KR100781554B1 - Method for preventing from debugging computer program in real time and recording material thereof - Google Patents

Abstract

Disclosed are a method for preventing debugging of a real-time computer program and a recording medium thereof. The present invention includes the steps of: A) hooking an interrupt table corresponding to an interrupt for debugging generated in a running computer program; B) determining whether the computer program for which the debugging has occurred is a target program for performing anti-debugging; C) if the computer program is the anti-debugging target program, registering the fact that debugging according to the interruption is being performed; D) sending said registered debugging performance to said computer program; E) including the step of calling the original code of the operating system (Operation System) of the computer on which the computer program is running, to prevent debugging of the computer program in real time to prevent disassembly, that is to prevent hacking can do.

Computer Program, Hack, Debug, Break Pointer, Interrupt

Description

Method for preventing debugging of real-time computer program and its recording medium {METHOD FOR PREVENTING FROM DEBUGGING COMPUTER PROGRAM IN REAL TIME AND RECORDING MATERIAL THEREOF}

1 is a flowchart illustrating a debugging prevention method of a real-time computer program according to an embodiment of the present invention.

2 is a flowchart illustrating a method for preventing debugging of a real-time computer program according to another embodiment of the present invention.

3 illustrates handler processing of interrupts implemented in the Windows NT series according to an embodiment of the present invention.

4 illustrates handler processing of an interrupt implemented in the Windows 9x series according to an embodiment of the present invention.

The present invention relates to preventing debugging of a computer program, and more particularly, to a debugging prevention method of a real-time computer program and a recording medium for blocking a running computer program from being disassembled.

Debuggers generally refer to tools for finding the source of errors in a program, but can also be used to analyze and correct the contents of a program.

 The debugger has functions such as a break point, trace, and go, so that the program can be stopped at a part desired by the user, and the program can be debugged by executing the program in units of instructions. It is possible.

The break pointer is a function for causing a program to exit at a point desired by a user during a course of executing a program in a general debugging system. Therefore, if the break pointer is caught while the program is running, the software abort is input to stop the execution and debug. The software abort is a function that causes an external hardware interrupt to exit a state in which the program can be paused and forced to debug while the program executes an infinite loop or during program execution.

It is possible to grasp the structure of a program and to disassemble the program created by others through a debugger including the functions such as the break pointer, the trace, and the go.

Therefore, in general, professional hackers have to perform an analysis on the hacking target in order to produce a hacking tool, and the most useful tool used at this time is a program called a debugger. to be.

Therefore, there is a need to prevent a computer program from being hacked and changed by debugging a computer program in an illegal manner by an illegal user who is not a party user.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a method for preventing debugging of a real-time computer program and a recording medium thereof for preventing a running computer program from being disassembled.

Debugging prevention method of a real-time computer program according to a first aspect of the present invention for achieving the above object,
A-1) inquiring whether or not the debugger is executed by a user level code;

A-2) when the debugger is operating, hooking an interrupt table corresponding to an interrupt for debugging generated in a running computer program;

B) determining whether the computer program where the debugging has occurred is a target program for performing anti-debugging;

C) registering the fact that debugging according to the interruption is performed when the computer program is the anti-debugging target program;

D) sending said registered debugging performance to said computer program; And

E) calling an original code of an operating system of a computer on which the computer program is running.

A computer-readable recording medium having recorded thereon a program according to the second aspect of the present invention for achieving the above object,
(A) inquiring whether a user level code is executed or not;

A-2) hooking an interrupt table corresponding to an interrupt for debugging generated in a running computer program when the debugger operates;

B) determining whether the computer program generating the interrupt is a target program for performing anti-debugging;

C) registering the fact that debugging according to the interruption is performed when the computer program is the anti-debugging target program;

D) transmitting the registered debugging execution fact to a processor for executing the computer program to terminate execution of the computer program;

E) calling an original code of an operating system of a computer on which the computer program is running;

F) inquiring whether a handler of an anti-debugging trace set to a predetermined interrupt of the interrupt table has changed; And

G) If the handler is changed as a result of the inquiry, the program for realizing the step of transmitting the change of the handler to the computer program is recorded.

Therefore, according to the present invention, it is possible to prevent debugging of a computer program in real time so that it is not disassembled, that is, hacking can be prevented.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

1 is a flowchart illustrating a debugging prevention method of a real-time computer program according to an embodiment of the present invention.

When an interrupt for debugging occurs in a computer program running in the computer, the interrupt table corresponding to the interrupt is hooked (S100 and S110).

The interrupt for debugging maps an interrupt and a predetermined handler to define its function in an interrupt description table. Thus, when an interrupt occurs, the debugger detects the interrupt and the operation as described above is performed according to the interrupt. That is, predetermined information that can be known by generating an interrupt is displayed on the screen of the user terminal.

In other words, when the first and second interrupts are generated, a predetermined function is executed according to a code address defined in the interrupt table.

For example, there are 255 interrupts defined on the CPU, especially for CPUs produced by Intel Microsoft Inc. and Interrupt 3 and Interrupt 1 are specified to perform debugging.

Thus, the occurrence of a break point 110, and a trace or single step 120 for debugging in the computer program is detected at the front end of the handler mapped in the interrupt table.

In other words, an anti-debugger tracer handler matching the interrupts 1 and 3 is installed in the interrupt table, and a handler for performing the original functions of the interrupts 1 and 3 is stored separately. Therefore, when the first and second interrupts are generated, the following operations are performed by an anti-debugger tracer handler.

That is, after hooking the interrupt table corresponding to the interrupt, it is determined whether or not the computer program generating the interrupt for performing the debugging is a computer program for preventing debugging (S120).

This is to exclude from the anti-debugging target program when debugging is performed during the development of the program by the developers (S170).

In step S120, when the computer program is to prevent debugging, that is, an anti-debugging target computer program, it is registered that debugging is being performed (S130).

In addition, periodically, the execution of the computer program itself is terminated by transmitting the fact that debugging is performed in real time to the computer program (S140).

In addition, if the anti-debugger tracer handler is changed, the system thread (Tred) is inquired as a separate function, and if the handler is changed, the debugging is performed on the computer program. Therefore, the debugging is performed by the computer program. The computer program is terminated by transferring the information (S360).

However, if the handler is not changed in step S360, the original code of the operating system of the computer is called to allow other programs of the computer to proceed normally.

2 is a flowchart illustrating a method for preventing debugging of a real-time computer program according to another embodiment of the present invention.

It is implemented by separating the kernel level for directly communicating with the hardware of the computer and the user level for running general programs.

The predetermined code of the user level inquires whether a debugger operating at the kernel level is executed (S200).

This is to detect when a debugger program that executes a debugger is executed in the anti-debugger target program and to prevent the disassembly by terminating the anti-debugger target program.

Therefore, the predetermined code of the user level calls the create file using the driver information of the debugger, and determines that the debugger operates when the create file is opened (S210). ). One example of the debugger is Soft Ice.

In another application, the user-level predetermined code invokes a predetermined function that possesses the Windows internal information of the computer at the kernel level. If the driver list is included in the currently running driver list in the internal information of the window and the driver is included in the list, it is determined that the debugger operates. An example of the predetermined function is NtQuerySystemInformation.

If it is determined that the debugger operates, in order to determine whether the target computer program in which the debugger operates is a computer program configured to not execute the debugger, a predetermined function located at the kernel level is called to receive a return value (S215). .

If the return value is included in the anti-debugging target program list, it registers that the debugging is being performed, and transmits the debugging performance to the computer program to terminate the computer program (S220, S230, S240).

Even if the computer program is terminated, other programs of the computer should be properly run, and as a result of the determination in step S220, the program being debugged should be executed without being terminated even when the program is not an anti-debugging target program. Call the original code (S250).

As described above, the method of the present invention is implemented as a program and stored in a recording medium such as a CD-ROM, a RAM, a ROM, a floppy disk, a hard disk, a magneto-optical disk, and the like.

The operating state of the present invention configured as described above will be described in more detail.

3 illustrates handler processing of interrupts implemented in the Windows NT series according to an embodiment of the present invention.

When a break point occurs in a running computer program, interrupt 3 is generated internally in the computer, and when debugging by a single step occurs, interrupt 1 is generated internally in the computer (S310 and S320).

When the interrupt 1 or the interrupt 3 is generated, values of the CS (Code Segment) register, the SS (Stack Segment) register, the DS (Data Segment) register, and the FS register, which are general-purpose registers existing in the computer, are stored ( S330).

After that, since the kernel API of Windows is used in the debugger handler, only the value of the FS register having a different kernel level and user level value is set to the kernel level value (S340).

After the modification is completed, the fact that the debugging has occurred is registered in the Work Item and transmitted to the computer program using an Asynchronous Procedure Call (APC) function (S350, S360).

Then, after the operation of transmitting the debugging occurrence fact by using the APC function to the computer program is completed, it is restored to the original register values, and then the handler mapped to the original interrupt is called (S370). .

At this time, if there is a kernel debugger handler, the kernel debugger handler is called and then the Windows operating system handler is called (S380 and S390).

4 illustrates handler processing of an interrupt implemented in the Windows 9x series according to an embodiment of the present invention.

In the case of the Windows 9x series, the description will be mainly focused on the differences from the above-described Windows NT series, and the descriptions thereof will be omitted.

The debugger tracing handler does not call a separate special kernel level application protocol interface (API) and stores only global variables, that is, values of all registers existing at the kernel level (S430).

In addition, when an interrupt occurs, only the code segment and the stack segment are modified to fit the kernel level. Thus, in order to modify the global variable of the present invention, the data segment is also required at the kernel level. The operation should be modified to be possible, and the value may be set to the same value as the stack segment (S440).

A call to a handler, that is, an external memory variable called flag is installed to indicate that debugging is being performed, the flag is checked and the computer program is notified to the computer program using an APC function (S450). , S460).

After the operation of transmitting the debugging occurrence fact to the computer program by using the APC function is completed, the process of restoring the previous register values to the original register values and then calling the handler mapped to the original interrupt is performed. Same as NT series (S470, S480, S490).

As described in detail above, according to the method for preventing debugging of a real-time computer program of the present invention and a recording medium thereof, when debugging is performed using a function such as a break pointer or a trace while an anti-debugging target computer program is running, debugging is performed. By passing the fact to the computer program to be anti-debugged, it is possible to prevent the computer program from being hacked by blocking the debugger from running in real time.

Therefore, it is possible not only to prevent the user from performing arbitrary assembly and further manipulation of the program by debugging arbitrarily, such as online games, but also to find a problem of a program that performs debugging with right rights. For debugging, the program does not terminate even if debugging is performed.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiments, and the technical field to which the present invention belongs without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Claims (15)

A-1) inquiring whether or not the debugger is executed by a user level code; A-2) when the debugger is operating, hooking an interrupt table corresponding to an interrupt for debugging generated in a running computer program; B) determining whether the computer program where the debugging has occurred is a target program for performing anti-debugging; C) registering the fact that debugging according to the interruption is performed when the computer program is the anti-debugging target program; D) sending said registered debugging performance to said computer program; And E) a method of preventing debugging of a real-time computer program, comprising the step of calling the original code of the operating system (Operation System) of the computer on which the computer program is running. The method of claim 1, wherein the method is F) inquiring whether a handler of an anti-debugging trace set to a predetermined interrupt of the interrupt table has changed; And G) The method of preventing debugging of a real-time computer program, if the handler is changed as a result of the inquiry, and transmits the change of the handler to the computer program. The method of claim 1, wherein step D) D-1) transmitting the registered debugging execution fact to a processor for executing the computer program, and terminating execution of the computer program. The process according to any one of claims 1 to 3, wherein in step B), B-1) calling a predetermined function located at a kernel level of the computer and receiving a return value to determine whether the computer program is an anti-debugging target program; And B-2) comparing the return value with the anti-debugging target program list and recognizing it as an anti-debugging target program, further comprising the step of preventing debugging of a real-time computer program. The method according to claim 4, wherein in step B-1), a predetermined function located at the kernel level is called. B-1a) backing up register values of the computer; And B-1b) setting a predetermined register value among the register values to each register value located in the kernel. 6. The method of claim 5, wherein if the computer is a Windows NT family, And the register to be set is an FS register. 6. The method of claim 5, wherein if the computer is a Windows 9x series, The setting register is a DS (Data Segment) register, and the value of the DS register is set to the same value as the SS (Stack Segment) register. delete The method of claim 1, wherein step A-1) A-1a) calling the create file function by using the driver information of the debugger by the user level code; And A-1b) when the create file is opened, determining that the debugger is operating. The method of claim 1, wherein step A-1) A-11) acquiring window internal information of the computer by the user level code calling a predetermined function; And A-12) A method for preventing debugging of a real-time computer program, comprising: inquiring whether a driver of the debugger is included in a list of currently running drivers of the internal information of the computer. delete (A) inquiring whether a user level code is executed or not; A-2) hooking an interrupt table corresponding to an interrupt for debugging generated in a running computer program when the debugger operates; B) determining whether the computer program generating the interrupt is a target program for performing anti-debugging; C) registering the fact that debugging according to the interruption is performed when the computer program is the anti-debugging target program; D) transmitting the registered debugging execution fact to a processor for executing the computer program to terminate execution of the computer program; E) calling an original code of an operating system of a computer on which the computer program is running; F) inquiring whether a handler of an anti-debugging trace set to a predetermined interrupt of the interrupt table has changed; And G) A computer-readable recording medium having recorded thereon a program for realizing the step of transmitting the change of the handler to the computer program when the handler is changed as a result of the inquiry. The method of claim 12, wherein step A-1), A-1a) calling the create file function by using the driver information of the debugger by the user level code; And A-1b) A computer-readable recording medium having recorded thereon a program for realizing that the debugger is operated when the create file is opened. The method of claim 12, wherein step A-1), (A) acquiring window internal information of the computer by calling a predetermined function by the user level code; And A-12) A computer-readable recording medium having recorded thereon a program for realizing a step of inquiring whether a driver of the debugger is included in a list of currently executed drivers of the internal information of the computer. The method according to any one of claims 12 to 14, wherein in step b): B-1) calling a predetermined function located at a kernel level of the computer and receiving a return value to determine whether the computer program is an anti-debugging target program; And B-2) comparing the return value with an anti-debug target program list and recognizing it as an anti-debug target program, To call a function located at the kernel level, B-1a) backing up register values of the computer; And B-1b) A computer-readable recording medium having recorded thereon a program for realizing the step of setting a predetermined register value among the register values to each register value located in the kernel.

Images