A method and system for tracking and modifying randomized heap addresses of ELF programs based on eBPF

Abstract

The present disclosure relates to the technical field of operating system kernel monitoring, and discloses a method and system for tracking and modifying the randomized heap address of an ELF program based on eBPF. The method includes: determining and uploading the eBPF program to the kernel space in the user space; executing the eBPF program in the kernel space, obtaining the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; when the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address is modified to the random address to be replaced through the eBPF program. In the method provided in the embodiment of the present disclosure, the random heap address generated by the target function of the ELF program can be tracked in real time in the kernel space through the eBPF method, which reduces the complexity and time cost of debugging and greatly improves the efficiency of developers in debugging and analyzing memory layout.

Description

Technical Field

[0001] The present disclosure relates to the technical field of operating system kernel monitoring, and in particular to a method and system for tracking and modifying randomized heap addresses of ELF programs based on eBPF. Background Art

[0002] With the continuous development of information security, current operating systems have gradually adopted Address Space Layout Randomization (ASLR) technology to improve system security. ASLR technology can randomize the memory address of the process, making it difficult for attackers to predict the memory layout.

[0003] However, there's no effective way to track and modify the random addresses generated by ASLR, which increases the complexity and time required for debugging operating systems. Therefore, finding a way to track and modify the random addresses generated by ASLR to reduce the complexity and time required for debugging operating systems has become a pressing issue. Summary of the Invention

[0004] In view of this, the present disclosure provides a method and system for tracking and modifying the randomized heap address of ELF programs based on eBPF, so as to solve the problem of how to track and modify the random addresses generated by ASLR to reduce the complexity and time cost when debugging the operating system.

[0005] On the one hand, the present disclosure provides an eBPF-based ELF program randomized heap address tracking and modification method, the method comprising: determining and uploading an eBPF program to a kernel space based on preset information in a user space; executing the eBPF program in the kernel space, obtaining a random heap address returned when the ELF program calls a target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return a random heap address; when the kernel space obtains the random address to be replaced uploaded by the user space, modifying the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program.

[0006] On the other hand, the present disclosure also provides a tracking and modification system, which includes an eBPF program determination module, a heap address tracking module and a heap address modification module, wherein: the eBPF program determination module is used to determine and upload the eBPF program to the kernel space based on preset information in the user space; the heap address tracking module is used to execute the eBPF program in the kernel space, obtain the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is used to generate and return a random heap address; the heap address modification module is used to modify the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program when the kernel space obtains the random address to be replaced uploaded by the user space.

[0007] On the other hand, the present disclosure further provides a computer-readable storage medium having computer instructions stored thereon, which are used to enable a computer to implement the above-mentioned eBPF-based ELF program randomized heap address tracking and modification method.

[0008] On the other hand, the present disclosure further provides a computer program product, including computer instructions, which are used to enable a computer to execute the above-mentioned eBPF-based ELF program randomized heap address tracking and modification method.

[0009] Through the eBPF-based ELF program randomized heap address tracking and modification method and system of the above-mentioned embodiments of the present invention, the random heap address generated by the target function during the execution of the ELF program can be tracked in real time in the kernel space through the eBPF-based method, avoiding the tedious manual tracking of memory addresses in traditional methods, reducing the complexity and time cost of debugging, and greatly improving the efficiency of developers in debugging and analyzing memory layout.

[0010] In addition, by dynamically modifying the random heap address returned when the ELF program is executed in kernel space, flexible memory management and debugging functions can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the following briefly introduces the drawings required for use in the specific embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0012] Figure 1 This is a flowchart of a method for randomizing heap address tracking and modification of ELF programs based on eBPF, provided by an embodiment of the present disclosure;

[0013] Figure 2 This is a schematic diagram of the rch_randomize_brk function call flow of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0014] Figure 3 This is a schematic diagram of a return value acquisition process of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0015] Figure 4 This is a user space execution flow diagram of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure;

[0016] Figure 5 is a structural diagram of a tracking and modification system provided by an embodiment of the present disclosure;

[0017] Figure 6 It is a structural diagram of another tracking and modification system provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] With the continuous development of information security, current operating systems have gradually adopted ASLR technology to improve system security. ASLR technology can randomize the memory address of the process, making it difficult for attackers to predict the memory layout.

[0019] However, there is no effective way to track and modify the random addresses generated by ASLR in related technologies, which may lead to the following problems:

[0020] 1. Because memory addresses change randomly each time a program is loaded, developers cannot stably track and locate specific memory locations during debugging. This is especially true when setting watchpoints or breakpoints. Developers must find new addresses each time the program is started, increasing debugging complexity and time costs.

[0021] 2. During the automated testing process, it is impossible to stably test and verify specific memory addresses, resulting in low test case execution efficiency, which in turn affects the vulnerability repair and verification process and reduces the security of the operating system.

[0022] To solve the above problems, various embodiments of the present disclosure provide an eBPF-based ELF program randomized heap address tracking and modification method, the method comprising: determining and uploading an eBPF program to the kernel space based on preset information in the user space; executing the eBPF program in the kernel space, obtaining the random heap address returned when the ELF program calls a target function through a preset tracking mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return a random heap address; when the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program.

[0023] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present disclosure.

[0024] Please refer to Figure 1 , Figure 1 This is a flow chart of a method for randomizing heap address tracking and modification of an ELF program based on eBPF, provided by an embodiment of the present disclosure. The method is applied to a LINUX operating system. The method may include the following steps:

[0025] Step S101: Determine and upload the eBPF program to the kernel space based on preset information in the user space.

[0026] In this embodiment, the user space may refer to a memory area running outside the operating system, in which user applications and other non-core codes run.

[0027] Kernel space refers to the memory area of the core part of the operating system. Kernel code and drivers can run in the kernel space. The kernel space is responsible for managing system resources, such as process scheduling, memory management, and hardware device access.

[0028] Furthermore, the user space and the kernel space can interact through an operating system interface (such as a system call). Here, the system call can be a preset interface provided by the operating system, which allows a program in the user space to request the kernel space to perform an operation or service.

[0029] As an example, the functions of the system call may include but are not limited to: process management, memory management, file reading and writing. Among them, process management may include fork(), exit(), etc., and memory management may include malloc(), mmap(), etc.

[0030] Furthermore, an Extended Berkeley Packet Filter (eBPF) program defined in user space can be a non-invasive, high-performance tool executed in kernel space, allowing users to safely execute custom programs in kernel space. The functions of an eBPF program can include at least one of the following: event tracing, security monitoring, and dynamic instrumentation. The non-invasiveness of an eBPF program can mean that the eBPF program does not modify the kernel source code and does not require kernel recompilation.

[0031] In this embodiment, the eBPF program determined and uploaded in the user space based on preset information may function as dynamic instrumentation, that is, tracking and modifying the randomized heap address during process initialization.

[0032] In one possible implementation, the preset information of the eBPF program may refer to at least one configuration and / or parameter determined for the eBPF program in the user space, and the preset information may be customized by the user.

[0033] As an example, the preset information may include at least one of the following: filtering conditions, target function, and random address to be replaced; wherein, the target function may refer to the kernel function to be mounted by the eBPF program defined by the user. When the process is executed, the eBPF program can be mounted to the characteristic event point of the target function.

[0034] Furthermore, the eBPF program can be uploaded to the kernel space by loading it into the kernel space through the bpf() system call. After being uploaded to the kernel space, the eBPF program can reside in the kernel space until manually uninstalled by the user.

[0035] Step S102: Execute the eBPF program in the kernel space, obtain the random heap address returned when the ELF program calls the target function through the preset tracking mechanism in the eBPF program, and send the random heap address to the user space.

[0036] In this embodiment, the target function is used to generate and return a random heap address.

[0037] In one possible implementation, the eBPF program is mounted to the return point of the target function through a preset tracing mechanism. When the ELF program calls the target function and completes execution and is ready to return, the preset tracing mechanism triggers the eBPF program, allowing the eBPF program to obtain the return value of the target function (random heap address).

[0038] The Executable and Linkable Format (ELF) program may refer to a standard file format used in a LINUX system. An ELF file may contain executable code, data, a symbol table, and other contents of a program.

[0039] Furthermore, the random heap address can refer to the starting address of the heap memory area randomly assigned by the kernel space based on ASLR technology when the ELF program is executed. For example, for ELF program A, assuming there is no ASLR technology, the heap memory address may be fixed at 0x7fffb000, that is, 0x7fffb000 is assigned as the starting address of the heap memory of program A every time. When ASLR technology is used, the heap memory of program A is randomized each time it is started, and it may be 0x7fffb000 or 0x7fffc000, thereby improving the security of the Linux system.

[0040] In one possible implementation, the random heap address can be sent to the user space by storing the random heap address in the BPFMap in the kernel space and obtaining the random heap address through the bpf() system call in the user space.

[0041] Furthermore, after the user space obtains the random heap address space, the random heap address can be displayed in the user space, so that the tester can further analyze the memory layout of the LINUX system and perform debugging based on the random heap address space.

[0042] Step S103: When the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program.

[0043] In this embodiment, the random address to be replaced may be a fixed address preset by the user based on demand, or may be an address dynamically calculated according to preset conditions.

[0044] The method of uploading the random address to be replaced from the user space to the kernel space can be the above-mentioned BPF Map, or it can be other interaction mechanisms between the kernel space and the user space, which is not specifically limited here. For example, a system call can be used to update the random address to be replaced to the BPF hash table. The hash table can use the process ID or user ID as the key and store the random address to be replaced as the value. Among them, the process ID (Process Identifier, PID) can be a unique identifier assigned by the operating system to each running process, which is used to distinguish different processes. The user ID (User Identifier, UID) can be a unique identifier assigned by the operating system to each user, which is used to distinguish different user identities.

[0045] In one possible implementation, the random heap address returned by the ELF program when calling the target function is modified to the random address to be replaced by the eBPF program, which may include:

[0046] When the ELF program calls the target function, the eBPF program is triggered according to the preset tracing mechanism, so that the eBPF program obtains the returned random heap address, modifies the random heap address to the random address to be replaced, and sends the modified random address to be replaced to the user space.

[0047] Here, by modifying the random heap address in the kernel space in the user space, the tester does not need to re-search the address every time the system starts. The different memory layouts can be simulated by modifying the heap address, making it easier to find potential problems and reducing the complexity of debugging.

[0048] In the above-mentioned randomized heap address tracking and modification method and system of the ELF program based on eBPF disclosed in the present invention, the random heap address generated by the target function during the execution of the ELF program can be tracked in real time in the kernel space through the eBPF-based method, avoiding the tedious manual tracking of memory addresses in traditional methods, reducing the complexity and time cost of debugging, and greatly improving the efficiency of developers in debugging and analyzing memory layout. Using this method, the random heap address can be dynamically replaced by the eBPF program, which can avoid the trouble of having to re-search the address every time debugging is performed, significantly simplifying the debugging process and saving debugging time and energy. By modifying the heap address, the layout of the heap can be dynamically adjusted according to specific needs to ensure that different program instances run under different memory layouts, avoid memory address conflicts, and improve the flexibility and security of the system.

[0049] In a possible implementation of step S101, determining and uploading the eBPF program to the kernel space based on preset information in the user space includes:

[0050] Determine in user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced;

[0051] When the eBPF program needs to be filtered, set the filtering conditions of the eBPF program, which include process ID and user ID;

[0052] When the eBPF program needs to replace the random heap address, the random address to be replaced is passed to the eBPF program;

[0053] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

[0054] In this embodiment, filtering may refer to an operation of enabling the eBPF program to monitor only a target process or a target user.

[0055] For example, before the eBPF program is uploaded to the kernel space, the user ID is set to 3 in the eBPF program, so that the eBPF program only tracks the user process with user ID 3 in the kernel space and skips other user processes that do not meet the user ID 3.

[0056] In one possible implementation, when an eBPF program needs to be filtered, setting the filtering conditions for the eBPF program may include:

[0057] When it is determined that the eBPF program needs to be filtered based on user needs, the process ID and user ID are set to positive numbers in the filtering conditions of the eBPF program.

[0058] Here, when it is determined that the eBPF program does not need to be filtered, the process ID and user ID can be defaulted to -1, which means that the heap addresses of all processes and users will be tracked by the eBPF program.

[0059] In one possible implementation, based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call, which may include:

[0060] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the eBPF program is configured in the user space. After the configuration is completed, the eBPF program is uploaded to the kernel space through the system call bpf().

[0061] In the above-disclosed eBPF-based ELF program randomized heap address tracking and modification method and system, the eBPF program can flexibly control whether to track and modify the heap address of a specific process, allowing users to decide whether to filter processes and modify the heap address based on their needs, thereby increasing the flexibility and efficiency of debugging, testing, and security analysis. By using filtering conditions based on process ID and user ID, users can accurately select the processes that need to monitor and modify the heap address, thereby avoiding indiscriminate operations on all processes, reducing the consumption of system resources, and improving the execution efficiency of the program.

[0062] In a possible implementation of the above embodiment, the preset tracing mechanism is Kretprobe, and the target function is the arch_randomize_brk function.

[0063] In this embodiment, a Kretprobe is a tracepoint, a probe mechanism in eBPF technology. A Kretprobe allows users to set a tracepoint at the return point of a kernel function. This triggers the Kretprobe when the kernel function completes execution and is about to return, allowing the function's return value to be obtained. Furthermore, a Kretprobe allows users to modify the function's return value.

[0064] Furthermore, the arch_randomize_brk function may be a key function for implementing ASLR in the Linux kernel space. It is called when a process allocates memory and generates and returns a randomized heap address through a random number generator.

[0065] In one possible implementation, Kretprobe is triggered when the arch_randomize_brk function is executed and returns a random heap address, and the return value of the function (ie, the random heap address) is obtained.

[0066] As an example, Figure 2 As shown, Figure 2 The following is a schematic diagram of the rch_randomize_brk function call flow of an eBPF-based ELF program randomized heap address tracking and modification method provided by an embodiment of the present disclosure, wherein:

[0067] When a user enters a command in the command line, the operating system needs to start the corresponding program to execute the command; the kernel space executes the execve system call, traverses the configured executable program loader list, calls the load_binary method, and loads the executable program corresponding to the command; when the executable program is in ELF format, the binfmt_elf module is called to handle the loading process of the executable program; the load_elf_binary method is used in the binfmt_elf module to parse the ELF program and load it into memory; during the ELF program loading process, the kernel space calls the arch_randomize_brk function to randomize the heap address.

[0068] In the disclosed eBPF-based ELF program randomized heap address tracking and modification method and system, by combining the eBPF program with Kretprobe, developers can accurately obtain the randomized heap address after the target function executes, allowing for flexible tracking, analysis, and modification of the heap address. By monitoring the return value of the arch_randomize_brk function with Kretprobe, security researchers can accurately capture the heap address randomization process, analyze its effectiveness against attack defenses, and improve the efficiency of developers' security research.

[0069] In a possible implementation of the above embodiment, the eBPF program is executed in kernel space, and a preset tracing mechanism in the eBPF program is used to obtain a random heap address returned when the ELF program calls a target function. The random heap address is then sent to user space, which is implemented based on the following steps:

[0070] When a process with an ELF program in kernel space calls the arch_randomize_brk function, a Kretprobe mounted on the arch_randomize_brk function is triggered, so that the eBPF program obtains the return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; the eBPF program obtains at least one of the target process ID, target user ID, process name, or stack information according to the Kretprobe;

[0071] Based on the target process ID and target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

[0072] In this embodiment, the eBPF program can also obtain the target process ID, target user ID, process name, and stack information based on the Kretprobe. Stack information can refer to data and context information related to the process stack. For example, stack information can include, but is not limited to, the stack pointer, the bottom of the stack, and the top of the stack.

[0073] In one possible implementation, determining whether a process satisfies the eBPF program's filtering conditions based on the target process ID and the target user ID, and if so, sending the process's return value to user space, may include:

[0074] Determine whether the process ID and / or user ID in the filtering conditions of the eBPF program is a positive number; when the process ID and / or user ID is a positive number, it indicates that the eBPF program has enabled filtering;

[0075] If the process ID is positive, and the process ID is equal to the target process ID, the return value of the process is sent to the user space.

[0076] When the user ID is a positive number, if the user ID is equal to the target user ID, the return value of the process is sent to the user space.

[0077] Among them, if the process ID is a positive number, it can be determined that the eBPF program has process filtering enabled. If the user ID is a positive number, it can be determined that the eBPF program has user filtering enabled. If both the process ID and the user ID are positive numbers, it can be determined that the eBPF program has both process filtering and user filtering enabled.

[0078] Furthermore, if the process ID is a positive number and the process ID is equal to the target process ID, it is determined whether the user ID is a positive number; when the user ID is not a positive number, the return value of the process is sent to the user space.

[0079] When the user ID is a positive number, continue to determine whether the user ID is equal to the target user ID; when the user ID is equal to the target user ID, send the return value of the process to the user space; when the user ID is not equal to the target user ID, skip the current process.

[0080] Furthermore, when the process ID is negative, it is determined whether the user ID is positive; when the user ID is negative, the return value of the process is sent to the user space;

[0081] When the user ID is a positive number, continue to determine whether the user ID is equal to the target user ID; when the user ID is equal to the target user ID, send the return value of the process to the user space; when the user ID is not equal to the target user ID, skip the current process.

[0082] In the eBPF-based ELF program randomized heap address tracking and modification method and system disclosed above, by determining the positive and negative values of the process ID and user ID, the user can control whether to enable the filtering mechanism. Simultaneously matching the process ID and user ID can also achieve more refined process screening, improving system flexibility. Multi-level filtering logic ensures that only processes that meet both process and user conditions are processed, thereby achieving more efficient and accurate monitoring.

[0083] In one embodiment, please refer to Figure 3 , Figure 3 The following is a flow chart of obtaining the return value of a method for randomizing heap address tracking and modifying an ELF program based on eBPF, provided by an embodiment of the present disclosure, which includes the following steps:

[0084] Step S301, obtain the PID and UID of the eBPF program;

[0085] Here, PID refers to the process ID and user ID in the filter conditions of the eBPF program;

[0086] Step S302: Check if PID>0? If yes, go to step S303; if not, go to step S302.

[0087] Here, by judging whether the PID is greater than 0, it is determined whether the eBPF program has enabled process filtering in the filtering;

[0088] Step S303: Check if PID = target PID. If so, proceed to step S304; if not, skip the current process and end the process.

[0089] Here, it is determined whether the target PID of the current process meets the filtering conditions;

[0090] Step S304: Check if UID>0? If yes, go to step S305; if not, go to step S306;

[0091] Here, by judging whether the UID is greater than 0, it is determined whether the eBPF program has enabled user filtering in the filtering;

[0092] Step S305: Check if UID = target UID? If so, go to step S306; if not, skip the current process and end the process;

[0093] Step S306, sending the return value of the process to the user space;

[0094] Here, the return value of the current process is sent to the user space, and the return value includes a random heap address.

[0095] In one embodiment, please refer to Figure 4 , Figure 4 The following is a user space execution flow diagram of a method for randomizing heap address tracking and modification of an ELF program based on eBPF provided by an embodiment of the present disclosure, which includes the following steps:

[0096] Step S401, starting the user space;

[0097] Step S402, determine whether filtering is required; if so, proceed to step S403, if not, proceed to step S404;

[0098] Step S403, setting UID and / or PID;

[0099] Step S404, determine whether to modify the random heap address; if so, proceed to step S405, if not, proceed to step S406;

[0100] Step S405, setting the random heap address to be replaced;

[0101] Step S406: Start and upload the eBPF program;

[0102] Step S407: Receive the return value from the kernel space.

[0103] In one embodiment, a tracking and modification system 500 is provided, which corresponds to the randomized heap address tracking and modification method of the ELF program based on eBPF in the above embodiment. Figure 5 As shown, the tracking and modification system 500 includes an eBPF program determination module 501, a heap address tracking module 502, and a heap address modification module 503. Each functional module is described in detail as follows:

[0104] An eBPF program determination module 501 is configured to determine and upload an eBPF program to a kernel space based on preset information in a user space;

[0105] The heap address tracking module 502 is used to execute the eBPF program in the kernel space, obtain the random heap address returned by the ELF program when calling the target function through the preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is used to generate and return the random heap address;

[0106] The heap address modification module 503 is used to modify the random heap address returned when the ELF program calls the target function to the random address to be replaced through the eBPF program when the kernel space obtains the random address to be replaced uploaded by the user space.

[0107] In one embodiment, the eBPF program determination module 501 is configured to determine in user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced;

[0108] When the eBPF program needs to be filtered, setting the filtering conditions of the eBPF program, wherein the filtering conditions include a process ID and a user ID;

[0109] When the eBPF program needs to replace the random heap address, the random address to be replaced is passed to the eBPF program;

[0110] Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

[0111] In one embodiment, the preset tracing mechanism is Kretprobe, and the target function is the arch_randomize_brk function.

[0112] In one embodiment, the heap address tracking module 502 is configured to trigger a Kretprobe mounted on the arch_randomize_brk function when a process containing an ELF program in kernel space calls the arch_randomize_brk function, so that the eBPF program obtains a return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; and the eBPF program obtains at least one of a target process ID, a target user ID, a process name, or stack information according to the Kretprobe.

[0113] Based on the target process ID and target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

[0114] In one embodiment, the heap address tracking module 502 is configured to determine whether the process ID and / or user ID in the filtering condition of the eBPF program is a positive number; when the process ID and / or user ID is a positive number, it indicates that filtering is enabled for the eBPF program;

[0115] If the process ID is positive, and the process ID is equal to the target process ID, the return value of the process is sent to the user space.

[0116] When the user ID is a positive number, if the user ID is equal to the target user ID, the return value of the process is sent to the user space.

[0117] It should be noted that: the tracking and modification system provided in the above embodiment only uses the division of the above program modules as an example to illustrate when implementing the corresponding eBPF-based ELF program randomized heap address tracking and modification method. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the above system can be divided into different program modules to complete all or part of the above-described processing. In addition, the system provided in the above embodiment and the corresponding Figure 1 The embodiments of the method shown belong to the same concept, and their specific implementation processes are detailed in the method embodiments, which will not be repeated here.

[0118] The present disclosure also provides a computer device having the above Figure 5 The track modification system shown.

[0119] See also Figure 6 , Figure 6 is a structural diagram of another tracking and modification system provided by an embodiment of the present disclosure, such as Figure 6 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0120] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0121] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.

[0122] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0124] The computer device further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The bus connection is taken as an example.

[0125] The input device 30 can receive input digital or character information and generate key signal input related to user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a trackpad, a touch pad, an indicator stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 can include a display device, an auxiliary lighting device (e.g., an LED), and a tactile feedback device (e.g., a vibration motor). The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display, and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0126] The computer device further includes a communication interface for the computer device to communicate with other devices or a communication network.

[0127] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0128] A portion of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes but is not limited to a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0129] Although the embodiments of the present disclosure have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A randomized heap address tracking and modification method for ELF programs based on eBPF, characterized in that: The method comprises: Determine and upload the eBPF program to the kernel space based on preset information in user space; Executing the eBPF program in the kernel space, obtaining a random heap address returned by the ELF program when calling a target function through a preset tracing mechanism in the eBPF program, and sending the random heap address to the user space; the target function is used to generate and return a random heap address; wherein the preset tracing mechanism is Kretprobe, and the target function is the arch_randomize_brk function; When the kernel space obtains the random address to be replaced uploaded by the user space, the random heap address returned when the ELF program calls the target function is modified to the random address to be replaced through the eBPF program; The eBPF program is executed in the kernel space, and a random heap address returned by the ELF program when calling a target function is obtained through a preset tracing mechanism in the eBPF program, and the random heap address is sent to the user space; the target function is used to generate and return a random heap address, including: when a process with an ELF program in the kernel space calls the arch_randomize_brk function, triggering a Kretprobe mounted on the arch_randomize_brk function, so that the eBPF program obtains a return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; and the eBPF program obtains at least one of a target process ID, a target user ID, a process name, or stack information according to the Kretprobe; According to the target process ID and the target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

2. The method according to claim 1, characterized in that Determining and uploading the eBPF program to the kernel space based on preset information in the user space includes: Determine in user space whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced; When the eBPF program needs to be filtered, setting the filtering conditions of the eBPF program, wherein the filtering conditions include a process ID and a user ID; When the eBPF program needs to replace the random heap address, passing the random address to be replaced to the eBPF program; Based on whether the eBPF program needs to be filtered and whether the random heap address needs to be replaced, the configuration information of the eBPF program is determined, and the eBPF program is uploaded to the kernel space through a system call.

3. The method according to claim 1, characterized in that The determining, based on the target process ID and the target user ID, whether the process satisfies the filtering condition of the eBPF program, and if so, sending the return value of the process to the user space includes: Determine whether the process ID and / or the user ID in the filtering condition of the eBPF program is a positive number; when the process ID and / or the user ID is a positive number, it indicates that filtering is enabled for the eBPF program; When the process ID is a positive number, when the process ID is equal to the target process ID, the return value of the process is sent to the user space; In the case where the user ID is a positive number, when the user ID is equal to the target user ID, the return value of the process is sent to the user space.

4. A tracking and modification system, characterized in that: The tracking and modification system includes an eBPF program determination module, a heap address tracking module, and a heap address modification module, wherein: The eBPF program determination module is used to determine and upload the eBPF program to the kernel space based on preset information in the user space; a heap address tracking module, configured to execute the eBPF program in the kernel space, obtain a random heap address returned by the ELF program when calling a target function through a preset tracking mechanism in the eBPF program, and send the random heap address to the user space; the target function is configured to generate and return a random heap address; wherein the preset tracking mechanism is Kretprobe, and the target function is the arch_randomize_brk function; a heap address modification module, configured to modify, through the eBPF program, the random heap address returned when the ELF program calls the target function to the random address to be replaced when the kernel space obtains the random address to be replaced uploaded by the user space; The heap address tracking module is specifically configured to trigger a Kretprobe mounted on the arch_randomize_brk function when a process containing an ELF program in the kernel space calls the arch_randomize_brk function, so that the eBPF program obtains a return value of the process calling the arch_randomize_brk function according to the Kretprobe; the return value includes a random heap address; and the eBPF program obtains at least one of a target process ID, a target user ID, a process name, or stack information according to the Kretprobe. According to the target process ID and the target user ID, determine whether the process meets the filtering conditions of the eBPF program. If so, send the return value of the process to the user space.

5. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the eBPF-based ELF program randomized heap address tracking and modification method according to any one of claims 1 to 3.

6. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the eBPF-based ELF program randomized heap address tracking and modification method according to any one of claims 1 to 3.

Images