CN105260659B - A kind of kernel level code reuse type attack detection method based on QEMU - Google Patents

Abstract

The invention discloses a QEMU-based kernel-level code reuse type attack detection method, which mainly solves the problems of relying on hardware or needing to modify kernel source codes in the prior art. It expands the functional modules of the QEMU virtual machine manager, traverses and detects every instruction in the operating system kernel running on it, and identifies jump instructions related to the control flow, including ret and indirect call instructions, through Record their jump target addresses, and then compare these target addresses with the legal target addresses in the normal execution flow of the system to detect whether the system is running normally; at the same time, it checks the interrupt return address and actual The return address used when returning is compared and verified to determine whether an attack has occurred. The present invention needs to change the characteristics of the original execution flow of the system for code reuse type attacks, and can effectively detect the attack by monitoring the instructions (and locations) that change the execution flow of the kernel, and can be used to protect the safety of the operating system.

Description

A Kernel-Level Code Reuse Attack Detection Method Based on QEMU

technical field

The invention belongs to the field of computer science and technology, relates to the protection of malicious software, in particular to a QEMU-based kernel-level code reuse type attack detection method.

Background technique

As a new contemporary attack method, the kernel-level code reuse attack does not need to inject any new code, and only uses (or reuses) the existing (legal) code in the kernel to construct a complete attack and fundamentally subvert the entire operation. system, it can escape the protection of the kernel code integrity protection mechanism, which brings a huge threat to the security of the user's computer system.

Code reuse attacks need two steps to complete: (1) The attacker carefully selects available instruction fragments and connects them through specific instructions (such as ret); (2) Changes the original execution flow of the system (by tampering Some control data in the kernel execution, such as function pointer or function return address), jump to the first instruction segment selected by the attacker to carry out the attack.

The earliest code reuse attack is ROP (return-oriented programming) attack. Since its carefully selected instruction fragments all end with ret instructions, the toolset it constructs will contain many ret instructions, which is unreasonable in a normal system. Therefore, Chen et al. [ICISS 2009] proposed a technical method to discover ROP attacks by detecting the frequency of ret instruction calls in the system instruction execution process. Li et al. [ACM EuroSys2010] from North Carolina State University removed all ret instruction opcode bytes in the kernel by modifying the compiler, making it impossible for attackers to find usable instruction fragments to construct attacks. The latest code reuse attack variants no longer rely on the ret instruction, but instead use similar jump instructions (such as indirect jmp or "pop+jmp" instructions) to concatenate instruction fragments, which is even more difficult to deal with. To this end, Li et al. [IEEE TIFS 2011] from North Carolina State University proposed a compiler-based approach to protect control data in the kernel (including function pointers and function return address) to prevent code reuse attacks. Kuznetsov et al. [OSDI2014] of EPFL also proposed a compiler-based method, which protects all code-pointers in the program to resist code reuse attacks.

It should be said that the current research results have achieved certain results in the detection of code reuse attacks. However, most of the existing detection methods have technical limitations. They either require additional hardware support or modifications to the kernel source code. The former will increase hardware costs and have poor scalability, while the latter is not suitable for non-open source operating system kernels (such as Windows).

The detection method proposed by the present invention is completed based on the QEMU virtual machine manager. QEMU is a fast and convenient dynamic binary translator that can start virtual machines and support many different CPU architectures. Since QEMU is executed in the form of binary instruction translation, it can intervene (or intervene) in every instruction executed by the virtual machine kernel. The code reuse type attacks all need to change the original execution flow of the system (the second step). The present invention can effectively detect and discover the attack by monitoring the instructions (and locations) that change the kernel execution flow. Moreover, none of the existing detection methods provides detection of the kernel interrupt process, and attackers can also implement attacks by changing the process of kernel interrupt processing. The invention provides the detection and verification of the kernel interrupt flow.

Contents of the invention

In order to make up for the deficiencies in the prior art, the present invention proposes a QEMU-based kernel-level code reuse attack detection method, which is used to detect the behavior of various kernel-level code reuse attacks (and variants thereof) to protect the operating system safety.

In order to achieve the above object, the technical solution adopted in the present invention comprises the following steps:

1) Pretreatment

1.1) Create an empty temporary file temp_file, and output the contents of the operating system kernel image file to the temporary file temp_file;

1.2) Create a file func_addr_file that records the entry addresses of functions in the kernel, obtain the entry addresses of all functions of the kernel in turn from the temp_file file, and write these addresses into the func_addr_file file;

1.3) Create a file ret_addr_file that records the return address of the function in the kernel, obtain all valid function return addresses in the system in turn from the temp_file file, and write these addresses into the ret_addr_file file;

2) Record and interrupt process verification of jump instruction target address based on QEMU

3) Jump instruction target address verification

While the instruction is translated, the target address of the jump instruction recorded by QEMU is verified to detect whether an attack has occurred.

The further improvement of the present invention is:

Described step 2) in, the specific method of recording and interrupt flow verification based on the jump instruction target address of QEMU is as follows:

2.1) Use QEMU to start the virtual machine kernel;

2.2) In the translation stage of QEMU from the client instruction to the host instruction, obtain an instruction I in the kernel instruction;

2.3) before instruction 1 is translated, at first judge whether interrupt event has occurred, if interrupt occurs, then jump to step 2.7);

2.4) judge the type of instruction I: if I is an indirect call instruction, then jump to step 2.5); if I is a ret instruction, then jump to step 2.6); otherwise jump to step 2.8);

2.5) Perform the following operations on the indirect call instruction I:

2.5a) If the file call_addr.out does not exist, create a file call_addr.out that records the target address of the indirect call instruction;

2.5b) When translating the indirect call instruction I, assign a value of 1 to its flag call_flag;

2.5c) If an interrupt occurs at this time, when entering the interrupt processing function, judge whether the call_flag is 1, if so, record the return address pushed on the stack during the interrupt processing to the call_addr.out file, then assign the call_flag value to 0, and jump to the step 2.5e);

2.5d) QEMU jumps to the target address of the indirect call instruction for translation. Before translation, judge whether the flag call_flag is 1. If so, record the first address of the translation block in the call_addr.out file, which is the target address of the indirect call instruction. Then assign call_flag to 0;

2.5e) jump to step 2.8);

2.6) Carry out the following operations to the ret instruction I:

2.6a) If the file ret_addr.out does not exist, then create a file ret_addr.out that records the target address of the ret instruction;

2.6b) When translating the ret instruction I, its flag ret_flag is assigned a value of 1;

2.6c) If an interrupt occurs at this time, when entering the interrupt processing function, judge whether ret_flag is 1, if so, record the return address pushed on the stack during interrupt processing to the ret_addr.out file, then assign ret_flag to 0, and jump to step 2.6e);

2.6d) QEMU jumps to the target address of the ret command for translation. Before translation, judge whether ret_flag is 1. If so, record the first address of the translation block in the ret_addr.out file, which is the target address of the ret command, and then set ret_flag assign a value of 0;

2.6e) jump to step 2.8);

2.7) Perform the following operations on the interrupt:

2.7a) If the int_addr.out file does not exist, create a file int_addr.out that records the interrupt information;

2.7b) If there is no custom stack, initialize the stack int_addr, and the top pointer of the stack points to the first position;

2.7c) Push the return address of the system push stack into the custom stack int_addr in the QEMU interrupt processing function;

2.7d) When QEMU finishes executing the interrupt program and calls the interrupt return instruction, it pops the return address in the custom stack int_addr and compares it with the return address of the interrupt return instruction. If the two are different, it reports that an attack has occurred. And record the return addresses with different comparison results in the int_addr.out file;

2.7e) jump to step 2.4);

2.8) If the operating system kernel still has unprocessed instructions, return to step 2.2), and start the processing of the next instruction; otherwise, end.

In said step 2.4), the type of instruction I is judged by QEMU by identifying the opcode of the binary instruction.

In said step 3), the verification steps of the jump instruction target address are as follows:

3.1) Read each newly added target address in call_addr.out, verify whether it is the function entry address in the func_addr_file file, if not, report an attack;

3.2) Read each newly added target address in ret_addr.out, verify whether it is a valid function return address in the ret_addr_file file, if not, report an attack;

3.3) Return to 3.1).

Compared with the prior art, the present invention has the following beneficial effects:

1) The present invention is implemented based on the QEMU virtual machine manager, does not need to expand the hardware, and does not need to modify the source code of the operating system kernel to identify, locate and record the target address of the jump instruction that needs to be detected. Compared with existing methods, this mechanism has low cost, strong scalability, and can support multiple types of operating systems (such as non-open source operating systems). By comparing the recorded target address with the legal jump address of the system, it is possible to detect kernel-level code reuse attacks and protect the security of the operating system.

2) The present invention only adds a storage operation when a jump instruction needs to be translated, that is, the operation of recording the destination address to a file. It has the advantage of high performance, and the performance test result based on UnixBench shows that the performance loss caused by the present invention is about 4%.

3) The present invention provides the detection of most of the jump instructions in the operating system kernel, and at the same time, it proposes a method for detecting and verifying the return address in the interrupt processing process when the system is interrupted. QEMU actually supervises the jump process of the entire operating system control flow, so it can detect kernel-level code reuse attacks and provide a strong guarantee for operating system security.

Description of drawings

Fig. 1 is a flow chart of the present invention.

Detailed ways

Below in conjunction with accompanying drawing and embodiment the present invention is described in further detail:

Referring to FIG. 1 , the present invention includes preprocessing and QEMU-based recording of the jump instruction target address and interrupt flow verification, as well as legality verification of the jump instruction target address. Among them, the jump instructions related to the control flow include indirect call instructions and ret instructions. By recording their jump target addresses, and then comparing these target addresses with the target addresses in the normal system execution process, it is detected whether the system is running normally. be attacked.

The present invention is proposed based on such an observation: no matter what type of code reuse attack, if they want to implement the attack, they must change the original execution flow (or control flow) of the system and jump to the attacker's selected The first instruction fragment is required to proceed. Attacks can be detected (or prevented) if they can be detected (or verified) where they could alter the flow of system execution. For this reason, the indirect call instruction, ret instruction and interrupt flow that change the system control flow in the system must be protected.

The core idea of the present invention is to use the QEMU virtual machine manager as a platform, and use the QEMU virtual machine manager to run the operating system kernel for detection or verification. Since QEMU is implemented based on binary instruction translation technology, each instruction of the system kernel will be translated and run in the QEMU virtual machine manager, and QEMU can intervene (or intervene) every instruction executed by the virtual machine kernel. By modifying the functional modules of the QEMU virtual machine manager, traversing and detecting each instruction in the operating system kernel, identifying the ret instruction, indirect call instruction and interrupt translation method, and then recording the jump target address of these instructions, by recording By comparing the information with legitimate information, the detection of code reuse attacks can be realized. The operating system runs on the virtual machine started by QEMU, and the attack occurs on the operating system, and the attacker will not hinder the operation of QEMU; the detection in QEMU does not need to modify the system kernel code, that is, for any operating system, there is no need to reinstall Compilation will be able to detect. At the same time, QEMU is an open-source software that does not require a large number of code changes. It only needs to add processing codes to key places in QEMU to complete the detection of code reuse attacks.

For the jump target address, because the value of the target address is dynamically generated and changed when the system is running, it can be recorded when QEMU performs dynamic translation. Specifically, following the flow of function calls in the system, when an indirect call instruction is executed to call a function, it will jump to the next QEMU translation block to continue execution. At this time, the first address of the translation block is the destination address of the jump instruction. Thus, the first address of the function called by the indirect call instruction can be recorded. Similarly, after the ret instruction is executed, it will also jump to the next translation block to execute the instruction execution flow, and the return address of the ret instruction can be recorded in the same way.

Considering the target address of the jump instruction comprehensively, the present invention needs to record the jump target address of the indirect call instruction and the ret instruction in the system, so that the subsequent legality judgment is carried out; and the interrupt pushed into the stack when the interrupt occurs returns The address is compared and verified with the return address used when the interrupt actually returns to determine whether an attack has occurred.

With reference to Fig. 1, the detailed operating steps of the present invention are as follows:

preprocessing step

a) Create a temporary file temp_file, use the code disassembly command (such as objdump) that comes with the system, and output the contents of the operating system kernel image file to the temp_file file;

b) Create a file func_addr_file, and record all function entry addresses in the temp_file file into the file func_addr_file;

c) Create a file ret_addr_file, and record all effective function return addresses in the temp_file file in the file ret_addr_file (each effective return address points to the instruction immediately after a certain call instruction).

QEMU-based jump instruction target address recording and interrupt process verification steps

d) Use QEMU to start the virtual machine kernel, read kernel instructions for translation and execution;

In the stage of QEMU translating instructions, QEMU does not translate in units of a single instruction. The translation process is divided into two steps. A block of instructions is called a translation block. In this way, each translation block ends with a jump instruction, and this feature makes the address acquisition have certain features. After the instruction flow is divided into translation blocks, QEMU uses the translation blocks as the translation unit; the second step is to translate each instruction in the translation block.

e) in the translation stage from the client computer instruction to the host computer instruction in QEMU, obtain an instruction I in the kernel instruction, before translation, first judge whether an interruption has occurred, if an interruption occurs, then perform step i);

f) by reading the opcode of the instruction, the type of the instruction I is judged: if I is an indirect call instruction, step g) is executed, if I is a ret instruction, step h) is executed, otherwise step j) is executed;

g) Perform the following operations on the indirect call instruction I:

g1) If the call_addr.out file does not exist, then create a file call_addr.out that records the target address of the indirect call instruction;

g2) when translating the indirect call instruction I, call_flag is assigned a value of 1;

In step g2), a flag is added during translation for each indirect call instruction to indicate that the indirect call instruction is being translated, and call_flag is assigned a value of 1 each time the indirect call instruction is translated;

g3) Before the translation block continues to execute the next translation block, judge whether an interruption occurs. If an interruption occurs, jump to the interrupt processing function to determine whether call_flag is 1. If so, push the return address record on the stack when interrupt processing In the file call_addr.out (at this time, the interrupt push return address is the jump destination address of the indirect call instruction), then assign call_flag to 0, and jump to step g5);

The reason why it is necessary to judge the occurrence of interruption in step g3) is that QEMU cannot interrupt at any time when performing dynamic binary translation. Since the translation blocks used for translation will be very small, QEMU will judge the interruption. When each translation block starts to translate, the judgment of interrupt occurrence is made, so the judgment of the target address of the jump instruction needs to consider the possibility of interrupt occurrence;

g4) Before QEMU translates the next translation block, judge whether call_flag is 1, if it is 1, record the first address of the translation block in the file call_addr.out, and then assign call_flag to 0;

g5) jump to step j);

h) carry out the following operations to the ret instruction I:

h1) If the ret_addr.out file does not exist, create a file ret_addr.out that records the target address of the ret command;

h2) when translating ret instruction I, ret_flag is assigned a value of 1;

In step h2), a flag is added to indicate that the ret instruction is being translated for each ret instruction during translation, and ret_flag is assigned a value of 1 each time the ret instruction is translated;

h3) Before the translation block continues to execute the next translation block, judge whether an interruption occurs. If an interruption occurs, jump to the interrupt processing function to judge whether ret_flag is 1. If so, push the return address record on the stack when interrupt processing In the file ret_addr.out (at this time, the interrupt push return address is the jump target address of the ret instruction), then assign ret_flag to 0, and jump to step h5);

The reason for judging the occurrence of an interrupt here is the same as that of the indirect call instruction.

h4) Before QEMU translates the next translation block, judge whether ret_flag is 1, if yes, record the first address of the translation block in the file ret_addr.out, and then assign ret_flag to 0;

h5) jump to step j);

i) Perform the following operations on the interrupt:

i1) If the int_addr.out file does not exist, then create the file int_addr.out;

i2) If there is no custom stack, initialize the stack int_addr, and set the space of the stack to 50, and the top pointer of the stack points to the first position;

i3) Before executing the interrupt function, the value of the register and the context need to be pushed onto the stack, including the interrupt return address. First, judge whether the custom stack int_addr space is full. If not, push the interrupt return address into the custom stack int_addr , and then the top pointer of the stack increases by 1; otherwise (int_addr space is full) the system reports an error;

i4) After the execution of the interrupt function is completed, the system calls the interrupt return function to return to the place where the interrupt occurred to continue execution, pops the interrupt return address recorded at the top of the stack when the interrupt processing function is called, and returns the interrupt recorded in the custom stack int_addr Take out the address and judge whether the return address used by the interrupt return function is consistent with the return address recorded in the custom stack int_addr; The return address of the output to the file int_addr.out;

i5) jump to step f);

j) If there are unprocessed instructions in the instruction set of the operating system, return to step e) and start processing the next instruction; otherwise, the instruction translation phase ends.

Jump instruction target address verification steps

k) While the instruction is being translated, the target address of the jump instruction recorded by QEMU is verified to detect whether an attack has occurred:

k1) Verification of the target address of the indirect call instruction: read each newly added jump target address in call_addr.out, verify whether it is the function entry address in the func_addr_file file, if not, report that an attack has taken place;

k2) Verification of the target address of the ret instruction: read each newly added return target address in ret_addr.out, verify whether it is a valid function return address in the ret_addr_file file, if not, report that an attack has occurred.

Performance effect of the present invention can further illustrate by following experiment:

Experimental conditions:

Implement the present invention into the QEMU virtual machine manager. The invention utilizes the QEMU1.5.0 version to detect the code reuse type attack on the kernel of the Linux3.11.1 version, and realizes the function by modifying the source code of the QEMU.

Experiment content:

The performance test tool UnixBench is selected to perform performance tests on the original QEMU boot system kernel and the QEMU boot system kernel with the function of the present invention added, to obtain the performance loss caused by the present invention. Each test was performed three times, and the average value was calculated.

Result analysis:

The performance test results based on UnixBench show that the performance loss caused by this solution is about 4%. Overall, the present invention has the advantage of high performance.

The above content is only to illustrate the technical ideas of the present invention, and cannot limit the protection scope of the present invention. Any changes made on the basis of the technical solutions according to the technical ideas proposed in the present invention shall fall within the scope of the claims of the present invention. within the scope of protection.

Claims (3)

1. a kind of kernel level code reuse type attack detection method based on QEMU, it is characterised in that comprise the following steps：

1) pre-process

1.1) an empty temporary file temp_file is created, and the content in operating system nucleus image file is output to In temporary file temp_file；

1.2) the file f unc_addr_file of function entrance address in a record kernel is created, from temp_file files The entry address of all functions of kernel is obtained successively, and these addresses are write in func_addr_file files；

1.3) create one record kernel in Function return addresses file ret_addr_file, from temp_file files according to All efficient function return addresses in secondary acquirement system, and these addresses are write in ret_addr_file files；

2) record of the jump instruction destination address based on QEMU and interruption flow verification, specific method are as follows：

2.1) virtual machine kernel is started using QEMU；

2.2) I is instructed in the QEMU translating phase from guest instruction to host command, one obtained in core instructions；

2.3) before being translated to instruction I, it is first determined whether there occurs interrupt event, in the event of interrupting, then jump Go to step 2.7)；

2.4) decision instruction I type：If I is indirect call instructions, step 2.5) is jumped to；If I is ret instructions, Then jump to step 2.6)；Otherwise step 2.8) is jumped to；

2.5) indirect call instructions I is proceeded as follows：

If 2.5a) file call_addr.out is not present, the file call_ for recording indirect call instruction target address is created addr.out；

2.5b) when translating indirect call instructions I, call_flag, which is entered as 1, to be indicated to it；

Judge whether call_flag is 1 if 2.5c) now interrupting, during into interrupt processing function, if so, in then recording Pop down is returned an address in call_addr.out files during disconnected processing, and call_flag then is entered as into 0, jumps to step 2.5e)；

2.5d) QEMU jumps to the destination address that indirect call is instructed and translated, before translation judgement symbol call_flag Whether it is 1, if so, then record translates block first address into call_addr.out files, the target of as indirect call instructions Location, call_flag is then entered as 0；

2.5e) jump to step 2.8)；

2.6) ret instructions I is proceeded as follows：

If 2.6a) file ret_addr.out is not present, the file ret_ of the destination address of record ret instructions is created addr.out；

2.6b) when translating ret instruction I, ret_flag, which is entered as 1, to be indicated to it；

Judge whether ret_flag is 1 if 2.6c) now interrupting, during into interrupt processing function, if so, then record interrupts Pop down is returned an address in ret_addr.out files during processing, ret_flag then is entered as into 0, jumps to step 2.6e)；

2.6d) QEMU jumps to the destination address that ret is instructed and translated, and judges whether ret_flag is 1 before translation, if It is that then record translation block first address is into ret_addr.out files, the destination address of as ret instructions, then by ret_ Flag is entered as 0；

2.6e) jump to step 2.8)；

2.7) interruption is proceeded as follows：

If 2.7a) int_addr.out files are not present, the file int_addr.out of record interrupting information is created；

If 2.7b) initializing stack int_addr without self-defined stack, top-of-stack pointer points to first position；

The return address of system pop down 2.7c) is pressed into self-defined stack int_addr simultaneously in the function that QEMU processing is interrupted In；

2.7d) after QEMU performs interrupt routine, when calling interrupt return instruction, by returning in self-defined stack int_addr Go back to address to pop, compared with the return address of interrupt return instruction, if the two is different, report is attacked, and will The different return address of comparing result recorded in int_addr.out files；

2.7e) jump to step 2.4)；

If 2.8) operating system nucleus also has untreated instruction, return to step 2.2), start the processing of next instruction；It is no Then terminate；

3) jump instruction destination address is verified

While instruction translation, the destination address of the jump instruction to QEMU records is verified, detects whether to be attacked Hit.

2. the kernel level code reuse type attack detection method according to claim 1 based on QEMU, it is characterised in that institute State in step 2.4), the type for instructing I is QEMU by identifying that the command code of binary command is judged.

3. the kernel level code reuse type attack detection method according to claim 1 or 2 based on QEMU, its feature exist In in the step 3), jump instruction destination address verification step is specific as follows：

3.1) each newly-increased destination address in call_addr.out is read, verifies whether it is func_addr_file texts Function entrance address in part, if it is not, then report is attacked；

3.2) each newly-increased destination address in ret_addr.out is read, verifies whether it is ret_addr_file files In valid function return address, if it is not, then report attacked；

3.3) return to 3.1).