A method and system for obtaining the address of unexported callback functions based on pointer chain tracing

Abstract

This invention relates to the fields of software monitoring, security analysis, and debugging technology. Specifically, it discloses a method and system for obtaining the address of unexported callback functions based on pointer chain tracing. The method includes selecting a known exported function in the target process as an entry point based on a pre-generated configuration file, and attaching an eBPF uprobe probe program at the entry point. During the execution of the target process, the eBPF uprobe probe program captures the pointer of the top-level structure as a seed pointer, and reads the structure member pointers in memory layer by layer according to the pointer tracing chain. The loading base address of the module to which the target process belongs is obtained. Based on the loading base address and the absolute address of the callback function at runtime, the relative offset of the ELF file is obtained. After validating the relative offset of the ELF file, it is output as a usable hook point. This method overcomes symbol table limitations by obtaining the address of unexported functions through runtime pointer tracing.

Description

Technical Field

[0001] This invention relates to the fields of software monitoring, security analysis and debugging technology, specifically to a method and system for obtaining the address of unexported callback functions based on pointer chain tracing. Background Technology

[0002] In the fields of software monitoring, security analysis, and debugging, function hooking is a core technology for achieving deep system monitoring. Its basic principle is to intercept the execution flow of a target function, insert custom monitoring code, and capture key information such as function calls, parameter passing, and return values. Hooking function acquisition relies on symbol table location methods and manual disassembly / static binary analysis methods.

[0003] Symbol table location methods obtain function addresses through the symbol table of ELF files or dynamic libraries for analysis or hooking. However, they can only obtain exported symbols and cannot directly locate callback functions that are not exported within the library.

[0004] The working principle of manual disassembly / static binary analysis method: When the target function is not exported, analysts use reverse engineering tools (such as IDA Pro and Ghidra) to disassemble the binary file, and infer the function address or call path by manually analyzing the instruction flow and cross-references, thereby determining the hook point. However, it is inefficient, error-prone, highly dependent on human experience, difficult to automate and scale up deployment, and cannot adapt to frequent version iterations.

[0005] In existing technologies, the addresses of exported functions can be directly resolved through a symbol table (dynsym), which is suitable for exported symbols such as standard library functions and public interfaces. However, this only covers the surface level of software functionality and cannot delve into the core logic.

[0006] Modern software commonly adopts modular design, and many key functions are implemented in the following ways: function pointer callbacks in structures, indirect calls to internal static functions, and anonymous functions in the interface abstraction layer.

[0007] These unexported functions cannot be directly located through the symbol table, resulting in: limited Hook point selection, only surface-level interfaces can be monitored; inability to deeply trace the execution path of core business logic; and severely limited monitoring depth and accuracy. Summary of the Invention

[0008] The purpose of this invention is to provide a method and system for obtaining the address of an unexported callback function based on pointer chain tracing, so as to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] A method for obtaining the address of an unexported callback function based on pointer chain tracing, the method comprising:

[0011] Based on a pre-generated configuration file, a known exported function in the target process is selected as the entry point, and an eBPF uprobe probe program is mounted at the entry point. The configuration file contains a pointer tracing chain from the top-level structure to the target callback function and its member offset information.

[0012] When the target process is running, the eBPF uprobe probe program captures the pointer of the top-level structure as a seed pointer, and reads the pointers of the structure members in memory layer by layer according to the pointer tracing chain until the runtime absolute address of the unexported callback function is obtained;

[0013] Obtain the loading base address of the module to which the target process belongs, obtain the relative offset of the ELF file based on the loading base address and the absolute address of the callback function at runtime, and output the usable Hook point after validating the relative offset of the ELF file.

[0014] As a further embodiment of the present invention, the configuration file is generated in the following ways:

[0015] Perform static source code analysis on the target library or application to filter out exported functions that contain pointers to top-level structures;

[0016] Analyze whether the timing of the exported function call covers the execution cycle of the target callback function;

[0017] Record the pointer tracing chain from the top-level structure to the target callback function and the offsets of each member, and generate a versioned configuration file.

[0018] As a further embodiment of the present invention, in the pointer chain tracing step, a validity check is performed each time memory is read, including non-null judgment, address range check and memory accessibility check; if the check fails, the tracing is stopped and the abnormal information is recorded.

[0019] As a further embodiment of the present invention, the method for obtaining the loading base address includes:

[0020] Parse the / proc / directory of the target process <pid>The / maps file is used to extract the memory mapping start address of the module as the load base address;

[0021] If the module is a dynamic library, then the starting address of the dynamic library's loading is used as the base address;

[0022] If the module is a statically linked executable file, then the base address is the starting address of the executable file.

[0023] As a further aspect of the present invention, a Hook point management step is also included:

[0024] The verified Hook point information is stored in the local candidate library. The information includes the module name, version number, offset, process PID and parsing timestamp.

[0025] Based on the Hook point information in the candidate library, it is possible to dynamically mount eBPF uprobe or other monitoring tasks.

[0026] As a further embodiment of the present invention, the pointer tracking chain is a multi-layer nested structure pointer chain, wherein the member offset of each layer of structure is determined based on source code analysis of the target software version.

[0027] This invention also discloses a system for obtaining the address of an unexported callback function based on pointer chain tracing, used to implement the aforementioned method for obtaining the address of an unexported callback function based on pointer chain tracing. The system includes:

[0028] The entry point selection and probe deployment module is used to select a known exported function in the target process as the entry point based on a pre-generated configuration file, and to mount the eBPF uprobe probe program at the entry point. The configuration file contains a pointer tracing chain from the top-level structure to the target callback function and its member offset information.

[0029] The pointer chain tracing module is used to capture the pointer of the top-level structure as a seed pointer through the eBPF uprobe probe program when the target process is running, and read the pointers of the structure members in memory layer by layer according to the pointer tracing chain until the runtime absolute address of the unexported callback function is obtained.

[0030] The address normalization module is used to obtain the loading base address of the module to which the target process belongs, obtain the relative offset of the ELF file based on the loading base address and the absolute address of the callback function at runtime, and output the usable Hook point after validating the relative offset of the ELF file.

[0031] Compared with the prior art, the beneficial effect of the present invention is that it breaks through the symbol table limitation by obtaining the address of unexported functions through runtime pointer tracing;

[0032] Establish a systematic dynamic analysis process to reduce manual intervention and achieve automated positioning;

[0033] Low-overhead monitoring technology is used to ensure system stability and support production environment deployment. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0035] Figure 1 The flowchart illustrates the entry function filtering provided in this embodiment of the invention.

[0036] Figure 2 This is a flowchart of pointer chain tracing provided in an embodiment of the present invention.

[0037] Figure 3 This is a flowchart illustrating the process of calculating the relative offset of an ELF file, as provided in an embodiment of the present invention. Detailed Implementation

[0038] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0039] Figure 1 This is a flowchart of a method for obtaining the address of an unexported callback function based on pointer chain tracing. In this embodiment of the invention, the method for obtaining the address of an unexported callback function based on pointer chain tracing includes:

[0040] Based on a pre-generated configuration file, a known exported function in the target process is selected as the entry point, and an eBPF uprobe probe program is mounted at the entry point. The configuration file contains a pointer tracing chain from the top-level structure to the target callback function and its member offset information.

[0041] When the target process is running, the eBPF uprobe probe program captures the pointer of the top-level structure as a seed pointer, and reads the pointers of the structure members in memory layer by layer according to the pointer tracing chain until the runtime absolute address of the unexported callback function is obtained;

[0042] Obtain the loading base address of the module to which the target process belongs, obtain the relative offset of the ELF file based on the loading base address and the absolute address of the callback function at runtime, and output the usable Hook point after validating the relative offset of the ELF file.

[0043] In this embodiment, a known exported function in the target library or application is used as the entry point. A predefined pointer tracing chain from the top-level structure to the target callback function is analyzed using static structure analysis, and the tracing chain and exported function information are packaged into a versioned configuration. At runtime, the system automatically reads this configuration, parses the target process's load base address and symbol offset, and automatically completes the mounting and lifecycle management of the eBPF uprobe according to the configuration. This allows for the real-time, low-intrusion acquisition of the actual addresses of unexported callback functions during program execution.

[0044] The top-level structure refers to the initial structure of a nested pointer chain, whose pointer can be obtained through exported function parameters / return values ​​(such as the SSL structure of OpenSSL).

[0045] The target structure refers to the final structure that stores pointers to unexported callback functions (such as the SSL3_ENC_METHOD structure in OpenSSL).

[0046] A tracing chain refers to a sequence of structures from the top-level structure to the target structure containing "unexported callback function pointers." It requires source code analysis to generate Hook configuration information. For example, the following tracing chain can be obtained from the OpenSSL 1.1.1d source code:

[0047] ;

[0048] The load base address refers to the starting address of the target module (ESF executable for static libraries, .so files for dynamic libraries) in the process's memory, denoted as B (via / proc / ). <pid>(Get from / maps).

[0049] The relative offset of an ELF file refers to the offset of the address of an unexported callback function relative to the starting position of the target module file, denoted as offset=addr-B (addr is the runtime address). This offset can be directly used for Hooking.

[0050] like Figure 1 As shown, in a preferred embodiment of the present invention, the configuration file is generated in the following manner:

[0051] Perform static source code analysis on the target library or application to filter out exported functions that contain pointers to top-level structures;

[0052] Analyze whether the timing of the exported function call covers the execution cycle of the target callback function;

[0053] Record the pointer tracing chain from the top-level structure to the target callback function and the offsets of each member, and generate a versioned configuration file.

[0054] In this embodiment, static source code analysis is performed on the target library or application to locate key functions. Function parameters and return value types are analyzed to filter functions containing pointers to top-level structures (such as SSL*, custom structure pointers, etc.). The timing of function calls is confirmed to cover the target callback or critical logic execution phase to ensure the collection of necessary pointers. The analysis results are generated into a standardized configuration file for subsequent reuse.

[0055] The program reads the configuration file and uses eBPF uprobe technology to mount the eBPF probe program to the target location of the target process according to the configuration information.

[0056] Taking the address location of SSL3_ENC_METHOD->do_write (pointing to the unexported function ssl3_handshake_write) in OpenSSL as an example, the detailed implementation process is as follows:

[0057] Filter exported functions based on source code.

[0058] Selection criteria (using the OpenSSL library as an example): ① It is an OpenSSL exported function (with a symbol table available, such as SSL_do_handshake, assuming the symbol is 0x12340); ② The parameter contains a pointer to the top-level SSL structure (the function prototype of SSL_do_handshake is int SSL_do_handshake(SSL *s), where s is an SSL* pointer); ③ The timing of the call covers the execution cycle of the target callback function (SSL_do_handshake is called during the TLS handshake, covering the execution phase of do_write).

[0059] The final choice was the OpenSSL exported function SSL_do_handshake as the entry function, tracing the chain: SSL→SSL_METHOD→SSL3_ENC_METHOD→do_write, with offsets of [off1,off2,off3], and generating a configuration file.

[0060] The program reads the configuration file and uses eBPF uprobe technology to mount the eBPF program to the "function entry point" (or "return point") of the target process's SSL_do_handshake. Here, the entry point is chosen to ensure that the initial SSL* pointer can be obtained.

[0061] like Figure 2 As shown in the preferred embodiment of the present invention, in the pointer chain tracing step, a validity check is performed each time memory is read, including non-null judgment, address range check and memory accessibility check; if the check fails, the tracing is stopped and the abnormal information is recorded.

[0062] The pointer tracing chain is a multi-level nested structure pointer chain, where the member offset of each level of structure is determined based on source code analysis of the target software version.

[0063] In this embodiment, for each software version, a structure member offset chain from the top-level structure to the target callback function is defined and recorded in a configuration file. This supports tracing chain management for different versions and modules, allowing for flexible user expansion.

[0064] The kernel-mode eBPF probe program reads the pointers of the structure members sequentially according to the tracing chain configuration until it obtains the actual address of the callback function.

[0065] Each memory read performs a validity check to ensure that the pointer is not null and the address falls within the memory range accessible to the process.

[0066] If any pointer in the tracing chain is null or out of bounds, the tracing should be stopped immediately, and the abnormal information should be recorded to ensure the stability of the monitoring system.

[0067] The successfully parsed callback function address, along with its module and process PID, is reported for use by the address normalization layer. After the kernel-mode probe (such as eBPF uprobe) captures the top-level structure pointer or the final callback function address, it reports it to user mode through the RINGBUF or PERF_EVENT_ARRAY channels provided by the kernel. The reported events include metadata such as the callback function address and process PID, ensuring that the normalization layer can correctly calculate the offset and perform verification.

[0068] Based on the tracing chain configuration, memory is read layer by layer from the top-level structure pointer to finally obtain the runtime address of the unexported callback function.

[0069] Taking the address location of SSL3_ENC_METHOD->do_write (pointing to the unexported function ssl3_handshake_write) in OpenSSL as an example, the detailed implementation process is as follows:

[0070] Starting from the "seed pointer P0", read memory layer by layer along the tracing chain to obtain the runtime address addr of the unexported callback function.

[0071] Program execution flow:

[0072] The eBPF procedure is triggered: the eBPF procedure reads the seed pointer P0. For example, the first parameter SSL*s in SSL_do_handshake is the seed pointer P0.

[0073] Based on the tracing chain, the eBPF program reads the pointer tracing chain configuration issued by the kernel-mode eBPF probe program from the BPF maps, and sequentially parses the offset relationships of each layer's structure members. Using the "parent layer structure pointer" as the base address, the program reads the pointers of the next layer layer by layer through offset calculation until the runtime address of the target callback function is resolved. Each access undergoes a validity check, including non-null checks, address range verification, and memory accessibility verification, to prevent out-of-bounds access or exceptions that could cause system crashes. If an exception occurs (such as a null or out-of-bounds pointer), the probe immediately stops tracing and records or reports the exception information to user space to ensure system stability.

[0074] Example: The eBPF program reads the tracking chain information from the BPF maps.

[0075] The tracing chain is: SSL → SSL_METHOD → SSL3_ENC_METHOD → do_write.

[0076] Offset values: [off1,off2,off3].

[0077] The eBPF program reads the information as follows:

[0078] Step 1: Read P1 = *(P0 + off1) — that is, the SSL_METHOD* pointer pointed to by SSL*s.

[0079] Step 2: Read P2 = *(P1 + off2) — that is, the pointer SSL3_ENC_METHOD* that SSL_METHOD* points to.

[0080] (Repeated secure read and verification logic)

[0081] Step 3: Read addr=*(P2+off3) — that is, the runtime address of the do_write callback function pointed to by SSL3_ENC_METHOD* (e.g., addr=0x7f0000023450);

[0082] Data transmission: Structure valid addr, PID and other data and transmit them to user space through a transmission channel (such as eBPF perf_event).

[0083] like Figure 3 As shown, in a preferred embodiment of the present invention, the method for obtaining the loading base address includes:

[0084] Parse the / proc / directory of the target process <pid>The / maps file is used to extract the memory mapping start address of the module as the load base address;

[0085] If the module is a dynamic library, then the starting address of the dynamic library's loading is used as the base address;

[0086] If the module is a statically linked executable file, then the base address is the starting address of the executable file.

[0087] It also includes Hook point management steps:

[0088] The verified Hook point information is stored in the local candidate library. The information includes the module name, version number, offset, process PID and parsing timestamp.

[0089] Based on the Hook point information in the candidate library, it is possible to dynamically mount eBPF uprobe or other monitoring tasks.

[0090] In this embodiment, / proc / is parsed. <pid>The / maps file contains the base address for loading the target module (dynamic library .so or static ELF).

[0091] For statically executable programs, the base address is the starting address where the executable file is loaded.

[0092] Subtract the module base address from the absolute address of the callback function to generate the relative offset of the ELF file, which is used for subsequent Hook deployment.

[0093] Validity check: Check whether the offset falls within the module loading range and meets the instruction boundary alignment requirements.

[0094] Information such as offset values ​​and process PIDs are stored in the Hook candidate library for use in subsequent Hook or monitoring tasks.

[0095] Taking the address location of SSL3_ENC_METHOD->do_write (pointing to the unexported function ssl3_handshake_write) in OpenSSL as an example, the detailed implementation process is as follows:

[0096] Dynamically obtain the module loading base address:

[0097] Kernel-mode eBPF probe program parses / proc / <pid>The / maps file (for Linux systems) filters memory mapping records for target modules (dynamic libraries or executables).

[0098] For dynamic libraries, such as libssl.so, their load address is chosen as base address B.

[0099] For statically compiled executables (without independent dynamic libraries), the starting load address of the process's ELF file is selected as the base address B.

[0100] ELF file relative offset calculation:

[0101] Subtract the module base address B from the absolute address addr of the runtime callback function to obtain the relative offset offset of the ELF file.

[0102] In dynamic library scenarios: offset=addr-B, which is suitable for randomized base addressing (ASLR) when loaded by different processes.

[0103] The same principle applies to static ELF executables, ensuring that the offset can still be reused in different process instances.

[0104] The system automatically verifies whether the offset value falls within the code segment of the target module.

[0105] Hook point verification and management:

[0106] The kernel-mode eBPF probe program comprehensively verifies the calculated offset, module name, and library version to confirm that the callback function address is valid and can be mounted. Verified hook points are stored in a local candidate library, recording information including version, offset, process PID, and parsing timestamp, facilitating subsequent dynamic updates or automatic matching.

[0107] Example:

[0108] Parse the / proc / PID / maps file, filter the loading records of the target module libssl.so (e.g., 7f0000010000-7f0000030000r-xp00000000 08:01 12345 / usr / lib / libssl.so), and take the starting address as the loading base address B=0x7f0000010000;

[0109] If it is a statically compiled OpenSSL (without libssl.so, the OpenSSL code is integrated into the ELF executable file app), then the loading record of app in / proc / PID / maps is parsed, and the base address B is the starting address of app loading (such as 0x400000).

[0110] In a dynamic library scenario (libssl.so): offset=addr-B=0x7f0000023450-0x7f0000010000=0x13450; In a static ELF executable scenario (app): if addr=0x413450 and B=0x400000, then offset=0x13450.

[0111] Verify the Hook point and store offset=0x13450, module name (libssl.so / app), and library version (OpenSSL1.1.1) in the local Hook point candidate library. The Hook can be mounted directly based on this offset later (e.g., eBPF uprobe is mounted to libssl.so+0x13450).

[0112] This invention also provides a system for obtaining the address of an unexported callback function based on pointer chain tracing, the system comprising:

[0113] The entry point selection and probe deployment module is used to select a known exported function in the target process as the entry point based on a pre-generated configuration file, and to mount the eBPF uprobe probe program at the entry point. The configuration file contains a pointer tracing chain from the top-level structure to the target callback function and its member offset information.

[0114] The pointer chain tracing module is used to capture the pointer of the top-level structure as a seed pointer through the eBPF uprobe probe program when the target process is running, and read the pointers of the structure members in memory layer by layer according to the pointer tracing chain until the runtime absolute address of the unexported callback function is obtained.

[0115] The address normalization module is used to obtain the loading base address of the module to which the target process belongs, obtain the relative offset of the ELF file based on the loading base address and the absolute address of the callback function at runtime, and output the usable Hook point after validating the relative offset of the ELF file.

[0116] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.< / pid> < / pid> < / pid> < / pid> < / pid>

Claims

1. A method for obtaining an address of a non-exported callback function based on a pointer chain tracking, characterized in that, The method comprises: Based on the pre-generated configuration file, a known exported function in the target process is selected as an entry point, and an eBPF uprobe probe program is mounted at the entry point, the configuration file containing a pointer tracking chain from a top-level structure to a target callback function and member offset information thereof; During runtime of the target process, a pointer of the top-level structure is captured as a seed pointer by the eBPF uprobe probe program, and a structure member pointer in the memory is read layer by layer according to the pointer tracking chain until a runtime absolute address of an unexported callback function is obtained; A load base address of a module belonging to the target process is obtained, and an ELF file relative offset is obtained based on the load base address and the runtime absolute address of the callback function, and the ELF file relative offset is verified for validity and output as a usable Hook point; The generation mode of the configuration file comprises: Static source code analysis is performed on a target library or application program to screen out an exported function containing a top-level structure pointer; Whether the call timing of the exported function covers the execution period of a target callback function is analyzed; A pointer tracking chain from the top-level structure to the target callback function and member offsets of each layer are recorded, and a versioned configuration file is generated; In the pointer chain tracking step, legality verification is performed each time the memory is read, including non-empty judgment, address range verification and memory accessibility verification; if the verification fails, the tracking is stopped and abnormal information is recorded; The load base address acquisition mode comprises: parsing / proc / of the target process <pid> / maps file, the memory mapping start address of the module is extracted as the load base address;< / pid> If the module is a dynamic library, the load start address of the dynamic library is taken as the base address; If the module is a statically linked executable file, the load start address of the executable file is taken as the base address.

2. The method of claim 1, wherein the method further comprises: It also includes a Hook point management step: The Hook point information that passes the verification is stored in a local candidate library, and the information includes module name, version number, offset, process PID and analysis timestamp; Based on the Hook point information in the candidate library, subsequent dynamic mounting of eBPF uprobe or other monitoring tasks is supported.

3. The method of claim 1, wherein the method further comprises: The pointer tracking chain is a multi-layer nested structure pointer chain, wherein the member offset of each layer of structure is determined based on source code analysis of the target software version.

4. A system for obtaining an address of an unexported callback function based on pointer chain chasing, for implementing the method for obtaining an address of an unexported callback function based on pointer chain chasing according to any one of claims 1-3, characterized in that, The system comprises: An entry point selection and probe deployment module for selecting a known exported function in a target process as an entry point based on a pre-generated configuration file, and mounting an eBPF uprobe probe program at the entry point, the configuration file containing a pointer tracking chain from a top-level structure to a target callback function and member offset information thereof; A pointer chain tracking module for capturing a pointer of the top-level structure as a seed pointer by the eBPF uprobe probe program during runtime of the target process, and reading a structure member pointer in the memory layer by layer according to the pointer tracking chain until a runtime absolute address of an unexported callback function is obtained; An address normalization module is configured to obtain a load base of a module to which the target process belongs, obtain an ELF file relative offset based on the load base and a callback function runtime absolute address, and output the ELF file relative offset as a usable hook point after validity verification.

Images