Mobile storage hardware protection method based on anti-debugging technology
By employing runtime detection, anti-debugging code injection, dynamic obfuscation, and multi-layer encryption techniques, the problem of traditional mobile storage hardware protection methods being bypassed is solved, thereby improving data security and protection capabilities.
Patent Information
- Application Number
- CN202410632133.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-21
- Publication Date
- 2026-01-27
AI Technical Summary
Traditional mobile storage hardware protection methods are vulnerable to being bypassed when faced with constantly evolving attack techniques, and cannot effectively prevent malicious debugging and reverse engineering, resulting in insufficient data security.
Anti-debugging technology is employed, which monitors storage devices through runtime detection mechanisms, injects anti-debugging code to interfere with debugger operation, and implements dynamic obfuscation and multi-layer encryption in critical data areas to improve protection capabilities.
It effectively interferes with the normal operation of the debugger, protects critical data, increases resistance to reverse engineering and attacks, and improves the protection performance of mobile storage hardware.
Smart Images
Figure CN121413038A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of mobile storage hardware protection technology, and in particular to a mobile storage hardware protection method based on anti-debugging technology. Background Technology
[0002] With the rapid development of mobile storage technology, users have increasingly higher requirements for the security of storage devices. However, traditional mobile storage hardware protection methods are gradually showing some problems when facing constantly evolving attack methods. In order to improve the resilience of mobile storage devices, researchers have turned their attention to anti-debugging technology, a technique that can effectively prevent malicious debugging and reverse engineering.
[0003] Traditional mobile storage hardware protection methods mainly include encryption algorithms, access control, and digital signatures. However, these methods are susceptible to being bypassed to some extent. For encryption algorithms, malicious attackers can exploit vulnerabilities or weak keys to crack them. While access control can restrict access to storage devices, it can still be bypassed in certain situations. Digital signatures are also vulnerable to forgery and tampering. Therefore, this invention proposes a mobile storage hardware protection method based on anti-debugging technology to address the above problems and improve the protection performance of mobile storage hardware. Summary of the Invention
[0004] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide a mobile storage hardware protection method based on anti-debugging technology. By monitoring and detecting storage devices in real time, any possible malicious injection behavior can be detected and blocked in a timely manner, thereby improving data security and protection capabilities.
[0005] To achieve the above objectives, the present invention provides the following solution: a mobile storage hardware protection method based on anti-debugging technology, comprising the following steps:
[0006] The runtime detection mechanism monitors the operation of mobile storage hardware and determines whether a debugging environment exists. The runtime detection mechanism includes register detection, software breakpoint detection, and exception handling detection.
[0007] If a debugging environment exists on the mobile storage hardware, anti-debugging code will be automatically injected to interfere with the normal operation of the debugger;
[0008] Dynamic obfuscation technology is used to obfuscate critical data areas of mobile storage hardware in order to protect the critical data.
[0009] Multi-layered encryption mechanisms are applied to the critical data areas to increase data complexity and improve defense against potential attacks.
[0010] Optionally, the register detection process is as follows: at the start of mobile storage hardware monitoring, a preliminary judgment is made as to whether there is interference from the debugger by checking whether the register is currently in a debug state;
[0011] The software breakpoint detection process is as follows: during the mobile storage hardware monitoring process, check whether the program's code area has been modified and whether there are interrupt instructions;
[0012] The anomaly handling detection process is as follows: monitor whether the debugger exhibits behavior when handling anomalies, and determine whether the debugger intervenes.
[0013] Optionally, the process of injecting anti-debugging code is as follows:
[0014] Select key function entry points, loop start points, or key code segments where the mobile storage hardware interacts with the debugger as injection points for the anti-debugging code;
[0015] Write the anti-debugging code containing instructions that interfere with the normal operation of the debugger, including software breakpoints, modifying register values, and jumping to meaningless addresses;
[0016] The anti-debugging code is injected into the injection point, causing the program to restart execution.
[0017] Optionally, the process of obfuscating critical data areas of mobile storage hardware using dynamic obfuscation technology is as follows:
[0018] Select key data from mobile storage hardware, encrypt the key data and use an XOR algorithm to dynamically obfuscate it to obtain an obfuscation key, and update the obfuscation key periodically;
[0019] When using the key data, the decryption function is called at the appropriate time to decrypt the key data back to its original value.
[0020] Optionally, the process of employing a multi-layered encryption mechanism is as follows:
[0021] Select the key data, use different encryption algorithms or encrypt the same data multiple times to increase data complexity and complete multi-layer encryption operations;
[0022] When using the critical data, it is checked whether the critical data has been encrypted in multiple layers. If the detection result is yes, corresponding security measures are taken.
[0023] This invention provides a mobile storage hardware protection method based on anti-debugging technology, and discloses the following technical effects:
[0024] 1. This invention monitors the debugging environment of mobile storage hardware and automatically injects anti-debugging code, which can interfere with the normal operation of the debugger, causing the debugger to lose control of the program and thus be unable to accurately track and analyze the program execution process, thereby improving the protection capability of mobile storage hardware.
[0025] 2. This invention uses dynamic obfuscation technology on critical data in mobile storage hardware, making it impossible for debuggers to accurately obtain plaintext data. This effectively protects critical data during program execution and increases resistance to reverse engineering and attacks.
[0026] 3. By employing multi-layer encryption technology, this invention ensures that even if an attacker manages to bypass one layer of encryption, they will still face a higher level of protection. This design increases the difficulty of attacks and enhances the defense against potential attacks and the security of the system.
[0027] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0029] Figure 1 This is a flowchart of a method provided in an embodiment of the present invention. Detailed Implementation
[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0031] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0032] like Figure 1 As shown, this invention provides a mobile storage hardware protection method based on anti-debugging technology, comprising the following steps:
[0033] 1. A runtime detection mechanism is used to monitor the operation of the mobile storage hardware and determine whether a debugging environment exists. This runtime detection mechanism includes register detection, software breakpoint detection, and exception handling detection. The specific implementation process is as follows:
[0034] 1.1 Register Inspection. At the beginning of runtime inspection, the system can determine whether it is currently in debug mode by checking certain specific registers. Common debug registers include DR0 to DR7, which are typically used to set hardware breakpoints. By checking the status of these registers, the system can initially determine whether there is interference from the debugger.
[0035] Check if DR0 to DR7 are set using CheckDebugRegisters:
[0036] mov eax,[DR0]
[0037] or eax,[DR1]
[0038] or eax,[DR2]
[0039] or eax,[DR3]
[0040] or eax,[DR6]
[0041] or eax,[DR7]
[0042] jnz DebugDetected
[0043] jmp DebugNotDetected
[0044] DebugDetected:
[0045] Handling situations where debug mode is detected. ...
[0047] DebugNotDetected:
[0048] Handling cases where debug mode is not detected. ...
[0050] 1.2 Software Breakpoint Detection. Debuggers typically use software breakpoints to monitor program execution. During runtime testing, it's possible to check if code regions have been modified, or if there are any signs of interrupt instructions (such as INT 3).
[0051] Check if there are interrupt instructions in the code region.
[0052] CheckSoftwareBreakpoint:
[0053] mov eax, [code_address]; code_address represents the starting address of the code region.
[0054] `cmp byte ptr[eax], 0xCC`; 0xCC is the machine code for INT 3.
[0055] je DebugDetected
[0056] jmp DebugNotDetected
[0057] 1.3 Exception Handling Detection. Debuggers may exhibit different behaviors when handling exceptions, such as pausing or altering the program's execution flow within the exception handler. By monitoring the exception handling process, the presence of debugger intervention can be detected.
[0058]
[0059] 2. If a debugging environment exists on the removable storage hardware, anti-debugging code is automatically injected to interfere with the normal operation of the debugger, preventing it from accurately tracking and analyzing the program execution process. The implementation process is as follows:
[0060] 2.1 Choosing the Injection Point: Selecting the appropriate location in the program to inject anti-debugging code is crucial. Typically, key function entry points, loop beginnings, or critical code segments that interact with the debugger are chosen as injection points.
[0061]
[0062] 2.2 Writing Anti-Debugging Code: Anti-debugging code should contain instructions that interfere with the normal operation of the debugger, such as software breakpoints, modifying register values, and jumping to meaningless addresses. These operations will cause the debugger to lose control of the program, making it difficult for the debugger to accurately trace the program's execution.
[0063]
[0064] 2.3 Injecting Anti-Debugging Code: Injecting anti-debugging code into selected injection points. This can be achieved by modifying the program's binary code or by dynamically injecting code into the process's memory at runtime.
[0065]
[0066]
[0067] 2.4 Bootstrap Execution: Finally, after injecting the anti-debugging code, the program needs to restart execution. This can be achieved by modifying the program's execution flow to jump to the address of the injection point.
[0068] Bootloader execution
[0069] StartProgram:
[0070] jmp InjectionPoint; jumps to the injection point and begins executing anti-debugging code.
[0071] The above steps complete the anti-debugging code injection process. This injection operation makes it difficult for debuggers to accurately trace the program's execution flow during debugging, thus improving the protection capabilities of removable storage hardware. It is important to note that to avoid disrupting the normal operation of the program, anti-debugging code injection needs to be handled with care, ensuring that the choice of injection point and the design of the anti-debugging code are reasonable.
[0072] 3. Utilizing dynamic obfuscation technology, critical data areas of the mobile storage hardware are obfuscated (this can be achieved by adding noise or obfuscation instructions to the critical data), making it impossible to accurately obtain plaintext data during debugging, thereby protecting the critical data. The specific implementation process is as follows:
[0073] 3.1 Selecting Critical Data: First, determine which data is considered critical in the program and needs to be obfuscated. This could be passwords, keys, sensitive configuration information, or other data essential to the application's security.
[0074] / / Example: Select a key: char encryptionKey[] = "MySecretKey123";
[0075] 3.2 Implement dynamic obfuscation algorithm:
[0076] The core idea of dynamic obfuscation is to encrypt and obfuscate critical data during program runtime to obtain an obfuscation key, and then decrypt the data when needed. Obfuscation algorithms can be symmetric encryption algorithms, XOR operations, hash functions, etc. This invention uses XOR operations for dynamic obfuscation:
[0077]
[0078] 3.3 Decrypting Key Data:
[0079] When the program is running, it decrypts critical data to restore its original value when needed.
[0080] This requires calling the decryption function at the appropriate time.
[0081]
[0082] 3.4 Use key data:
[0083] After decryption, the original critical data can be used securely for operations such as encryption, decryption, and authentication.
[0084]
[0085] 3.5 Update the obfuscation key regularly:
[0086] To increase the difficulty for attackers to crack the code, the obfuscation key is updated periodically. This means that the obfuscation key used in the dynamic obfuscation algorithm changes after a period of time, requiring attackers to re-analyze the program to obtain the new obfuscation key.
[0087]
[0088] Through the steps above, dynamic obfuscation of critical data can effectively protect critical data during program runtime, increasing resistance to reverse engineering and attacks. However, it should be noted that dynamic obfuscation does not completely prevent reverse engineering; it only increases the difficulty for attackers to obtain critical information.
[0089] 4. By employing multi-layered encryption mechanisms in the critical data areas, data complexity is increased, enhancing defense against potential attacks. Even if an attacker manages to bypass one layer of encryption, they will still face a higher level of protection. This design increases the difficulty of attacks and improves system security. The specific implementation process is as follows:
[0090] 4.1 Select the data to be detected:
[0091] First, determine which data requires multi-layered encryption. This is typically critical data within the program, such as passwords, keys, and sensitive configuration information.
[0092] / / Example: Select a key that needs to detect multiple layers of encryption.
[0093] char encryptedKey[]="EncryptedKey123";
[0094] 4.2 Implement multi-layered encryption:
[0095] Implementing multi-layered encryption on critical data involves using different encryption algorithms or encrypting the same data multiple times. This makes the data more complex and increases the difficulty of cracking it.
[0096]
[0097]
[0098] 4.3 Implement runtime detection algorithm:
[0099] During program execution, data is examined to determine whether it has undergone multiple layers of encryption. This may involve analyzing the patterns, characteristics, or statistical information of the encrypted data.
[0100]
[0101] 4.4 Integrated runtime detection:
[0102] When critical data needs to be used, a runtime detection algorithm should be integrated into the program to determine whether the data has undergone multiple layers of encryption. If multiple layers of encryption are detected, appropriate security measures can be taken, such as issuing alerts or blocking further operations.
[0103]
[0104] By following the steps above, runtime detection of multi-layered encryption can effectively identify and address multi-layered encryption scenarios during program execution, improving defense against potential attacks. It is important to note that the effectiveness of this method depends on the accuracy of the detection algorithm and its adaptability to different encryption layers.
[0105] Therefore, this invention provides a mobile storage hardware protection method based on anti-debugging technology, which improves data security and protection capabilities by real-time monitoring and detection of storage devices, timely detection and prevention of any possible malicious injection behavior.
[0106] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0107] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for protecting mobile storage hardware based on anti-debugging technology, characterized in that, Includes the following steps: The runtime detection mechanism monitors the operation of mobile storage hardware and determines whether a debugging environment exists. The runtime detection mechanism includes register detection, software breakpoint detection, and exception handling detection. If a debugging environment exists on the mobile storage hardware, anti-debugging code will be automatically injected to interfere with the normal operation of the debugger; Dynamic obfuscation technology is used to obfuscate critical data areas of mobile storage hardware in order to protect the critical data. Multi-layered encryption mechanisms are applied to the critical data areas to increase data complexity and improve defense against potential attacks.
2. The mobile storage hardware protection method based on anti-debugging technology according to claim 1, characterized in that: The register detection process is as follows: at the start of mobile storage hardware monitoring, by checking whether the register is currently in a debug state, it is initially determined whether there is interference from the debugger. The software breakpoint detection process is as follows: during the mobile storage hardware monitoring process, check whether the program's code area has been modified and whether there are interrupt instructions; The anomaly handling detection process is as follows: monitor whether the debugger exhibits behavior when handling anomalies, and determine whether the debugger intervenes.
3. A mobile storage hardware protection method based on anti-debugging technology according to claim 2, characterized in that, The process of injecting anti-debugging code is as follows: Select key function entry points, loop start points, or key code segments where the mobile storage hardware interacts with the debugger as injection points for the anti-debugging code; Write the anti-debugging code containing instructions that interfere with the normal operation of the debugger, including software breakpoints, modifying register values, and jumping to meaningless addresses; The anti-debugging code is injected into the injection point, causing the program to restart execution.
4. A mobile storage hardware protection method based on anti-debugging technology according to claim 3, characterized in that, The process of obfuscating critical data areas of mobile storage hardware using dynamic obfuscation technology is as follows: Select key data from mobile storage hardware, encrypt the key data and use an XOR algorithm to dynamically obfuscate it to obtain an obfuscation key, and update the obfuscation key periodically; When using the key data, the decryption function is called at the appropriate time to decrypt the key data back to its original value.
5. A mobile storage hardware protection method based on anti-debugging technology according to claim 4, characterized in that, The process of using a multi-layered encryption mechanism is as follows: Select the key data, use different encryption algorithms or encrypt the same data multiple times to increase data complexity and complete multi-layer encryption operations; When using the critical data, it is checked whether the critical data has been encrypted in multiple layers. If the detection result is yes, corresponding security measures are taken.