KR100927974B1 - Source code generation system of executable image and its method - Google Patents

Abstract

The present invention discloses an original code generation system of an executable image. That is, a file retrieval module for retrieving a file mapped to an execution image loaded at a first address on a memory; An information analysis module for analyzing header information of the retrieved file; And loading the execution image of the searched file into a second address, which is a separate address in the memory, based on the analyzed header information, and among the plurality of sections included in the specific file when loading the execution image of the specific file into the memory. The relocation target section includes a code section on an execution image loaded at the second address, based on an area allocation information table that specifies a relocation target section that is mapped based on an actually loaded address. By including a region allocation module for mapping by reference, it is possible to generate the original code unmodified for any executable image, regardless of the location of the execution image location to find the code modulated by malicious programs or before Can be used to restore the code of.

Description

Source code generation system of executable image and method thereof {SYSTEM AND METHOD FOR GENERATING ORIGINAL CODE OF EXECUTE IMAGE}

The present invention relates to a system for generating an original image of an executable image and a method thereof, and more particularly, to a relocation target section including a code section on an executable image loaded in a memory, according to attributes of a section, A source code generation system and method for executing an image for relocation based on an address to convert a code portion of a modulated executable image into original executable code before modulation.

In general, tampering with executable image code in memory occurs in many cases as hooking, and some hacking tools use arbitrary code to randomly generate different behavior than the original behavior of the executable image. Occurs upon modification.

This tampering behavior causes many security problems by making the executable image impossible to perform. For example, a malicious program can cause a continuous malfunction of an executable image by forming a rootkit that prevents itself from being found by hooking a specific executable image. In addition, by modifying the code part related to authentication, it can be applied to a crack that allows a user without access authority to use the corresponding program even if the user does not go through the authentication procedure.

In particular, in online games, a certain code of a game execution image is tampered with, or some modules are hooked so that they operate much more advantageously than normal.

In this regard, as a conventional defense against code tampering of the execution image as described above, the code data is read from the file to detect and restore the changed code and the signature information on the original code is periodically used. A method of detecting changed code by comparing signature information with code loaded in a memory has been proposed.

However, in the case of the existing defense against code tampering, since the original copy is copied from the file, detection and restoration are impossible when the module is relocated. Moreover, even if the restoration is made, the malicious code repeats the same code. There is a problem that can be rehooked or remodulated.

 The present invention was created to solve the problems inherent in the prior art as described above, and an object of the present invention is to provide an execution image in which relocation occurs when a code of an execution image is hooked or modulated in memory. The present invention provides a system and method for generating an original image of an executable image that finds and recovers a modified code, and generates an executable original code that is not affected by rehooking or remodulation.

In accordance with an aspect of the present invention for achieving the above object, there is provided a system for generating an original code of an executable image: the system retrieves a file mapped to an executable image loaded at a first address in memory. A file search module; An information analysis module for analyzing header information of the retrieved file; And loading the execution image of the searched file into a second address, which is a separate address in the memory, based on the analyzed header information, and among the plurality of sections included in the specific file when loading the execution image of the specific file into the memory. The relocation target section includes a code section on an execution image loaded at the second address, based on an area allocation information table that specifies a relocation target section that is mapped based on an actually loaded address. And an area allocation module that maps to a reference.

Preferably, when the relocation target section loaded to the second address of the memory has an Execute attribute, the area allocation module maps the relocation target section based on the second address. do.

Advantageously, the area allocation module compares the execution image loaded at the second address of the memory with the execution image loaded at the first address, thereby specifying a particular on the execution image loaded at the first address and the second address. If the sections are different, the different sections loaded at the first address are replaced with the sections loaded at the second address.

According to another aspect of the present invention, a system for generating an original code of an execution image is provided: The system copies an execution image loaded at a first address in a memory to a second address, which is a separate address in a memory. An image copy module; A file retrieval module for retrieving a file mapped to the execution image copied to a second address on the memory; An information analysis module for analyzing header information of the retrieved file; And overlapping by loading a specific section included in the execution image copied to the second address based on the analyzed header information, and when the execution image of the specific file is loaded into the memory, a plurality of sections included in the specific file. Wherein the relocation target section is selected from among a plurality of sections on the execution image copied to the second address and overlapping a specific section, based on an area allocation information table that specifies a relocation target section mapped based on an actually loaded address. And an area allocation module for mapping based on one address.

Preferably, when the relocation target section loaded to the second address of the memory has an Execute attribute, the area allocation module maps the relocation target section based on the second address. do.

According to another aspect of the present invention, a method of generating an original code of an executable image is provided, the method comprising: a) retrieving a file mapped to an executable image loaded at a first address on a memory; b) analyzing, by the information analysis module, header information of the retrieved file; And c) loading an execution image of the retrieved file into a second address, which is a separate address in the memory, based on the analyzed header information.

Preferably, the step c) is a region allocation information table for specifying a relocation target section that is mapped based on the actual loading address of a plurality of sections included in the specific file when loading the execution image of the specific file into the memory Based on the above, the relocation target section including a code section on the execution image loaded at the second address may be mapped based on the first address.

Preferably, in step c), when the relocation target section loaded to the second address of the memory has an Execute attribute, the relocation target section is mapped based on the second address. do.

Advantageously, the method further comprises: d) comparing an execution image loaded at a second address of said memory with an execution image loaded at said first address; And e) if the particular section on the execution image loaded at the first address and the second address is different as a result of the comparison, replacing the different section loaded at the first address with the section loaded at the second address. Step; characterized in that it further comprises.

According to yet another aspect of the present invention, there is provided a method of generating an original image of an executable image, which method comprises: a) copying an executable image loaded at a first address in memory to a second address, which is a separate address; Making; b) retrieving a mapped file for the executable image copied to a second address on the memory; c) analyzing, by the information analysis module, header information of the retrieved file; And d) newly loading and overlapping a specific section included in the image file loaded at the second address based on the analyzed header information.

Preferably, the step d) is a region allocation information table for specifying the relocation target section that is mapped based on the actual loading address of the plurality of sections included in the specific file when loading the execution image of the specific file into the memory Based on the first address, the retargeting section among the plurality of sections on the execution image copied to the second address and overlapping a specific section.

Preferably, the step d), if the relocation target section loaded to the second address of the memory has an Execute attribute, characterized in that for mapping the relocation target section based on the second address. do.

The original code generation system of the execution image and the method thereof according to the present invention can generate an unmodified original code for any execution image regardless of whether or not the execution image is relocated. Can be used to find them or restore them to code prior to modulation.

Also, it is possible to create original code independent executable code while sharing the data already used without being affected by re-hooking or re-modulation by malicious program. It can guarantee the safe operation of its original purpose without being affected by hooking or tampering.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a schematic configuration diagram of a system for generating an original code of an execution image according to a first embodiment of the present invention.

As shown in FIG. 1, the system is provided with a file retrieval module for retrieving a file mapped to an executable image loaded in the memory on the assumption that a specific code of the executable image loaded on the memory is modulated. 100); An information analysis module 200 for analyzing header information of the retrieved file; A region allocation module for newly loading an execution image loaded into a memory at an address separate from an existing address, and relocating a specific section of the newly loaded execution image based on a predetermined memory address by referring to the region allocation information table. 300); has a configuration including. Here, the area allocation information table stores information for specifying a relocation target section that is mapped based on an actual loaded address among a plurality of sections included in the specific file when the execution image of the specific file is loaded into the memory.

The file search module 100 searches for a file mapped to an execution image loaded at a first address on a memory. Here, when the execution image loaded at the first address on the memory is also loaded on the memory, a plurality of sections are mapped based on the first address, which is an address actually loaded on the memory, with reference to the allocation information table described above.

The information analysis module 200 analyzes the header information of the file retrieved through the file search module 100 to grasp a plurality of section information included in the execution image that is actually loaded.

The area allocation module 300 may store the file search module at a second address that is different from the first address where the previous execution image on the memory was loaded based on the header information analyzed by the information analysis module 200. In step 100), the execution image for the searched file is newly loaded.

At this time, the area allocation module 300 relocates the relocation target section including the code section on the execution image loaded at the second address based on the area address information table as described above based on the first address. (Relocation) For reference, in the relocation operation of the area allocation module 300, when the execution image is loaded into the memory at the time of producing the execution image, it is not known to which region it is loaded. Refers to a process of storing objects to be stored as an area allocation information table and then changing them based on an address that is actually loaded with reference to the area allocation information table when loading into a memory for actual use.

More specifically, the area allocating module 300 refers to a relocation target section including a code section, which is a previously loaded memory address instead of a second address, which is a newly allocated memory address, by referring to the area allocation information table. By mapping based on the first address to have the effect previously loaded at the first address, an execution image before being modulated is obtained. Here, the relocation target section may be set in units of sections, and preferably, a target designation for some codes included in one section is also possible.

In addition, the area allocating module 300 compares the execution image loaded at the second address of the memory with the execution image loaded at the first address, and then executes a specific section on the execution image loaded at the first address and the second address. In this case, it is also possible to replace the different section loaded at the first address with the section loaded at the second address.

Meanwhile, when the relocation target section including the code section has an execute attribute, the area allocation module 300 relocates based on the newly allocated second address. In this case, when the relocation target section does not have an execution attribute such as a data attribute, by relocating based on the first address of the memory, data previously used at the first address on the memory may be shared.

Hereinafter, a method of generating original code of an execution image according to a first embodiment of the present invention will be described with reference to FIG. 2. 2 is a schematic flowchart illustrating a method of generating original code of an execution image according to a first embodiment of the present invention.

First, the file search module 100 searches for a file mapped to an execution image loaded at a first address in a memory (S110).

Next, the information analysis module 200 analyzes the header information of the file retrieved through the file search module 100 to grasp a plurality of section information included in the execution image that is actually loaded (S120).

Then, the area allocation module 300 newly loads the execution image of the searched file to a second address which is a separate address in the memory based on the analyzed header information (S130). Preferably, the area allocation module 300 is based on the header information analyzed by the information analysis module 200, the file at a second address which is separate from the first address where the previous execution image on the memory was loaded. The execution module for the searched file is newly loaded through the search module 100.

At this time, when the region allocation module 300 loads an execution image of a specific file into a memory, an area allocation information table specifying a relocation target section that is mapped based on an actually loaded address among a plurality of sections included in the specific file On the basis of this, the relocation target section including the code section on the execution image loaded at the second address is mapped based on the first address (S140). Preferably, the area allocation module 300 may refer to the area allocation information table for the relocation target section including the code section, instead of the second address which is a newly allocated memory address, instead of the previously loaded memory address. By relocating based on the first address to have the effect previously loaded at the first address, an execution image before being modulated is obtained.

In addition, when the relocation target section including the code section has an execute attribute, the area allocation module 300 relocates based on the newly allocated second address. In this case, when the relocation target section does not have an execution attribute such as a data attribute, by relocating based on the first address of the memory, data previously used at the first address on the memory may be shared.

Meanwhile, the area allocation module 300 compares the execution image loaded at the second address of the memory with the execution image loaded at the first address, and, as a result of the comparison, the execution loaded at the first address and the second address. If the specific sections on the image are different, different sections loaded at the first address may be replaced with sections loaded at the second address.

3 is a schematic structural diagram of an original code generation system of an execution image according to a second embodiment of the present invention.

As shown in FIG. 3, the system includes an image copy module 400 for copying an execution image loaded onto a memory; A file retrieval module (500) for retrieving a file mapped to an executable image loaded in the memory on the assumption that a specific code of the executable image loaded on the memory is modulated; An information analysis module 600 for analyzing header information of the retrieved file; Reloading and overlapping a specific section included in the execution image copied to the memory, and allocating an area for relocating the specific section of the newly loaded execution image based on a predetermined memory address by referring to the region allocation information table. Module 700; has a configuration that includes. Here, the area allocation information table stores information for specifying a relocation target section that is mapped based on an actual loaded address among a plurality of sections included in the specific file when the execution image of the specific file is loaded into the memory.

The image copy module 400 copies the execution image loaded at the first address on the memory to a second address which is a separate address on the memory. Here, when the execution image loaded at the first address on the memory is also loaded on the memory, a plurality of sections are mapped based on the first address, which is an address actually loaded on the memory, with reference to the allocation information table described above.

The file search module 500 searches for a file mapped to an execution image copied to a second address on a memory.

The information analysis module 600 analyzes the header information of the file retrieved through the file search module 500 to grasp a plurality of section information included in the execution image that is actually loaded.

The area allocation module 700 preferably includes a specific section included in the image file copied to the second address of the memory, the file retrieved through the file retrieval module 100, based on the header information analyzed by the information analysis module 600. Preferably, a new section of the modulated or modifiable section is loaded and overlapped.

At this time, the area allocation module 700 refers to the relocation target section among the plurality of sections on the execution image, which are copied to the second address and overlap the specific section, based on the area allocation information table as described above. Map to.

More specifically, the area allocation module 700 refers to a relocation target section including a code section, which is a previously loaded memory address instead of a second address, which is a newly allocated memory address, by referring to the area allocation information table. By mapping based on the first address to have the effect previously loaded at the first address, an execution image before being modulated is obtained.

Meanwhile, when the relocation target section including the code section has an Execute attribute, the area allocation module 700 relocates based on the newly allocated second address. In this case, when the relocation target section does not have an execution attribute such as a data attribute, by relocating based on the first address of the memory, data previously used at the first address on the memory may be shared.

Hereinafter, a method of generating original code of an execution image according to a second embodiment of the present invention will be described with reference to FIG. 4. 4 is a schematic flowchart illustrating a method of generating original code of an execution image according to a second embodiment of the present invention.

First, the image copy module 400 copies an execution image loaded at a first address on a memory to a second address which is a separate address (S210).

Then, the file search module 500 searches for a file mapped to the execution image copied to the second address on the memory (S220).

Next, the information analysis module 600 analyzes the header information of the file retrieved through the file search module 500 to grasp a plurality of section information included in the execution image that is actually loaded (S230).

Then, the area allocation module 700 newly loads and overlaps a specific section included in the image file loaded at the second address based on the analyzed header information (S240). Preferably, the area allocation module 700 includes the file retrieved through the file retrieval module 100 in the image file copied to the second address of the memory, based on the header information analyzed by the information analysis module 600. A particular section, that is, a particular section that is hooked or modulated, or possibly modulated, is newly loaded and overlapped.

At this time, when the region allocation module 700 loads the execution image of the specific file into the memory, the region allocation information table specifying the relocation target section that is mapped based on the actual loading address among the plurality of sections included in the specific file Based on the first address, a retargeting section of the plurality of sections on the execution image copied to the second address and overlapping a specific section is mapped based on the first address (S250). Preferably, the area allocation module 700 refers to a relocation target section including a code section that is a previously loaded memory address instead of a second address that is a newly allocated memory address with reference to the area allocation information table. By relocating based on the first address to have the effect previously loaded at the first address, the execution image before being modulated is obtained. Meanwhile, when the relocation target section including the code section has an Execute attribute, the area allocation module 700 relocates based on the newly allocated second address. In this case, when the relocation target section does not have an execution attribute such as a data attribute, by relocating based on the first address of the memory, data previously used at the first address on the memory may be shared.

Although the present invention has been described in detail with reference to the preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

An original code generation system of an execution image and a method thereof according to the present invention relocate a relocation target section including a code section on an execution image loaded into a memory based on a section attribute, based on a specific address of the memory. By switching the code portion of the modulated executable image to the original executable code before tampering, the malicious code can repeatedly rehook or remodulate the same code.

The following drawings, which are attached in this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention, serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a schematic structural diagram of an original code generation system of an execution image according to a first embodiment of the present invention;

2 is a schematic flowchart illustrating a method of generating original code of an execution image according to a first embodiment of the present invention.

3 is a schematic structural diagram of an original code generation system of an execution image according to a second embodiment of the present invention;

4 is a schematic flowchart illustrating a method of generating original code of an execution image according to a second embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100, 500: File Search Module

200, 600: information analysis module

300, 700: zone allocation module

400: image copy module

Claims (12)

In the original code generation system of the executable image, A file retrieval module for retrieving a file mapped to an executable image loaded at a first address on a memory; An information analysis module for analyzing header information of the retrieved file; And Based on the analyzed header information, the execution image of the searched file is loaded to a second address, which is a separate address in the memory, and when a running image of a specific file is loaded into the memory, among the plurality of sections included in the specific file, Based on the relocation target section including a code section on an execution image loaded at the second address, based on an area allocation information table specifying a relocation target section mapped based on the loaded address; And an area allocation module for mapping to the source code generation system of the executable image. The method of claim 1, wherein the area allocation module, And when the relocation target section loaded to the second address of the memory has an Execute attribute, mapping the relocation target section based on the second address. The method of claim 1, wherein the area allocation module, Comparing the execution image loaded at the second address of the memory with the execution image loaded at the first address, if the specific section on the execution image loaded at the first address and the second address is different, the first address And replace the different sections loaded at with the sections loaded at the second address. In the original code generation system of the executable image, An image copy module for copying an execution image loaded at a first address on a memory to a second address, which is a separate address on the memory; A file retrieval module for retrieving a file mapped to the execution image copied to a second address on the memory; An information analysis module for analyzing header information of the retrieved file; And Loading and overlapping a specific section included in the execution image copied to the second address based on the analyzed header information, and among the plurality of sections included in the specific file when loading the execution image of the specific file into the memory. Based on an area allocation information table specifying a relocation target section mapped based on an actually loaded address, the relocation target section among a plurality of sections on the execution image copied to the second address and overlapping a specific section; And an area allocation module for mapping the address based on the address. The method of claim 4, wherein the area allocation module, And when the relocation target section loaded to the second address of the memory has an Execute attribute, mapping the relocation target section based on the second address. In the original code generation method of the executable image, a) retrieving a mapped file for an executable image loaded at a first address on memory; b) analyzing, by the information analysis module, header information of the retrieved file; And and c) loading the executable image of the retrieved file into a second address, which is a separate address in the memory, based on the analyzed header information. The method of claim 6, wherein step c) When the execution image of a specific file is loaded into the memory, the second image is loaded at the second address based on an area allocation information table that specifies a relocation target section that is mapped based on an address that is actually loaded among a plurality of sections included in the specific file. And the relocation target section including a code section on an execution image based on the first address. The method of claim 7, wherein the step c) And when the relocation target section loaded at the second address of the memory has an Execute attribute, mapping the relocation target section based on the second address. The method of claim 6, wherein the method is d) comparing the execution image loaded at the second address of the memory with the execution image loaded at the first address; And e) if a particular section on the execution image loaded at the first address and the second address is different as a result of the comparison, replacing a different section loaded at the first address with a section loaded at the second address; Source code generation method of the executable image, characterized in that it further comprises. In the original code generation method of the executable image, a) copying an execution image loaded at a first address on a memory to a second address, which is a separate address; b) retrieving a mapped file for the executable image copied to a second address on the memory; c) analyzing, by an information analysis module, header information of the retrieved file; And and d) newly loading and overlapping a specific section included in the image file loaded at the second address, based on the analyzed header information. The method of claim 10, wherein the d) step, When the execution image of a specific file is loaded into memory, the second file is copied to the second address based on an area allocation information table that specifies a relocation target section that is mapped based on an address that is actually loaded among a plurality of sections included in the specific file. And a relocation target section among a plurality of sections on the execution image in which a specific section overlaps, based on the first address. The method of claim 11, wherein the d) step, And when the relocation target section loaded at the second address of the memory has an Execute attribute, mapping the relocation target section based on the second address.

Images