Full-system-state process identification method based on linkage of simulator and debugger

Abstract

The invention discloses a simulator and debugger linkage-based full-system-state process identification method, which comprises the following steps of: S1, constructing a new command get-process of qemu for performing a process identification function according to values of an IP (Internet Protocol) register and an SP (Service Provider) register; s2, setting an interaction module for completing information collection of the process; s3, constructing a full-system-state virtual machine mirror image of a simulated environment, wherein the full-system-state virtual machine mirror image comprises a gdbserver user state program; and S4, calling an interaction module to complete process identification. The method has the advantages of being simple in principle, simpler and more convenient to operate, easier to implement, better in compatibility and the like.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of computer system security, and particularly refers to a full-system process recognition method based on the linkage of an emulator and a debugger. Background Art

[0002] The process recognition technology in the system-level simulation environment is a method that uses a full-system emulator such as QEMU or Bochs to run the operating system, simulates hardware-level operations identical to the real environment, and performs process recognition on this basis.

[0003] Process recognition in the full-system simulation environment is of extremely high importance in the fields of information security, software testing, etc. That is: by identifying specified processes in the full-system simulation environment, the behaviors of malicious software (such as viruses, Trojans, etc.) can be detected and analyzed more effectively, the performance of software in different environments and configurations can be monitored more precisely, and potential problems and vulnerabilities of application software can be identified and located more easily. Currently, the process recognition technologies in the full-system simulation environment mainly include: ① Tracking based on the CPU execution sequence. By analyzing the instruction sequences executed by each process, specified processes can be identified from them. ② Monitoring based on memory access. Some processes will access specific memory areas. By monitoring memory access, specified processes can be identified. ③ Based on virtual machine introspection technology. By injecting a kernel module into the simulated environment, process recognition is performed when a process switch occurs in the kernel.

[0004] However, the following technical deficiencies exist in the existing process recognition technologies in the full-system simulation environment: 1. For the tracking method based on the CPU execution sequence, it is necessary to analyze the instruction execution sequences of all processes in the tracking system environment, which has a large overhead. 2. For the monitoring method based on memory access, it is necessary to track the access of processes to certain specific areas. However, in actual situations, it is very difficult to determine which memory areas the processes access. 3. For the method based on virtual machine introspection technology, it is necessary to inject a kernel module. However, in actual situations, it is very difficult to load the kernel module in different versions of the kernel. Summary of the Invention

[0005] The technical problem to be solved by the present invention is: aiming at the technical problems existing in the prior art, the present invention provides a full-system process recognition method based on the linkage of an emulator and a debugger, which has a simple principle, is more convenient to operate, is easier to implement, and has better compatibility.

[0006] To solve the above technical problems, the present invention adopts the following technical solutions: A full-system process recognition method based on the linkage of a simulator and a debugger, which includes: Step S1: Construct a new command get-process for qemu to perform the process recognition function according to the values of the IP and SP registers; Step S2: Set up an interaction module to complete the process information collection; Step S3: Construct a full-system virtual machine image of the simulated environment, and the full-system virtual machine image contains the gdbserver user-mode program; Step S4: Call the interaction module to complete the process recognition.

[0007] As a further improvement of the present invention: In step S2, the process information is passed to the qemu engine by calling get-process.

[0008] As a further improvement of the present invention: In step S2, the process information includes the values of the IP and SP registers.

[0009] As a further improvement of the present invention: In step S2, calling get-process to pass the process information to the qemu engine includes; (1) Connect to the remote gdbserver; gdb_session = connect_to_gdbserver(gdb_host, gdb_port) (2) Obtain the values of the IP and SP registers; registers = get_registers_value(gdb_session, ['ip','sp']) (3) Connect to the QMP port of QEMU; qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port) (4) Construct and send a QMP command; cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'],'SP': registers['sp']}} response = send_qmp_command(qmp_socket, cmd).

[0010] As a further improvement of the present invention: in step S3, use qemu generated in step S1 to start the virtual machine, and start gdbserver to attach to the specified process.

[0011] As a further improvement of the present invention: in step S3, use the ubuntu image. After starting with qemu generated in step S1, the user-mode program of gdbserver already exists in the image.

[0012] As a further improvement of the present invention: in step S3, for the image without the user-mode program of gdbserver, upload gdbserver into the image through tools such as wget and scp; then, execute the command to attach gdbserver to the httpd process.

[0013] As a further improvement of the present invention: in step S1, use the QMP framework owned by qemu to get-process <ip> <sp>Commands are added to the system, and the get-process(IP, SP) includes: (1) get-process <ip> <sp>Command: Record the IP into the system, denoted as IP_STORE; Record the SP into the system, denoted as SP_STORE; (2)Logic of process identification during the execution of basic blocks in qemu: process-identify() CPU_IP, CPU_SP = IP and SP values of the current process's CPU; If(CPU_IP = IP_STORE && CPU_SP = SP_STORE) The current process is identified as the required process.

[0014] As a further improvement of the present invention: The interaction module includes a gdb module and a qmp communication module. The interaction module is used to cooperate with the qemu full-system simulation environment, which includes: an application layer, a kernel layer, and a qemu emulator; within the application layer, there are sslvpnd application, gdbserver application, and telnetd application, and an attach operation is performed between the gdbserver application and the telnetd application.

[0015] As a further improvement of the present invention: A connection operation and IP and SP reading operations are performed between the gdbserver application in the qemu full-system simulation environment and the gdb module of the interaction module, and the qemu emulator in the qemu full-system simulation environment is used to read the get-process command in the qmp communication module of the interaction module.

[0016] Compared with the prior art, the advantages of the present invention are: The full-system state process identification method based on the linkage of the emulator and the debugger of the present invention has a simple principle, more convenient operation, easier implementation, and better compatibility. The present invention constructs a new command get-process in qemu and performs the process identification function according to the values of the IP and SP registers; at the same time, an interaction module is set up to complete the information collection of the process; further, a full-system state virtual machine image of the simulated environment is constructed, which can directly call the interaction module to complete the process identification. Description of the Drawings

[0017] Figure 1 It is a schematic diagram of the working principle in a specific embodiment of the present invention.

[0018] Figure 2 It is a schematic diagram of the principle of the complete system topology structure built in a specific embodiment of the present invention.

[0019] Figure 3 is the get - process in the specific embodiment of the present invention <ip> <sp>The code added to the system by the command.

[0020] Figure 4 In the specific implementation of the present invention, it is the code that calls get - process to transfer the process information to the qemu engine.

[0021] Figure 5 In the specific implementation of the present invention, it is the command to execute attaching gdbserver to the httpd process. Detailed implementation manner

[0022] The present invention will be further described in detail below in conjunction with the accompanying drawings of the specification and specific embodiments.

[0023] As Figure 1 shown, the present invention discloses a full - system - state process recognition method based on the linkage of an emulator and a debugger, which includes: Step S1: Construct a new command get - process of qemu to complete the process recognition function according to the values of the IP and SP registers; Among them, qemu (Quick Emulator) is a hardware virtualization and emulator tool that allows users to run operating systems or programs with different architectures on a physical host; it can be used as a system emulator (simulating the entire computer) or as a user - mode emulator (running a single cross - architecture program).

[0024] Step S2: Set up an interaction module to complete the collection of process information; In a specific application example, the present invention further transfers the process information to the qemu engine by calling get - process; The process information includes the values of the IP and SP registers; Step S3: Construct a full - system - state virtual machine image of the simulated environment, and the image contains the gdbserver user - state program; Start the virtual machine with the modified qemu, and then start gdbserver to attach to the specified process; Among them, gdbserver is a component of the GNU debugger (GDB) that allows remote debugging of target programs; it runs on the target machine (or simulated environment) and communicates with the GDB debugger on the host, enabling developers to debug programs running on different devices (such as embedded systems, virtual machines, or remote servers).

[0025] Step S4: Call the interaction module to complete the process recognition.

[0026] As can be seen from the above, by modifying QEMU, the present invention enables the identification of a specified process in a full-system emulation environment through the values of the IP and SP registers. After adopting the method of the present invention, it has the characteristics of easy implementation and good compatibility.

[0027] After adopting the above technical solution of the present invention, a complete system can be constructed, and its overall structure is as Figure 2 shown, including a QEMU full-system emulation environment and an interaction module; wherein, the QEMU full-system emulation environment includes: an application layer, a kernel layer, and a QEMU emulator; within the application layer, there are included an sslvpnd application, a gdbserver application, and a telnetd application, and an attach operation is performed between the gdbserver application and the telnetd application. The interaction module includes a gdb module and a QMP communication module. A connection operation and IP and SP reading operations are performed between the gdbserver application in the QEMU full-system emulation environment and the gdb module of the interaction module, and the QEMU emulator in the QEMU full-system emulation environment is used to read the get-process command of the QMP communication module in the interaction module.

[0028] In a specific application example, the present invention takes the ubuntu image and the specified process httpd as an example to further describe in detail the specific implementation manner of the present invention.

[0029] Step S100: Construct a new command get-process of QEMU to complete the process identification function according to the values of the IP and SP registers.

[0030] In this embodiment, the present invention uses the QMP framework owned by QEMU to make get-process <ip> <sp>The command is added to the system, see Figure 3 , and its implementation pseudocode is: get-process(IP, SP), which includes: (1) get-process <ip> <sp>Command: Record the IP into the system, denoted as IP_STORE; Record the SP into the system, denoted as SP_STORE; (2)Logic of process identification during the execution of basic blocks in qemu: process-identify() CPU_IP, CPU_SP = IP and SP values of the current process's CPU; If(CPU_IP = IP_STORE && CPU_SP = SP_STORE) The current process is identified as the required process; Step S200: Set up an interaction module to complete the collection of process information, and then pass the process information (values of IP and SP registers) to the qemu engine by calling get-process; In this embodiment, referring to Figure 4 , the present invention gives an implementation pseudocode, including: (1)Connect to the remote gdbserver; gdb_session = connect_to_gdbserver(gdb_host, gdb_port) (2)Obtain the values of IP and SP registers; registers = get_registers_value(gdb_session, ['ip','sp']) (3)Connect to the QMP port of QEMU; qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port) (4)Construct and send a QMP command; cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'], 'SP': registers['sp']}} response = send_qmp_command(qmp_socket, cmd); Step S300: Construct a full-system virtual machine image of the emulated environment; Among them, the full-system state virtual machine image contains the gdbserver user-mode program; start the virtual machine with the modified qemu, and then start gdbserver to attach to the httpd process (assuming the process ID is 4321).

[0031] Furthermore, taking the ubuntu image downloaded from the ubuntu official website as an example in the present invention, after starting with the modified qemu, the user-mode program of gdbserver already exists in the image.

[0032] For an image without the gdbserver user-mode program, the gdbserver can be uploaded into the image through tools such as wget and scp.

[0033] Next, execute the following command to attach gdbserver to the httpd process, where the listening port of gdbserver is specified as 1234, as shown in Figure 5 shown.

[0034] Step S400: Call the interaction module to complete the identification of the process, and the httpd process can be identified.

[0035] The above are only the preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions falling within the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those of ordinary skill in the art, several improvements and refinements made without departing from the principle of the present invention should be regarded as within the protection scope of the present invention.< / sp> < / ip> < / sp> < / ip> < / sp> < / ip> < / sp> < / ip> < / sp> < / ip>

Claims

1. A full-system state process recognition method based on the linkage of a simulator and a debugger, characterized in that It includes: Step S1: Construct a new qemu command 'get-process' to perform process identification based on the values of IP and SP registers; Step S2: Set up an interaction module to complete the collection of process information; Step S3: Construct a full-system virtual machine image for the emulated environment, where the full-system virtual machine image contains the gdbserver user-mode program; Step S4: Call the interaction module to complete the process identification.

2. The method for identifying all-system-state processes based on the linkage of a simulator and a debugger according to claim 1, wherein In step S2, the process information is passed to the qemu engine by calling 'get-process'.

3. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to claim 2, wherein In step S2, the process information includes the values of IP and SP registers.

4. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to claim 2, wherein In step S2, calling 'get-process' to pass the process information to the qemu engine includes: (1) Connect to the remote gdbserver; gdb_session = connect_to_gdbserver(gdb_host, gdb_port) (2) Obtain the values of IP and SP registers; registers = get_registers_value(gdb_session, ['ip','sp']) (3) Connect to the QMP port of QEMU; qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port) (4) Construct and send a QMP command; cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'], 'SP': registers['sp']}} response = send_qmp_command(qmp_socket, cmd).

5. The method for identifying a full-system state process based on the linkage of a simulator and a debugger according to any one of claims 1-4, characterized in that, In step S3, use the qemu generated in step S1 to start the virtual machine, and start gdbserver to attach to the specified process.

6. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to claim 5, wherein In step S3, when using the ubuntu image and starting it with the qemu generated in step S1, the user-mode program of gdbserver already exists in the image.

7. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to claim 6, wherein In step S3, for an image without the user-mode program of gdbserver, upload gdbserver to the image through tools such as wget or scp; then, execute a command to attach gdbserver to the httpd process.

8. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to any one of claims 1-4, characterized in that In the step S1, get-process is obtained through the QMP framework inherent in qemu <ip> <sp>The command is added to the system, the get-process <ip> <sp>It includes: < / sp> < / ip> < / sp> < / ip> (1)get-process <ip> <sp>Commands: < / sp> < / ip> Record the IP into the system, denoted as IP_STORE; Record the SP into the system, denoted as SP_STORE; (2) The logic of process identification during the execution of basic blocks in qemu: process-identify() CPU_IP, CPU_SP = the IP and SP values of the current process CPU; If(CPU_IP=IP_STORE && CPU_SP =SP_STORE) It is recognized that the current is the required process.

9. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to any one of claims 1-4, characterized in that The interaction module includes a gdb module and a qmp communication module. The interaction module is used to cooperate with the qemu full-system simulation environment, which includes an application layer, a kernel layer, and a qemu emulator. In the application layer, there are sslvpnd application, gdbserver application, and telnetd application. An attach operation is performed between the gdbserver application and the telnetd application.

10. The method for identifying a full-system state process based on the linkage between a simulator and a debugger according to claim 9, wherein A connection operation and IP and SP reading operations are performed between the gdbserver application in the qemu full-system simulation environment and the gdb module of the interaction module. The qemu emulator in the qemu full-system simulation environment is used to read the get-process command in the qmp communication module of the interaction module.

Images