KR101182346B1 - Apparatus and method for dynamic binary instrumentaion - Google Patents

Abstract

In dynamic code analysis in accordance with the present invention, a process running on a guest machine is executed in debug mode to obtain DLL information loaded for the process, to set a software breakpoint at the start address of the process, After all the information is obtained, API call information is extracted by using the DLL information loaded during process execution and the acquired DLL information, and command analysis is performed by single step analysis when an exception occurs according to process execution.

Description

Dynamic code analysis apparatus and method {APPARATUS AND METHOD FOR DYNAMIC BINARY INSTRUMENTAION}

The present invention relates to a code analysis apparatus, and more particularly, to a dynamic code analysis apparatus and method for analyzing a process running in a virtual machine.

Dynamic code analysis techniques are used for a variety of purposes, including memory management, thread bug detection, heap / stack overrun detection, and program profiling. These code analysis techniques are available in various forms, including emulators and process-level dynamic code analyzers, depending on the purpose and implementation.

In particular, recently, with the development of virtualization technology, dynamic code analysis techniques are actively being researched. Virtualization technology is a technology that acts as an arbiter that can provide limited physical resources as a service or multiple services. As such, virtualization technology simplifies existing complex environments in a variety of fields, including servers, desktops, operating systems, applications, storage, and networks, allowing for the integration of distributed processing and management tools.

The representative dynamic code analysis technique based on the virtualization technology is an emulator. Such an emulator provides a virtual computer system through software independent of hardware, which allows other operating systems to run without code modification. However, there is a drawback in using it because it is very slow.

Another dynamic code analysis technique is a dynamic code analyzer that monitors the execution of a program at the user level. In the case of a program running in user mode in a general operating system, only access to general-purpose registers and user-space address space is possible, and system calls are used to use the remaining resources. In user level dynamic code analyzer monitoring, user contexts are managed through shadow registers and memory areas, and system call calls are handled by the kernel through redirection. This allows you to dynamically monitor all code in your application except for system call processing within the kernel.

These dynamic code analyzers include Valgrind and Pin. Valgrind is an open source program that detects memory leaks and bad memory accesses. Pin is a dynamic code analyzer developed by Intel and runs on the JIT compiler.

However, analysis of code using a user-level dynamic code analyzer is faster and easier to track by process than analysis using an emulator, but has a disadvantage of being easily exposed to debugging avoidance techniques due to code conversion.

Therefore, there is a need for a dynamic code analysis apparatus and method that can perform efficient, accurate and detailed dynamic code analysis of execution compression and anti-debugging techniques, along with memory tracing, system call tracing, and process-limited tracing based on virtualization technology. It is true.

The present invention is to solve the above-mentioned problems, based on the virtualization technology to analyze the program code executed by the process running on the guest machine, dynamic code analysis to perform DLL information analysis and API call information extraction process loading An apparatus and method are provided.

As a technical means for achieving the above technical problem, a dynamic code analysis apparatus according to an aspect of the present invention, a host machine for registering at least one process operating in the guest machine as the analysis target process; A guest machine for executing the analysis target process in debug mode to obtain DLL (Dynamic Link Library) information, and extracting API (Application Programming Interface) call information using the obtained DLL information; And a hypervisor for adding a process requested to be registered through the host machine to a list of analysis target processes and performing a single step analysis process on exceptions generated in the analysis target process.

In addition, the dynamic code analysis method according to another aspect of the present invention, by executing a process running in the guest machine in the debug mode to obtain information of the loaded DLL (Dynamic Link Library) for the process; Setting a software breakpoint at a start address of the process; After all of the information on the DLL for the process is obtained, extracting API (Application Programming Interface) call information by using the information of the DLL loaded when the process is executed and the obtained DLL information; And performing command analysis through single step analysis when an exception occurs according to the execution of the process.

According to any one of the problem solving means of the present invention described above, it is possible to extract the API call information by analyzing the information of the DLL to be loaded by the analysis target process can analyze the process more accurately and in detail.

Further, according to any one of the problem solving means of the present invention, it is possible to prevent the instruction execution time delay caused by kernel code analysis by performing a single step analysis of the user code by distinguishing the execution authority state when analyzing the analysis target processes. .

1 is a view showing the structure of a dynamic code analysis apparatus according to an embodiment of the present invention.
2 and 3 are diagrams for explaining a dynamic code analysis method according to an embodiment of the present invention.
4 is a flowchart illustrating a dynamic code analysis method through API call information extraction according to an embodiment of the present invention.
5 is a flowchart illustrating a dynamic code analysis method when an exception occurs according to an embodiment of the present invention.
6 is a flowchart illustrating a dynamic code analysis method when executing an execution permission state according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

1 is a view showing the structure of a dynamic code analysis apparatus according to an embodiment of the present invention.

In this case, the dynamic code analysis apparatus according to an embodiment of the present invention shows a case where a full virtualization technique is implemented based on Xen using Vt (Virtualization) technology supported by an Intel x86 processor.

First, as shown in FIG. 1, the dynamic code analysis apparatus 100 according to an exemplary embodiment of the present invention may include the host machine 10, the guest machines 20 and 30, the hypervisor 40, and the physical device 50. Include.

The host machine 10 includes an analysis control program 11 and a kernel 12. The analysis control program 11 according to an embodiment of the present invention is an analysis target during the process of operating in the guest machine (20, 30) Guest machines 20, 30, such as monitoring the execution of instruction units of a specific process (hereinafter referred to as 'analysis target process'), obtaining system call call information, and storing the analyzed information through the hypervisor 40. Control the analysis of the process.

At this time, the analysis control program 11 adds the name of at least one analysis target process to the analysis target process list existing on the hypervisor 40 at the same time as it is executed.

The guest machines 20 and 30 include a process to be analyzed 21, a debugger program 22 that operates based on a Windows operating system, and a Linux kernel or Windows 23. At this time, the debugger program 22 according to the embodiment of the present invention runs the analysis target process in debug mode to track the module loading history.

The hypervisor 40 includes an analysis processing module 41 and an exception handling handler 42 (vmexit handler).

At this time, the analysis processing module 41 according to the embodiment of the present invention adds a specific process added through the analysis control program 10 among the processes operating on the guest machines 20 and 30 to the analysis target process list. The analysis processing module 41 analyzes the program code executed in the analysis target process 21 operating in the guest machines 20 and 30 in a single step method.

In addition, the exception handling handler 42 according to the embodiment of the present invention may generate an exception from a specific process (that is, an analysis target process) operating in the guest machines 20 and 30. The exception occurrence is received by the analysis control program 11, and preset exception processing is performed according to the type of the exception.

The physical device 50 includes a CPU, a memory, a disk, a network interface, and the like. For reference, the CPU according to the embodiment of the present invention may be an x86 processor.

Meanwhile, the dynamic code analysis apparatus 100 according to an embodiment of the present invention extracts API (Application Programming Interface) call information by tracking a DLL (Dynamic Link Library) loaded by an analysis target process operating in a guest machine.

Hereinafter, a method of extracting API information using the debugger program 22 of the dynamic code analysis apparatus 100 according to an embodiment of the present invention will be described with reference to FIG. 4.

4 is a flowchart illustrating a dynamic code analysis method through API call information extraction according to an embodiment of the present invention.

Specifically, as shown in FIG. 4, the debugger program 22 executes the process of the guest machine 20 in the debug mode (S410).

Accordingly, an event occurs every time the DLL is loaded in the process running in debug mode, and the generated event information is transmitted to the debugger program 22. At this time, the debugger program 22 analyzes the generated event, obtains DLL information including the name and memory address of the DLL, and delivers the DLL information to the analysis control program 11. Specifically, the debugger program 22 reads DLL files to be analyzed to obtain DLL configuration information, and analyzes offset values in which respective APIs are located in the DLL.

For reference, the debugger program 22 according to the embodiment of the present invention may obtain the DLL loading information and then exit the debug mode so that the anti-debugging technique is not exposed.

Next, the debugger program 22 sets a software break point at the start address of the process (S420).

Then, the debugger program 22 extracts API information called by the analysis target process based on the DLL information obtained by step S410 and the DLL loading address value loaded by the analysis target process (S430).

Then, if a debug exception occurs due to the software break point set at the start address after all the DLL loading is completed, the debugger program 22 deletes the software break point and recovers the existing instruction (S440).

For reference, when the DLL information acquisition is completed, the analysis control program 11 adds the corresponding process to the analysis target process list of the analysis processing module 40. Therefore, the corresponding process (that is, the process to be analyzed) is code analyzed in a single step manner when an exception occurs.

Hereinafter, a dynamic code analysis method will be described in detail when an exception occurs in the dynamic code analysis apparatus 100 according to an embodiment of the present invention with reference to FIGS. 2 and 5.

2 is a view for explaining a dynamic code analysis method according to an embodiment of the present invention.

5 is a flowchart illustrating a dynamic code analysis method when an exception occurs according to an embodiment of the present invention.

When an exception occurs in a process running on the guest machine 20 in the dynamic code analysis apparatus 100 according to an embodiment of the present invention, a handler for the exception operates to analyze the process in units of instructions. In other words, monitoring is performed by analyzing the operation of the process in a single step method.

First, as shown in FIG. 2A, a process operating in the guest machine 20 obtains execution permission through a context-switching process of a window. At this time, when an instruction is performed to replace the CR3 register value in the context switching process, an exception occurs in the guest machine 20, and the exception handling handler 42 of the hypervisor 40 operates.

Specifically, as shown in FIG. 5, when the window 23 generates an exception according to context-switching (S510), the exception handling handler 42 calls the mov_to_cr () function (S520). .

At this time, the called mov_to_cr () function checks whether the name of the corresponding process (that is, the analysis target process) in which the exception occurred is included in the analysis target program list managed by the analysis processing module 41.

Then, when the name of the process in which the exception occurred is included in the analysis target program list, the mov_to_cr () function sets a trap flag of the CPU eflags register of the guest machine 20 (S530).

In this case, if a trap flag is set in the eflags register, a debug exception is generated whenever a corresponding process (ie, an analysis target process) executes an instruction. Then, whenever a debug exception occurs, the analysis processing module 41 performs a single step analysis of analyzing the generated exception (ie, instruction unit).

In addition, the exception handling handler 42 switches the execution authority so that the context processing of the guest machine 20 is performed by performing a return instruction (vmresume) after the analysis processing module 41 completes the single step analysis for all the instructions. (S550).

In addition, as shown in FIG. 2B, the exception handling handler 42 of the hypervisor 40 operates even when a debug exception occurs in a process running in the guest machine 20 to perform a handle debug exception. .

For reference, as described above with reference to FIG. 4, the exception handling handler 42 operates when a debug exception occurs in a process in which DLL information acquisition and API call information extraction are completed (that is, an analysis target process).

In addition, if a debug exception occurs when checking the contents of the memory of the guest machines 20 and 30 and tracking the memory change, the exception handling handler 42 operates.

Specifically, as shown in FIG. 5, when a debug exception occurs (S510), the exception handling handler 42 transmits information on the debug exception that occurred to the analysis processing module 41.

Then, the analysis processing module 42 performs a single step analysis on the generated debug exception, and transfers the result to the analysis control program 11 and stores the result (S540). At this time, the analysis processing module 42 analyzes the current memory value and the memory value to be modified when the instruction in which the debug exception is generated is a memory read / write instruction.

Then, the exception handling handler 42 executes a return instruction (vmresume) after the analysis processing module 41 completes the single step analysis for all the instructions so that the context of the guest machine 20 is executed. Switch (S550).

Hereinafter, a dynamic code analysis method will be described in detail when the execution authority state of the dynamic code analysis apparatus 100 according to the embodiment of the present invention is described with reference to FIGS. 3 and 6.

3 is a view for explaining a dynamic code analysis method according to an embodiment of the present invention.

6 is a flowchart illustrating a dynamic code analysis method when executing an execution authority state according to an exemplary embodiment of the present invention.

First, as shown in Figure 3, the dynamic code analysis apparatus 100 according to an embodiment of the present invention, if an interrupt or an error occurs during the execution of the user program of the guest machine (20, 30), the corresponding kernel code is It will act as a handler. This process accesses the Global Descriptor Table (GDT) that contains kernel code segment information. In this case, the dynamic code analysis apparatus 100 classifies the kernel code and the user code to perform dynamic code analysis (ie, single step code analysis for obtaining DLL information, API information extraction, and exception generation) for the user code. The execution time delay can be prevented.

Specifically, as shown in FIG. 6, when an execution authority state conversion event for the analysis target process of the guest machines 20 and 30 is generated (S610), the analysis processing module 42 processes according to the execution authority state to be converted. Perform

Note that according to the memory protection mechanism, user programs running on x86 processors run on CPL 3 and kernel code runs on CPL 0.

In this case, when the kernel code operation occurs in step S610, the analysis processing module 42 indicates the kernel code segment of the GDT on the window of the guest machine 20 (for reference, in FIG. 3, 'kernel code seg.'). ) Information is moved to another storage area, and the corresponding entry is initialized (for example, changed to a value of '0') (S621).

Then, during the transition from the user mode to the kernel mode, a GPE (General Protection Error) occurs because the entry of the GDT has an incorrect value.

Then, the exception handling handler 42 stops the single step analysis function according to the generation of GPE (S631).

Thereafter, the analysis processing module 42 restores the moved kernel code segment information to the GDT, and then transfers user code segment information (referred to as 'user code seg.' In FIG. 3) to another storage area. Move and initialize the entry (S641).

Then, the exception handling handler 42 activates the guest machine 20 again by performing a return command (vmresume) (S650). By doing this, the kernel code of the guest machine 20 is normally executed.

For reference, when all the kernel codes of the guest machine 20 are executed, at the time of returning to the user program through the IRET command, the GDT is generated by initializing the corresponding entry value in the GDT in advance.

That is, when the GPE according to the return of the user program occurs in step S610, the analysis processing module 41 restores the moved user code segment information to the GDT, and then moves the kernel code segment information to another storage area. Initialize the entry (S622).

Then, the exception handling handler 42 activates the single step analysis function to analyze the user code (S632).

Then, the exception handling handler 42 activates the guest machine 20 again by performing a return command (vmresume) (S650). In this way, the user code of the guest machine 20 is normally executed to perform single step analysis via the analysis processing module 41.

As described above, in the dynamic code analysis apparatus 100 according to the exemplary embodiment of the present invention, an exception caused by the GPE occurs at every execution authority state transition time of the guest machines 20 and 30, and the exception handling handler 42 is applied to the generated exception. And the analysis processing module 41 performs exception processing according to the execution permission state.

Embodiments of the invention may also be implemented in the form of a recording medium containing instructions executable by a computer, such as a program module executed by the computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

Although the apparatus and method of the present invention have been described in connection with specific embodiments, some or all of their components or operations may be implemented using a computer system having a general purpose hardware architecture.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the above description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

10: host machine 20, 30: guest machine
11: Analysis control program 21: Process to be analyzed
22: debugger program 40; Hypervisor
41: Analysis Processing Module 42: Exception Handling Handler

Claims (12)

In the dynamic code analysis device,
A host machine that registers at least one process running on the guest machine as an analysis target process;
A guest machine for executing the analysis target process in debug mode to obtain DLL (Dynamic Link Library) information, and extracting API (Application Programming Interface) call information using the obtained DLL information; And
And a hypervisor for adding a process requested to be registered through the host machine to a list of analysis target processes and performing a single step analysis process on exceptions generated in the analysis target process.
The method of claim 1,
The hypervisor,
And stopping the single step analysis when an event occurs due to a kernel code operation occurring in the analysis target process and activating the single step analysis when an event occurs due to a return to a user program.
The method of claim 1,
The hypervisor,
And changing at least one of kernel code segment information and user code segment information of the analysis target program to distinguish execution permission state transition of the analysis target program.
The method of claim 1,
The hypervisor,
And performing an return instruction after setting a trap flag of an eflags register when an exception occurs in the analysis target process.
The method of claim 1,
The guest machine,
And analyzing the event generated when the DLL is loaded to obtain DLL information including the name and memory address of the DLL, and analyzing the offset value at which each API is located from the DLL information.
The method of claim 1,
The guest machine,
Dynamic code analysis device for exiting the debug mode after obtaining all the DLL loading information.
In the method that the dynamic code analysis device dynamically analyzes the code,
Executing a process operating in a guest machine in debug mode to obtain information of a loaded Dynamic Link Library (DLL) for the process;
Setting a software breakpoint at a start address of the process;
After all of the information on the DLL for the process is obtained, extracting API (Application Programming Interface) call information by using the information of the DLL loaded when the process is executed and the obtained DLL information; And
And performing command analysis through single step analysis when an exception occurs according to the execution of the process.
The method of claim 7, wherein
Performing the command analysis,
Stopping the single step analysis when an event occurs due to a kernel code operation in the process, and activating the single step analysis when an event occurs according to a return to a user program.
The method of claim 7, wherein
After extracting the API call information,
Registering the process as an analysis target process;
And performing a command analysis through the single step analysis on the process registered as the analysis target process.
The method of claim 7, wherein
Performing the command analysis,
And performing a return instruction after setting a trap flag of the eflags register of the process when the exception occurs.
The method of claim 7, wherein
Extracting the API call information,
And analyzing the event generated when the DLL is loaded in the debug mode to obtain DLL information including the name and memory address of the DLL, and analyzing the offset value at which each API is located from the DLL information.
The method of claim 7, wherein
After acquiring the information of the DLL,
And exiting the debug mode when all the information of the DLL for the process is obtained.

Images