KR100949949B1 - Method and Apparatus for prevention an debugging using call stack - Google Patents

Abstract

The present invention relates to an apparatus and method for preventing debugging using a call stack.

In the debugging prevention method using a call stack according to an embodiment of the present invention, in the call stack indicating a call relationship between functions, selecting a debugging prevention function among specific functions on the call stack, the selected debugging prevention function Changing the stack information including the position information on the call stack with respect to a predetermined value, and restoring the stack information of the function to be debugged to the value before the change.

According to the present invention, since the call stack information can be changed without affecting the execution of the application, the call stack information can be checked through a hacking tool such as a debugger, so as to hide whether or not a specific function is called or block the confirmation of the execution process. This makes it possible to prevent the program from being hacked.

Call Stack, Base Pointer, Return Address, EBP, RET, Debugging Prevention

Description

Method and Apparatus for prevention an debugging using call stack}

The present invention relates to a method and apparatus for preventing debugging using a call stack. More particularly, the present invention relates to a method and apparatus for preventing debugging using a debugger to check call stack information for a specific application and analyze a function execution process.

In computer science, a call stack is a stack data structure that dynamically stores information about subroutines of a program being executed, that is, information about call relationships between functions. The call stack is used for a variety of purposes, and one of the important purposes is to store information (eg, instruction addresses) about where to return when each subroutine terminates during function execution.

When a program runs, several subfunctions are executed within a function. At this time, the stack reference position of the upper calling function and the return address of the upper calling function for the instruction processing are stored on the stack, and the state of the upper calling function is referred to by referring to the value stored in the stack at the end of the sub function, that is, the called function. Perform a series of steps to return to. Since the call stack is configured as a stack memory, an operation is performed in which the calling function pushes a return address or the like onto the stack, and the called function pops up a return address or the like stored from the stack at the end of the call.

1 illustrates a structure 100 of a typical call stack memory.

The stack uses the Last In First Out (LIFO) method and takes the form of filling data from upper address to lower address. The parameter stores a parameter 110 (PARAM) 110, a return address (RET) 120, a base pointer 130 (BP) 130, a local variable LOCAL 140, and the like. Will be. The parameter 110 is a space for storing information about a parameter of a function. The return address 120 is a space for storing an address to which the instruction of the CPU should return after the called function ends. That is, when a specific function executes the called function as a subroutine during execution, after the execution of the called function is finished, the address to which the instruction of the CPU is to be transferred to the specific function which is a higher function to the called function is stored. As a result, when a particular function calls a called function, the return address 120 is stored on the stack. The base pointer 130 serves as a reference point of the stack. In general, when the CPU searches the stack memory, the base pointer 130 refers to a location where the return address 120 or the parameter 110 is stored based on the base pointer 130. Search. For example, the location where the return address 120 is stored on the stack becomes a location corresponding to the address of the base pointer 130 + 4 bytes. In addition, the information stored on the base pointer 130 is the address of the base pointer 130 of the higher call function of the function corresponding to the stack in which the base pointer 130 is stored. In other words, the base pointer 130 becomes a reference point on the stack memory associated with the base pointer 130, and the information stored in the base pointer 130 identifies the call relation of the function as the address of the base pointer 130 of the higher calling function. It is information. The local variable 140 stores values of various local variables required during function execution.

As shown above, since the call stack contains information such as the call position and execution order of functions, the call stack traces back information such as the return address 120 and the base pointer 130 stored in the call stack, and the overall execution of the program to date. You can see the flow and see what functions have been performed. Tools such as debuggers allow you to monitor these call stacks at a glance. Therefore, if a program is stopped using a hacking tool such as a debugger and the program is stopped by setting a breakpoint, and the call stack information is grasped, the contents and information of the specific program can be hacked. Hackers have a variety of problems, such as the development of similar programs or by stealing user's information by identifying the behavior of a particular program through the above hacking method.

As above, a solution for preventing hacking damage using the call stack information exposed by the debugging tool has been needed.

The present invention blocks the debugging behavior itself so that the information of the call stack is not exposed to hackers. That is, the present invention is to solve the above problems, and the technical problem to be achieved by the present invention is a method for preventing the analysis of the process of checking the call stack information and the function execution process for a specific application using a debugging tool (debugger) And to provide a device.

The object of the present invention is not limited to the above-mentioned object, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a method for preventing debugging using a call stack according to an embodiment of the present invention includes selecting a function to be prevented from debugging on a call stack in a call stack indicating a call relationship between functions, and selecting the selected debugging prevention object. Changing the stack information indicating the relative position of the function on the call stack to a predetermined value, and restoring the stack information of the function to be debugged to the value before the change.

Preferably, the stack information includes a base pointer including stack position information of the upper call function that calls the debugging prevention function. Also, more preferably, the stack information may include a function return address including an address to which a CPU instruction returns after completion of execution of the anti-debugging function.

Preferably, the step of modifying the stack information of the function to be debugged includes performing an exclusive OR operation with any data having the same digit number and restoring the exclusive OR operation. After the execution, the stack information of the function to be prevented to be debugged is performed with the arbitrary data and the exclusive OR operation.

Preferably, the changing step is performed immediately after the debugging prevention function is called.

Preferably, the changing step is executed at any point in the execution of the function to be debugged.

Preferably, the restoring step is executed just before the debugging prevention function ends.

Preferably, the restoring step is executed before the stack information of the function to be debugged is referred to by the CPU.

Preferably, the step of changing includes backing up stack information of the debugging target function, and the step of restoring includes restoring stack information of the debugging target function with the backed up stack information.

Preferably, the changing step changes the stack information of the anti-debugging function to the stack information of the parent call function for the anti-debugging function.

Preferably, the changing step changes the stack information of the function to be prevented to debug to an arbitrary value.

Preferably, the step of backing up backs up the stack information of the function to be debugged in a separate memory space.

In order to achieve the above object, an apparatus for preventing debugging using a call stack according to an embodiment of the present invention includes a means for selecting a function to be prevented from debugging on a call stack in a call stack indicating a call relation between functions, selected debugging prevention Means for changing the stack information indicating the relative position of the target function on the call stack to a predetermined value, and means for restoring the stack information of the debugging prevention target function to the value before the change.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the debugging prevention apparatus and method using the call stack of the present invention as described above has the following effects.

According to the present invention, since the call stack information can be changed without affecting the execution of the application, the call stack information can be checked through a hacking tool such as a debugger, so as to hide whether or not a specific function is called or block the confirmation of the execution process. This has the advantage of preventing you from trying to hack your program.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that the combination of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flow chart step of the block diagram. Computer program instructions It can also be mounted on a computer or other programmable data processing equipment, so a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to perform the computer or other programmable data processing equipment. It is also possible for the instructions to provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative implementations, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

2 shows the execution of a function within a typical program.

In a program, a function is frequently called to perform a specific function while another function is being executed. For example, if function C needs to be performed while function C starts and is performed, function B is called 210. In this case, stack information to be referred to during or after the execution of function B is generated and stored in the stack 260. Thereafter, the function B calls the function A 220 during its execution and accordingly, related stack information is generated and stored. When function A terminates, the instruction of the CPU returns to the execution point of function B using the return address stored on the stack, and the address stored in the function pointer's base pointer, that is, the address of the function pointer's base pointer. You can refer to the stack of function B using.

Therefore, if the program is stopped at a specific point in time and the call stack, ie, the call stack, is checked in reverse, the execution order of the program, the called functions, and the like can be identified.

3 is a flowchart illustrating a debugging prevention method using a call stack according to an embodiment of the present invention.

First, a step S310 of selecting a function to be hidden, that is, a function to be prevented from debugging, among functions on the call stack is included. Next, a step (S320) of changing stack information including information about a relative position on the call stack of the debugging prevention function to a predetermined value is included. For example, if you want to hide the fact that function B is being executed to prevent debugging of the program's operation, change the information recorded on the stack containing stack information such as return address and base pointer to function B. If you change the stack information for function B to the stack information for function C, if you debug the execution of the function through the call stack, it will appear that function C calls function A immediately and then returns to function C. do. In other words, the fact that function B is executed is not confirmed on the call stack. Thereafter, the stack is restored to the stack information before changing the stack information of the debugging prevention target function (S330) so that the program can operate normally. In other words, the stack information is changed for a certain period to prevent debugging, but when the program needs to operate by referring to the stack information, it can refer to the normal stack information.

Hereinafter, a detailed embodiment of a stack information change method, a change point, and a restore point will be described.

More specifically, as described above, the stack information to be changed may be a return address storing an address to which the instruction of the CPU returns, or a base pointer that stores stack position information and is a reference of a stack reference, or a return address. You can also change both the and the base pointers, which may be determined by the information referenced by hacking tools such as debuggers when attempting to debug using the call stack.

One embodiment of a method for changing stack information is using an exclusive OR. When the stack information to be changed is taken by using an exclusive OR operation with arbitrary data and then restored to original data, the stack information before the change can be restored by performing the exclusive OR operation with the same data.

Another embodiment of changing the stack information is a method of changing the stack information of a function to be prevented from debugging into stack information of a higher calling function. For example, if you change the return address of your subcall function to the return address of the calling function that calls you, not your own address, the calling function will appear to be calling the lower call function directly on the call stack and you The fact that it is done will not appear on the call stack.

Another example of changing the stack information is to change the stack information of a function to be prevented from debugging to an arbitrary value. In this case, even if you try to verify the execution of the program through the debugger, it becomes impossible to check the call stack because the referenced information appears to be inaccurate.

Preferably, changing the stack information includes backing up the original stack information before changing the stack information of the function to be debugged. As described above, in order for a program to be protected after changing the stack information to operate normally, a step of restoring to the normal stack is required, and for this purpose, it may be necessary to back up the stack information before the change. The backup of the stack information may be performed by a data backup method commonly used in the art, including a method of backing up and storing stack information in a separate memory space.

As described above, a time point for changing the stack information may be variously selected. Preferably, the stack information can be changed immediately after the function is called. In such a case, the function is executed with the stack information hidden for the longest time, thus effectively preventing the attempt to debug using the call stack. However, if desired, the change point may change at any point during execution after the function is called.

In addition, it is necessary to restore the changed stack information to the value before the change so that the operation of the actual program does not operate abnormally before the program to be debugged is actually executed while the program to be debugged is executed. Preferably, there is a way to restore the stack of functions just before they are referenced by the CPU. This allows the stack information to be hidden for the longest time. In addition, restoring the function just before the function ends is another method. In addition, the restoring time may be any point before the debugging target prevention function ends.

4 is a block diagram illustrating a configuration of an apparatus for preventing debugging using a call stack according to an embodiment of the present invention.

The debugging apparatus using the call stack includes a stack memory unit 410, a stack information backup unit 420, a stack information selecting unit 430, a stack information changing unit 440, and a stack information restoring unit 450.

The stack memory unit 410 includes a stack memory constituting the call stack. The stack information of each function is stored in this stack memory section, and this is used to construct a call stack and to run a program.

When the stack information backup unit 420 needs to back up the stack information, the stack information backup unit 420 is responsible for backing up and storing the stack information. The space to be backed up includes all the backup means and methods commonly available in the art, such as a separate memory.

The stack information selector 430 plays a role of selecting and storing a stack when a stack of an anti-debugging function is changed to a stack accessible on a stack memory unit such as a stack of an upper or lower calling function of an anti-debugging function. This is a component that operates when changing stack information to other stack information.

The stack information changing unit 440 is a part for changing stack information of a function to be hidden, and as described above, the stack information changing unit 440 changes the data through logical exclusive sum, changes to other stack information, and changes to an arbitrary value. It is responsible for changing the stack information.

The stack information restoring unit 45 is a part that restores the stack information changed by the stack information changing unit 440 before being referred to by the program again. The information backed up by the stack information backup unit 420 may be restored, or the stack may be performed once again with the same data as the data used in the logical exclusive sum performed by the stack information changing unit 440. You can also restore the information.

Until now, each component of FIG. 4 may refer to software or hardware such as a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). However, the components are not limited to software or hardware, and may be configured to be in an addressable storage medium and may be configured to execute one or more processors. The functions provided in the above components may be implemented by more detailed components, or may be implemented by combining a plurality of components to perform a specific function. In addition, the components may be implemented to execute one or more computers in a system. In addition, not all components are essential components and may not be included or included in a plurality without departing from the spirit of the present invention.

The present invention can be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CO-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which may also be implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

1 is a structure of a call stack memory in a typical computer.

2 shows the execution of a function within a typical program.

3 is a flowchart illustrating a debugging prevention method using a call stack according to an embodiment of the present invention.

4 is a block diagram illustrating a configuration of an apparatus for preventing debugging using a call stack according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

400: debugging prevention device using a call stack 410: stack memory unit

420: stack information backup unit 430: stack information selection unit

440: stack information changing unit 450: stack information restoring unit

Claims (15)

In a call stack that shows the call relationship between functions, Selecting a function to be prevented from debugging among the functions on the call stack; Changing stack information indicating a relative position on a call stack of the selected debugging prevention function to a predetermined value; And Restoring the stack information of the debugging prevention target function to a value before the change; How to prevent debugging using the call stack. The method of claim 1, The stack information may include a base pointer (BP) including stack position information of an upper call function that calls the debugging prevention target function. How to prevent debugging using the call stack. The method of claim 1, And a function return address (RET) including an address to which the CPU instruction returns after the execution of the debugging prevention target function ends. How to prevent debugging using the call stack. The method of claim 1, The changing may include performing exclusive OR operation (XOR) with arbitrary data having the same digit number in the stack information of the function to be debugged, The restoring may include, after the exclusive OR operation is performed, performing exclusive OR operation on the stack information of the function to be debugged again with the arbitrary data. How to prevent debugging using the call stack. The method of claim 4, wherein The changing may be performed immediately after the debugging prevention target function is called. How to prevent debugging using the call stack. The method of claim 4, wherein The changing may be performed at any point during execution of the debugging prevention target function. How to prevent debugging using the call stack. The method of claim 4, wherein The restoring may be performed immediately before the debugging prevention target function ends. How to prevent debugging using the call stack. The method of claim 4, wherein The restoring may be performed before the stack information of the function to be debugged is referenced by the CPU. How to prevent debugging using the call stack. The method of claim 1, The changing may include backing up stack information of the function to be prevented from debugging, The restoring may include restoring stack information of the debugging prevention function to the backed up stack information. How to prevent debugging using the call stack. The method of claim 9, The changing may include changing stack information of the anti-debugging function into stack information of an upper call function that calls the anti-debugging function. How to prevent debugging using the call stack. The method of claim 9, The changing may include changing stack information of the debugging prevention target function to an arbitrary value. How to prevent debugging using the call stack. The method of claim 9, The backing up may include stacking stack information of the debugging prevention target function in a separate memory space. How to prevent debugging using the call stack. The method of claim 1, The changing may include encrypting stack information of the function to be debugged by a certain law, The restoring may include decrypting the stack information of the encrypted debugging prevention function according to the predetermined rule after the encrypting is performed. How to prevent debugging using the call stack. In the call stack that represents the call relationship between functions, Means for selecting a function to be prevented from debugging among the functions on the call stack; Means for changing stack information indicating a relative position on a call stack of the selected debugging prevention function to a predetermined value; And Means for restoring the stack information of the anti-debugging function to a value before the change; Means to prevent debugging using call stack. A recording medium having recorded thereon a computer readable program for executing the method according to any one of claims 1 to 13 on a computer.

Images