the return value of the process is sent to the user space.

6. A tracking and modification system, characterized in that: The tracking and modification system includes an eBPF program determination module, a heap address tracking module and a heap address modification module, wherein: An eBPF program determination module is used to determine and upload the eBPF program to the kernel space based on preset information in the user space; A heap address tracking module is used to execute the eBPF program in the kernel space, obtain the random heap address returned when the ELF program calls the target function through a preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is used to generate and return a random heap address; The heap address modification module is used to modify the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program when the kernel space obtains the random address to be replaced uploaded by the user space.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the randomized heap address tracking and modification method for ELF programs based on eBPF according to any one of claims 1 to 5.

8. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the randomized heap address tracking and modification method of an ELF program based on eBPF according to any one of claims 1 to 5.

Images