Dynamic library mapping loading method and device, electronic equipment and storage medium
By hijacking kernel module functions during dynamic library loading and expanding the virtual address space, the problem of limited jump range in existing technologies is solved, enabling long jump calls of dynamic libraries in Linux and Windows systems, thus improving applicability and efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-04
- Publication Date
- 2026-03-13
AI Technical Summary
Existing technologies for jump methods in dynamic libraries have limitations in terms of applicability and effectiveness in compact code segments. In particular, in Linux and Windows systems, PLT/GOT hijacking methods and short jump replacement methods cannot be applied to all function calls, and the continuous loading logic of the ld.so library makes it difficult to insert jump sections.
By hijacking the dynamic library mapping function in the kernel module during the dynamic library loading process, the target mapping program is used to expand the virtual address space and create an extended address range to achieve long jump calls, thus avoiding modification of the original loading process and additional call overhead.
It expands the jump scope, improves applicability and versatility, and reduces system overhead without affecting the original dynamic library loading process, making it suitable for jump control of any function.
Smart Images
Figure CN121658098A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and more specifically, to a method, apparatus, electronic device, and storage medium for mapping and loading dynamic libraries. Background Technology
[0002] In modern operating systems, dynamic shared libraries (DLLs) are widely used to implement program modularization, code reuse, and runtime functionality extension. In Linux's ELF (Executable and Linkable Format Dynamic Library) or Windows' PE (Portable Executable Dynamic Library) formats, external function calls are typically implemented through the Procedure Linkage Table (PLT) and the Global Offset Table (GOT). On the first call, the PLT jumps to the dynamic linker (e.g., ld.so) to resolve the actual address; subsequent calls jump directly to the PLT.
[0003] Currently, commonly used jump methods include PLT / GOT hijacking and short jump replacement. PLT / GOT hijacking modifies the GOT entry to point to the hook function, but this method only applies to functions called via GOT, limiting its applicability. Short jump replacement replaces short jumps with long jumps by patching code and inserting long jump instructions into free memory areas. However, this method requires reserving free space and is ineffective for compact code segments. The internal implementation logic of the ld.so library is continuously loaded, and dynamic libraries are often compact.
[0004] Therefore, the above methods have significant limitations. Summary of the Invention
[0005] The purpose of this application is to address the shortcomings of the prior art by providing a dynamic library mapping and loading method, electronic device, and storage medium, so as to complete the loading of the extended address range without modifying the original dynamic library loading process and without generating additional call overhead, thereby realizing long jump calls of the dynamic library based on the extended address range.
[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a method for mapping and loading a dynamic library, including: Load kernel modules; During dynamic library loading, the dynamic library mapping function in the kernel module is hijacked to run the target mapping program; When the target mapping program runs, it determines the virtual address range based on the storage length required by the dynamic library. The virtual address range includes: the address range corresponding to the storage length and the extended address range. The dynamic library is mapped to the address range corresponding to the storage length, and instruction jumps are performed based on the extended address range.
[0007] Optionally, the step of hijacking the dynamic library mapping function in the kernel module to run the target mapping program during dynamic library loading includes: When the dynamic library is loaded, the dynamic library mapping function is hijacked by the interception instruction in the kernel module to run the target mapping program.
[0008] Optionally, the step of hijacking the dynamic library mapping function to run the target mapping program by intercepting instructions in the kernel module when the dynamic library is loaded includes: Run the dynamic library loader. When the dynamic library loader reaches the intercept instruction, it jumps to the location of the target mapping program that replaces the dynamic library mapping function. Run the target mapping program.
[0009] Optionally, determining the virtual address range based on the required storage length of the dynamic library includes: The required storage length of the dynamic library is determined based on its file size. Determine the initial address range of the dynamic library based on the required storage length of the dynamic library; The virtual address range is determined based on the initial address range of the dynamic library and the preset address range adjustment strategy.
[0010] Optionally, determining the virtual address range based on the initial address range of the dynamic library and a preset address range adjustment strategy includes: According to preset address adjustment parameters, the length of the initial address interval is adjusted to obtain the target adjustment address; the target adjustment address is less than the start address or greater than the end address of the initial address interval. The virtual address range is obtained based on the start address or end address in the initial address range and the target adjustment address; the start address of the extended address range in the virtual address range overlaps with the end address of the address range corresponding to the storage length, or the end address of the extended address range overlaps with the start address of the address range corresponding to the storage length. Optionally, determining the virtual address range based on the initial address range of the dynamic library and a preset address range adjustment strategy includes: The virtual address range is determined based on the preset extended address size and the initial address range.
[0011] Optionally, mapping the dynamic library to the address range corresponding to the storage length includes: Parse the dynamic library to obtain the file data contained in the dynamic library; Write the file data into the address range corresponding to the storage length, and configure the data permissions for the mapped data of different address ranges within the address range.
[0012] Optionally, the extended address range is an executable memory region; The extended address range is used to control the execution of long jump operations of the dynamic library.
[0013] Optionally, the instruction jump based on the extended address range includes: A preset jump instruction is written into the extended address range, and the jump instruction points to the target address.
[0014] Secondly, embodiments of this application also provide a dynamic library mapping and loading device, including: a loading module, an interception module, a determination module, and a processing module; The loading module is used to load the kernel module; The interception module is used to hijack the dynamic library mapping function in the kernel module to run the target mapping program when the dynamic library is loaded. The determining module is used to determine a virtual address range based on the storage length required by the dynamic library when the target mapping program is running. The virtual address range includes: the address range corresponding to the storage length and the extended address range. The processing module is used to map the dynamic library to the address range corresponding to the storage length, and to perform instruction jumps based on the extended address range.
[0015] Optionally, the loading module is specifically used to hijack the dynamic library mapping function through interception instructions in the kernel module to run the target mapping program when the dynamic library is loaded.
[0016] Optionally, the loading module is specifically used to run a dynamic library loader. When the dynamic library loader runs to the intercept instruction, it jumps to the location of the target mapping program that replaces the dynamic library mapping function. Run the target mapping program.
[0017] Optionally, the determining module is specifically used to determine the required storage length of the dynamic library based on the file size of the dynamic library; Determine the initial address range of the dynamic library based on the required storage length of the dynamic library; The virtual address range is determined based on the initial address range of the dynamic library and the preset address range adjustment strategy.
[0018] Optionally, the determining module is specifically used to adjust the length of the initial address interval according to a preset address adjustment parameter to obtain a target adjustment address; the target adjustment address is less than the starting address in the initial address interval or greater than the ending address in the initial address interval; The virtual address range is obtained based on the start address or end address in the initial address range and the target adjustment address; the start address of the extended address range in the virtual address range overlaps with the end address of the address range corresponding to the storage length, or the end address of the extended address range overlaps with the start address of the address range corresponding to the storage length.
[0019] Optionally, the determining module is specifically used to determine the virtual address range based on the preset extended address size and the initial address range.
[0020] Optionally, the processing module is specifically used to parse the dynamic library and obtain the file data contained in the dynamic library; Write the file data into the address range corresponding to the storage length, and configure the data permissions for the mapped data of different address ranges within the address range.
[0021] Optionally, the extended address range is an executable memory region; The extended address range is used to control the execution of long jump operations of the dynamic library.
[0022] Optionally, the processing module is specifically used to write a preset jump instruction into the extended address range, the jump instruction pointing to the target address.
[0023] Thirdly, embodiments of this application provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to implement the dynamic library mapping and loading method provided in the first aspect.
[0024] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the dynamic library mapping and loading method provided in the first aspect.
[0025] The beneficial effects of this application are: This application provides a method, apparatus, electronic device, and storage medium for mapping and loading dynamic libraries, including: loading a kernel module; hijacking the dynamic library mapping function in the kernel module to run a target mapping program during dynamic library loading; determining a virtual address range based on the required storage length of the dynamic library during runtime; mapping the dynamic library to the address range corresponding to the storage length; and performing instruction jumps based on the extended address range. Based on this method, the creation of the extended address range is automatically triggered by the kernel module during the dynamic library mapping function call phase, without the user-mode program being aware of it. It does not affect the original dynamic library loading process, does not rely on free memory patch areas, solves the failure problem of traditional methods in compact code segments, and improves the versatility of the solution. Furthermore, hijacking is triggered only once during dynamic library loading, and no additional system calls or frequent interventions are required subsequently, significantly reducing overhead.
[0026] Furthermore, the extended address range created by this method is allocated on demand and used only for performing long jump operations, not for mapping dynamic library files, resulting in a smaller space footprint. The loading of the extended address range is based on the existing dynamic library loading mechanism, with minimal overhead. Since the extended address range is a contiguous address range immediately following the initial address range, the addresses are relatively fixed.
[0027] By uniformly expanding the address range during the dynamic library loading stage and adopting a function entry-level hijacking mechanism, the dependency on specific linking structures such as GOT / PLT is eliminated. Therefore, it is possible to implement jump control on any function in the dynamic library, which significantly improves the applicability and versatility of the solution. Attached Figure Description
[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0029] Figure 1 A flowchart illustrating a dynamic library mapping and loading method provided in an embodiment of this application; Figure 2 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; Figure 3 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; Figure 4 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; Figure 5 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; Figure 6 This application provides a schematic diagram illustrating data mapping within a virtual address range, as part of an embodiment of the present application. Figure 7 This is a schematic diagram illustrating another data mapping in a virtual address range provided in an embodiment of this application; Figure 8 A schematic diagram of a dynamic library mapping and loading device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.
[0031] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0032] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.
[0033] In modern operating systems, shared libraries (DLLs) are widely used for modular program design and resource reuse. In Linux systems based on the Executable and Linkable Format (ELF) or Windows systems based on the Portable Executable (PE) format, function calls in DLLs are typically implemented using the Procedure Linkage Table (PLT) and the Global Offset Table (GOT). Upon the first call, a jump is made via the PLT to the dynamic linker (e.g., ld.so), which resolves the actual address of the target function and fills the GOT. Subsequent calls directly use the GOT for jumps, improving execution efficiency.
[0034] Unconditional jump instructions can be used without corrupting the register context. However, unconditional jump instructions are short jump instructions and often have a maximum jump address limit. On x86, this is represented by the JMP instruction, with a maximum range of ±2GB. On the ARMv8 architecture, it is represented by the B instruction, with a range of only ±128MB.
[0035] Currently, the mainstream redirection methods mainly include the following two categories: 1. PLT / GOT table hijacking This method intercepts function calls by modifying GOT entries to point to user-defined hook functions. Since it only involves data page modifications, the operation is simple and requires no changes to the code.
[0036] Limitations: This method only applies to functions indirectly called via GOT, and is ineffective for direct calls or internal functions, thus limiting its applicability.
[0037] 2. Short jump instruction replacement method (Trampoline Patching) This method replaces short jumps with long jumps by patching code and inserts long jump instructions using free memory areas. However, this method requires available memory space and is not suitable for highly compact or randomly laid-out dynamic libraries. To ensure available space, the loading order of dynamic libraries needs to be rearranged, which brings additional complexity and compatibility issues.
[0038] Furthermore, considering that dynamic libraries on the ARM architecture are generally loaded by the statically linked ld.so file, whose implementation logic involves continuous mapping and step-by-step permission settings, resulting in a compact overall structure and a lack of space for insertion, attempting to intervene in the loading process at the ld.so level to insert jump sections presents two major challenges: Recompiling ld.so involves modifying core system components, which is difficult to deploy and has low acceptance. Using ptrace for interception: While it allows monitoring of loading behavior in user space, it introduces significant runtime overhead and impacts system performance.
[0039] Based on this, this solution provides a mapping loading method for dynamic libraries. By combining kernel-level hijacking technology during the dynamic library loading process to achieve seamless intervention, it dynamically expands the virtual address space to create a jump extension region, thus solving the fundamental problem of limited jump instruction range in dynamic libraries. This allows the loading of the jump extension region to be completed without modifying the original dynamic library loading process or incurring additional call overhead, thereby enabling long jump calls to the dynamic library based on the jump extension region.
[0040] Figure 1 This application provides a flowchart illustrating a dynamic library mapping and loading method; the execution subject of this method can be a computer device, such as... Figure 1 As shown, the method includes: S101, Load kernel module.
[0041] In this embodiment, the kernel module is used to monitor the calls to dynamic library mapping functions during the dynamic library loading process, so as to intercept the calls to dynamic library mapping functions and achieve non-intrusive virtual address space expansion.
[0042] Before loading the dynamic library, the kernel module is loaded first, so that the kprobe probe can be deployed before the dynamic library is loaded. In this way, when the dynamic library mapping function is first detected during the dynamic library loading process, it can intervene instantly and expand the virtual address space of the dynamic library. This achieves the goal of creating a jump extension area for the dynamic library to implement long jump calls without affecting the original loading process of the dynamic library.
[0043] Optionally, after system startup or before application execution, a kernel module can be loaded using a loading command to register and initialize a kprobe probe point. The kprobe probe point is used to intercept calls to specified functions. In this scheme, the kprobe probe point can be used to intercept calls to dynamically mapped functions.
[0044] S102. When the dynamic library is loaded, hijack the dynamic library mapping function in the kernel module to run the target mapping program.
[0045] Dynamic library mapping functions can refer to the `mmap` loading function in the kernel. The `mmap` loading function is a set of core functions responsible for mapping files or devices into the process's virtual address space. When loading a dynamic library, the `mmap` loading function is first called to map the dynamic library's file data into the process's virtual address space. That is, the `mmap` loading function allocates a contiguous range of virtual memory addresses for the dynamic library, mapping ELF or PE format dynamic library files (such as .text code segments) page by page into this virtual memory address range, achieving on-demand paging loading for subsequent execution. Afterwards, permissions are set for different address ranges within the virtual memory address range to create read-only data segments, read-write data segments, and private data segments, etc.
[0046] Optionally, by monitoring calls to dynamic library mapping functions, the calls to these functions can be intercepted, and upon interception, a target mapping program can be triggered to run. The target mapping program is used to replace or extend the mapping behavior of the original dynamic library mapping function, thereby enabling customized allocation of the mapped virtual address space for the dynamic library.
[0047] In other words, the target mapping program is the key control code injected into the mmap loading function call flow of the kernel module. It can implement a new virtual address space allocation strategy without changing the original loading process of the dynamic library.
[0048] S103. When the target mapping program is running, it determines the virtual address range based on the storage length required by the dynamic library.
[0049] The virtual address range includes: the address range corresponding to the storage length and the extended address range.
[0050] In some embodiments, during the execution of the target mapping program, the virtual address range required for dynamic library mapping can be determined based on the storage length required by the dynamic library.
[0051] The required storage length for a dynamic library can refer to the file size of the dynamic library.
[0052] By executing the target mapping program of this scheme, the determined virtual address range can include the address range corresponding to the storage length and the extended address range. The address range corresponding to the storage length is used to store the original file of the dynamic library, while the extended address range is used to implement long jump calls of the dynamic library.
[0053] S104. Map the dynamic library to the address range corresponding to the storage length, and perform instruction jumps based on the extended address range.
[0054] Based on the virtual address range determined above, dynamic library files can be mapped to the address range corresponding to the storage length, while the extended address range is used for instruction jumps.
[0055] In summary, the dynamic library mapping and loading method provided in this embodiment includes: loading a kernel module; hijacking the dynamic library mapping function in the kernel module to run the target mapping program during dynamic library loading; determining the virtual address range based on the storage length required by the dynamic library during runtime; mapping the dynamic library to the address range corresponding to the storage length; and performing instruction jumps based on the extended address range. Based on this method, the creation of the extended address range is automatically triggered by the kernel module during the dynamic library mapping function call phase, without the user-mode program being aware of it. It does not affect the original dynamic library loading process, does not rely on free memory patch areas, solves the failure problem of traditional methods in compact code segments, and improves the versatility of the solution. Furthermore, since hijacking is triggered only once during dynamic library loading, no additional system calls or frequent interventions are required subsequently, significantly reducing overhead.
[0056] Optionally, in step S102, hijacking the dynamic library mapping function in the kernel module to run the target mapping program during dynamic library loading includes: hijacking the dynamic library mapping function to run the target mapping program through interception instructions in the kernel module during dynamic library loading.
[0057] Optionally, during kernel module initialization, the function pointers of the corresponding entries for dynamically mapped functions in the system call table can be redirected, or interception instructions can be injected into the function entry points of dynamically mapped functions. This achieves interception of calls to dynamically mapped functions.
[0058] In one implementation, the interception instruction can refer to the kprobe probe point registered in the kernel module, i.e., the probe instruction. In some embodiments, the interception instruction can be directed to the dynamic library mapping function to be hijacked, thereby triggering the interception when the dynamic library mapping function is called, and calling the target mapping program developed in this solution to achieve the allocation of virtual address space.
[0059] Of course, other interceptors can also be written in the kernel module, as long as they can trigger the interception of the dynamic library mapping function when it is called. Triggering the interception of the dynamic library mapping function means pausing the execution of the dynamic library mapping function.
[0060] Figure 2 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; optionally, the above steps, during dynamic library loading, involve intercepting the dynamic library mapping function through an interception instruction in the kernel module to run the target mapping program, including: S201. Run the dynamic library loader. When the dynamic library loader reaches the intercept instruction, jump to the location of the target mapping program that replaces the dynamic library mapping function.
[0061] In some embodiments, dynamic libraries can be loaded by running a dynamic library loader. During the execution of the dynamic library loader, an interception instruction is injected into the entry point of the dynamic library mapping function. Normally, when the dynamic library mapping function is executed, it would directly allocate virtual address space for the dynamic library.
[0062] In this scheme, when the interception instruction is executed, the execution of the dynamic library mapping function will be paused, and the execution will be redirected to the location of the target mapping program to determine the target mapping program to be executed.
[0063] S202, Run the target mapping program.
[0064] Running the target mapping program allows for dynamic modification of the virtual address space of dynamic libraries, eliminating the need for fixed virtual address space allocation as in dynamic library mapping functions.
[0065] In some embodiments, the target mapping program, at runtime, first obtains the raw parameters, which include at least the file size of the dynamic library to be loaded. Secondly, it determines whether it is a file mapping loading logic for a dynamic library; if so, it performs a virtual address range determination operation.
[0066] Figure 3 This is a flowchart illustrating another dynamic library mapping and loading method provided in an embodiment of this application; optionally, in step S103, determining the virtual address range based on the storage length required by the dynamic library includes: S301. Determine the required storage length for the dynamic library based on its file size.
[0067] In some embodiments, the required storage length of the dynamic library can be determined based on the file size of the dynamic library obtained above. For example, if the file size of the dynamic library is 4000, then the required storage length of the dynamic library can be determined to be 4000.
[0068] S302. Determine the initial address range of the dynamic library based on the required storage length of the dynamic library.
[0069] The initial address range of a dynamic library can be determined based on the required storage length and the current address.
[0070] For example, suppose we need to load a dynamic library file of size 0x4000 at address 0x1000. The current address is 0x1000, and the required storage length for the dynamic library is 4000. Therefore, the initial address range of the dynamic library can be determined to be 0x1000-0x5000. This initial address range is also the theoretical mapping range when the dynamic library performs full file mapping.
[0071] S303. Determine the virtual address range based on the initial address range of the dynamic library and the preset address range adjustment strategy.
[0072] This solution requires adding an extended address range on top of the theoretical mapping range. Therefore, the initial address range can be adjusted according to the initial address range of the dynamic library and the preset address range adjustment strategy to obtain a virtual address range with an extended address range.
[0073] Figure 4 A flowchart illustrating another dynamic library mapping and loading method provided in this application embodiment; optionally, in step S303, determining the virtual address range based on the initial address range of the dynamic library and a preset address range adjustment strategy includes: S401. Adjust the length of the initial address range according to the preset address adjustment parameters to obtain the target adjustment address.
[0074] The target adjustment address is less than the starting address of the initial address range or greater than the ending address of the initial address range.
[0075] In one implementation, the length of the initial address range can be adjusted according to preset address adjustment parameters, which can be determined based on the required length of the extended address range. When the required length of the extended address range is fixed, the preset address adjustment parameters are also determined accordingly.
[0076] The adjusted length of the initial address range can be determined based on the original length of the initial address range and the preset address adjustment parameters. Then, the target adjusted address of the initial address range can be obtained based on the start or end address of the initial address range and the adjusted length of the initial address range.
[0077] The target adjustment address is used to indicate the start or end address of the virtual address range obtained after expanding the address range from the initial address range.
[0078] For example, suppose we need to load a dynamic library file of size 0x2000 at address 0x3000. The current address is 0x3000, and the required storage length of the dynamic library is 2000. Therefore, the initial address range of the dynamic library can be determined to be 0x3000-0x5000. Assuming the preset address adjustment parameter is 1000, and the original length of the initial address range is 2000, the adjusted length of the initial address range is 3000, which means that the address length is extended by 1000 based on the initial address range.
[0079] The expansion can be performed at either the beginning or the end of the initial address range, so the resulting target adjustment address is not fixed. In the example above, when the target adjustment address is less than the starting address in the initial address range, the target adjustment address can be 0x2000, and when the target adjustment address is greater than the ending address in the initial address range, the target adjustment address can be 0x6000.
[0080] S402. Obtain the virtual address range based on the start or end address in the initial address range and the target adjustment address.
[0081] The starting address of the extended address range in the virtual address range overlaps with the ending address of the address range corresponding to the storage length, or the ending address of the extended address range overlaps with the starting address of the address range corresponding to the storage length.
[0082] In some embodiments, an extended address range can be extended either at the beginning or the end of the address range corresponding to the storage length. When the target adjustment address is less than the starting address in the initial address range, the target adjustment address can be used as the starting address of the virtual address range, and the virtual address range is obtained from the target adjustment address and the ending address in the initial address range. When the target adjustment address is greater than the ending address in the initial address range, the target adjustment address can be used as the ending address of the virtual address range, and the virtual address range is obtained from the starting address in the initial address range and the target adjustment address.
[0083] For example, assuming the initial address range is 0x3000-0x5000 and the target adjustment address is 0x6000, the resulting virtual address range is 0x3000-0x6000; while when the target adjustment address is 0x2000, the resulting virtual address range is 0x2000-0x5000. Regardless of the extension method, it can satisfy the requirement of extending the original address range of 2000 to a length of 1000.
[0084] In some cases, the length of the required extended address range can be predetermined based on the needs, and the preset address adjustment parameters can be determined based on the determined length of the extended address range.
[0085] Optionally, in step S303, determining the virtual address range based on the initial address range of the dynamic library and the preset address range adjustment strategy includes: determining the virtual address range based on the preset extended address size and the initial address range.
[0086] In another feasible approach, a virtual address range can be obtained by directly expanding the initial address range by the required extended address size at the beginning or end of the initial address range.
[0087] For example, assuming the initial address range is 0x3000-0x5000 and the required extended address size is 1000, that is, the preset extended address size is 1000, then the address length can be directly increased by 1000 based on the end address of the initial address range, that is, the address range of 0x5000-0x6000 is extended as the above-mentioned extended address range, thereby obtaining the address range of 0x3000-0x6000 as the virtual address range.
[0088] Alternatively, the address length can be increased by 1000 in reverse from the starting address of the initial address range, that is, the address range of 0x2000-0x3000 can be extended as the above extended address range, thus obtaining the address range of 0x2000-0x5000 as the virtual address range.
[0089] The initial address range of 0x3000-0x5000 is used to map the full file of the dynamic library, while the extended address range of 0x2000-0x3000 or 0x5000-0x6000 is used to perform long jump operations.
[0090] The extended address range created by this method is allocated on demand and used only for performing long jump operations. It is not used for mapping dynamic library files, resulting in a small space footprint. Furthermore, the loading of the extended address range is based on the existing dynamic library loading mechanism, with minimal additional overhead. Since the extended address range is a contiguous address range immediately following the initial address range, the addresses are relatively fixed.
[0091] Figure 5 This is a flowchart illustrating another dynamic library mapping and loading method provided in an embodiment of this application; optionally, in step S104, mapping the dynamic library to an address range corresponding to the storage length includes: S501. Parse the dynamic library and obtain the file data contained in the dynamic library.
[0092] Dynamic libraries typically consist of multiple sections, such as ".text, .data, .rodata, .bss", each with a different function and should be assigned different access permissions.
[0093] In some embodiments, by parsing a dynamic library, the file data contained in the dynamic library can be obtained, and the attributes of different code segments in the file data can be determined, that is, the read-only data segment, the read-write data segment, and the private data segment, etc.
[0094] S502. Write the file data to the address range corresponding to the storage length, and configure the data permissions for the mapped data of different address ranges within the address range.
[0095] When writing file data to the address range corresponding to the storage length, data permissions can be configured for each address range according to the attributes of the file data written to different address ranges to prevent code from being tampered with.
[0096] In another possible approach, on-demand delayed mapping and paging loading can be used. That is, instead of writing all the file data into the address range corresponding to the storage length at once, a paging mapping mechanism is used, and the corresponding page is loaded only when accessed.
[0097] Optionally, a paging virtual memory mechanism is used for mapping file data, dividing the file data into fixed-size page units; initially, only the mapping relationship between the address range corresponding to the storage length and the file offset is established, and it is not immediately written to physical memory; when the program accesses a page, a page fault is triggered, and the contents of that page are then loaded from the file data into physical memory, and the corresponding data permissions are set according to its type.
[0098] Figure 6 This is a schematic diagram illustrating data mapping within a virtual address range, provided as an embodiment of this application. The defined virtual address range includes the extended address range derived from this solution. Figure 6 In the demonstrated process, an anonymous memory segment can first be loaded to occupy the virtual address. Then, the size of the virtual address range is determined according to the method described above in this scheme to obtain the extended address range. Finally, the extended address range is separated after the entire dynamic library is loaded.
[0099] in, Figure 6 The example demonstrates the case where the extended address range is located at the end of the initial address range. In practical applications, as described above, the extended address range can also be located at the beginning of the initial address range. In the initial address range, the private data segment, read-only data segment, and read-write data segment are mapped sequentially to complete the full file mapping of the dynamic library. The extended address range is temporarily blank, and instructions or addresses will be added later as needed.
[0100] Figure 7 This is a schematic diagram illustrating another data mapping within a virtual address range provided in an embodiment of this application. Figure 7 In the demonstrated process, the extended address range can be directly expanded in the manner described in this solution while loading a segment of anonymous memory to occupy the virtual address, and the extended address range can be separated after the entire dynamic library is loaded.
[0101] Optionally, the extended address range can be an executable memory region; by extending the address range, long jump operations of the dynamic library can be controlled.
[0102] It's worth noting that the extended address range obtained through this solution can be an executable memory region, which can be used as a "jump relay station" to receive short jumps from the original code segment and execute long jump instructions or lightweight hook logic there, thereby achieving hijacking and control transfer of distant target functions. This solves the problems of limited short jump range and difficulty in instrumentation due to code compactness, and is applicable to all dynamic library functions, not limited to GOT calls.
[0103] Optionally, in step S104, the instruction jump based on the extended address range includes: writing a preset jump instruction into the extended address range, wherein the jump instruction points to the target address.
[0104] In one feasible approach, a preset jump instruction can be written into the extended address range. The preset jump instruction can be a long jump instruction, and the preset jump instruction can point to any distant target address.
[0105] Based on the long jump instructions set in the extended address range mentioned above, long jumps can be implemented through a two-level jump mechanism.
[0106] Level 1: Replace the instruction at the original function entry point with a short jump instruction (B) to jump to the extended address range; Level 2: Based on the long jump instruction in the extended address range, jump to any distant target address.
[0107] In practical applications, the preset jump instructions include, but are not limited to, register assignment and jump combination instructions for performing long jumps, indirect loading jumps to the global offset table, calls to procedure link table stubs, or multi-level jump scheduling logic, etc.
[0108] In another possible approach, general jump engine code can be written into the extended address range. Short jump instructions can first jump to the extended address range. The extended address range does not jump directly to the target address, but first enters a small jump dispatcher, and then the jump is implemented by the jump dispatcher after looking up the table.
[0109] In summary, the dynamic library mapping and loading method provided in this embodiment includes: loading a kernel module; hijacking the dynamic library mapping function in the kernel module to run the target mapping program during dynamic library loading; determining the virtual address range based on the storage length required by the dynamic library during runtime; mapping the dynamic library to the address range corresponding to the storage length; and performing instruction jumps based on the extended address range. Based on this method, the creation of the extended address range is automatically triggered by the kernel module during the dynamic library mapping function call phase, without the user-mode program being aware of it. It does not affect the original dynamic library loading process, does not rely on free memory patch areas, solves the failure problem of traditional methods in compact code segments, and improves the versatility of the solution. Furthermore, since hijacking is triggered only once during dynamic library loading, no additional system calls or frequent interventions are required subsequently, significantly reducing overhead.
[0110] Furthermore, the extended address range created by this method is allocated on demand and used only for performing long jump operations, not for mapping dynamic library files, resulting in a smaller space footprint. The loading of the extended address range is based on the existing dynamic library loading mechanism, with minimal overhead. Since the extended address range is a contiguous address range immediately following the initial address range, the addresses are relatively fixed.
[0111] By uniformly expanding the address range during the dynamic library loading stage and adopting a function entry-level hijacking mechanism, the dependency on specific linking structures such as GOT / PLT is eliminated. Therefore, it is possible to implement jump control on any function in the dynamic library, which significantly improves the applicability and versatility of the solution.
[0112] The following describes the apparatus, device, and storage medium used to execute the mapping and loading method of the dynamic library provided in this application. The specific implementation process and technical effects are described above and will not be repeated below.
[0113] Figure 8 This diagram illustrates a dynamic library mapping and loading device provided in an embodiment of this application. The function implemented by this dynamic library mapping and loading device corresponds to the steps executed by the method described above. This device can be understood as the aforementioned server, or the server's processor, or as a component independent of the aforementioned server or processor that implements the functions of this application under the control of the server, such as... Figure 8 As shown, the device may include: a loading module 100, an interception module 200, a determination module 300, and a processing module 400; Load module 100, used to load kernel modules; Intercept module 200 is used to hijack dynamic library mapping functions in kernel modules during dynamic library loading in order to run the target mapping program; The determination module 300 is used by the target mapping program to determine the virtual address range based on the storage length required by the dynamic library during runtime. The virtual address range includes the address range corresponding to the storage length and the extended address range. The processing module 400 is used to map dynamic libraries to address ranges corresponding to the storage length and to perform instruction jumps based on the extended address ranges.
[0114] Optionally, the loading module 100 is specifically used to hijack the dynamic library mapping function through interception instructions in the kernel module to run the target mapping program when the dynamic library is loaded.
[0115] Optionally, the loading module 100 is specifically used to run the dynamic library loader. When the dynamic library loader runs to the intercept instruction, it jumps to the location of the target mapping program that replaces the dynamic library mapping function. Run the target mapping program.
[0116] Optionally, module 300 is specifically used to determine the required storage length of the dynamic library based on the file size of the dynamic library; Determine the initial address range of the dynamic library based on the required storage length of the dynamic library; The virtual address range is determined based on the initial address range of the dynamic library and the preset address range adjustment strategy.
[0117] Optionally, the determining module 300 is specifically used to adjust the length of the initial address interval according to preset address adjustment parameters to obtain a target adjustment address; the target adjustment address is less than the start address in the initial address interval or greater than the end address in the initial address interval. The virtual address range is obtained based on the start address or end address in the initial address range and the target adjustment address; the start address of the extended address range in the virtual address range overlaps with the end address of the address range corresponding to the storage length, or the end address of the extended address range overlaps with the start address of the address range corresponding to the storage length. Optionally, the determining module 300 is specifically used to determine the virtual address range based on the preset extended address size and the initial address range.
[0118] Optionally, the processing module 400 is specifically used to parse the dynamic library and obtain the file data contained in the dynamic library; Write file data to the address range corresponding to the storage length, and configure the data permissions for the mapped data of different address ranges within the address range.
[0119] Optionally, the extended address range can be the executable memory region; By expanding the address range, long jump operations of dynamic libraries can be controlled.
[0120] Optionally, the processing module 400 is specifically used to write a preset jump instruction into the extended address range, the jump instruction pointing to the target address.
[0121] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0122] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).
[0123] The modules described above can be connected or communicate with each other via wired or wireless connections. Wired connections can include metal cables, optical fibers, hybrid cables, or any combination thereof. Wireless connections can include connections via LAN, WAN, Bluetooth, ZigBee, or NFC, or any combination thereof. Two or more modules can be combined into a single module, and any module can be divided into two or more units. Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here.
[0124] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The device may be a computing device with data processing capabilities.
[0125] The device includes: a processor 801 and a storage medium 802.
[0126] Storage medium 802 is used to store programs, and processor 801 calls the programs stored in storage medium 802 to execute the above method embodiments. The specific implementation and technical effects are similar, and will not be described in detail here.
[0127] The storage medium 802 stores program code, which, when executed by the processor 801, causes the processor 801 to perform various steps in the dynamic library mapping and loading method according to various exemplary embodiments of this application as described in the "Exemplary Methods" section above.
[0128] The processor 801 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.
[0129] Storage medium 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The storage medium can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type storage medium, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage medium, magnetic disk, optical disk, etc. The storage medium is any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, storage medium 802 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.
[0130] Optionally, this application also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, performs the above-described method embodiments.
[0131] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0132] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0133] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.
[0134] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
Claims
1. A method for mapping and loading a dynamic library, characterized in that, include: Load kernel modules; During dynamic library loading, the dynamic library mapping function in the kernel module is hijacked to run the target mapping program; When the target mapping program runs, it determines the virtual address range based on the storage length required by the dynamic library. The virtual address range includes: the address range corresponding to the storage length and the extended address range. The dynamic library is mapped to the address range corresponding to the storage length, and instruction jumps are performed based on the extended address range.
2. The method according to claim 1, characterized in that, The method of hijacking the dynamic library mapping functions in the kernel module to run the target mapping program during dynamic library loading includes: When the dynamic library is loaded, the dynamic library mapping function is hijacked by the interception instruction in the kernel module to run the target mapping program.
3. The method according to claim 2, characterized in that, The step of hijacking the dynamic library mapping function to run the target mapping program by intercepting instructions in the kernel module when the dynamic library is loaded includes: Run the dynamic library loader. When the dynamic library loader reaches the intercept instruction, it jumps to the location of the target mapping program that replaces the dynamic library mapping function. Run the target mapping program.
4. The method according to claim 1, characterized in that, The step of determining the virtual address range based on the required storage length of the dynamic library includes: The required storage length of the dynamic library is determined based on its file size. Determine the initial address range of the dynamic library based on the required storage length of the dynamic library; The virtual address range is determined based on the initial address range of the dynamic library and the preset address range adjustment strategy.
5. The method according to claim 4, characterized in that, The step of determining the virtual address range based on the initial address range of the dynamic library and a preset address range adjustment strategy includes: According to preset address adjustment parameters, the length of the initial address interval is adjusted to obtain the target adjustment address; the target adjustment address is less than the start address or greater than the end address of the initial address interval. The virtual address range is obtained based on the start address or end address in the initial address range and the target adjustment address; the start address of the extended address range in the virtual address range overlaps with the end address of the address range corresponding to the storage length, or the end address of the extended address range overlaps with the start address of the address range corresponding to the storage length.
6. The method according to claim 4, characterized in that, The step of determining the virtual address range based on the initial address range of the dynamic library and a preset address range adjustment strategy includes: The virtual address range is determined based on the preset extended address size and the initial address range.
7. The method according to claim 1, characterized in that, The step of mapping the dynamic library to the address range corresponding to the storage length includes: Parse the dynamic library to obtain the file data contained in the dynamic library; Write the file data into the address range corresponding to the storage length, and configure the data permissions for the mapped data of different address ranges within the address range.
8. The method according to claim 1, characterized in that, The extended address range is an executable memory region; The extended address range is used to control the execution of long jump operations of the dynamic library.
9. The method according to claim 1, characterized in that, The instruction jump based on the extended address range includes: A preset jump instruction is written into the extended address range, and the jump instruction points to the target address.
10. A mapping and loading device for a dynamic library, characterized in that, include: The module includes a loading module, an interception module, a determination module, and a processing module. The loading module is used to load the kernel module; The interception module is used to hijack the dynamic library mapping function in the kernel module to run the target mapping program when the dynamic library is loaded. The determining module is used to determine a virtual address range based on the storage length required by the dynamic library when the target mapping program is running. The virtual address range includes: the address range corresponding to the storage length and the extended address range. The processing module is used to map the dynamic library to the address range corresponding to the storage length, and to perform instruction jumps based on the extended address range.
11. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus. The storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to implement the dynamic library mapping and loading method as described in any one of claims 1 to 9.
12. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is executed by a processor to implement the dynamic library mapping and loading method as described in any one of claims 1 to 9.