CN116340081A - RISCV memory access violation detection method and device based on hardware virtualization - Google Patents

Abstract

The invention discloses a method and a device for detecting RISCV memory access violations based on hardware virtualization, wherein the method comprises the following steps: an operating system kernel running on the reverse RISCV acquires a process kernel data structure; simulating the RISCV CPU based on a hardware simulator; constructing a basic process list of an operating system; the sptbr register and a process kernel data structure are used for acquiring characteristic information of a new process; screening the characteristic information according to the basic process list to obtain a target process; API detection and instruction analysis are carried out based on the process information and the dynamic operation process information of the target process, and the obtained memory access data is compared with a memory access authority list to obtain a violation detection result. The invention can completely and transparently monitor the whole running process of the program on the RISCV CPU, provide a configurable memory violation access configuration interface, realize transparent process monitoring and memory violation access detection without depending on functions or interfaces provided by a system, and improve the memory violation access detection capability and accuracy.

Description

A RISCV memory access violation detection method and device based on hardware virtualization

technical field

The invention belongs to the field of computer science and technology, and in particular relates to a hardware virtualization-based RISCV memory access violation detection method and device.

Background technique

Memory violation access means that the purpose of access is different from the expected design, such as writing to read-only memory, dynamically updating static variables, etc. At present, the most important detection method for memory violation access is dynamic analysis. Since RISCV is a brand new hardware platform, on which the research work on program dynamic analysis is currently less. For memory access violations, it mainly relies on manual analysis or embedding detection codes in the source code. Manual analysis is time-consuming and laborious, requiring analysts to have a good technical foundation. The method based on source code has indeed improved the detection capability of memory access violations to a certain extent, but currently a large number of software products do not provide source code. Expand the analysis.

The current memory access violation detection on the RISCV platform usually uses the following methods:

1. Debugger-based access violation detection

Code violation access is a program error that is difficult to detect and analyze. In most cases, violation access does not cause program or system crashes, but causes unexpected changes in the values of certain variables during program execution. It is difficult to locate and troubleshoot the problem. At present, the main method for code violation access detection is that when a logic error occurs in the program operation, the developer analyzes it through debugging tools such as gdb. However, due to the characteristics of code violation access itself, the analysis process has a high time complexity and requires a large amount of human support. This analysis method has relatively large limitations.

2. Compiler-based access violation detection

At present, some work is based on the code optimization function of the compiler. In the code optimization stage, the handwritten illegal access detection code is embedded into the target program, and the dynamic analysis is carried out for the RISCV program in the running stage to detect whether there is a memory violation access. . This method can indeed improve the ability to detect code access violations to a certain extent, but most of the software is released in binary form, and the source code cannot be obtained. The detection method of violation access based on source code has great limitations.

To sum up, the current method of dynamic analysis of programs based on RISCV hardware has the main defect that: because violations usually do not cause program crashes or system crashes, but cause some variables of the program to change, it is not easy to The analyst locates and troubleshoots. Existing analysis methods based on debugging tools have great limitations. Although some works use compiler optimization technology to insert the analysis code into the source code, and realize memory violation access through the inserted code, the source code of many software is difficult to obtain, and the method based on the source code also has great limitations.

Contents of the invention

Aiming at the problem that the existing program memory violation access detection on RISCV CPU relies on manual analysis or source code implementation, which requires a lot of manpower and material resources, high time complexity, and large limitations. The object of the present invention is to provide a method and device for detecting violations of RISCV memory access based on hardware virtualization. By modifying the hardware simulator, while translating and executing RISCV instructions, the method extracts and calibrates the memory access authority in the process, and monitors RISCV The LOAD and STORE instructions of the instruction detect memory access violations.

Technical contents of the present invention include:

A kind of RISCV memory access violation detection method based on hardware virtualization, its step comprises:

Reverse the operating system kernel running on RISCV to obtain the process kernel data structure;

Simulate the RISCV CPU based on the hardware simulator, and build the basic process list of the operating system;

Use the sptbr register and the process kernel data structure to obtain the characteristic information of the new process, and obtain the target process according to the basic process list and characteristic information;

Based on the process information and dynamic running process information of the target process, API detection and instruction analysis are performed, and the list of memory access permissions is obtained through API detection, and the memory access data of the target process is obtained by instruction analysis;

Compare the memory access data with the memory access permission list to obtain the access violation detection result.

Further, the operating system includes: Linux operating system or Windows operating system.

Further, the type of the hardware simulator includes: Qemu hardware simulator.

Further, obtain the feature information of the new process through the following steps:

1) Monitor changes in the sptbr register, and get a new process when a new address appears;

2) Then take the physical page pointed to by sptbr as a starting point, search the process kernel data structure through the feature, and obtain the feature information of the new process.

Further, the feature information includes: module loading address, length, thread information and memory information.

Further, the process information of the target process includes: process structure address, page table physical address, process name, module structure information list and process current module structure pointer.

Further, the list of memory access permissions is obtained through the following steps:

1) Intercept all ecall instructions, obtain the address, function name, input/output parameters and return value of the API call;

2) Based on the API call information, determine whether the corresponding function of the address called by the API is a memory application/release/permission operation function:

If so, update the existing memory access permission list through the configuration process name, the start address of the memory area, the length of the memory area, and the access permission of the memory area input by the user, and use the updated memory access permission list as the memory access permission list;

If not, use the existing memory access permission list as the memory access permission list.

Further, the memory access data is obtained through the following steps:

1) Intercept all LOAD instructions and STORE instructions;

2) Obtain the opcode, operand, register, memory address and memory content of the instruction based on the LOAD instruction and the STORE instruction;

3) Obtain memory access data based on the address and register read by the LOAD instruction and the address and register written by the STORE instruction.

A storage medium, in which a computer program is stored, wherein the computer program is configured to execute the above method when running.

An electronic device includes a memory and a processor, wherein the memory stores a program for executing the method described above.

Advantage of the present invention and positive effect are as follows:

The present invention can completely and transparently monitor the whole running process of the program on the RISCV CPU, provides a configurable memory access configuration interface, the monitoring process does not depend on the functions or interfaces provided by the system, and can realize transparent process monitoring and memory access configuration Detection, which effectively improves the ability and accuracy of memory access violation detection.

Description of drawings

FIG. 1 is a flowchart of a hardware virtualization-based RISCV memory access violation detection method according to the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

RISCV memory access violation detection method of the present invention comprises:

· Install the operating system on the Qemu hardware emulator;

·Based on the Qemu hardware simulator, using the virtual sptbr register as a clue to distinguish different processes;

·Based on the Qemu hardware simulator, build a virtual process kernel data structure register, analyze the physical memory content, and search the process kernel data structure;

Based on the Qemu hardware simulator, by modifying the decoding engine, when the ecall command is executed in the user mode, it detects whether the memory allocation/release/privilege update operation has been implemented, and calibrates the access rights and access rules of the memory area;

·Based on the Qemu hardware simulator, by providing a user mode interface, the user can calibrate the access rights and access rules of the memory area;

·Based on the Qemu hardware simulator, by modifying the decoding engine, adding callback functions before and after the LOAD and STORE instructions for analysis, and based on the memory area access rules, to detect memory access violations.

· Output memory access violation detection results in JSON file format.

Specifically, as shown in Figure 1, the steps it includes are described as follows:

1) Manually reverse the operating system kernel running on RISCV, and analyze the kernel data structure. The relevant data structure is mainly used in physical memory to verify each other through multi-level pointers (the operating system kernel data structure is connected by a doubly linked list, and the data structure between the kernel data structures Whether the two values point to the associated legal address, you can detect whether it is a legal kernel data structure) to find the process kernel data structure, and enter step 2);

2) Based on the RISCV CPU simulated by the Qemu hardware emulator, and install the Linux operating system, record the basic processes that a general Linux operating system needs to start, build the basic process list, and do not monitor this type of process in the later analysis to enter step 3);

3) start the Linux operating system and the target process, build the process kernel data structure register, and enter step 4);

4) Monitoring the change of the sptbr register in the system: when a new address appears, it is considered that a new process has appeared, and then the physical page pointed to by sptbr is used as a starting point to search the process kernel data structure through the feature to obtain the feature information of the current process, including Module loading address, length, thread information, memory information, etc., and based on the characteristic information, determine whether the process belongs to the basic process list, and ignore it if it belongs. If not, record process information, process information includes: process structure address, page table physical address, process name, module structure information list, process current module structure pointer, and enter step 5);

5) Modify the decoding engine to the target process, and add API detection and instruction analysis codes in the decoding mechanism of Qemu, wherein, when Qemu actually executes, except process information, further extract dynamic running process information and enter step 6);

6) For the target process, intercept all ecall instructions, obtain the address of the API call, function name, input/output parameters, and return value, and determine whether the corresponding function of the call address is a memory application/release/permission operation function: if so, update the memory Access permission list, go to step 7); if not, go to step 8);

7) The user enters the command line through the provided interface, configures information such as the process name, the starting address of the memory area, the length of the memory area, and the access rights of the memory area to realize the addition, deletion, modification, and query of memory access rules. Go to step 8);

8) For the target process, intercept all LOAD and STORE instructions, obtain information such as the opcode, operand, register, memory address and memory content of the instruction, and read the address and register of the LOAD instruction, the address written by the STORE instruction, The register and the memory access authority table are compared to determine whether there is a memory violation access, and if so, output the violation access detection result and enter step 9);

9) Determine whether the target process exits, if exits, output the dynamic information in the form of a JSON file, if not exit, enter step 4).

Further, the installation of the operating system on the Qemu hardware emulator is currently only a Linux system because the Windows system does not yet support the RISCV CPU. However, the monitoring process for the Windows operating system is consistent with the principle of the Linux system monitoring process, and the present invention can also support the Windows operating system.

Further, based on the Qemu hardware simulator, the virtual sptbr register is used as a clue to distinguish different processes, wherein sptbr is the physical address of the page table of each process. Since different processes use different page tables, the page table information can be The unique logo process records process information by building a HASH table indexed by the page table address in memory.

Further, the Qemu-based hardware simulator uses the virtual kernel data structure register as a clue to traverse the linked list in the physical memory to search the kernel process data structure to extract process information.

Further, the Qemu hardware simulator, by modifying the decoding engine, detects whether the target address of the instruction is a function of memory allocation/release/memory permission setting when the program executes the instruction ecall instruction, and records the memory area and the corresponding access permission.

Further, the Qemu hardware emulator adds a user interface, allowing the user to define the access rights of the memory area of the target process by inputting commands.

Further, based on the Qemu hardware simulator, by modifying the decoding engine, adding a callback function before and after the LOAD and STORE instructions for analysis, realizing the analysis of the instruction read and write memory address and length, and according to the predefined memory access authority, Determine whether the operation is a violation operation.

The present invention proposes to identify the process by modifying the hardware simulator, aiming at the RISCV CPU, by analyzing the registers in the virtual CPU, locating and reading the key data structure of the operating system in the physical memory, and intercepting the function call and the executed instruction of the process , a method for detecting memory access violations that occur while a process is running. The present invention can completely and transparently monitor the whole running process of the program on the RISCV CPU, provides a configurable memory access configuration interface, the monitoring process does not depend on the functions or interfaces provided by the system, and can realize transparent process monitoring and memory access configuration Detection, which effectively improves the ability and accuracy of memory access violation detection.

Although specific embodiments and drawings of the present invention are disclosed for the purpose of illustration, the purpose is to help understand the content of the present invention and implement it accordingly, but those skilled in the art can understand that: without departing from the present invention and the appended claims Various substitutions, changes and modifications are possible within the spirit and scope of . Therefore, the present invention should not be limited to the content disclosed in the preferred embodiments and drawings, and the protection scope of the present invention should be defined by the claims.

Claims (10)

1. A RISCV memory access violation detection method based on hardware virtualization, the steps comprising: Reverse the operating system kernel running on RISCV to obtain the process kernel data structure; Simulate the RISCV CPU based on the hardware simulator, and build the basic process list of the operating system; Use the sptbr register and the process kernel data structure to obtain the characteristic information of the new process, and obtain the target process according to the basic process list and characteristic information; Based on the process information and dynamic running process information of the target process, API detection and instruction analysis are performed, and the list of memory access permissions is obtained through API detection, and the memory access data of the target process is obtained by instruction analysis; Compare the memory access data with the memory access permission list to obtain the access violation detection result. 2. The method according to claim 1, wherein the operating system comprises: a Linux operating system or a Windows operating system. 3. The method according to claim 1, wherein the type of the hardware simulator comprises: a Qemu hardware simulator. 4. The method according to claim 1, wherein the feature information of the new process is acquired through the following steps: 1) Monitor changes in the sptbr register, and get a new process when a new address appears; 2) Then take the physical page pointed to by sptbr as a starting point, search the process kernel data structure through the feature, and obtain the feature information of the new process. 5. The method according to claim 1, wherein the feature information includes: module loading address, length, thread information and memory information. 6. The method according to claim 1, wherein the process information of the target process comprises: process structure address, page table physical address, process name, module structure information list and process current module structure pointer. 7. The method according to claim 1, characterized in that, the memory access authority list is obtained through the following steps: 1) Intercept all ecall instructions, obtain the address, function name, input/output parameters and return value of the API call; 2) Based on the API call information, determine whether the corresponding function of the address called by the API is a memory application/release/permission operation function: If so, update the existing memory access permission list through the configuration process name, the start address of the memory area, the length of the memory area, and the access permission of the memory area input by the user, and use the updated memory access permission list as the memory access permission list; If not, use the existing memory access permission list as the memory access permission list. 8. The method according to claim 1, wherein the memory access data is obtained through the following steps: 1) Intercept all LOAD instructions and STORE instructions; 2) Obtain the opcode, operand, register, memory address and memory content of the instruction based on the LOAD instruction and the STORE instruction; 3) Obtain memory access data based on the address and register read by the LOAD instruction and the address and register written by the STORE instruction. 9. A storage medium, wherein a computer program is stored in the storage medium, wherein the computer program is configured to execute the method according to any one of claims 1-8 when running. 10. An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1-8.

Images