KR100939210B1 - Apparatus and method for prevention an debugging in a virtual environment - Google Patents

Abstract

An apparatus and method for preventing debugging in a virtual environment.

According to an embodiment of the present invention, a method for preventing debugging in a virtual environment may include performing initialization for building a virtual environment, switching to a kernel level of the virtual environment, and storing first CPU state information that is current CPU state information. Modifying the contents of the current CPU register to a value generated by performing the initialization step after executing the step of storing the first CPU state information, executing the application using the modified CPU register, and generating a debugging interrupt for the application. Detecting whether or not, and processing a debugging interrupt to prevent debugging of the application when a debugging interrupt occurs.

According to the present invention, an anti-debugging system in a virtual environment isolates the code to be protected from the kernel of an existing operating system so that it is executed in the virtual environment and controls the processing of debugging-related interrupts, thereby analyzing tools such as hacking tools for the code. It becomes possible to prevent performing the analysis.

Virtual Environment, Virtual Kernel, Debugging Interrupts, Debugging Prevention

Description

Apparatus and method for prevention an debugging in a virtual environment}

The present invention relates to an apparatus and method for preventing debugging execution in a virtual environment, and more particularly, to provide a virtual environment isolated from the kernel of an existing operating system in order to prevent debugging for a specific application, and to control debugging related interrupt processing. An apparatus and method are provided.

A hierarchical illustration of a mechanism in which one application is performed is shown in FIG. 1. The application 4 calls the library function through the API, the library 3 requests the hardware resource 1 from the operating system 2 through a system call, and the operating system controls the hardware resource through the ISA. do. The virtualization technique is a technique for providing an environment in which applications based on different operating systems can be executed by allowing a plurality of operating systems to be supported on common hardware resources. This virtualization concept can be classified according to the layer on which it is implemented. ISA level virtualization is a method that emulates ISA of multiple operating systems so that multiple operating systems can run on a single hardware. The speed is too slow because all instructions for hardware from multiple operating systems must be converted. There was this. Therefore, the hardware abstraction layer (HAL) level virtualization has emerged, which virtualizes only a part of ISA by using the existing code as it is and emulating only the instructions related to other state changes. 2 illustrates a general concept of HAL level virtualization.

HAL level virtualization is based on the guest operating system by the applications (11, 21) running in the guest operating system (12, 22) different from the host operating system with the host operating system (31) mounted on the common hardware 33 The hardware is accessed through system calls, and the virtual machines 13 and 23 and the virtual machine monitor 32 relay the operation instructions during these calls so that the operation codes of the host operating system can be used as they are, and other state transition related instructions In this case, by providing newly defined codes, the applications 11 and 21 on the plurality of operating systems can be allocated hardware. However, HAL-level virtualization also has a problem that there is a very large overhead in handling interrupts by different operating systems because the interrupts for multiple operating systems must be mapped to common hardware.

Most existing analysis tools for debugging running applications are built using the kernel code provided by the operating system and the debugging capabilities provided by the CPU. In order to prevent analysis by such analysis tools, such as hacking, solutions are known to prevent debugging by manipulating the kernel code used by the operating system to provide debugging services or by monitoring system registers that are changed at debugger activation. have. However, many analysis tools avoid this by circumventing or restoring the code or data affected by this prevention solution. This problem occurs because the application and the hacking program to be protected are executed in one operating system environment composed of the same kernel code and data.

The technical problem of the present invention is to prevent the application from being debugged by the hacking tool by allowing the application to be protected to be executed in a virtual environment isolated from the kernel of the existing operating system and controlling the processing when a debugging related interrupt occurs. It is intended to provide a debugging prevention apparatus and method.

The object of the present invention is not limited to the above-mentioned object, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a method for preventing debugging in a virtual environment according to an embodiment of the present invention may include performing initialization for building a virtual environment, switching to a kernel level of the virtual environment, and presenting first CPU state information. Storing the CPU state information, modifying the contents of the current CPU register to a value generated by performing the initialization step after performing the first CPU state information storing step, executing the application using the modified CPU register, and the application Detecting whether or not the debugging interrupt for the occurrence of and processing the debugging interrupt to prevent the debugging of the application when the debugging interrupt is generated.

In order to achieve the above object, a method for preventing debugging in a virtual environment according to another embodiment of the present invention includes performing initialization for building a virtual environment, switching to a kernel level of a virtual environment, and present CPU state information. Storing the first CPU state information, modifying the contents of the current CPU register to a value generated by performing the initialization step after performing the first CPU state information storing step, and executing the application using the modified CPU register Detecting whether a debugging interrupt has occurred for the application, determining whether the processing of the debugging interrupt for the application is prohibited when the debugging interrupt is generated, and preventing debugging of the application if the processing of the debugging interrupt is prohibited. Processing to effect.

In order to achieve the above object, an apparatus for preventing debugging in a virtual environment according to an embodiment of the present invention includes a means for performing initialization for building a virtual environment, a means for switching to a kernel level of a virtual environment, and a current CPU state information. Means for storing CPU state information, means for modifying the contents of the current CPU register to values generated by the initialization performing means after performing the first CPU state information storing means, means for executing the application using the modified CPU register, application Means for detecting whether a debugging interrupt has occurred and means for handling the debugging interrupt to prevent debugging of the application when the debugging interrupt is generated.

In order to achieve the above object, an apparatus for preventing debugging in a virtual environment according to another embodiment of the present invention is a means for performing initialization for building a virtual environment, a means for switching to a kernel level of a virtual environment, and current CPU state information. Means for storing the first CPU state information, means for modifying the contents of the current CPU register to values generated by the initialization performing means after performing the first CPU state information storage means, means for executing the application using the modified CPU registers Means for detecting whether or not a debugging interrupt has occurred for the application, means for determining whether processing of the debugging interrupt for the application is prohibited when the debugging interrupt is generated, and preventing debugging of the application if processing for the debugging interrupt is prohibited. And means for processing.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the application execution apparatus and method in the virtual environment of the present invention as described above has the following advantages.

Debugging code by hacking tools by allowing code to be executed without affecting the code or operating system to be protected in a virtual environment separate from the kernel of the existing operating system and controlling the handling of debugging-related interrupts generated in the virtual environment. There is an advantage that can be prevented.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that the combination of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions It can also be mounted on a computer or other programmable data processing equipment, so a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to perform the computer or other programmable data processing equipment. It is also possible for the instructions to provide steps for executing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative implementations, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

3 is a diagram illustrating a hierarchical structure when a program for building a virtual environment in which an application is executed is executed in an apparatus and a method for preventing debugging in a virtual environment according to an embodiment of the present invention.

When the virtual environment building application is executed, the virtual environment kernel 44 is isolated from the existing operating system 43, and the application 41 to be executed in the virtual environment is an emulation API that supports system calls to the virtual environment kernel. At 42, system calls are made to the operating system. At this time, the virtual environment kernel can use the existing operating system kernel code 43 as it is, except for operating system codes related to CPU registers and memory for applications executed in the virtual environment. For example, the interrupt handling code of the existing operating system can be used as it is for interrupt processing except debugging-related interrupts which will be described in detail later. The relationship between the virtual environment kernel and the existing operating system and the mechanism in which the application is executed in the virtual environment will be described in more detail with reference to FIG. 4.

First, when the virtual environment building application 52 is executed to create a virtual environment for the execution application 61 in the virtual environment to be executed, this is an existing operating system, that is, another application 51 from the standpoint of the Windows operating system 54 in FIG. 4. It is recognized as one application that is equivalent to. The virtual environment building application 52 switches to the virtual environment kernel level through the initial entry path to the predefined virtual environment kernel 62. The initial entry path to the virtual environment kernel 62 may be implemented in various forms. For example, a call gate may be one implementation form.

The virtual environment building application 52 switches to the virtual environment kernel level by the call gate, and then generates a virtual environment kernel 62 that is isolated from the kernel 54 of the existing operating system by the context switching mechanism and executes in the virtual environment. Allow application 61 to access hardware resources 55 through virtual environment kernel 62.

Here, context switching is a computing process that stores and restores the state (context) of a CPU so that a plurality of processes can share a single CPU resource, and is a register context switch, a task context switch, a thread context switch, or It can mean a process context switch. What constitutes a context is determined by the processor and operating system.

Looking at the process of the CPU allocation is switched in more detail between the application 51 running in the actual environment and the execution application 52 in the virtual environment as follows. In a multitasking environment, the application 51 and the virtual environment building application 52 may be allocated a CPU by a context switching mechanism. When the virtual environment building application 52 is allocated a CPU, the virtual environment building application 52 isolates the application from the existing operating system by storing its CPU context and restoring the CPU context of the running application 61 in the virtual environment. To run in a virtualized environment. However, other than that, the kernel code of the existing operating system can be used as it is.

5 is a block diagram illustrating a configuration of an anti-debugging device in a virtual environment according to an embodiment of the present invention.

Debugging device 70 in the virtual environment is largely initializer 71, task manager 72, virtual environment switch unit 73, application execution unit 74, debugging interrupt processing unit 75 and the actual environment restoration unit ( 76).

The initialization unit 71 configures a call gate defining an initial entry path to the virtual environment kernel level and performs initialization for the virtual environment. Initialization for the virtual environment involves initializing the CPU register values and allocating memory. In addition, the initialization unit 71 may load an application to be executed in a virtual environment in an encrypted state and decrypt the encrypted application code. In this case, encryption and decryption may be performed by using an encryption key and a decryption key known only by the anti-debugging device in the virtual environment according to an embodiment of the present invention to further improve the protection and debugging prevention effect of an application executed in the virtual environment.

The task manager 72 receives an instruction regarding execution of the execution application 61 in the virtual environment from the outside and manages the operation of the application 61 at the user level of the virtual environment according to the instruction. The instruction may include a command for stopping execution of the execution application 61 in the virtual environment, resuming execution of the paused application, outputting the contents of the memory at the present time to the hard disk, or terminating execution of the application. This could be

The virtual environment switching unit 73 enters the virtual kernel level by the call gate configured by the initialization unit and stores the registry information of the CPU which has been executed recently at the user level of the existing operating system, that is, the CPU context information of the current real environment. Then, when another application 51 is executed as a system quantum time out, when the virtual environment building application 52 is allocated CPU, the CPU context of the execution application in the virtual environment is executed before the user level code execution. The code is registered as an Asynchronous Procedure Call (APC) so that the steps of storing and restoring the CPU context of the real environment, that is, the CPU context of the virtual environment building application 52 can be performed.

In the present embodiment, a method of switching from an application executed in a real environment to an executed application in a virtual environment has been described based on a context switching technique by APC registration. However, the scope of the present invention is not limited thereto. According to the scope of the present invention, when the virtual environment building application 52 is allocated CPU time again, the virtual environment is stored again by storing the CPU context of the execution application 61 in the virtual environment that cannot be recognized by the existing operating system. It should be construed to include all implementation methods that enable the continuous execution of the application 61 that was executed in the virtual environment when switching to.

The virtual environment switching unit 73 modifies the value of the CPU system register to a value for the virtual environment after performing the APC registration step. That is, the values of the CR3 register and the Interrupt Description Table (IDT) register are changed according to the virtual environment to be constructed. The CPU context of the application executed in the virtual environment is restored to complete the switch to the virtual environment in which the application is executed.

The application execution unit 74 allows the application 61 to access CPU resources through the virtual environment kernel in the virtual environment provided by the virtual environment switching unit 73 so that the application can be executed in an environment isolated from the existing operating system. Make sure The application execution unit 74 executes the application under the control of the job manager 72.

The debugging interrupt processing unit 75 controls the processing of debugging-related interrupts generated for the application in the virtual environment provided by the virtual environment switching unit 73 so as to prevent debugging. It is possible to prevent an attack such as hacking by controlling interrupt processing to be terminated without performing a debugging operation on an interrupt for debugging an application among the interrupts generated in the virtual environment.

When the virtual environment building application 52 is newly allocated CPU resources, the real environment restoration unit 76 executes the code registered as APC by the virtual environment switching unit 73 to execute the virtual environment building application 52. Restore the real environment. That is, by saving the CPU context information of the application executed in the virtual environment and restoring the CPU context information of the real environment, the execution of the virtual environment building application can be resumed and switched to the virtual environment kernel level. Meanwhile, when the execution of the execution application in the virtual environment is completed during the quantum time, the real environment restoration unit 76 restores the CPU context information of the real environment so that the execution of the virtual environment construction application can be resumed and switched to the virtual environment kernel level. do.

Until now, each component of FIG. 5 may refer to software or hardware such as a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). However, the components are not limited to software or hardware, and may be configured to be in an addressable storage medium and may be configured to execute one or more processors. The functions provided in the above components may be implemented by more detailed components, or may be implemented by combining a plurality of components to perform a specific function. In addition, the components may be implemented to execute one or more computers in a system.

6 is a flowchart illustrating a debugging prevention method in a virtual environment according to an embodiment of the present invention.

The virtual environment building application 52 generates a call gate for entering the virtual environment kernel level (S1) and performs initialization for building the virtual environment (S2). In the virtual environment construction initialization phase, CPU register values to be used in the virtual environment are initialized and memory allocation and initialization are performed.

In another embodiment of the present invention, an application to be executed in the virtual environment is loaded in an encrypted state and decrypts the encrypted application code in an initialization step for building a virtual environment. In this case, encryption and decryption may be performed by using an encryption key and a decryption key known only by the anti-debugging device in the virtual environment according to an embodiment of the present invention to further improve the protection and debugging prevention effect of an application executed in the virtual environment. In other words, by encrypting the raw data of the application and decrypting it when the virtual environment enters, the application can be executed through the restored raw data in the virtual environment, thereby protecting the execution code of the application. It is characterized by setting. Encryption in this process may include all common encryption methods that can be used on a computer program, including encryption methods currently commonly used.

Before switching to the virtual environment kernel level, an instruction regarding execution of an application executed in the virtual environment is received from the outside (S3). Instructions regarding the execution of the execution application 61 in the virtual environment are as described above with reference to FIG. 5. The execution of the application is paused. It includes instructions for resuming execution of an application which has been paused and terminating execution of the application. The virtual environment building application switches from the user level to the virtual environment kernel level through the call gate generated in step S1 (S4).

At the virtual environment kernel level, the CPU context information that was executed at the user level of the existing operating system to the last is stored (S5), and the CPU context information of the running application in the virtual environment is preserved at the next scheduling and the CPU context information of the existing physical environment is stored. The APC for restoring is registered (S6). Thereafter, the virtual environment conversion unit 73 changes the values of the system registers and general registers of the current CPU to values initialized to be used in the virtual environment in step S2 (S7), thereby changing the CPU to the current operating system. It is separated from (S9).

When a debugging interrupt occurs in the virtual environment (YES in S10), the virtual environment controls the processing of the debugging interrupt (S11). That is, the handling of debugging interrupts occurring in the virtual environment is controlled separately from the interrupt handling method of the existing operating system, and the debugging expected when the debugging interrupt occurs in order to prevent an operation to hack an application through debugging in the virtual environment. Prevents debugging by interrupting interrupt processing without performing any action.

When the execution of the application at the virtual environment user level is the end of the system quantum time (No in S12), the next time the context switch to the virtual environment building application occurs after the CPU has been allocated to the application in the real environment, in S6 By storing the CPU context information of the application executed in the virtual environment by executing the code registered with the APC (S14), the trap frame (Trap) of the process with respect to the registers of the application finally executed at the user level of the existing real environment By modifying the frame), execution of the context back to the actual environment is made possible (S15).

On the other hand, if the execution of the application 61 in the virtual environment is completed before the end of the system quantum time (YES in S12), the CPU context was finally executed at the user level of the real environment before the application execution at the virtual environment user level. After restoring the information (S13) and receiving an instruction from the outside (S3), it switches back to the virtual environment kernel level through the call gate (S4).

FIG. 7 is a flowchart illustrating S10 and S11 of FIG. 6 in more detail.

As described above with reference to FIG. 6, if a debugging-related interruption occurs during application execution after building the virtual environment (S21), it is determined whether the debugging prevention function is set in the current virtual environment (S22). Information on whether or not to set such a function may be input from a user who runs the application, or a flag variable or a separate register may be set so that a system administrator may set debugging prevention function as necessary. It is possible to use techniques to set and determine anti-debugging features.

If the debugging function is determined as a result of the debugging, if the anti-debugging function is set in the virtual environment (Yes in S22), the debugging interrupt type is determined (S23) and the virtual environment is prevented according to the type. In step S24 is a separate process. Specifically, as described below, in order to prevent an operation of hacking an application through debugging in a virtual environment, interrupt processing is terminated without debugging operation expected when debugging related interrupt occurs, thereby preventing debugging. . This is an effect of the present invention that can be obtained by providing a virtual environment that allows an application to operate in a kernel separate from the existing operating system and thereby allow control of interrupt processing.

In addition, it is possible to skip the step of checking whether or not the debugging prevention function is set (S22) and to perform debugging prevention processing for all debugging-related interrupts, and to set whether or not to perform debugging prevention processing for each application. It is possible. That is, it may be set to control only debugging related interrupts for a specific application, or may be set to control processing of debugging related interrupts for all applications.

Hereinafter, a more detailed processing procedure according to the debugging related interrupt will be described with reference to FIG. 8.

The debugging method is to generate a debugging-related interrupt, break the running application, and grasp the operation of the application. Breaks can be generally classified into hardware breaks and software breaks. The former is to set a specific memory address to be debugged and generate an interrupt for debugging to access the specific memory address for debugging. It refers to the operation of designating specific instructions in the application and performing debugging on them. Typically, 255 interrupts are defined on the CPU, especially for Intel-produced CPUs, Interrupt 1 (Interrupt 1: INT 1) and Interrupt 3 (Interrupt 3: INT 3) respectively perform hardware debugging interrupts and software debugging interrupts. It is specified to be able to.

8 is a flowchart illustrating a processing method for hardware debugging interrupts and software debugging interrupts in a virtual environment according to an embodiment of the present invention.

First, when a hardware debugging interrupt occurs (S31), it is determined whether single step tracing is set (S32). Single-step tracing refers to a debugging state that generates an interrupt by the CPU for execution of all instructions of an application and grasps the flow of the application in every step. In general, the setting of the single step tracing can be grasped by reading the bit setting value of the Debug Status register among the debug registers in which the settings related to debugging are stored. More specifically, in case of the Intel series CPU, when debugging by single step tracing occurs, interrupt 1 is generated internally in the computer. Therefore, when the interrupt 1 is checked, the debug status register (DR6 register) is checked to determine the BS (Break). for single-step) bit, it can be determined that tracing by single step has occurred.

If single step tracing is set as a result of the determination of the debug status register value (YES in S32), the interrupt processing is terminated without any separate processing operation. That is, interrupt processing is terminated without performing any operation on the operation to grasp the contents of the application through single step tracing, thereby preventing debugging.

On the other hand, when not set to single step tracing (NO in S32), it is determined whether or not the hardware brake is set (S33). A hardware break is a debugging operation that stops the application and allows debugging for that particular memory address when the application has access to a particular memory address. Normally, whether or not the hardware break is set can be determined by reading the bit setting value of the debug status register. More specifically, in the case of an Intel-based CPU, if the B0 to B3 bits of the debug status register (DR6 register) are set when interrupt 1 occurs, this means that a hardware break is set. The memory address to be debugged at the time of hardware break is recorded in the debug address register, and the memory address to be debugged is recorded in the DR0 to DR3 registers corresponding to the B0 to B3 bits.

If the hardware break is set as a result of determining whether the hardware break is set (YES in S33), the debug address register and the debugging condition in which the relevant system register or debug register information, for example, a memory address to be debugged, are recorded. The information on the recorded debug control register is reset (S34). By resetting the memory address information to be debugged and terminating the debugging interrupt processing, it is possible to prevent the debugging operation for the memory address. On the other hand, if the hardware break is not set (No in S33), the operation to process the interrupt in general in the virtual environment, for example, to perform the interrupt processing operation of the existing operating system (S35). According to the processing flow as described above, even if a hardware break is set, interrupt processing can be normally terminated without processing, thereby achieving an effect of preventing debugging.

On the other hand, when a software debugging interrupt occurs (No in S31), unlike a hardware debugging interrupt, an operation for ignoring the interrupt and immediately ending the interrupt processing without modifying a separate system register setting is performed. Is enough.

More specifically, a software debugging interrupt is an interrupt that is generated to perform debugging for a specific instruction of an application. In other words, if a software breakpoint is set for a particular instruction and the instruction is about to be executed, an interrupt is generated. In the case of Intel's CPUs, setting a software break causes interrupt 3. When such a software debugging interrupt occurs, that is, when a software break is set and an interrupt occurs, the debugging operation can be prevented by immediately terminating the interrupt processing to ignore the interrupt without performing a separate processing operation for the interrupt. It becomes possible.

By controlling the debug interrupt handling as described above, it is possible to prevent the debugging operation for the application, which provides a virtual environment that allows the application to operate in a kernel separate from the existing operating system and thereby control the debugging interrupt processing. The effect of the present invention can be obtained by being possible.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

1 is a hierarchical diagram of application execution on a typical computer.

FIG. 2 is a diagram illustrating a virtualization concept in a conventional hardware abstraction layer (HAL).

3 is a hierarchical diagram when a program for building a virtual environment in which an application is executed is executed in an apparatus and method for preventing debugging in a virtual environment according to an embodiment of the present invention.

4 illustrates an application execution mechanism in a virtual environment according to an embodiment of the present invention.

5 is a block diagram illustrating a configuration of an anti-debugging device in a virtual environment according to an embodiment of the present invention.

6 is a flowchart illustrating a debugging prevention method in a virtual environment according to an embodiment of the present invention.

FIG. 7 is a flowchart illustrating the debugging interrupt processing steps S10 and S11 of FIG. 6 in more detail.

8 is a flowchart illustrating a processing method for hardware debugging interrupts and software debugging interrupts in a virtual environment according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

70: anti-debugging device in a virtual environment 71: initialization unit

72: Task Manager 73: Virtual Environment Switcher

74: application execution unit 75: debugging interrupt processing unit

76: real environment restore unit

Claims (23)

Performing initialization to establish a virtual environment; Switching to a kernel level of the virtual environment; Storing first CPU state information which is current CPU state information; Modifying the contents of the current CPU register to a value generated by performing the initialization step after performing the first CPU state information storing step; Executing an application using the modified CPU register; Detecting whether a debugging interrupt for the application occurs; And Processing the debugging interrupt to prevent debugging of the application when the debugging interrupt is generated; How to avoid debugging in a virtual environment. The method of claim 1, Performing the initialization is Loading an encrypted image of the application; And Decrypting the encrypted image How to avoid debugging in a virtual environment. The method of claim 1, The debugging interrupt processing step Determining the type of debugging interrupt generated; And And performing corresponding debugging interrupt processing according to the type of the generated debugging interrupt. How to avoid debugging in a virtual environment. The method of claim 3, wherein The type of debugging interrupt generated is at least one of a hardware debugging interrupt or a software debugging interrupt. How to avoid debugging in a virtual environment. The method of claim 3, wherein If the debugging interrupt is a software debugging interrupt, the debugging interrupt processing step Terminates interrupt processing without processing the software debugging interrupt. How to avoid debugging in a virtual environment. The method of claim 3, wherein If the debugging interrupt is an interrupt requesting debugging for all instructions of the application, the debugging interrupt processing step Terminating interrupt processing without processing the debugging interrupt How to avoid debugging in a virtual environment. The method of claim 3, wherein If the debugging interrupt is an interrupt requesting debugging when the application approaches a specific memory address, the debugging interrupt processing step To reset the value of the system register for debugging. How to avoid debugging in a virtual environment. The method of claim 4, wherein If the CPU is an Intel series CPU, The hardware debugging interrupt is Interrupt 1 and the software debugging interrupt is Interrupt 3 How to avoid debugging in a virtual environment. The method of claim 1, Storing second CPU state information which is CPU state information of the application when the execution of the application is stopped without completing; Restoring the first CPU state information after performing the storing of the second CPU state information; And Restoring the second CPU state information when the execution of the application where the execution was interrupted is resumed; How to avoid debugging in a virtual environment. The method of claim 1, The initialization step Creating a path to a virtual environment kernel level without passing through an existing operating system; And Initializing the CPU registers and the memory to be used in the virtual environment. How to avoid debugging in a virtual environment. Performing initialization to establish a virtual environment; Switching to a kernel level of the virtual environment; Storing first CPU state information which is current CPU state information; Modifying the contents of the current CPU register to a value generated by performing the initialization step after performing the first CPU state information storing step; Executing an application using the modified CPU register; Detecting whether a debugging interrupt for the application occurs; Determining whether processing of the debugging interrupt for the application is prohibited when the debugging interrupt is generated; And And processing to prevent debugging of the application when processing of the debugging interrupt is prohibited. How to avoid debugging in a virtual environment. The method of claim 11, Performing the initialization is Loading an encrypted image of the application; And Decrypting the encrypted image How to avoid debugging in a virtual environment. The method of claim 11, The debugging interrupt processing step Determining the type of debugging interrupt generated; And And performing corresponding debugging interrupt processing according to the type of the generated debugging interrupt. How to avoid debugging in a virtual environment. The method of claim 13, The type of debugging interrupt generated is at least one of a hardware debugging interrupt or a software debugging interrupt. How to avoid debugging in a virtual environment. The method of claim 13, If the debugging interrupt is a software debugging interrupt, the debugging interrupt processing step Terminating interrupt processing without processing the software debugging interrupt How to avoid debugging in a virtual environment. The method of claim 13, If the debugging interrupt is an interrupt requesting debugging for all instructions of the application, the debugging interrupt processing step Terminating interrupt processing without processing the debugging interrupt How to avoid debugging in a virtual environment. The method of claim 13, If the debugging interrupt is an interrupt requesting debugging when the application approaches a specific memory address, the debugging interrupt processing step To reset the value of the system register for debugging. How to avoid debugging in a virtual environment. The method of claim 14, If the CPU is an Intel series CPU, The hardware debugging interrupt is Interrupt 1 and the software debugging interrupt is Interrupt 3 How to avoid debugging in a virtual environment. The method of claim 11, Storing second CPU state information which is CPU state information of the application when the execution of the application is stopped without completing; Restoring the first CPU state information after performing the storing of the second CPU state information; And Restoring the second CPU state information when the execution of the application where the execution was interrupted is resumed; How to avoid debugging in a virtual environment. The method of claim 11, The initialization step Creating a path to a virtual environment kernel level without passing through an existing operating system; And Initializing a CPU register and a memory to be used in the virtual environment; How to avoid debugging in a virtual environment. Means for performing initialization for building a virtual environment; Means for switching to a kernel level of the virtual environment; Means for storing first CPU state information that is current CPU state information; Means for modifying a content of a current CPU register to a value generated by said initialization performing means after performing said first CPU state information storing means; Means for executing an application using the modified CPU register; Means for detecting whether a debugging interrupt for the application has occurred; And Means for processing said debugging interrupt to prevent debugging of said application when said debugging interrupt is generated; Debugging prevention device in virtual environment. Means for performing initialization for building a virtual environment; Means for switching to a kernel level of the virtual environment; Means for storing first CPU state information that is current CPU state information; Means for modifying a content of a current CPU register to a value generated by said initialization performing means after performing said first CPU state information storing means; Means for executing an application using the modified CPU register; Means for detecting whether a debugging interrupt for the application has occurred; Means for determining whether processing of the debugging interrupt for the application is prohibited when the debugging interrupt is generated; And Means for processing to prevent debugging of said application if processing of said debugging interrupt is prohibited; Debugging prevention device in virtual environment. 21. A recording medium having recorded thereon a computer readable program for executing the method according to any one of claims 1 to 20.

Images