A system-wide process identification method based on simulator and debugger linkage

Abstract

The present invention discloses a system-wide process identification method based on the linkage of a simulator and a debugger. The method comprises: step S1: constructing a new qemu command get-process to perform process identification based on the values ​​of the IP and SP registers; step S2: setting an interaction module to complete process information collection; step S3: constructing a system-wide virtual machine image of the simulated environment, wherein the system-wide virtual machine image includes the gdbserver user-mode program; and step S4: calling the interaction module to complete process identification. The present invention has the advantages of simple principle, easier operation, greater ease of implementation, and better compatibility.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of computer system security, and in particular to a system-wide process identification method based on the linkage of a simulator and a debugger. Background Art

[0002] Process identification technology in a system-state simulation environment uses a full-system simulator such as QEMU or Bochs to run the operating system, simulate the same hardware-level operations as the real environment, and perform process identification based on this method.

[0003] Process identification in a full-system simulation environment is extremely important in fields such as information security and software testing. That is, by identifying specified processes in a full-system simulation environment, the behavior of malware (such as viruses and Trojans) can be more effectively detected and analyzed, the performance of software in different environments and configurations can be more accurately monitored, and potential problems and vulnerabilities in application software can be more easily identified and located.

[0004] At present, the process identification technology in the full system simulation environment mainly includes:

[0005] ① Based on CPU execution sequence tracking, by analyzing the instruction sequence executed by each process, the specified process can be identified;

[0006] ② Based on memory access monitoring, some processes will access specific memory areas. By monitoring memory access, the specified process can be identified;

[0007] ③ Based on virtual machine introspection technology, by injecting kernel modules into the simulated environment, process identification is performed when process switching occurs in the kernel.

[0008] However, the existing process identification technology in the full system state simulation environment has the following technical deficiencies:

[0009] 1. The CPU execution sequence-based tracking method requires analyzing and tracking the instruction execution sequences of all processes in the system environment, which has a large overhead;

[0010] 2. Memory access-based monitoring methods require tracking the process's access to certain specific areas. However, in practice, it is difficult to determine which memory areas a process has accessed.

[0011] 3. The method based on virtual machine introspection technology requires the injection of kernel modules. However, in practice, kernel modules are difficult to load in kernels of different versions. Summary of the Invention

[0012] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a full-system process identification method based on the linkage of simulator and debugger, which has simple principle, simpler operation, easier implementation and better compatibility.

[0013] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0014] A system-wide process identification method based on simulator and debugger linkage, comprising:

[0015] Step S1: construct a new qemu command get-process to perform process identification according to the values ​​of the IP and SP registers;

[0016] Step S2: Setting up an interactive module to complete the process information collection;

[0017] Step S3: constructing a full system virtual machine image of the simulated environment, wherein the full system virtual machine image includes the gdbserver user state program;

[0018] Step S4: calling the interaction module to complete the process identification.

[0019] As a further improvement of the present invention: in step S2, the process information is passed to the qemu engine by calling get-process.

[0020] As a further improvement of the present invention: in step S2, the process information includes the values ​​of the IP and SP registers.

[0021] As a further improvement of the present invention: in step S2, calling get-process to pass the process information to the qemu engine includes:

[0022] (1) Connect to the remote gdbserver;

[0023] gdb_session = connect_to_gdbserver(gdb_host, gdb_port)

[0024] (2) Get the values ​​of IP and SP registers;

[0025] registers = get_registers_value(gdb_session, ['ip', 'sp'])

[0026] (3) Connect to QEMU's QMP port;

[0027] qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port)

[0028] (4) Construct and send QMP commands;

[0029] cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'],'SP': registers['sp']}}

[0030] response = send_qmp_command(qmp_socket, cmd).

[0031] As a further improvement of the present invention: in step S3, the virtual machine is started using the qemu generated in step S1, and gdbserver is started to attach to the specified process.

[0032] As a further improvement of the present invention: in step S3, after using the ubuntu image and starting with the qemu generated in step S1, the user-mode program of gdbserver already exists in the image.

[0033] As a further improvement of the present invention: in step S3, for the image of the user-mode program in which gdbserver does not exist, gdbserver is uploaded to the image through tools such as wget and scp; then, a command is executed to attach gdbserver to the httpd process.

[0034] As a further improvement of the present invention: in step S1, get-process <ip> <sp>The command is added to the system, the get-process(IP, SP) includes:

[0035] (1) get-process <ip> <sp>Order:

[0036] Record the IP into the system as IP_STORE;

[0037] Record SP into the system as SP_STORE;

[0038] (2) The logic of process identification during the execution of qemu's basic blocks:

[0039] process-identify()

[0040] CPU_IP, CPU_SP = the IP and SP values ​​of the current process CPU;

[0041] If(CPU_IP=IP_STORE&&CPU_SP =SP_STORE)

[0042] Identify that the current process is the desired process.

[0043] As a further improvement of the present invention: the interaction module includes a gdb module and a qmp communication module, the interaction module is used to cooperate with the qemu full-system simulation environment, the qemu full-system simulation environment includes: an application layer, a kernel layer and a qemu simulator; the application layer includes an sslvpnd application, a gdbserver application and a telnetd application, and an attach operation is performed between the gdbserver application and the telnetd application.

[0044] As a further improvement of the present invention: the gdbserver application in the qemu full-system simulation environment performs connection operations and IP and SP reading operations with the gdb module of the interactive module, and the qemu simulator in the qemu full-system simulation environment is used to read the get-process command of the qmp communication module in the interactive module.

[0045] Compared with the prior art, the advantages of the present invention are:

[0046] The system-wide process identification method based on the linkage of a simulator and a debugger of the present invention has a simple principle, is easier to operate, is easier to implement, and has better compatibility. The present invention constructs a new command get-process of qemu and performs a process identification function according to the values ​​of the IP and SP registers; at the same time, an interaction module is set to complete process information collection; further, a system-wide virtual machine image of the simulated environment is constructed, and the interaction module can be directly called to complete process identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a schematic diagram of the working principle of the present invention in a specific embodiment.

[0048] Figure 2 It is a schematic diagram of the principle of the complete system topology structure constructed in a specific embodiment of the present invention.

[0049] Figure 3 In the specific embodiment of the present invention, get-process <ip> <sp>Commands are added to the system code.

[0050] Figure 4 This is the code for calling get-process in a specific implementation of the present invention to pass process information to the qemu engine.

[0051] Figure 5 In a specific implementation of the present invention, the command for attaching gdbserver to the httpd process is executed. DETAILED DESCRIPTION

[0052] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] like Figure 1 As shown, the present invention discloses a system-wide process identification method based on the linkage of a simulator and a debugger, which includes:

[0054] Step S1: construct a new qemu command get-process to complete the process identification function according to the values ​​of the IP and SP registers;

[0055] Among them, qemu (Quick Emulator) is a hardware virtualization and emulator tool that allows users to run operating systems or programs of different architectures on a physical host; it can be used as a system emulator (simulating the entire computer) or as a user mode emulator (running a single program across architectures).

[0056] Step S2: Setting up an interactive module to complete the process information collection;

[0057] In a specific application example, the present invention further passes the process information to the qemu engine by calling get-process;

[0058] The process information includes the values ​​of IP and SP registers;

[0059] Step S3: construct a full system-state virtual machine image of the simulated environment, which contains the gdbserver user-state program;

[0060] Start the virtual machine with the modified qemu, and then start gdbserver to attach to the specified process;

[0061] Among them, gdbserver is a component of the GNU Debugger (GDB) that allows remote debugging of target programs; it runs on the target machine (or simulation environment) and communicates with the GDB debugger on the host, enabling developers to debug programs running on different devices (such as embedded systems, virtual machines, or remote servers).

[0062] Step S4: calling the interaction module to complete the process identification.

[0063] As can be seen from the above, the present invention transforms qemu so that a specified process in a full system state simulation environment can be identified by the values ​​of the IP and SP registers. After adopting the method of the present invention, it has the characteristics of easy implementation and good compatibility.

[0064] By adopting the above technical solution of the present invention, a complete system can be constructed, and its overall structure is as follows: Figure 2 As shown, it includes a QEMU full-system simulation environment and an interaction module; wherein the QEMU full-system simulation environment includes: an application layer, a kernel layer, and a QEMU simulator; the application layer includes an sslvpnd application, a gdbserver application, and a telnetd application, and the gdbserver application and the telnetd application perform an attach operation. The interaction module includes a gdb module and a QMP communication module. The gdbserver application in the QEMU full-system simulation environment performs a connection operation and an IP and SP reading operation with the gdb module of the interaction module, and the QEMU simulator in the QEMU full-system simulation environment is used to read the get-process command of the QMP communication module in the interaction module.

[0065] In a specific application example, the present invention takes the Ubuntu image and the specified process httpd as an example to further describe the specific implementation of the present invention in detail.

[0066] Step S100: construct a new qemu command get-process to complete the process identification function according to the values ​​of the IP and SP registers.

[0067] In this embodiment, the present invention uses qemu's own QMP framework to get-process <ip> <sp>Commands are added to the system, see Figure 3 , its implementation pseudo code is: get-process(IP, SP), which includes:

[0068] (1) get-process <ip> <sp>Order:

[0069] Record the IP into the system as IP_STORE;

[0070] Record SP into the system as SP_STORE;

[0071] (2) The logic of process identification during the execution of qemu's basic blocks:

[0072] process-identify()

[0073] CPU_IP, CPU_SP = the IP and SP values ​​of the current process CPU;

[0074] If(CPU_IP=IP_STORE&&CPU_SP =SP_STORE)

[0075] Identify that the current process is the desired process;

[0076] Step S200: Setting an interactive module to complete process information collection, and then passing the process information (IP and SP register values) to the qemu engine by calling get-process;

[0077] In this embodiment, see Figure 4 , the present invention provides an implementation pseudo code, including:

[0078] (1) Connect to the remote gdbserver;

[0079] gdb_session = connect_to_gdbserver(gdb_host, gdb_port)

[0080] (2) Get the values ​​of IP and SP registers;

[0081] registers = get_registers_value(gdb_session, ['ip', 'sp'])

[0082] (3) Connect to QEMU's QMP port;

[0083] qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port)

[0084] (4) Construct and send QMP commands;

[0085] cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'],'SP': registers['sp']}}

[0086] response = send_qmp_command(qmp_socket, cmd);

[0087] Step S300: constructing a full system virtual machine image of the simulated environment;

[0088] The full system state virtual machine image includes a gdbserver user state program. The virtual machine is started with the modified qemu, and then gdbserver is started and attached to the httpd process (assuming the process number is 4321).

[0089] Furthermore, the present invention uses the Ubuntu image downloaded from the Ubuntu official website as an example. After starting it with the modified qemu, the user-mode program of gdbserver already exists in the image.

[0090] For an image that does not contain the user-mode program of gdbserver, you can use tools such as wget and scp to upload gdbserver to the image.

[0091] Next, execute the following command to attach gdbserver to the httpd process, where the listening port of gdbserver is specified as 1234. Figure 5 shown.

[0092] Step S400: calling the interaction module to complete process identification, and the httpd process can be identified.

[0093] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.< / sp> < / ip> < / sp> < / ip> < / sp> < / ip> < / sp> < / ip> < / sp> < / ip>

Claims

1. A system-wide process identification method based on the linkage of simulator and debugger, characterized in that: include: Step S1: construct a new qemu command get-process to perform process identification according to the values ​​of the IP and SP registers; Step S2: Setting up an interactive module to complete the process information collection; Step S3: constructing a full system virtual machine image of the simulated environment, wherein the full system virtual machine image includes the gdbserver user state program; Step S4: calling the interaction module to complete the process identification.

2. The system-wide process identification method based on simulator and debugger linkage according to claim 1, characterized in that: In step S2, the process information is passed to the qemu engine by calling get-process.

3. The system-wide process identification method based on simulator and debugger linkage according to claim 2, characterized in that: In step S2, the process information includes the values ​​of the IP and SP registers.

4. The system-wide process identification method based on simulator and debugger linkage according to claim 2, characterized in that: In step S2, calling get-process to pass process information to the qemu engine includes: (1) Connect to the remote gdbserver; gdb_session = connect_to_gdbserver(gdb_host, gdb_port) (2) Get the values ​​of IP and SP registers; registers = get_registers_value(gdb_session, ['ip', 'sp']) (3) Connect to QEMU's QMP port; qmp_socket = connect_to_qemu_qmp(qemu_host, qemu_port) (4) Construct and send QMP commands; cmd = {'execute': 'get-process', 'arguments': {'IP': registers['ip'], 'SP': registers['sp']}} response = send_qmp_command(qmp_socket, cmd).

5. The system-wide process identification method based on simulator and debugger linkage according to any one of claims 1 to 4, characterized in that: In step S3, the virtual machine is started using the qemu generated in step S1, and gdbserver is started to attach to the specified process.

6. The system-wide process identification method based on simulator and debugger linkage according to claim 5, characterized in that: In step S3, the ubuntu image is used and after starting with the qemu generated in step S1, the user-mode program of gdbserver already exists in the image.

7. The system-wide process identification method based on simulator and debugger linkage according to claim 6, characterized in that: In step S3, for an image of a user-mode program in which gdbserver does not exist, gdbserver is uploaded to the image using a wget or scp tool; then, a command is executed to attach gdbserver to the httpd process.

8. The system-wide process identification method based on simulator and debugger linkage according to any one of claims 1 to 4, characterized in that: In step S1, get-process is executed through qemu's own QMP framework. <ip> <sp>Command added to the system, the get-process <ip> <sp> include:< / sp> < / ip> < / sp> < / ip> (1)get-process <ip> <sp> Order:< / sp> < / ip> Record the IP into the system as IP_STORE; Record SP into the system as SP_STORE; (2) The logic of process identification during the execution of qemu's basic blocks: process-identify() CPU_IP, CPU_SP = the IP and SP values ​​of the current process CPU; If(CPU_IP=IP_STORE && CPU_SP =SP_STORE) Identify that the current process is the desired process.

9. The system-wide process identification method based on simulator and debugger linkage according to any one of claims 1 to 4, characterized in that: The interactive module includes a gdb module and a qmp communication module. The interactive module is used to cooperate with the qemu full-system simulation environment. The qemu full-system simulation environment includes: an application layer, a kernel layer and a qemu simulator; the application layer includes an sslvpnd application, a gdbserver application and a telnetd application, and an attach operation is performed between the gdbserver application and the telnetd application.

10. The system-wide process identification method based on simulator and debugger linkage according to claim 9, characterized in that: The gdbserver application in the qemu full-system simulation environment performs connection operations and IP and SP reading operations with the gdb module of the interactive module. The qemu simulator in the qemu full-system simulation environment is used to read the get-process command of the qmp communication module in the interactive module.

Images