Process processing method and device, electronic equipment and readable medium

Abstract

The embodiment of the invention provides a process processing method and device, electronic equipment and a readable medium, and relates to the technical field of computers, in the method, a preset executable program is injected into a tracked target process based on a tracking process. And based on the injection position information of the executable program, determining exemption information corresponding to the executable program. And performing real-time detection on the target process, and if the first filter requested to be registered by the target process is detected, adding exemption information in the first filter so as to enable the executable program to run normally. Wherein the exemption information is used for controlling the first filter to allow the executable program to perform system calling. Thus, the exemption information of the executable program is added to the filter correspondingly registered by the target process, so that the injected system call requested by the executable program cannot be intercepted by the filter of the target process, and normal operation of the executable program is ensured.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a process processing method, device, electronic device and readable medium. Background Art

[0002] Currently, code injection technology is widely used. Users can inject executable programs into tracked processes, implementing the executable program's functionality during the tracked process's lifecycle. If the executable program includes system call requests, the requested system call may be blocked by the tracked process's filter due to matching the tracking process's filter rules, causing the executable program to fail to run properly.

[0003] Therefore, how to ensure the normal operation of executable programs has become a technical problem that needs to be solved urgently. Summary of the Invention

[0004] Embodiments of the present invention provide a process processing method, device, electronic device, and readable medium, which can solve the problem of how to ensure the normal operation of an executable program.

[0005] In order to solve the above problems, an embodiment of the present invention discloses a process processing method, which includes:

[0006] Injecting a preset executable program into the tracked target process based on the tracking process;

[0007] Determining exemption information corresponding to the executable program based on the injection location information of the executable program;

[0008] Performing real-time detection on the target process, and if a first filter requested to be registered by the target process is detected, adding the exemption information to the first filter to enable the executable program to run normally;

[0009] The exemption information is used to control the first filter to allow the executable program to make a system call.

[0010] On the other hand, an embodiment of the present invention discloses a process processing device, comprising:

[0011] A first processing module is used to inject a preset executable program into the tracked target process based on the tracking process;

[0012] A generating module, configured to determine exemption information corresponding to the executable program based on the injection location information of the executable program;

[0013] an adding module, configured to perform real-time detection on the target process, and if a first filter requested to be registered by the target process is detected, add the exemption information to the first filter to enable the executable program to run normally;

[0014] The exemption information is used to control the first filter to allow the executable program to make a system call.

[0015] On the other hand, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the aforementioned method.

[0016] An embodiment of the present invention further discloses a machine-readable medium having instructions stored thereon. When executed by one or more processors, the processors are enabled to execute the method described above.

[0017] The embodiment of the present invention includes the following advantages: In the process processing method provided by the embodiment of the present invention, a preset executable program is injected into the tracked target process based on the tracking process. Based on the injection location information of the executable program, the exemption information corresponding to the executable program is determined. The target process is detected in real time. If it is detected that the first filter requested to be registered by the target process is detected, the exemption information is added to the first filter to enable the normal operation of the executable program. The exemption information is used to control the first filter to allow the executable program to make system calls. In this way, by adding the exemption information of the executable program to the filter registered corresponding to the target process, the system call requested by the injected executable program will not be intercepted by the filter of the target process, thereby ensuring the normal operation of the executable program. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 This is a flowchart of a process processing method provided by an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram of a processing flow provided by an embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram of a user program processing process provided by an embodiment of the present invention;

[0022] Figure 4 is another processing process schematic diagram provided by an embodiment of the present invention;

[0023] Figure 5 This is a block diagram of a process processing device provided by an embodiment of the present invention;

[0024] Figure 6 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort shall fall within the scope of protection of the present invention.

[0026] Figure 1 This is a flowchart of a process processing method provided by an embodiment of the present invention. Figure 1 As shown, the process processing method may include the following steps:

[0027] Step 101: inject a preset executable program into a tracked target process based on the tracking process.

[0028] Step 102: Determine exemption information corresponding to the executable program based on the injection location information of the executable program.

[0029] Step 103: Perform real-time detection on the target process. If a first filter that the target process requests to register is detected, add the exemption information to the first filter to enable the executable program to run normally; wherein the exemption information is used to control the first filter to allow the executable program to make system calls.

[0030] Embodiments of the present invention can be applied to electronic devices. In these embodiments, the program to which the target process being tracked belongs is referred to as the target program, and the target program is referred to as the tracked program. Therefore, the target process can also be referred to as the tracked process. Specifically, the tracked program can be started by a tracking program. Assuming the tracked program is wps and the tracking program is trace, the electronic device can start the tracked program wps using the startup command: trace wps. Specifically, the process for starting the tracked program can include first starting the tracking program. The process that runs after the tracking program is started is referred to as the tracking process. The tracking process then creates a new process using a process creation command (e.g., the clone command or the fork command). The created new process is then tracked using a process tracking command (e.g., the TRACEME command provided by the ptrace system call), causing the new process to accept scheduling by the tracking program. The new process, which has been scheduled, then calls a system call for program execution (e.g., the execve system call) to run the tracked program, thereby ensuring normal startup of the tracked program. The new process is the target process that runs the tracked program, which can be the main program.

[0031] In the present embodiment, the ptrace system call is a Linux system call that provides a process tracking function. Through the ptrace system call, a process (tracker, i.e., the tracking process in the embodiment of the present invention) can observe and control the execution of another process (the tracked, i.e., the target process in the embodiment of the present invention), and can read and modify the memory and registers of the tracked. When a tracking process is attached to the target process through ptrace, the state of the target process will become a stopped state. Accordingly, the tracking process can read the executable program corresponding to the tracked program from the preset file, and then inject the executable program into the target process so that the executable program can be executed during the operation of the tracked program. Exemplarily, the executable program can be executed directly after the executable program is injected, or the executable program can be executed when the target process executes to the area where the executable program is located.

[0032] An executable program is binary code, consisting of multiple instructions. An executable program can also be referred to as a binary program. Injecting the executable program into the target process can involve inserting the executable program into the requested code injection area. This code injection area belongs to the executable space, where the executable space refers to the memory area available for storing and executing code during program execution. The executable program's injection location information can represent the executable program's storage range within the memory area. Accordingly, exemption information, consisting of information representing the executable program's storage range within the memory area and an exemption code template, can be used to indicate whether system calls requested by instructions within the storage range should be intercepted, or whether system calls requested by instructions within the storage range should be allowed. System calls requested by instructions within the storage range are system calls requested by the executable program. Furthermore, if the tracked program itself requires registering at least one filter (i.e., a first filter), exemption information is added to each of the registered first filters to ensure that no filter registered by the target process intercepts system calls requested by the executable program.

[0033] In summary, in the process processing method provided by the embodiment of the present invention, a preset executable program is injected into the tracked target process based on the tracking process. Based on the injection location information of the executable program, the exemption information corresponding to the executable program is determined. The target process is detected in real time. If the first filter requested to be registered by the target process is detected, the exemption information is added to the first filter to enable the normal operation of the executable program. The exemption information is used to control the first filter to allow the executable program to make system calls. In this way, by adding the exemption information of the executable program to the filter registered corresponding to the target process, the system call requested by the injected executable program will not be intercepted by the filter of the target process, thereby ensuring the normal operation of the executable program.

[0034] Optionally, in an embodiment of the present invention, the step of determining the exemption information corresponding to the executable program based on the injection location information of the executable program may specifically include:

[0035] Step 1021: Obtain the starting position and the ending position of the code injection area of ​​the executable program.

[0036] Step 1022: Load a preset exemption code template from a designated location; the exemption code template defines an exemption start position parameter item and an exemption end position parameter item.

[0037] Step 1023: Write the starting position and the ending position into the exemption starting position parameter item and the exemption ending position parameter item respectively to obtain the exemption information.

[0038] The starting position and ending position of the code injection area represent the instruction starting position and instruction ending position of the executable program, respectively. The instruction starting position represents the storage address of the first instruction in the instruction sequence of the executable program, and the instruction ending position represents the storage address of the last instruction in the instruction sequence of the executable program. For instructions for making system calls included in the executable program, when executed, the instruction triggers a call request for invoking the system call defined in the instruction. The request address of the call request is the storage address of the instruction.

[0039] In one implementation, when the tracked program initially runs, the target code segment in the target process's executable space is replaced with a preset injection program. The target code segment refers to a portion of the tracked program's code. A code segment of the same size as the preset injection program can be selected from the original, unexecuted code segment as the target code segment. The preset injection program is then executed to determine the code injection area for the executable program. Specifically, a memory area can be allocated based on the size of the executable program to be injected, serving as the code injection area for the executable program. Alternatively, a preset instruction storage area can be used as the code injection area for the executable program. This injection replaces the original instructions in the instruction storage area with the injected executable program, allowing the executable program to execute when the instructions in the instruction storage area are executed. The preset instruction storage area can be pre-set by the developer. For example, the preset instruction storage area can be the storage area for a function in the tracked program. Thus, after the injection, the original function is replaced with the injected executable program, allowing the executable program to execute when the function is called. This means that the executable program runs normally after being called by a function call initiated by the target process. Next, the executable program is inserted into the code injection area. After the preset injection program is executed, the replaced target code segment is restored, that is, the preset injection program is replaced with the previously saved target code segment. Then, the target process is resumed to allow the tracked program to run normally.

[0040] Specifically, a preset code segment read command can be used to read and save the target code segment from the executable space of the target process. The preset code segment read command can be the PTRACE_PEEKTEXT command. Then, a preset code segment modification command can be used to modify the target code segment in the executable space of the target process to a preset injection program. The preset code segment modification command can be PTRACE_POKETEXT. The preset injection program is used to determine the code injection area of ​​the executable program and insert the executable program into the code injection area. Next, the traced program calls the preset injection program. Specifically, a preset pointer modification command can be used to set the program counter (PC) pointer to the entry point of the preset injection program, i.e., modify the PC pointer to point to the address of the first instruction of the inserted preset injection program, thereby starting execution of the preset injection program. After the preset injection program is executed, the executable program is inserted into the code injection area based on the determined code injection area of ​​the executable program. The preset pointer modification command can be PTRACE_SETREGS. The preset injection program can apply for a memory area using a memory allocation command (e.g., the mmap command), and the executable program is inserted into the applied memory area using a copy command. Furthermore, the preset injection program can be modified to the previously saved target code segment through a preset code segment modification command, and then the tracing can be canceled. Of course, other methods can also be used to inject an executable program into the target process, and the embodiment of the present invention is not limited to this. For example, assuming that the storage location of the target code segment is addr1, the electronic device can execute the command: PTRACE_PEEKTEXT(addr1) to read the target code segment codeA stored at addr1, so as to facilitate the subsequent restoration of codeA to addr1. Then execute the command: PTRACE_POKETEXT(addr1, BIN1) to replace codeA in addr1 with BIN1. Among them, BIN1 represents the code of the preset injection program. Then, execute the command PTRACE_SETREGS(addr1) to start executing the preset injection program at addr1. After the execution is completed, the command: PTRACE_PEEKTEXT(addr1, codeA) can be executed to modify BIN1 at addr1 to codeA.

[0041] Specifically, during the execution of BIN1, the code injection area of ​​the executable program will be determined. For example, assuming that the preset instruction storage area is 0x12000~0x14000, the storage area indicated by 0x12000~0x14000 will be used as the code injection area, and BIN2 will be written to 0x12000~0x14000. Among them, BIN2 indicates that the executable program that needs to be actually injected into the target process is BIN2. After BIN1 is executed, BIN2 is inserted into the target process. It should be noted that, in the case where BIN2 needs to be executed first and then the tracked program continues to be executed, the preset pointer modification command can be used to modify the PC pointer to point to the address of the first instruction of the inserted executable program, and the function return address is set to the address of the instruction to be executed of the tracked program.

[0042] Furthermore, the starting address and ending address of the memory area requested by the preset injection program, or the starting address and ending address of the preset instruction storage area, can be obtained to obtain the starting position and ending position of the code injection area of ​​the executable program. For example, assuming that the starting address and ending address of the memory area requested by the preset injection program are 0x12000 and 0x14000 respectively, then the starting position and ending position are 0x12000 and 0x14000 respectively, and the executable program is inserted at 0x12000-0x14000.

[0043] The exemption information for an executable program is an exemption code that defines the starting and ending locations of the executable program. The exemption code template can be a pre-set code template, with an exemption starting location parameter item and an exemption ending location parameter item set therein. These two parameter items represent the exemption starting location and exemption ending location, respectively, i.e., the starting and ending locations of the executable program's code injection area. The exemption code template is pre-stored in a designated location, which can be pre-specified by the developer. For example, the designated location can be a non-volatile storage location within the electronic device. The semantics of the exemption code template indicate that system calls requested by instructions within the memory areas indicated by the exemption starting location and exemption ending location will not be intercepted. In embodiments of the present invention, the exemption code template can be a conditional statement. This, to a certain extent, can avoid the problem of the exemption information generated based on the exemption code template being too large, which would result in the first filter being too large after the exemption information is added to the first filter. The conditional statement corresponds to a filtering rule. The exemption code template indicates that if the request address of the call request is between the starting location indicated by the exemption starting location parameter item and the ending location indicated by the exemption ending location parameter item, the call request is allowed, i.e., the system call requested by the call request is allowed. For example, the exemption code template may be:

[0044] if (pc≥exemption starting position parameter item &&pc≤exemption ending position parameter item), pass;

[0045] It means that if the requested address is within the address range of the code injection area, it is exemption information. Accordingly, the starting position and the ending position can be filled into the exemption starting position parameter item and the exemption ending position parameter item respectively, and the filled exemption code template can be used as the exemption information of the executable program. Exemplarily, the exemption information of the executable program can be "if(pc≥0x12000&&pc≤0x14000), pass;". Accordingly, after adding the exemption information to the first filter, when the operating system kernel executes the first filter, it will execute the exemption information, detect the call request context information, and obtain the request address of the call request.

[0046] For example, the current value of the instruction pointer of the target process is accessed to obtain the request address of the call request. Then, it is detected whether the request address belongs to the address range defined in the exemption information. If so, no interception is performed, that is, the call request is allowed, and accordingly, the system call requested by the call request can be executed. For example, assuming that the request address of call request A is 0x13000, since 0x13000 ≥ 0x12000 and ≤ 0x14000, it is within the address range of the code injection area. Therefore, the system call requested by the call request is executed, that is, the call request A is allowed, and the system call requested by the call request A is called normally. Since the instructions of the injected executable program are stored in 0x12000~0x14000, it is equivalent to that the call requests generated by the executable program will not be intercepted, thereby allowing the executable program to make system calls and achieving exemption for the executable program.

[0047] In this embodiment of the present invention, exemption information for an executable program is generated by writing the corresponding exemption start position parameter item and exemption end position parameter item to the starting position and ending position of the executable program's code injection area, respectively. This ensures the efficiency of exemption information generation to a certain extent, improving overall processing efficiency.

[0048] Optionally, the embodiment of the present invention may further include the following steps:

[0049] Step S21 : registering a second filter and a second signal processing function based on a preset injection program.

[0050] The step of adding the exemption information to the first filter if the target process is detected to request registration of the first filter may specifically include:

[0051] Step 1031: In response to a first call request, if the first call request is used to register the first filter for the target process, intercepting the first call request based on the second filter;

[0052] Step 1032: Add the exemption information to the header of the first filter based on the second signal processing function.

[0053] Step 1033: Register the first filter to which the exemption information has been added for the target process.

[0054] In an embodiment of the present invention, the above-mentioned step S21 can be performed after the operation of injecting the executable program is executed. Specifically, the preset injection program is also used to register the second filter and the second signal processing function after the executable program is inserted into the code injection area, so as to add the exemption information of the executable program to the first filter through the second filter and the second signal processing function. That is to say, the preset injection program includes a code for determining the code injection area, a code for inserting the executable program into the code injection area, an implementation code of the second filter and the second signal processing function, and a code for requesting the registration of the second filter and the second signal processing function. This series of operations can be achieved by executing the preset injection program. The second filter and the second signal processing function can be understood as the filter and signal processing function registered by the executable program.

[0055] The second filter is used to intercept specific system calls other than system calls requested by the executable program. In an embodiment of the present invention, the filter can be a filter that uses the Seccomp (Secure Computing Mode) mechanism, that is, a Seccomp filter, and the tracked program can be called a sandbox with the Seccomp mechanism or a Seccomp program. The filter includes a set of filtering rules, and the filtering rules can be used to indicate which call requests are allowed and which call requests are intercepted, thereby limiting the system calls that can be executed, thereby reducing the potential attack surface and improving the security of the system. The specific content of the filtering rules can be customized according to user needs. For example, the filtering rules are used to indicate that requests for a certain system call will be intercepted, that call requests whose request addresses fall within a specified address range will be intercepted, and so on. The filter can be used to filter and control system calls. Accordingly, the second filter can also be added with exemption information for the executable program to avoid intercepting system calls requested by the executable program. Alternatively, the filtering rules included in the second filter only include instructions to intercept call requests whose request addresses fall within a non-code injection area and are used to request specific system calls.

[0056] Exemplarily, when registering the second filter, the base address parameter and address length parameter of the second filter defined in the preset injection program can be used as system call parameters to trigger a call request for calling the filter registration system call (for example, the prctl system call or the seccomp system call) to call the filter registration system call and register the second filter based on the base address and address length of the second filter. Specifically, the handler corresponding to the filter registration system call can be found in the kernel, and the handler can be a system call processing function. Then, the registration operation is performed through the system call processing function: data is loaded into the kernel starting from the base address of the second filter until the length of the loaded data reaches the address length of the second filter, and the loaded data is the second filter. The second filter can be in code form.

[0057] Exemplarily, the second filter may include a specific structure and its corresponding pointer. The specific structure may describe a set of filtering rules, and the pointer corresponding to the specific structure may point to the filtering rules in the specific structure. The specific structure may be implemented based on kernel interpretable executable code, such as bpf code. Specifically, the specific structure may include code instructions implemented by the bpf code. After loading is completed, the loaded code may be converted into kernel executable code. For example, a compiler that complies with BPF technology may be used to compile the loaded code into kernel executable code, thereby registering the second filter in the kernel state. Accordingly, the operating system kernel may bind the second filter to the target process to intercept specific system calls initiated by the target process. In specific implementation, in response to any call request initiated by the target process or executable program, the operating system kernel will execute the filters registered for the target process and executable program in the kernel (i.e., all currently registered filters, including the second filter and the first filter registered subsequently).

[0058] Furthermore, when registering the second signal processing function, the base address parameter and address length parameter of the second signal processing function defined in the preset injection program can be used as system call parameters to trigger a call request for calling a function registration system call (e.g., a sigaction system call). This call triggers the function registration system call and registers the second signal processing function based on the base address and address length of the second signal processing function. For example, data is loaded into the kernel based on the base address and address length of the second signal processing function, and the loaded data is the second signal processing function. After loading is completed, the loaded code can be converted into kernel executable code to complete the registration of the second signal processing function. Exemplarily, during execution of the preset injection program, a call request can be generated: sigaction(base1, lenth1), where base1 and lenth1 represent the base address parameter and address length parameter of the second signal processing function, respectively. In response to the request for calling the sigaction system call, the handler corresponding to the sigaction system call is executed to load data starting from base1 until the loaded data has a length of lenth1. The loaded data is converted into kernel executable code to complete the registration of the second signal processing function.

[0059] When registering the first filter, the base address parameter and address length parameter of the first filter defined in the traced program can be used as system call parameters to trigger a call request for invoking a filter registration system call. The filter registration system call is then called to register the first filter based on the base address and address length of the first filter. Specific implementation details are described above and are not repeated here.

[0060] Accordingly, the first call request may be a call request for invoking a system call. In response to the first call request, all currently registered filters (i.e., the second filter) may be executed first to detect whether to intercept. If the request address of the first call request belongs to the address range of the memory area of ​​the tracked program, and the system call requested by the first call request is used to register a filter (for example, the system call number carried in the first call request is prctl or seccomp), then it can be determined that the first call request is used to register the first filter for the target process, that is, the first call request is a request triggered by the target process to request registration of a filter for the target process, and the first call request is triggered by the tracked program to request registration of a filter system call. Therefore, the first call request can be intercepted based on the second filter. The request address of the call request belongs to the address range of the memory area of ​​the tracked program, which means that the PC value of the call request belongs to the address range of the memory area of ​​the tracked program. The memory area of ​​the tracked program is the area where instructions in the tracked program are stored. The call request is triggered when the instructions of the tracked program are executed, and the PC value of the call request is the address of the instruction that triggered the call request. That is, during normal operation of the traced program, the specific system calls that the second filter is responsible for intercepting include filter registration system calls (eg, prctl system calls or seccomp system calls) initiated by the target process.

[0061] Specifically, the second filter includes a filtering rule for intercepting the first call request for registering the first filter for the target process. The filtering rule defines the address range of the memory area of ​​the tracked program and the system call number to be intercepted (the system call number of the filter registration system call in this example). The filtering rule is used to indicate that the call request that belongs to the address range and is used to request the filter registration system call is intercepted, and the operation of generating a first notification signal is performed. Accordingly, in response to the first call request, when the operating system kernel executes the filtering rule, it will detect whether the request address of the first call request belongs to the address range of the memory area of ​​the tracked program, and whether the system call number of the first call request is the system call number of the filter registration system call. If so, the filter registration system call requested by the first call request is not called to achieve the interception of the first call request. At the same time, the first notification signal is generated according to the filtering rule, and the operating system kernel can send the generated first notification signal to the second signal processing function.

[0062] For example, taking the program being tracked as being stored in the range 0x01000 to 0x10000, the second filter defines the conditional statement: if (pc ≥ 0x01000 && pc ≤ 0x10000 && prctl, seccomp), output = SIGSYS1. If the request address of the first call request currently received falls within the range 0x01000 to 0x10000, and the system call number carried in the first call request is prctl or seccomp, the first notification signal SIGSYS1 is generated instead of calling the prctl or seccomp system calls, thereby achieving interception.

[0063] Based on the second filter intercepting the first call request, the registration of the first filter without adding the exemption information is avoided, and then a first notification signal can be generated, that is, a notification signal for instructing the second signal processing function to add the exemption information to the header of the first filter, so that the second signal processing function responds to the first notification signal and performs the operation of adding the exemption information to the header of the first filter. For example, a notification signal carrying an identifier for instructing the execution of the operation of adding the exemption information. The notification signal can be a SIGSYS type of information. Since the operating system kernel executes the first filter sequentially, by adding the exemption information to the filter header, when the first filter is executed, the exemption information added therein is executed first, and then when the currently received call request is initiated by the executable program, the call request initiated by the executable program can be quickly exempted, so that the system call required by the executable program is quickly executed, thereby improving the subsequent processing efficiency.

[0064] Specifically, the base address and address length of the first filter can be read from the first call request. The address length represents the length of the first filter. The base address of the first filter is used as the starting storage position of the first filter, and the sum of the base address and address length of the first filter is used as the ending storage position of the first filter. The data between the starting storage position and the ending storage position (i.e., the original first filter) is copied to a preset storage area, and exemption information is added to the header of the data in the preset storage area. The preset storage area can be a storage area designated by the developer for use when adding exemption information. The length parameter of the first filter is then modified to represent the length of the first filter after the exemption information is added. For example, the length parameter of the first filter can be modified to the address length of the first filter after the exemption information is added. Finally, the first filter after the exemption information is added is written back to the memory space of the target process, and the target process continues to call the filter registration system call to register the first filter after the exemption information is added for the target process. For example, assuming the preset storage area is 0x50000-0x80000, the exemption information can be written starting at 0x50000. Then, after the exemption information, the original first filter can be written, thereby forming the first filter with the exemption information added. Assuming the exemption information has a length of 0x00100 and the original first filter has a length of 0x00700, the length parameter of the first filter can be modified to 0x00800. The modified length parameter can be passed to the target process by the operating system kernel, or the length parameter can be written to a pre-defined register and modified by modifying the value in the register. Accordingly, the target process can directly read the value in the register to obtain the modified length parameter, then write the first filter with the exemption information added from the base address of the first filter back to the target process's memory space. After the target process resumes execution, it will re-initiate a filter registration system call based on the address length 0x00800 in the length parameter and the base address of the first filter.

[0065] It should be noted that in embodiments of the present invention, simulation testing can also be performed after adding exemption information. For example, the updated first filter can be loaded into a test environment, and then a system call from the code injection area defined in the exemption information can be simulated. If the system call is not intercepted, the update is determined to be successful, and the code can be rewritten back to the target process's memory space.

[0066] In actual application scenarios, after an executable program is injected into a target process, the system calls requested by the executable program may be intercepted by the target process's first filter. This means that the call request initiated by the executable program cannot normally invoke the system call, and the executable program cannot normally perform the system call, which in turn causes the executable program to malfunction. Specifically, the first filter set for the tracked program is determined by the developer in advance, and the functions required to be implemented by the added executable program may sometimes require system calls intercepted by the first filter. Therefore, the call request initiated by the executable program will be intercepted. For example, the tracked program is not allowed to open files, but based on development requirements, the injected executable program needs to open a certain file, and accordingly, it needs to call the "open" system call. To this end, after the executable program is injected, when registering the first filter for the tracked program, adding exemption information before the first filter registration can avoid conflicts caused by the executable program's required system call being intercepted by the tracked program's first filter, ensuring the normal execution of the executable program and, in turn, the normal implementation of the executable program's required functions.

[0067] In an embodiment of the present invention, a second filter and a second signal processing function are further registered based on a preset injection program. In response to a first call request, if the first call request is used to register a first filter for a target process, the first call request is intercepted based on the second filter, and then, based on the second signal processing function, exemption information is added to the header of the first filter, and the first filter to which the exemption information has been added is registered for the target process. In this way, by registering the second filter and the second signal processing function, exemption information is added to the header of the first filter, thereby preventing the system call requested by the executable program from being intercepted by the first filter, ensuring that the executable program can make system calls normally, and further ensuring that the executable program can operate normally.

[0068] Optionally, the embodiment of the present invention may further include the following steps:

[0069] Step S31: In response to a second call request, if the second call request is used to start a new program specified by the target process, intercept the second call request based on the second filter.

[0070] Step S32: Send notification information to the tracking process based on the second signal processing function to instruct the tracking process to inject a preset executable program into the target process corresponding to the new program and start execution.

[0071] Accordingly, the second call request may be a call request for invoking a system call. In response to the second call request, all currently registered filters may be executed first to detect whether to intercept. If the request address of the second call request belongs to the address range of the memory area of ​​the tracked program, and the system call requested by the second call request is used to start a new program (for example, the system call number carried in the second call request is execve), then it can be determined that the second call request is used to call a second specific system call, that is, the second call request is a request triggered by the target process to request the execution of a new program, and the second call request is triggered by the tracked program to request the program to start a system call (that is, a system call for starting a new program). Therefore, the second call request can be intercepted based on the second filter. That is, during the normal operation of the tracked program, the specific system calls that the second filter is responsible for intercepting include the execve system call initiated by the target process. Since the execution of the execve system call will clear the running space of the original target process and directly create a new process to run the new program, the new program will not be injected into the executable program, causing the executable program to generate an exception. Therefore, the second call request can be intercepted based on the second filter to avoid directly creating a new process to run the new program, resulting in the inability to continue injecting into the process running the new program. Afterwards, a second notification signal can be generated to instruct the second signal processing function to send notification information to the tracking process, for example, a SIGSYS signal carrying an identifier for instructing the execution of the notification information sending operation. The second signal processing function then responds to the second notification signal and executes the operation of sending the first notification information to the tracking process. The first notification information is to instruct the tracking process to inject preset executable program information into the target process corresponding to the new program.

[0072] Furthermore, in an embodiment of the present invention, the notification signal can be a SIGSYS type of information, and the data structure used by the notification signal can be sigset_t. In response to the notification signal, the second processing function can search for a processing operation pre-defined for the second notification signal and then execute the processing operation. Exemplarily, the second filter includes a filtering rule for intercepting a second call request for starting a new program specified by the target process. The filtering rule defines the address range of the memory area of ​​the tracked program and the system call number to be intercepted (execve in this example). The filtering rule is used to indicate that requests that fall within the address range and are used to request the program to start a system call are intercepted, and the operation of generating a second notification signal is executed. Accordingly, in response to the second call request, when the operating system kernel executes the filtering rule, it will detect whether the request address of the second call request falls within the address range of the memory area of ​​the tracked program, and whether the system call number of the second call request is the system call number of the program start system call. If so, the system call number of the program start system call requested by the second call request is not called to intercept the second call request. At the same time, the operation of generating a second notification signal is executed. The operating system kernel may send the generated second notification signal to the second signal processing function.

[0073] Exemplarily, taking the program being tracked as being stored in 0x01000-0x10000 as an example, a conditional statement is defined in the second filter: if (pc≥0x01000&&pc≤0x10000&&execve), output=SIGSYS2. If the request address of the second call request currently received belongs to 0x01000-0x10000, and the system call number carried by the second call request is execve, a second notification signal: SIGSYS2 is generated. In response to the second notification signal (SIGSYS2), the second processing function will perform the processing operation pre-defined for the second notification signal: sending a first notification message to the tracking process. Accordingly, in response to the first notification message, the tracking process uses the new program as the new target program and restarts execution from step 101 above. Exemplarily, a new process can be created by the tracking process using a process creation command. Then, the created new process is tracked using a process tracking command (e.g., the TRACEME command). Then, the new process calls the program to execute a system call (for example, an execve system call) to run the new program and obtain the target process corresponding to the new program. The target process corresponding to the new program serves as a new target process, and the executable program can be re-injected into the new target process. It should be noted that, in an embodiment of the present invention, in response to the fifth call request, the fifth call request can be intercepted based on the second filter, and a second notification message can be sent to the tracking process based on the second signal processing function, and the second notification message is used to instruct the tracking process to track the target process corresponding to the new program. Among them, the request address of the fifth call request belongs to the address range of the memory area of ​​the tracked program, and the requested system call is used to start a new program, and the running space of the original target program is not cleared (for example, a clone system call with a system call number of clone). That is, in the case where the target process calls the clone system call to create a child process, the executable program is not re-injected into the child process.

[0074] The process running the new program is essentially a child process of the previous target process, and the target process corresponding to the new program is the process running the new program. If the new target process again initiates another new program through a second specific system call, the corresponding process running the new program is a grandchild process. In other words, in this embodiment of the present invention, a tracking program is used to track the main process, all child processes spawned by the main process, and the grandchild processes.

[0075] In an embodiment of the present invention, a second call request for starting a new program specified by a target process is intercepted based on a second filter, and then a notification message is sent to the tracking process based on a second signal processing function to instruct the tracking process to use the new program as a new target program, and return to the step of injecting a preset executable program into the tracked target process based on the tracking process to start execution. In this way, the same injection can be performed for descendant processes subsequently, achieving the purpose of deep injection, so that the descendant process can add exemption information of the executable program to the first filter registered by the descendant process based on the second filter and the second signal processing function, ensuring that the executable program injected into the descendant process is not affected and that the executable program injected into the descendant process can also work normally.

[0076] It's important to note that child processes derived from a parent process that registers filters inherit the parent's filters. Because this inheritance is irreversible and deeply inherited, not only does the child process inherit the filters, but all subsequent grandchild processes also inherit them. Once a process registers a filter, it cannot return to a state without registering filters, nor can it remove those filters. Therefore, the filters possessed by a grandchild process include both the inherited first filter and the first filter it registered. For example, suppose the target process is process A, the parent process. A child process B is created for parent A to run a new program. Then, a grandchild process C is created for child B to run another new program. Process A registers filter FA, and child process B registers filter FB. In this case, child process B not only possesses filter FA but also inherits filter FB. The subsequent grandchild process C will inherit both filters FA and FB. In other words, grandchild process C now possesses both filters FA and FB. When injecting an executable into a grandchild process, the code injection area of ​​the injected executable can be the same as the code injection area of ​​the previously injected executable, meaning the executable is injected into the same location each time. Alternatively, it can be different. In the case of injecting into different positions, for any filter inherited by the descendant process, the exemption starting position parameter item and the exemption ending position parameter item defined in the exemption information added to the filter are modified to the starting position and ending position of the code injection area of ​​the executable program injected this time. For example, assuming that the original injection position is 0x12000~0x14000, and the starting position and ending position of the code injection area of ​​the executable program injected this time are 0x15000~0x16000, then the 0x12000 defined in the injection position can be modified to 0x15000, and the defined 0x14000 can be modified to 0x16000.

[0077] Furthermore, when injecting an executable program into a descendant process, the injected executable program may be identical to the previously injected executable program, or may be different from the previously injected executable program, which is not limited in this embodiment of the present invention. That is, the BIN1 used is the same, but the BIN2 may be different.

[0078] Figure 2 This embodiment of the present invention provides a processing flow diagram, such as Figure 2 As shown, the tracking program can start the main program (i.e., the target program) based on the clone command, the TRACEME command, and the execve system call. Then, the tracking process binary (i.e., the preset executable program) is injected into the main program. Then, the second signal processing function and the second filter can be registered based on the preset injection program. During the normal operation of the main program, the second filter intercepts the first specific call request (i.e., the first call request for registering the first filter for the target process), then adds exemption information to the first filter and registers the first filter with the added exemption information. The second filter intercepts the second specific call request (i.e., the second call request for starting a new program specified by the target process), then notifies the tracking process to use the new program as the new target program, so that the new program is started based on the tracking process and re-injected. The second filter intercepts the third specific call request (i.e., the third call request for registering the first signal processing function for the target process), then records the function address of the first signal processing function and the signal identifier it processes. If the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function, the first signal processing function is called based on the recorded function address for processing.

[0079] Optionally, the embodiment of the present invention may further include the following steps:

[0080] Step S41: In response to a third call request, if the third call request is used to register a first signal processing function for the target process, intercepting the third call request based on the second filter;

[0081] Step S42: recording the function address of the first signal processing function and the signal identifier processed by the first signal processing function based on the second signal processing function;

[0082] Step S43: When the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function, call the first signal processing function based on the function address to process the notification signal.

[0083] Among them, the third call request can be a call request for calling a system call. In response to the third call request, all currently registered filters can be executed first to detect whether to intercept. If the request address of the third call request belongs to the address range of the memory area of ​​the tracked program, and the system call requested by the third call request is used to register a signal processing function (for example, the system call number carried in the third call request is sigaction), then it can be determined that the third call request is used to register a first signal processing function for the target process, that is, the third call request is a request triggered by the target process to request registration of a signal processing function for the target process, and the first call request is triggered by the tracked program and is used to request a function registration system call. Therefore, the third call request can be intercepted based on the second filter. That is to say, during the normal operation of the tracked program, the specific system calls that the second filter is responsible for intercepting include function registration system calls initiated by the target process (for example, sigaction system calls).

[0084] After the third call request is intercepted based on the second filter, a third notification signal can be generated. Accordingly, the signal identifiers of the first notification signal, the second notification signal, and the third notification signal belong to the signal identifiers processed by the second signal processing function. In response to the third notification signal, the second signal processing function can record the function address of the first signal processing function and the signal identifier processed by the first signal processing function. The signal identifier processed by the first signal processing function can be pre-defined in the first signal processing function and is used to represent the notification signal that the first signal processing function is responsible for responding to.

[0085] Specifically, the second filter also includes a filtering rule for intercepting the third call request for registering the first signal processing function for the target process. The filtering rule defines the address range of the memory area of ​​the tracked program and the system call number to be intercepted (the system call number of the function registration system call in this example), which is used to indicate that the call request that belongs to the address range and is used to request the function registration system call is intercepted, and the operation of generating a third notification signal is executed.

[0086] Accordingly, in response to the third call request, when the operating system kernel executes the filtering rule, it checks whether the request address of the third call request falls within the address range of the memory area of ​​the traced program, and whether the system call number of the third call request is the system call number of the function registration system call. If so, the function registration system call requested by the third call request is not called, thereby intercepting the third call request. Simultaneously, an operation is executed to generate a third notification signal and send it to the second signal processing function.

[0087] For example, assuming the traced program is stored in the range 0x01000 to 0x10000, the second filter defines the conditional statement: if (pc ≥ 0x01000 && pc ≤ 0x10000 && sigaction), output = SIGSYS3. If the request address of the currently received third call request falls within the range 0x01000 to 0x10000, and the system call number carried in the third call request is prsigaction, then the generation of the third notification signal: SIGSYS3 is triggered. This third notification signal generated by the operating system kernel can be sent to the second signal processing function.

[0088] Accordingly, the notification signal generated by the operating system kernel when executing the filter registered for the target process and the executable program will be sent to the second signal processing function. After receiving the notification signal, the second signal processing function can first determine whether the signal identifier of the notification signal belongs to the signal identifier processed by the first signal processing function. If it does, it can be determined that the notification signal is not a notification signal that the second processing function is concerned about. Therefore, the first signal processing function can be called from the recorded function address, and the first signal processing function responds to the notification signal and executes the processing operation pre-defined for the notification signal. Among them, the notification signal whose signal identifier belongs to the signal identifier processed by the first signal processing function may include the notification signal generated after the above-mentioned first filter intercepts the system call. Exemplarily, the base address and address length of the signal processing function carried in the third call request can be extracted as the function address of the first signal processing function. The value of the signal identifier field is extracted from the code stored at the function address of the first signal processing function to obtain the signal identifier processed by the first signal processing function. For example, assuming that the base address and address length of the signal processing function carried in the third call request are: base2, lenth2, and the signal identification field extracted in the first signal processing function is "sig4", then the function address of the first signal processing function can be recorded: base2 (indicating the starting position of the first signal processing function) to base2+lenth2 (indicating the ending position of the first signal processing function), as well as the signal identification "sig4" of the processed signal. In response to the generated notification signal, the value of the signal identification field of the notification signal is extracted to obtain the signal identification of the notification signal. If the signal identification of the notification signal is "sig4", the first signal processing function stored in base2 to base2+lenth2 is called.

[0089] In an embodiment of the present invention, in response to a third call request, if the third call request is used to register a first signal processing function for a target process, the third call request is intercepted based on a second filter. The function address of the first signal processing function and the signal identifier processed by the first signal processing function are recorded based on the second signal processing function. In the case where the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function, the first signal processing function is called based on the recorded function address to process the notification signal. In this way, the notification signal is uniformly processed by the second processing function, and in the case where the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function, the first signal processing function is called for processing, which can conveniently implement the processing of the notification signal to a certain extent.

[0090] Optionally, after the step of adding the exemption information to the first filter, the embodiment of the present invention may further include the following steps:

[0091] Step S51: In response to a fourth call request, if the request address of the fourth call request does not belong to the code injection area of ​​the executable program, and the fourth call request corresponds to hitting the first filter, intercepting the fourth call request based on the first filter.

[0092] The fourth call request may be a call request for invoking a system call. In response to the fourth call request, all currently registered filters may be executed first to detect whether interception is performed. If the request address of the fourth call request does not belong to the code injection area of ​​the executable program, it means that the system call requested by the fourth call request is not initiated by the injected executable program. Specifically, it may be detected whether the request address belongs to the interval formed by the starting position and the ending position of the code injection area of ​​the executable program.

[0093] Furthermore, the system call requested by the fourth call request hits the first filter, which means that the system call requested by the fourth call request is a system call that is intercepted according to the filtering rules defined in the first filter. Accordingly, if the system call requested by the fourth call request hits the first filter, the system call requested by the fourth call request is intercepted based on the first filter. Furthermore, after the interception, a notification signal indicating that the system call has been intercepted can be directly returned, or a notification signal can be generated to instruct the first processing function to perform a user-defined operation. This embodiment of the present invention does not impose any restrictions on this.

[0094] In an embodiment of the present invention, in response to a fourth call request, if the request address of the fourth call request does not fall within the code injection area of ​​the executable program and the fourth call request matches the first filter, the fourth call request is intercepted based on the first filter. Thus, only when the request address of the call request does not fall within the code injection area of ​​the executable program and matches the first filter will the first filter of the target process intercept the call request, thereby preventing any impact on the system call requested by the injected executable program. For example, taking the traced program stored in 0x01000-0x10000 and the executable program injected into 0x12000-0x14000 as an example, the first filter defines filter rule 1: if (pc ≥ 0x01000 && pc ≤ 0x10000 && exit), output = SIGSYS4. If the request address of the currently received fourth call request falls within 0x12000-0x14000, it is exempted. Otherwise, the determination continues based on other filter rules. Furthermore, assuming that the request address of the fourth call request belongs to 0x01000-0x10000, and the system call number carried by the fourth call request is exit, the filtering rule 1 is hit, and therefore, the operation of generating the fourth notification signal: SIGSYS4 is triggered.

[0095] Accordingly, if the request address of the fourth call request belongs to the code injection area of ​​the executable program, the fourth call request will be exempted, and the system call requested by the fourth call request can be executed normally. Furthermore, in the case that the injected executable program needs to intercept certain system calls initiated by itself and perform custom operations, by running the injected executable program, the third filter and the third signal processing function can be registered for the executable program first. Accordingly, if the request address of the call request belongs to the code injection area of ​​the executable program, and the system call requested by the call request hits the third filter, the system call requested by the call request is intercepted based on the third filter, and then the third signal processing function is called to perform the custom operation.

[0096] Figure 3 This is a schematic diagram of a user program processing process provided by an embodiment of the present invention, such as Figure 3As shown in the figure, assume that a user program opens and reads a file in a directory whose full path is " / opt / app / myfile." Accordingly, the user program (the tracked program) is run by parent process P1 (the target process). To prevent access to other private data (i.e., files not prefixed with "opt / app / "), a communication mechanism, such as a pipe, is first established. Then, by cloning the process, a child process P2 is created to open the file. In child process P2, a first signal handler function is registered, namely the SIGSYS system call handler function FUN in the figure. The Seccomp mechanism is then used to set the first filter: Seccomp filter F1. The filtering rules of Seccomp filter F1 block system calls within the "open," "read," "write," "close," and "exit process" categories. Specifically, if the currently requested system call is an "open," "read," "write," "close," or "exit process" system call, further determination is made as to whether it is an "open" system call. On the contrary, if the currently requested system call is not an "open", "read", "write", "close" or "exit process" system call, the target process (ie, the parent process P1) continues to run.

[0097] When filtering the "open" system call, if the call is being opened within FUN, the call is allowed and the file descriptor is returned. If the call is not initiated from FUN, a SIGSYS signal is triggered, which FUN handles. FUN's processing flow checks whether the file name begins with " / opt / app / ". If so, it indicates that the file is non-private data and an attempt to open the file is allowed. The "file open attempt" executed within FUN is implemented through the "open" system call. Accordingly, since F1 intercepts all "open" system calls, the "file open attempt" executed within FUN is further processed by F1. F1 then determines whether the call is within FUN, ultimately opening the file within FUN and returning the file descriptor to the child process. The child process then continues the program flow, reading the file, writing to the pipe, and closing the process. Otherwise, the pipe is closed and the child process exits.

[0098] Furthermore, assume that it is necessary to inject an executable program, which intercepts the "open" system call and replaces the / opt / app / prefix with the " / opt / fake_dir" prefix when the intercepted "open" system call is used to open a file with the / opt / app / prefix to open the " / opt / fake_dir / myfile" file, thereby achieving the opening of private data whose prefix is ​​not opt / app / .

[0099] Accordingly, Figure 4 This is another processing diagram provided by an embodiment of the present invention. Figure 4 As shown, the tracking program P3 can start the user program (i.e., the tracked program) based on the fork command, the TRACEME command, and the execve system call, and inject the binary (i.e., inject the preset injection program BIN1) into the parent process P1 (i.e., the target process) running the user program. Then, the binary injection operation is performed (i.e., injecting the preset executable program BIN2), and then the second filter and the second signal processing function (i.e., the preset injection program) are registered based on the preset injection program. Figure 4 Seccomp filter F2 and SIGSYS signal processing function FUN2 in P1). When P1 clones P2, the clone system call is intercepted based on the second filter F2, and TRACEME is set for the child process based on FUN2 to track the child process (i.e., the new target process). When the target process P2 registers the first filter, the first call request for registering the first filter for the target process P2 is intercepted based on the second filter F2, and exemption information is added to the first filter based on the second signal processing function FUN2, and the first filter with the added exemption information is registered. When P2 registers the first signal processing function, the third call request for registering the first signal processing function for the target process P2 is intercepted based on the second filter F2, and the function address of the registered first signal processing function FUN and the signal identifier handled are recorded based on the second signal processing function FUN2. When the executable program attempts to open a file and initiates an "open" system call, it is intercepted based on the third filter, and based on the third signal processing function, when the file prefix is ​​ / opt / app / , the / opt / app / prefix is ​​replaced with the " / opt / fake_dir" prefix, and the file is opened and the descriptor is returned. Since the first filter adds exemption information, the call request for requesting the "open" system call initiated by the executable program will not be intercepted, thereby enabling access to files in another directory " / opt / fake_dir / myfile" in the subroutine containing the first filter F1.

[0100] Of course, when the request address of the call request does not belong to the code injection area of ​​the executable program and the system call requested by the call request hits the first filter F1, the processing branch of the first filter F1 is entered.

[0101] Reference Figure 5 , shows a block diagram of a process processing device provided by an embodiment of the present invention, such as Figure 5 As shown, the process processing device may specifically include:

[0102] The first processing module 201 is configured to inject a preset executable program into a tracked target process based on the tracked process;

[0103] A generating module 202 is configured to determine exemption information corresponding to the executable program based on the injection location information of the executable program;

[0104] An adding module 203 is configured to determine exemption information corresponding to the executable program based on the injection location information of the executable program;

[0105] The exemption information is used to control the first filter to allow the executable program to make a system call.

[0106] Optionally, the generating module 202 is specifically configured to:

[0107] Obtaining the starting position and ending position of the code injection area of ​​the executable program;

[0108] Loading a preset exemption code template from a specified location; the exemption code template defines an exemption start position parameter item and an exemption end position parameter item;

[0109] The starting position and the ending position are written into the exemption starting position parameter item and the exemption ending position parameter item respectively to obtain the exemption information.

[0110] Optionally, the apparatus further comprises: a registration module, configured to register the second filter and the second signal processing function based on a preset injection program;

[0111] The adding module 203 is specifically used to:

[0112] In response to a first call request, if the first call request is used to register the first filter for the target process, intercepting the first call request based on the second filter;

[0113] adding the exemption information to the header of the first filter based on the second signal processing function;

[0114] A first filter to which the exemption information has been added is registered for the target process.

[0115] Optionally, the device further comprises:

[0116] a first interception module, configured to respond to a second call request and, if the second call request is for starting a new program specified by the target process, intercept the second call request based on the second filter;

[0117] A sending module is used to send notification information to the tracking process based on the second signal processing function to instruct the tracking process to inject a preset executable program into the target process corresponding to the new program and start execution.

[0118] Optionally, the device further comprises:

[0119] a second interception module, configured to respond to a third call request and, if the third call request is for registering a first signal processing function for the target process, intercept the third call request based on the second filter;

[0120] a recording module, configured to record, based on the second signal processing function, a function address of the first signal processing function and a signal identifier processed by the first signal processing function;

[0121] The second processing module is configured to call the first signal processing function based on the function address to process the notification signal when the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function.

[0122] Optionally, the device further comprises:

[0123] The third interception module is used to respond to the fourth call request. If the request address of the fourth call request does not belong to the code injection area of ​​the executable program, and the fourth call request corresponds to the first filter, the fourth call request is intercepted based on the first filter.

[0124] In summary, in the process processing device provided by the embodiment of the present invention, a preset executable program is injected into the tracked target process based on the tracking process. Based on the injection location information of the executable program, the exemption information corresponding to the executable program is determined. The target process is detected in real time. If the first filter requested to be registered by the target process is detected, the exemption information is added to the first filter to enable the normal operation of the executable program. The exemption information is used to control the first filter to allow the executable program to make system calls. In this way, by adding the exemption information of the executable program to the filter registered corresponding to the target process, the system call requested by the injected executable program will not be intercepted by the filter of the target process, thereby ensuring the normal operation of the executable program.

[0125] Reference Figure 6 Schematic diagram of the structure of the electronic device provided by the embodiment of the present invention. Figure 6 As shown, the electronic device includes: a processor, a memory, a communication interface and a communication bus.

[0126] The processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, which enables the processor to execute the process processing method of the above embodiment. The executable instructions can form a program.

[0127] An embodiment of the present invention provides a machine-readable medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the process processing method of the aforementioned embodiment.

[0128] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0129] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0131] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a predictable manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0134] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0135] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0136] Moreover, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or terminal device that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not preclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0137] The above is a detailed introduction to a process processing method, a process processing device, an electronic device and one or more readable media provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A process processing method, characterized in that: The method comprises: Injecting a preset executable program into the tracked target process based on the tracking process; Determining exemption information corresponding to the executable program based on the injection location information of the executable program; Performing real-time detection on the target process, and if a first filter requested to be registered by the target process is detected, adding the exemption information to the first filter to enable the executable program to run normally; The exemption information is used to control the first filter to allow the executable program to make a system call.

2. The method according to claim 1, characterized in that The determining, based on the injection location information of the executable program, exemption information corresponding to the executable program includes: Obtaining the starting position and ending position of the code injection area of ​​the executable program; Loading a preset exemption code template from a specified location; the exemption code template defines an exemption start position parameter item and an exemption end position parameter item; The starting position and the ending position are written into the exemption starting position parameter item and the exemption ending position parameter item respectively to obtain the exemption information.

3. The method according to claim 1 or 2, characterized in that The method further includes: registering a second filter and a second signal processing function based on a preset injection program; If the first filter requested to be registered by the target process is detected, adding the exemption information to the first filter includes: In response to a first call request, if the first call request is used to register the first filter for the target process, intercepting the first call request based on the second filter; adding the exemption information to the header of the first filter based on the second signal processing function; A first filter to which the exemption information has been added is registered for the target process.

4. The method according to claim 3, characterized in that The method further comprises: In response to a second call request, if the second call request is for starting a new program specified by the target process, intercepting the second call request based on the second filter; Notification information is sent to the tracking process based on the second signal processing function to instruct the tracking process to inject a preset executable program into the target process corresponding to the new program and start execution.

5. The method according to claim 3, characterized in that The method further comprises: In response to a third call request, if the third call request is used to register a first signal processing function for the target process, intercepting the third call request based on the second filter; recording, based on the second signal processing function, a function address of the first signal processing function and a signal identifier processed by the first signal processing function; In a case where the signal identifier of the received notification signal belongs to the signal identifier processed by the first signal processing function, the first signal processing function is called based on the function address to process the notification signal.

6. The method according to claim 1, characterized in that The method further comprises: In response to a fourth call request, if the request address of the fourth call request does not belong to the code injection area of ​​the executable program, and the fourth call request corresponds to hitting the first filter, the fourth call request is intercepted based on the first filter.

7. A process processing device, characterized in that: The device comprises: A first processing module is used to inject a preset executable program into the tracked target process based on the tracking process; A generating module, configured to determine exemption information corresponding to the executable program based on the injection location information of the executable program; an adding module, configured to perform real-time detection on the target process, and if a first filter requested to be registered by the target process is detected, add the exemption information to the first filter to enable the executable program to run normally; The exemption information is used to control the first filter to allow the executable program to make a system call.

8. The device according to claim 7, characterized in that The generation module is specifically used for: Obtaining the starting position and ending position of the code injection area of ​​the executable program; Loading a preset exemption code template from a specified location; the exemption code template defines an exemption start position parameter item and an exemption end position parameter item; The starting position and the ending position are written into the exemption starting position parameter item and the exemption ending position parameter item respectively to obtain the exemption information.

9. An electronic device, characterized in that: include: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store executable instructions, and the executable instructions enable the processor to execute the method according to any one of claims 1 to 6.

10. A machine-readable medium, characterized in that Instructions are stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 6.

Images