KR102111886B1 - Method and apparatus for dbi detection on arm architecture - Google Patents

Abstract

According to one embodiment, provided is a dynamic program correction detection technology performed by a detection device, which comprises the steps of: estimating difference information in which a modulated code is operated by inserting an arbitrary code into a program running in an ARM architecture or a dynamic binary instrumentation environment of the ARM architecture; and voluntarily discriminating an execution environment of the program using the estimated difference information.

Description

Dynamic program modification detection technology on ARM architecture {METHOD AND APPARATUS FOR DBI DETECTION ON ARM ARCHITECTURE}

The following description relates to a technique for determining whether a process on an ARM architecture is undergoing dynamic program modification by itself, and more particularly, an analysis method using a code cache structure.

As a method for detecting an existing dynamic program modification, a heuristic method has been common. Specifically, check the bug existing in a specific DBI, check the implementation characteristics of the DBI such as signal mask or resource usage information, check the existence of a DBI-only library used by the DBI, or handle the error caused by a specific command And to confirm.

On the other hand, U.S. Patent No. 8151352 (Anti-malware emulation systems and methods) deals with whether or not it is possible to know whether a program currently being executed in an emulation environment is running in an emulation environment.

It is possible to provide a method and apparatus for determining whether a process on an ARM architecture is running in a DBI environment by itself other than a heuristic-based method.

The dynamic program modification detection method performed by the detection system includes estimating difference information in which a modulated code is operated by inserting arbitrary code into a program running in the ARM architecture; And voluntarily discriminating the execution environment of the program using the estimated difference information.

The estimating the difference information may include determining whether or not to operate the self-modifying code for changing the code by inserting arbitrary code in the running program in the ARM architecture.

The estimating the difference information may include estimating whether the self-correcting code operates on the ARM architecture or whether the self-correcting code operates on dynamic binary instrumentation of the ARM architecture.

The ARM architecture includes an I-cache, which means the cache for the contents of which the processor fetches instructions from memory for execution of instructions, and a D-cache, which means the cache for contents obtained from memory. Configuration, the structure of the I-cache and the D-cache in the ARM architecture can be asynchronous.

The discriminating step includes updating the memory address in the ARM architecture so that the I-cache and the D-cache configured in the ARM architecture include the same memory address, and then writing the contents of the code by writing data to the rwx memory area. When attempting to modulate a code that modifies, it may include determining that the modulated code operates abnormally in the ARM architecture.

The discriminating step may include an I-cache miss when attempting to modulate the code to modify the contents of the code by utilizing the rwx memory area as the memory address is updated in the ARM architecture. And determining that the modulated code operates normally in a binary measurement environment.

In the dynamic program modification detection method, a process of voluntarily discriminating the execution environment of a program using the estimated difference information as an arbitrary code is inserted into a program running in the ARM architecture and the modulated code is operated through PoC code It may further include the step of verifying.

The computer program stored in the computer readable storage medium in order to execute the dynamic program modification detection method performed by the detection system estimates difference information in which the modulated code is operated by inserting arbitrary code into a program running in the ARM architecture. To do; And voluntarily discriminating the execution environment of the program using the estimated difference information.

The detection system for detecting a dynamic program modification includes: an estimator for estimating difference information in which a modulated code is operated by inserting arbitrary code into a program running in the ARM architecture; And a discrimination unit for voluntarily discriminating the execution environment of the program using the estimated difference information.

The estimator may determine whether to operate the self-modifying code to change the code by inserting arbitrary code into the running program in the ARM architecture.

The estimation unit may estimate whether the self-modifying code is operated in the ARM architecture or whether the self-modifying code is operated in dynamic binary instrumentation of the ARM architecture.

The discrimination unit corrects the contents of the code by writing data to the rwx memory area after making the I-cache and the D-cache configured in the ARM architecture contain the same memory address as the memory address is updated in the ARM architecture. When attempting code modulation, it may be determined that the modulated code operates abnormally in the ARM architecture.

The discriminating step may include an I-cache miss when attempting to modulate the code to modify the contents of the code by utilizing the rwx memory area as the memory address is updated in the ARM architecture. It can be determined that the modulated code operates normally in a binary measurement environment.

It can be a detection technology for programs such as DynamicRIO, which is a representative method of dynamic binary measurement (DBI), which can be used on the ARM architecture.

In addition, it can be used as a technology to prevent information theft of commercialized software in advance, and it is possible to improve the obfuscation level of software.

1 is a diagram for describing an operation of performing dynamic program modification detection in an ARM architecture in one embodiment.
2 is a diagram for explaining an operation of performing dynamic program modification detection in a dynamic binary measurement environment, in an embodiment.
3 is a flowchart illustrating the configuration of a detection device according to an embodiment.
4 is a flowchart illustrating a method of performing dynamic program modification detection on an ARM architecture in a detection device according to an embodiment.
5 is an example of verifying an operation for performing dynamic program modification detection in an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

In an embodiment, a technique for detecting a modification of a dynamic program using an architecture structure will be described.

1 is a diagram for describing an operation of performing dynamic program modification detection in an ARM architecture in one embodiment.

The ARM architecture is a RISC processor that is commonly used in embedded devices.

The ARM architecture internally uses two types of cache, including I-cache and D-cache. I-cache refers to a cache for the contents of a processor fetching instructions from memory to execute instructions. D-cache refers to the cache for the contents of the operation data from memory. At this time, the structures of the I-cache and the D-cache are not synchronized with each other. Accordingly, if the I-cache and the D-cache contain the contents of the same memory address, and if the contents of the memory address are changed in either the I-cache or the D-cache, the remaining unchanged cache It may take time to receive the changes.

Referring to Figure 1, it is possible to update the memory address in the ARM architecture. You can access the data for the memory address. Using rwx memory area, update memory addresses in I-cache and D-cache so that the I-cache and D-cache configured in the ARM architecture contain the same memory address, and then modify the contents of the code by writing data. Code tampering can be attempted. At this time, it is possible to determine the possibility that the code modulated in the ARM architecture operates normally based on the self-modifying code operating in the program being executed by the program running in the ARM architecture. There is a high probability that the modulated code is not applied in the ARM architecture.

On the other hand, referring to Figure 2, in the case of a dynamic binary instrumentation (Dynamic Binary Instrumentation) environment, a code modulation process for dynamic code change itself by dynamic binary instrumentation is included when executing the code. For example, there may be an additional process of copying the code to another location by the code modulation process. Accordingly, an I-cache miss occurs in a dynamic binary measurement environment and can be patched with an updated cache. In dynamic binary instrumentation, when code modulation is attempted by utilizing the rwx memory area, there is a high probability that the self-correcting code operates normally in dynamic binary instrumentation as an additional code modulation process is included in dynamic binary instrumentation.

If the running program runs directly on the ARM architecture, there is a high probability that the self-modifying code operating in the running program will not operate normally due to the cache structure of the ARM architecture, and the running program is a dynamic binary. When running in measurement, in a dynamic binary measurement environment, there is a high probability that the self-correcting code operates normally. In this case, the self-modifying code refers to code that changes one's instruction during execution.

In summary, the difference between the probability information that the self-modifying code running in the running program and the probability information of the self-modifying code operating normally in the dynamic binary measurement environment is estimated by the cache structure of the ARM architecture. Can be. The execution environment of the program can be determined spontaneously through self-correcting code operated in the program executed using the difference information. For example, the operation of the self-modifying code may be determined in a program running in the ARM architecture. In this case, it may be estimated whether the self-modifying code operated in the running program is executed in the ARM architecture or in the dynamic binary instrumentation of the ARM architecture through the running program.

When self-modifying code that changes the code by inserting arbitrary code into the running program in the ARM architecture operates normally, the program is running in the dynamic binary instrumentation environment of the ARM architecture. It may be determined that, if the self-correcting code operates abnormally, it may be determined that the program is running in the ARM architecture.

Referring to FIG. 5, the PoC code is shown, and is a code for verifying the dynamic program modification detection. As the PoC code is actually executed, an error occurs in the ARM architecture, but in a dynamic binary measurement environment such as DynamoRIO, the program can be normally terminated without any error.

When checking the code information of FIG. 5, a macro called smc means a self-modifying code. The self-correcting code can perform self-correcting by performing an xor operation on the back of the program with a value of 0xff. The latter part of the program is an invalid instruction, but while the code is being executed, the latter part of the program is changed to an instruction indicating the end of the function called 'bx lr' by the xor operation. In the dynamic binary measurement environment, the converted instruction is executed and the function is terminated safely. In the ARM architecture, the instruction before the transformation is executed and an error occurs.

According to an embodiment, analysis of software utilizing dynamic program modification can be very effectively blocked. In addition, it can be a detection technology for DynamoRIO, Valgrind, etc., which are dynamic binary modification technologies that operate on ARM.

3 is a flowchart illustrating the configuration of a detection system according to an embodiment, and FIG. 4 is a flowchart illustrating a method for performing dynamic program modification detection on an ARM architecture in a detection system according to an embodiment.

The processor of the detection system 300 may include an estimation unit 310 and a determination unit 320. The components of the processor may be expressions of different functions performed by the processor according to a control command provided by the program code stored in the detection system 300. The processor and components of the processor may control the detection system 300 to perform steps 410-420 included in the method of performing dynamic program modification detection on the ARM architecture of FIG. 4. At this time, the processor and the components of the processor may be implemented to execute instructions according to the code of the operating system included in the memory and the code of at least one program.

The processor may load program code stored in a file of a program for a method for performing dynamic program modification detection on an ARM architecture into memory. For example, when a program is executed in the detection system 300, the processor may control the detection system 300 to load program code from a file of the program into a memory under the control of the operating system. At this time, each of the processor and the estimation unit 310 and the determination unit 320 included in the processor executes an instruction of a corresponding part of the program code loaded in the memory to execute subsequent steps 410 to 420. It can be different functional expressions.

In step 410, the estimator 310 may estimate the operation of the self-modifying code in the running program based on the ARM architecture. Dynamic binary instrumentation can be run on the ARM architecture. The estimator 310 may determine whether the running program is operating in the ARM architecture or in a dynamic binary measurement environment operating in the ARM architecture based on self-modifying code that operates in the running program. In other words, the estimator 310 has probability information for self-modifying code to operate normally in a program running by the cache structure of the ARM architecture and probability information for self-modifying code to operate normally in a dynamic binary measurement environment. You can estimate the difference.

In step 420, the determination unit 320 may determine the execution environment of the running program as it estimates the operation of the self-correcting code in the running program. When the self-modifying code operates normally, the determination unit 320 determines that the program is running in the dynamic binary instrumentation environment of the ARM architecture, and the self-modifying code operates abnormally. In this case, it can be determined that the program is running in the ARM architecture. The determining unit 320 utilizes the rwx memory area to update the memory addresses in the I-cache and D-cache so that the I-cache and D-cache configured in the ARM architecture include the same memory address, and then write data. When attempting to tamper with the code by modifying the contents of the code, the running program can determine that the self-correcting code operates abnormally in the ARM architecture. The determining unit 320 updates the memory addresses in the I-cache and the D-cache so that the I-cache and the D-cache configured in the ARM architecture include the same memory address by utilizing the rwx memory area, and then uses data writing. When attempting to tamper with the code to modify the contents of the code, an I-cache miss occurs and it can be determined that the self-correcting code operates normally in a dynamic binary measurement environment.

delete

The device described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the devices and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, field programmable gate arrays (FPGAs). , A programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and / or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. Can be embodied in The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded in the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. -Hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and / or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (13)

In the dynamic program modification detection method performed by the detection system,
Determining an ARM architecture environment of the specific program being executed or an execution environment including a dynamic binary measurement environment by using a self-modifying code that operates in a specific program that is running based on the ARM architecture.
Dynamic program modification detection method comprising a. According to claim 1,
The determining step,
When the data for the memory address is changed by the self-modifying code operating in the specific program being executed, execution of the specific program being executed according to whether the data of each cache is asynchronous or not based on the cache structure configured in the ARM architecture Determining whether the environment is an ARM architecture environment or a dynamic binary instrumentation environment
Dynamic program modification detection method comprising a. delete According to claim 2,
The ARM architecture,
The processor consists of I-cache, which means the cache for the contents of instructions fetched from the memory for execution of instructions, and D-cache, which means the cache for the contents of data obtained from memory, and the ARM. In the architecture, the cache data of the I-cache and D-cache is asynchronous.
How to detect dynamic program modifications. According to claim 1,
The determining step,
The self-modifying code after updating the memory addresses in the I-cache and D-cache so that the I-cache and D-cache configured in the ARM architecture include the same memory address by utilizing the rwx memory area in the specific program being executed. Determining that the self-correcting code operates abnormally in the ARM architecture environment when a code tampering attempting to modify the content of the code is attempted using data writing in the
Dynamic program modification detection method comprising a. According to claim 1,
The determining step,
When code modulation is attempted to modify the contents of the code by writing data in the self-correcting code, it is determined that the self-correcting code operates normally in the dynamic binary measurement environment as an additional modulation process is included in the dynamic binary measurement environment. Steps to
Dynamic program modification detection method comprising a. delete A computer program stored in a computer-readable storage medium for executing a dynamic program modification detection method performed by the detection system,
Determining an ARM architecture environment of the specific program being executed or an execution environment including a dynamic binary measurement environment by using a self-modifying code that operates in a specific program that is running based on the ARM architecture.
Computer program stored in a computer-readable storage medium comprising a. A detection system for detecting dynamic program modifications,
Based on the ARM architecture, a determination unit for determining an execution environment including an ARM architecture environment or a dynamic binary measurement environment of the specific program being executed by using a self-modifying code operating in a specific program being executed.
Detection system comprising a. The method of claim 9,
The discrimination unit,
When the data for the memory address is changed by the self-modifying code operating in the specific program being executed, execution of the specific program being executed according to whether the data of each cache is asynchronous or not based on the cache structure configured in the ARM architecture Determine whether the environment is an ARM architecture environment or a dynamic binary instrumentation environment
Detection system characterized in that. delete The method of claim 9,
The discrimination unit,
The self-modifying code after updating the memory addresses in the I-cache and D-cache so that the I-cache and D-cache configured in the ARM architecture include the same memory address by utilizing the rwx memory area in the specific program being executed. If code modification is attempted to modify the contents of the code by writing data, the running program determines that the self-correcting code operates abnormally in the ARM architecture environment.
Detection system characterized in that. The method of claim 9,
The discrimination unit,
When code modulation is attempted to modify the contents of the code by writing data in the self-correcting code, it is determined that the self-correcting code operates normally in the dynamic binary measurement environment as an additional modulation process is included in the dynamic binary measurement environment. doing
Detection system characterized in that.

Images