KR101217668B1 - Malicious program hooking prevention apparatus and method - Google Patents

Abstract

An apparatus and method for preventing malware hooking is disclosed. Embodiments of the present invention track branch execution instructions by a malicious program using a branch trace function of a central processing unit (CPU), extract an original execution instruction included in a malicious program function, and extract the original source. By providing a technique for restoring a function of the hooked operating system based on an execution command, it is possible to prevent a hooking behavior by a malicious program and to restore the function of the hooked operating system to an original function.

Description

Anti-malware hooking device and method {MALICIOUS PROGRAM HOOKING PREVENTION APPARATUS AND METHOD}

An apparatus and method for preventing malware hooking is disclosed. In particular, embodiments of the present invention are directed to a technique for preventing hooking caused by functions of an operating system by a malicious program.

Recently, malicious programs have attempted self-protection or concealment by hooking execution commands of various functions provided by an operating system.

In this regard, various security programs can recover malicious programs by recovering changes in the execution commands included in the operating system function by the hooking of the malicious programs to the previous execution commands to diagnose and remove these malicious programs. I do not.

However, recent malicious programs detect that their hooking information has been removed, attempt to rehook, or find that the security program extracts information from the operating system's files in order to recover execution instructions. By impeding access, it makes recovery difficult.

Therefore, in order to minimize the damage caused by malicious programs, a study on a technique for recovering an execution command changed by the hooking of the malicious programs is needed.

Embodiments of the present invention track branch execution instructions by a malicious program using a branch trace function of a central processing unit (CPU), extract an original execution instruction included in a malicious program function, and extract the original source. By providing a technique for restoring a function of the hooked operating system based on an execution command, it is possible to prevent hooking behavior by a malicious program and to restore a function of the hooked operating system to an original function.

The anti-malware hooking prevention device according to an embodiment of the present invention activates a branch trace function of a central processing unit (CPU) to check an address where a branch execution instruction is located in a function of an operating system, and executes the branch. A branch check unit for checking an address where a return execution command is located in a hooking function branched according to an instruction, and an argument value last stored on the stack associated with the branched hooking function calls a function of the operating system. And a determining unit to determine whether the argument value is the same as the specified argument value. When the argument value last stored in the stack associated with the branched hooking function is the same as the argument value specified when the function of the operating system is called, the branch execution command is executed. From the branched hooking function based on the address at which it is located and the address at which the return execution instruction is located. And an extracting unit for extracting an original execution command for a function of the operating system and a restoring unit for restoring a function of the operating system based on the extracted original execution command.

In addition, the malicious program hooking prevention method according to an embodiment of the present invention to activate the branch tracking function of the CPU to check the address where the branch execution command is located in the function of the operating system, the hooking branched according to the branch execution command Ascertaining an address at which a return execution instruction to a function of the operating system is located within a function, wherein an argument value last stored on a stack associated with the branched hooking function is the same as an argument value specified when calling a function of the operating system; Determining whether the last stored argument value on the stack associated with the branched hooking function is the same as the argument value specified when invoking the function of the operating system; From the branched hooking function to the function of the operating system based on the location address In step and based on the extracted run original command to extract the original execution command includes the step of restoring the function of the operating system.

Embodiments of the present invention track branch execution instructions by a malicious program using a branch trace function of a central processing unit (CPU), extract an original execution instruction included in a malicious program function, and extract the original source. By providing a technique for restoring a function of the hooked operating system based on an execution command, it is possible to prevent a hooking behavior by a malicious program and to restore the function of the hooked operating system to an original function.

1 is a diagram illustrating an example in which a function of an operating system is hooked by a malicious program.
2 is a diagram illustrating a structure of an anti-malware hooking device according to an embodiment of the present invention.
3 is a flowchart illustrating a malicious program hooking prevention method according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

Malicious programs can attack the system by changing the execution instructions included in the functions of the operating system through a hooking handler.

In this regard, FIG. 1 shows an example in which a function of an operating system is hooked by a malicious program.

Referring to FIG. 1, reference numeral 110 denotes an example of an original of a function of the operating system, and reference numeral 120 denotes an example of an original of a function of an operating system shown in 110 by a malicious program hooked. .

As shown at 120, when a malicious program executes a branch execution command such as a "JMP" 121 command and calls a predetermined malicious program function 122, the called malicious program function 122 is executed. ) Executes a malicious action 123, executes original execution instructions 126 and 127 included in a function of the operating system, and executes a branch execution instruction such as "JMP" 125 again. You can make the function of be run again.

A more detailed description thereof is as follows.

First, a malicious program may hook a function of an operating system so that the function of the operating system is changed as indicated by reference numeral 120.

At this time, when the function of the hooked operating system is executed, as shown by reference numeral 110, "PUSH EBP" 111 is not executed first, as shown by reference numeral 120, "JMP" 121 first. The malicious program function 122 can be called to execute.

When the malicious program function 122 is called, the malicious program function 122 executes the malicious action 123, and when execution of the malicious action 123 is completed, the execution command "PUSH EBP" included in the function of the original operating system is completed. After executing " 126 " and " MOV EBP, ESP " 127, a " JMP " 125, which is a return execution command, can be returned to the function of the operating system so that the function of the operating system can continue to be executed.

When the execution command "JMP" 125 is executed in the malicious program function 122, the function of the operating system may execute the execution command "PUSH EDI" 124 included in the address indicated by the "JMP" 125. After executing, you can execute subsequent commands.

Thus, in order to prevent the hooking behavior by the malicious program and to restore the function of the hooked operating system to the original function, embodiments of the present invention utilize a branch trace function of a central processing unit (CPU). It is to provide a technique for tracing the branch execution command by, extracting the original execution command included in the malicious program function and restoring the function of the hooked operating system based on the extracted original execution command.

2 is a diagram illustrating a structure of an anti-malware hooking device according to an embodiment of the present invention.

Referring to FIG. 2, the malicious program hooking prevention device 210 includes a branch checker 211, a determiner 212, an extractor 213, and a restorer 214.

The branch checking unit 211 activates the branch tracking function of the CPU to check the address where the branch execution instruction is located in the function of the operating system, and returns to the function of the operating system in the hooking function branched according to the branch execution instruction. Check the address where the execution command is located.

Here, the branch tracking function of the CPU transmits information on the branch execution instruction by executing the interrupt # 1 designated in advance only when "JMP" or "CALL", which is a branch instruction among execution instructions, is executed. It means function.

The operation of the branch checking unit 211 will be described in more detail with reference to FIG. 1 as follows.

The branch checking unit 211 may activate the branch tracking function of the CPU to check the address where the branch execution command “JMP” 121 is located within a function of the operating system.

Then, the branch check unit 211 locates the "JMP" 125 which is a return execution command to the function of the operating system in the hooking function (malware function) 122 branched using the branch tracking function of the CPU. You can check the address.

At this time, according to one embodiment of the present invention, the branch check unit 211 activates the last branch record function of the CPU, when the branch execution command or the return execution command is executed, the register in the CPU The register may identify the address where the branch execution command is located and the address where the return execution command is located.

The determination unit 212 determines whether the argument value last stored in the stack associated with the branched function is the same as the argument value specified when calling the function of the operating system.

When the argument value last stored in the stack associated with the branched hooking function is the same as the argument value specified when the function of the operating system is called, the extractor 213 displays the address where the branch execution instruction is located and the return execution instruction. Extract the original execution instruction for the function of the operating system from the branched hooking function based on the located address.

The operation of the determination unit 212 and the extraction unit 213 will be described in more detail with reference to FIG. 1 as follows.

When the branch execution command is executed in a function of an operating system and the malicious program function 122 that is the branched hooking function is called, the determination unit 212 determines that the return execution command is "JMP" 125 in the malicious program function 122. Is executed, it is determined whether the argument value last stored on the stack associated with the malicious program function 122 is equal to the argument value specified when calling the function of the operating system.

In the example of FIG. 1, execution instructions "PUSH EBP" 126 and "MOV EBP, ESP" 127 which are positioned immediately before the execution execution command "JMP" 125 are executed are functions of the operating system. Is the same as the execution commands "PUSH EBP 111" and "MOV EBP, ESP 112" which are executed when is called for the first time, and since the return execution command "JMP" 125 is executed, the malicious program function is executed. The argument value last stored on the stack associated with 122 is the same as the argument value specified when invoking the function of the operating system.

Accordingly, the extracting unit 213 executes the execution commands which are executed before the "PUSH EBP" 126 and the "MOV EBP, ESP" 127 which are the execution commands included in the malicious program function 122 to cause malicious actions. Instructions, and based on the address where the branch execution instruction "JMP" 121 for calling the malicious program function 122 is located and the return execution instruction "JMP" 125 is located, the malicious By extracting the "PUSH EBP" 126 and the "MOV EBP, ESP" 127 from the program function 122, the original instructions "PUSH EBP" 111 and "MOV" included in the function of the operating system changed by hooking. EBP, ESP "112 can be found.

According to an embodiment of the present invention, the extractor 213 may include a first operator 217, a second operator 218, and an execution command extractor 219.

The first calculator 217 calculates a position difference between an address where the branch execution command is located and a start position address of a function of the operating system after the return execution command is executed.

The second calculator 218 calculates an address reduced by a position difference calculated by the first calculator 217 from the address where the return execution command is located in the branched hooking function.

The execution command extracting unit 219 extracts, as the original execution command, an execution command located from the address computed by the second operation unit 218 to just before the address where the return execution command is located in the branched hooking function.

Hereinafter, operations of the first calculator 217, the second calculator 218, and the execution command extractor 219 will be described in detail with reference to FIG. 1.

The first operation unit 217 is the address where the branch execution command "JMP" 121 is located within the function of the operating system, and the "JMP" 125 which is a return execution command in the malicious program function 122 is executed. Thereafter, the position difference between addresses where the execution instruction "PUSH EDI" 124 at the start position of the function of the operating system is located is calculated.

Then, the second operation unit 218 reduces the address reduced by the position difference calculated by the first operation unit 217 from the address where the "JMP" 125, which is a return execution command, is located in the malicious program function 122. Calculate

In this case, the address calculated by the second calculator 218 may be an address where the "PUSH EBP" 126 is located.

Execution command extraction unit 219 is an execution command located from the address where "PUSH EBP" 126 is located within the malicious program function 122 to immediately before the address where "JMP" 125 is a return execution command. The execution command up to the address where the MOV EBP, ESP "127 is located may be extracted as the original execution command for the function of the operating system.

In this embodiment, the execution command extractor 219 may extract the "PUSH EBP" 126 and the "MOV EBP, ESP" 127.

The restoration unit 214 restores a function of the operating system based on the extracted original execution command.

The operation of the restoration unit 214 will be described with reference to FIG. 1, and the extraction unit 213 extracts the "PUSH EBP" 126 and the "MOV EBP, ESP" 127 from the malicious program function 122. As such, the restoration unit 214 may know that the "PUSH EBP" 111 and the "MOV EBP, ESP" 112 have been changed in the function of the hooked operating system, and the extracted "PUSH EBP" 126 may be changed. And "MOV EBP, ESP" 127 may be used to restore the function of the hooked operating system.

According to an embodiment of the present invention, the malicious program hooking prevention device 210 may further include an execution command checking unit 215 and an address calling unit 216.

The execution command checking unit 215 checks the address where the extracted original execution command is located in the branched hooking function.

When the function of the operating system is called, the address caller 216 directly calls the address where the extracted original execution command is located.

The anti-malware hooking prevention device 210 according to an embodiment of the present invention may restore the function of the hooked operating system through the restorer 214, but executes the execution command checker 215 and the address caller 216. Instead of restoring the function of the hooked operating system, the function of the operating system can be normally operated by directly calling the address where the original execution instruction included in the branched hooking function is located when the function of the operating system is executed. .

Hereinafter, the operation of the execution command confirming unit 215 and the address calling unit 216 will be described in more detail with reference to FIG. 1.

First, since the extractor 213 may extract the "PUSH EBP" 126 and the "MOV EBP, ESP" 127 from the malicious program function 122, the execution command checker 215 may execute the malicious program function ( 122, the addresses where the "PUSH EBP" 126 and the "MOV EBP, ESP" 127 are located can be checked.

Then, when the function of the operating system is called in the future host, the address caller 216 is located in the malicious program function 122 "PUSH EBP" 126 and "MOV EBP, ESP" 127 is located You can call the address directly.

As a result, when the function of the operating system is executed, "PUSH EBP" 126 and "MOV EBP, ESP" 127 are called and executed first, and then "PUSH EDI" 124 is called and executed again. As a result, the malicious program hooking prevention device 210 may provide the same result as that of a function of a normal operating system.

3 is a flowchart illustrating a malicious program hooking prevention method according to an embodiment of the present invention.

In step S310, the branch tracking function of the CPU is activated to check the address where the branch execution instruction is located in a function of the operating system.

In step S320, the address where the return execution instruction to the function of the operating system is located in the hooking function branched according to the branch execution instruction is checked.

In step S330, it is determined whether an argument value last stored in a stack associated with the branched hooking function is the same as an argument value specified when calling a function of the operating system.

As a result of performing the determination on the step S330 in step S340, if the argument value last stored on the stack associated with the branched hooking function is not the same as the argument value specified when calling the function of the operating system, The malicious program hooking prevention method performs step S320 again.

However, as a result of performing the determination on step S330 in step S340, if the argument value last stored in the stack associated with the branched hooking function is the same as the argument value specified when calling the function of the operating system, step In operation S350, an original execution command for a function of the operating system is extracted from the branched hooking function based on the address where the branch execution command is located and the address where the return execution command is located.

In this case, according to an embodiment of the present invention, in step S350, calculating a position difference between an address where the branch execution command is located and a start position address of a function of the operating system after the return execution command is executed. It may include.

Then, in step S350, calculating the address reduced by the calculated position difference from the address where the return execution instruction is located in the branched hooking function and decreasing by the position difference within the branched hooking function. The method may further include extracting, as the original execution command, the execution command located from the address to the address immediately before the return execution command.

In step S360, a function of the operating system is restored based on the extracted original execution command.

At this time, according to an embodiment of the present invention, the malicious program hooking prevention method, after the step (S350) to check the address in which the extracted source execution command is located in the branched hooking function and the function of the operating system When is called, the method may further include directly calling an address where the extracted original execution command is located.

In the above, the malicious program hooking prevention method according to an embodiment of the present invention was described with reference to FIG. Here, since the malicious program hooking prevention method according to an embodiment of the present invention may correspond to the configuration of the malicious program hooking prevention apparatus 210 described with reference to FIG. 2, a detailed description thereof will be omitted.

Malicious program hooking prevention method according to an embodiment of the present invention is implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

210: Anti-malware hooking device
211: branch confirmation unit 212: determination unit
213: extracting unit 214: restoring unit
215: execution command confirmation unit 216: address call unit
217: first operation unit 218: second operation unit
219: execution command extracting unit

Claims (7)

Activate the branch trace function of the central processing unit (CPU) to check the address where the branch execution instruction is located in the function of the operating system, and to the function of the operating system in the hooking function branched according to the branch execution instruction. A branch confirmation unit for confirming an address where the return execution command of the terminal is located;
A determination unit that determines whether an argument value last stored on the stack associated with the branched hooking function is equal to an argument value specified when calling a function of the operating system;
If the argument value last stored on the stack associated with the branched hooking function is equal to the argument value specified when invoking the function of the operating system, based on the address where the branch execution instruction is located and the address where the return execution instruction is located An extraction unit for extracting an original execution command for a function of the operating system from the branched hooking function; And
A restoration unit for restoring a function of the operating system based on the extracted original execution command;
Anti-malware hooking prevention device comprising a. The method of claim 1,
An execution command confirmation unit confirming an address where the extracted original execution command is located in the branched hooking function; And
When the function of the operating system is called, an address caller for directly calling the address where the extracted original execution command is located
Anti-malware hooking prevention device further including. The method of claim 1,
The extracting unit
A first calculator configured to calculate a position difference between an address where the branch execution command is located and a start position address of a function of the operating system after the return execution command is executed;
A second calculator configured to calculate an address reduced by the calculated position difference from an address at which the return execution command is located in the branched hooking function; And
An execution command extracting unit configured to extract an execution command located from the address calculated by the second operation unit to just before the address where the return execution command is located in the branched hooking function as the original execution command;
Anti-malware hooking prevention device comprising a. Activating a branch trace function of a central processing unit (CPU) to identify an address where a branch execution instruction is located in a function of an operating system;
Identifying an address where a return execution command to a function of the operating system is located in a hooking function branched according to the branch execution command;
Determining whether an argument value last stored on a stack associated with the branched hooking function is equal to an argument value specified when calling a function of the operating system;
If the argument value last stored on the stack associated with the branched hooking function is equal to the argument value specified when invoking the function of the operating system, based on the address where the branch execution instruction is located and the address where the return execution instruction is located Extracting an original execution command for a function of the operating system from the branched hooking function; And
Restoring a function of the operating system based on the extracted original execution command;
How to prevent malware hooking, including. 5. The method of claim 4,
Identifying an address at which the extracted original execution instruction is located in the branched hooking function; And
When the function of the operating system is called, directly calling an address where the extracted original execution command is located
How to prevent malware hooking further comprising. 5. The method of claim 4,
The extracting step
Calculating a position difference between an address at which the branch execution instruction is located and a start position address of a function of the operating system after the return execution instruction is executed;
Calculating an address reduced by the calculated position difference from an address at which the return execution command is located in the branched hooking function; And
Extracting, as the original execution instruction, an execution instruction located from the address reduced by the position difference within the branched hooking function to just before the address where the return execution instruction is located;
How to prevent malware hooking, including. A computer-readable recording medium having recorded thereon a program for performing the method of any one of claims 4 to 6.

Images