JP4927231B1 - Program, information device, and unauthorized access detection method - Google Patents

Abstract

An object of the present invention is to increase detection accuracy of unauthorized access.
When a call to a predetermined function is detected and a function is detected, a return address stored in a stack area is obtained, and the detected function is in a specified address range on a memory. If the previous instruction pointed to by the return address is not a function call instruction, the address range is stored in the address range storage unit, and the detected function When the return address is within the address range stored in the address range storage unit, it is determined that unauthorized access has been performed.
[Selection] Figure 1

Description

  The present invention relates to a program, an information device, and an unauthorized access detection method.

  In recent years, cases in which personal information and confidential information are leaked due to execution of illegal program codes in a computer have become a social problem. Such execution of unauthorized program code, that is, a program for performing unauthorized access is also called malware, and often uses software vulnerabilities. For example, buffer overflow is well known as a software vulnerability. For example, buffer overflow means that a character string or the like that is larger than the area reserved for the variable is input to a variable used in the program, and the character string or the like is written to another area. It is.

  When a function is called by a program, a return address (return address) is stored in the stack so that the function can be returned to the caller of the function. For example, by using the vulnerability of the function, the malware causes a buffer overflow when the function is executed, and rewrites the return address to an invalid address. The illegal address indicates, for example, a data area, not a memory area where the program code is stored, and the illegal program code is stored in the data area. The illegal address may be, for example, the start address of another function used for illegal access. When the execution of the function is completed in this state, the execution of the program is not the caller of the function, but transits to an illegal address. As a result, the program code stored at the unauthorized address is executed and unauthorized access is performed.

  Various methods for detecting such unauthorized access have been proposed. For example, the technique disclosed in Patent Document 1 uses the characteristic that the program code is stored in either a memory area for the program code or a data area having a non-writable attribute. ing. Specifically, for example, if the destination indicated by the return address is not a memory area for storing the program code, it is determined that the access is unauthorized. Further, for example, if the destination attribute indicated by the return address is writable, it is determined that the access is unauthorized.

  Further, for example, Patent Document 2 discloses a technique for detecting unauthorized access by an attack technique called Return-to-Libc or ROP (Return Oriented Programming). For example, if the destination indicated by the return address is the start address of the function, or if the instruction immediately before the destination indicated by the return address is a function call instruction (call instruction), it is determined that the access is illegal.

JP 2009-199529 A JP 2010-257275 A

However, for example, in some normal programs, another program code is developed in a data area on a memory, an execution attribute is given to the data area, and the program code is executed. In this case, since the write attribute is given to the data area in addition to the execution attribute, if the technique disclosed in Patent Document 1 is applied, it is erroneously detected as unauthorized access. Some normal programs make function calls without using the call instruction. Therefore, if the technique disclosed in Patent Document 2 is applied to such a program, it is erroneously detected as unauthorized access.
Therefore, an object of the present invention is to improve the detection accuracy of unauthorized access.

  A program according to an aspect of the present invention includes a call detection unit that detects a call to a predetermined function, and a return address that acquires a return address stored in the stack area when the function is detected. The acquisition unit and the detected function are functions that give an executable attribute to an area in a specified address range on the memory, and the previous instruction pointed to by the return address is not a function call instruction The attribute change detection unit that stores the address range in the address range storage unit, and the unauthorized access is performed when the return address of the detected function is within the address range stored in the address range storage unit It is intended to function as an unauthorized access detector that determines that

  Furthermore, when the function is detected, the return address acquisition unit sequentially acquires a plurality of return addresses stored in the stack area, and the attribute change detection unit, for each of the sequentially acquired return addresses, If the detected function is a function that adds an executable attribute to the area of the specified address range on the memory, and the previous instruction pointed to by the return address is not a function call instruction, the address range Is stored in the address range storage unit, and the unauthorized access detection unit performs unauthorized access when the return address is within the address range stored in the address range storage unit for each of the sequentially acquired return addresses. It is good also as determining with having.

  An information device according to an aspect of the present invention includes a call detection unit that detects a call to a predetermined function, and a return address that acquires a return address stored in the stack area when the function is detected. An acquisition unit and an attribute change detection unit that stores the address range in an address range storage unit when the detected function is a function that assigns an executable attribute to a specified address range area on the memory; And an unauthorized access detection unit that determines that unauthorized access is being performed when the return address of the detected function is within the address range stored in the address range storage unit.

  In the unauthorized access detection method according to one aspect of the present invention, the computer detects a call to a predetermined function, and when the function is detected, obtains a return address stored in the stack area, When the detected function is a function that adds an executable attribute to the specified address range area on the memory, the address range is stored in the address range storage unit, and the return address of the detected function is the address If it is within the address range stored in the range storage unit, it is determined that unauthorized access has been performed.

  In the present invention, the “part” does not simply mean a physical means, but includes a case where the function of the “part” is realized by software. Also, even if the functions of one “unit” or device are realized by two or more physical means or devices, the functions of two or more “units” or devices are realized by one physical means or device. May be.

  According to the present invention, it is possible to improve the accuracy of detecting unauthorized access.

It is a figure which shows an example of the hardware constitutions of the information equipment which is one Embodiment of this invention. It is a figure which shows the structural example of the function part implement | achieved in information equipment. It is a figure which shows an example of the structure of a stack area | region. It is a figure which shows an example of the memory map at the time of the program with a vulnerability being executed. It is a figure which shows an example of the attack code overwritten on the stack area | region by the vulnerability of the buffer overflow. It is a figure which shows an example of operation | movement of an attack code | cord | chord. It is a figure which shows an example of operation | movement of an attack code | cord | chord. It is a figure which shows an example of operation | movement of an attack code | cord | chord. It is a flowchart which shows an example of the detection process of an unauthorized access.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
== Configuration ==

  First, the configuration of an information device that is an embodiment of the present invention will be described. FIG. 1 is a diagram illustrating an example of a hardware configuration of an information device that is an embodiment of the present invention. As shown in FIG. 1, the information device 10 includes a processor 20, a memory 22, a storage device 24, an input interface (I / F) 26, a data interface (I / F) 28, a communication interface (I / F) 30, and The display device 32 is included. The information device 10 is an information processing apparatus such as a personal computer or a portable information terminal.

  The processor 20 controls the execution of various processes in the information device 10 by executing a program stored in the memory 22. Although not shown in FIG. 1, the processor 20 includes various registers for storing instructions and addresses. In this embodiment, the configuration of the processor 20 will be described on the assumption of IA-32, which is a 32-bit microprocessor architecture developed by Intel (registered trademark). The configuration of the processor 20 is not limited to this, and an arbitrary configuration can be adopted.

  The memory 22 is a storage area such as a RAM (Random Access Memory), for example, and temporarily stores a program code of a program executed by the processor 20 and data necessary for executing the program. For example, in the storage area of the memory 22, a stack area necessary for executing a program is secured.

  The storage device 24 is a storage area such as a hard disk or a flash memory, and stores various programs including an operating system, various data, and the like. Programs and data stored in the storage device 24 are loaded into the memory 22 as necessary, and are referenced by the processor 20.

  The input I / F 26 is a device for receiving input from the user, and is, for example, a keyboard, a mouse, a touch panel, various sensors, or the like. The input I / F 26 may be provided outside the information device 10 via an interface such as USB (Universal Serial Bus), for example.

  The data I / F 28 is a device for inputting data from the outside of the information device 10, and is, for example, a drive device for reading data stored in various storage media. The data I / F 28 may be provided outside the information device 10 via an interface such as a USB.

  The communication I / F 30 is a device for performing data communication with an external device of the information device 10, and can perform data communication by wire or wireless, for example. The communication I / F 30 may be provided outside the information device 10 via an interface such as a USB.

  The display device 32 is a device for displaying various information, and is, for example, a liquid crystal display or an organic EL (Electro-Luminescence) display. The display device 32 may be provided outside the information device 10 via a display cable or the like.

  FIG. 2 is a diagram illustrating a configuration example of a functional unit realized in the information device 10. 2 can be realized, for example, by using a storage area on the memory 22 or by the processor 20 executing a program stored in the memory 22.

  As shown in FIG. 2, the information device 10 can include a call detection unit 40, a return address acquisition unit 42, an attribute change detection unit 44, an address range storage unit 46, and an unauthorized access detection unit 48.

  The call detection unit 40 can detect a call of a predetermined API (Application Program Interface) function in the information device 10. The function call detection by the call detection unit 40 can be performed, for example, by using a hook by an arbitrary method. In the present embodiment, a case of hooking VirtualProtect and WinExec, which are API functions in Windows (registered trademark), will be described as an example. In this embodiment, VirtualProtect and WinExec are shown as examples of functions to be detected. However, the functions are not limited to this, and any function that may be used for unauthorized access can be detected. Similarly, for example, in other environments such as UNIX (registered trademark), it is possible to detect an API function call by a hook.

  The return address acquisition unit 42 acquires the return address stored in the stack area when a call to a predetermined API function is detected by the call detection unit 40. FIG. 3 shows an example of the structure of the stack area. As shown in FIG. 3, in the stack area, an area called a stack frame is secured for each function. As shown in FIG. 3, a stack pointer (esp: Extended Stack Pointer) and a base pointer (ebp: Extended Base Pointer) are provided as pointers in the stack area. The stack pointer indicates the top position of the stack, and its value is stored in the stack pointer register. The base pointer indicates the location of the bottom (base) of the stack frame of the function being executed, and its value is stored in the base pointer register.

  Then, the base address (ebp Backup) in the stack frame of the caller function is stored at the location pointed to by the base pointer, and the return address is stored below it. Therefore, the return address acquisition unit 42 can sequentially acquire a plurality of return addresses stored in the stack area by tracing the base address. The process of sequentially acquiring a plurality of return addresses by tracing the base address in this way is called backtrace.

  However, there is a function that does not follow this rule in the application, and there is a possibility that an invalid value is stored in ebp Backup. Therefore, the return address acquisition unit 42 determines that the address stored in the ebp backup is out of the stack area or is an incorrect value when the address is smaller than the stored address. End backtrace.

  If the function detected by the call detection unit 40 is a function that assigns an executable attribute to the designated address range area on the memory, the attribute change detection unit 44 stores the address range on the memory 22. The data is stored in the address range storage unit 46 that is a reserved area. In the present embodiment, the attribute change detection unit 44 detects the call of VirtualProtect by the call detection unit 40, and if the function assigns an execution attribute to the specified address range area, Store in the address range storage unit 46. VirtualProtect is the start address (first argument) of the attribute change target area, the size of the target area (second argument), the attribute after change (third argument), and the storage destination of the attribute before change (fourth argument). Takes four arguments. Therefore, when the call to VirtualProtect is detected, the attribute change detection unit 44 determines whether the executable attribute is to be given by the third argument, and changes the attribute by the first argument and the second argument. Address range can be obtained. The format of the address range information stored in the address range storage unit 46 is arbitrary. For example, the start address and end address of the address range may be stored, or the start address of the address range and the size of the address range may be stored.

  Further, the attribute change detection unit 44 can consider the return address acquired by the return address acquisition unit 42. Specifically, the attribute change detection unit 44 is a case where an execution attribute is given to the area of the designated address range by VirtualProtect, and the previous instruction to which the acquired return address indicates is called When the instruction is not an instruction (call instruction), the address range can be stored in the address range storage unit 46. When a plurality of return addresses are sequentially acquired by the return address acquisition unit 42, the attribute change detection unit 44 can make the determination for each return address.

  The unauthorized access detection unit 48 determines that unauthorized access has been performed when the return address acquired by the return address acquisition unit 42 is within the address range stored in the address range storage unit 46. In the present embodiment, the unauthorized access detection unit 48 detects, for example, a call to WinExec by the call detection unit 40 and the return address acquired by the return address acquisition unit 42 is stored in the address range storage unit 46. If it is within the range, it is determined that unauthorized access is being performed. When a plurality of return addresses are sequentially acquired by the return address acquisition unit 42, the unauthorized access detection unit 48 can make the determination for each return address.

== Unauthorized access detection processing ==
Next, unauthorized access detection processing in the information device 10 will be described. FIG. 4 is a diagram illustrating an example of a memory map when a vulnerable program is executed. In the example shown in FIG. 4, the program code is arranged in the 1.5 MB area from 0x65300000 to 0x6547FFFF, and the static data is arranged in the 0.5 MB area from 0x654480000 to 0x654FFFF. The program contains a vulnerable function that can cause a buffer overflow. As shown in FIG. 4, 0x54 is stored at address 0x650401122 in the program area, and 0xC3 is stored at address 0x650401123. In IA-32, 0x54 is a push esp instruction, and 0xC3 is a ret instruction. The push esp instruction is an instruction for pushing the value stored in the stack pointer register to the stack area. The ret instruction is an instruction for returning control from the called function to the calling function. In the present embodiment, these push esp instruction and ret instruction are used by an attack code for performing unauthorized access.

  FIG. 5 is a diagram showing an example of attack code overwritten in the stack area due to a buffer overflow vulnerability in the program shown in FIG. In the example of FIG. 5, the stack area has a 4-byte (double word) width, and the attack code is indicated in hexadecimal. In the example shown in FIG. 5, the attack code is composed of three blocks, block A to block C.

  Block A is a ROP (Return Oriented Program) program code for assigning an execution attribute to a data area by calling a VirtualProtect function. On the right side of the stack area of block A, the meaning of each double word is shown. The leading double word is an area where the return address for returning to the calling function is stored, but is overwritten with the address of the VirtualProtect function. Note that the address of the VirtualProtect function differs depending on the version of Windows (registered trademark) and the execution environment, but in the example of FIG. 5, it is set to 0x7C801AD0. As shown in FIG. 5, in the block A, the address of the ret instruction (0x650401123), the argument of the VirtualProtect function, and the address of the push esp instruction (0x650401122) are stored.

  Block B is a program code for copying the attack code body to the data area to which the execution attribute is given by the VirtualProtect function. On the right side of the stack area of block B, an assembly language notation of the program code is shown. The program code of block B is executed by the processor 20 referring to this stack area.

  Block C is an attack code body that is copied to the data area by the program code of block B. On the right side of the stack area of block C, an assembly language notation of the program code is shown. The program code of the block C is executed by the processor 20 referring to the copy destination data area. In the example shown in FIG. 5, in order to simplify the description, WinExec (“calc”, 1) is executed in the attack code body, and the calculator application is only activated. In the attack code actually used, an arbitrary application or function for performing unauthorized access is activated.

  The operation of the attack code shown in FIG. 5 will be described with reference to FIGS. 6 to 8, esp is a stack pointer, and eip (Extended Instruction Pointer) is an instruction pointer. The instruction pointer holds the address of the instruction to be executed next by the processor 20, and its value is stored in the instruction pointer register. In the example shown in FIGS. 6 to 8, state changes from state S1 to state S9 are shown.

  A state S1 shown in FIG. 6 shows a state immediately before the stack area is overwritten by the execution of the vulnerable function shown in FIG. 4 and the function returns to the calling function. At this time, esp indicates the head of the attack code. Eip indicates the position of a ret instruction (return instruction) for returning control from the vulnerable function to the calling function. The processor 20 executes the ret instruction according to eip, sets the contents of the location pointed to by esp, that is, the address 0x7C801AD0 of the VirtualProtect function to eip, and increases esp by 1 double word (4 bytes). Thereby, it changes to state S2. That is, a transition is made to the VirtualProtect function instead of the caller of the vulnerable function.

  In the state S2, the processor 20 executes the VirtualProtec function according to eip. At this time, the VirtualProtect function receives four double words as arguments in order from the next double word at the location pointed to by esp. The first argument 0x654800000 is the start address of the target area for attribute change, and the second argument 0x00001000 is the size of the target area. Referring to FIG. 4, this address range is the address range of static variable 1. The third argument 0x00000040 indicates that the changed attributes are all “read, write, execute” attributes. The fourth argument 0x654481000 is the storage destination of the attribute before the change. Referring to FIG. 4, it can be seen that the area of the static variable 2 is set as the storage destination of the attribute before the change. As a result, the attribute “read, write, execute” is given to the 4096-byte area of the static variable 1.

  A state S3 indicates a state immediately before returning from the VirtualProtect function. At this time, eip points to the position of the ret 16 instruction. In the case of the API of Windows (registered trademark), when returning from the function, esp is moved to the next address in the argument area. Accordingly, when executing the ret 16 instruction of the VirtualProtect function, the processor 20 sets the value 0x650401123 of the address pointed to by esp as eip as the return address, and increases esp by 5 double words (20 bytes). Thereby, the state transits to the state S4 shown in FIG.

  In state S4, a ret instruction is stored at address 0x650401123 pointed to by eip. Therefore, the processor 20 executes the ret instruction according to ei, sets 0x650401122 stored in the location pointed to by esp to eip, and increases esp by 1 double word (4 bytes). Referring to FIG. 4, it can be seen that 0x54 (push esp instruction) is stored at address 0x650401122. Thereby, it changes to state S5.

  In state S5, the processor 20 executes a push esp instruction according to eip. When executing the push esp instruction, the processor 20 decreases esp by 1 double word (4 bytes), and stores the original esp value (esp + 4 in the example of FIG. 7) at the location pointed to by esp. Further, the processor 20 advances the eip one instruction ahead. Thereby, it changes to state S6.

  In state S6, the processor 20 executes a ret instruction according to eip. Then, the processor 20 sets the value (esp + 4) stored in the location pointed to by esp to eip, and increases esp by 1 double word (4 bytes). Thereby, the state transits to the state S7 shown in FIG.

  In the state S7, both esp and eip point to the head of the block B on the stack area shown in FIG. The processor 20 sequentially reads and executes the program code of the block B from the stack area in accordance with eip. As a result, the attack code body is copied to the area of static variable 1 on the data area. Thereby, it changes to state S8.

  In state S8, eip points to the last instruction in the program code of block B. The processor 20 executes a jmp instruction for setting the address of the static variable 1 to “ip” according to “eip”. Thereby, it changes to state S9.

  In state S9, eip points to the beginning of the area of static variable 1 on the data area. As described above, the attack code body is stored in the area of the static variable 1. Therefore, the processor 20 sequentially reads and executes the program code of the attack code body from the area of the static variable 1 in accordance with the eip. As a result, the processor 20 activates the calculator application by the WinExec function. As described above, the calculator application is activated here, but any processing can be executed by changing the program code of the attack code body.

  Here, when the WinExec function is called in the state S9, an execution attribute is given to the area of the static variable 1, which is the area pointed to by the return address, and a memory area for normal program code and Looks similar. Therefore, in a general method of detecting unauthorized access by determining whether the destination indicated by the return address is a memory area for storing program code, unauthorized access as shown in FIGS. It cannot be detected. In addition, if a general method of detecting unauthorized access by determining whether or not the destination attribute indicated by the return address is writable, the unauthorized access can be detected. There is a possibility of false detection.

  In the state S9, when the WinExec function is called, there is a low possibility that the destination indicated by the return address is the head of the function. For this reason, it is impossible to detect the unauthorized access by a general method of detecting unauthorized access by determining whether the destination indicated by the return address is the start address of the function. Further, since some normal programs call a function without using a call instruction, an unauthorized access is detected by determining whether the instruction immediately before the return address is a call instruction. There is a possibility of false detection in the general method.

  On the other hand, by using the detection method in the present embodiment, it is possible to detect unauthorized access without performing the erroneous detection as described above. The detection procedure in this embodiment will be described below.

  FIG. 9 is a flowchart showing an example of unauthorized access detection processing in the present embodiment. The process illustrated in FIG. 9 is started when the call detection unit 40 detects a call to a predetermined API function. When the API function call is detected by the call detection unit 40, the return address acquisition unit 42 sequentially acquires return addresses with reference to the stack area in the backtrace loop process shown in FIG. 9 (S901). Then, the processing in the backtrace loop is executed for each return address acquired sequentially.

  The attribute change detection unit 44 determines whether the API function detected by the call detection unit 40 is a memory attribute change function such as VirtualProtect (S902). If it is a memory attribute change function (S902: YES), the attribute change detection unit 44 further determines whether or not the changed attribute includes an execution attribute (S903). When the changed attribute includes an execution attribute (S903: YES), the attribute change detection unit 44 further sets the instruction immediately before the return destination indicated by the return address acquired by the return address acquisition unit 42 to call. It is determined whether it is an instruction (S904). If it is a call instruction (S904: YES), the attribute change detection unit 44 stores the address range of the area subject to attribute change in the address range storage unit 46 (S905). That is, the attribute change detection unit 44 stores the address range of the area whose attribute is to be changed as the API function call detected by the call detection unit 40 is likely to be caused by an attack code. Store in the unit 46.

  If the API function detected by the call detection unit 40 is not a memory attribute change function (S902: NO), the unauthorized access detection unit 48 stores the return address acquired by the return address acquisition unit 42 in the address range storage unit 46. It is determined whether it is included within the address range that has been set (S906). If the changed attribute does not include an execution attribute (S903: NO), the instruction immediately preceding the return destination indicated by the return address is a call instruction (S904: NO), or the address range is changed. Also when it preserve | saves (S905), it changes to the said determination process (S906).

  If the return address is included in the address range (S906: YES), the unauthorized access detection unit 48 determines that unauthorized access using the attack code is being performed (S907). In this case, for example, the unauthorized access detection unit 48 outputs information indicating the unauthorized access determination result (S908), and forcibly terminates the program being executed.

  On the other hand, if the return address is not included in the address range (S906: NO), the unauthorized access detection unit 48 executes unauthorized access detection processing by another general method as necessary (S909).

  Then, after the above-described processing is executed for a plurality of return addresses sequentially acquired by the return address acquisition unit 42, the call detection unit 40 executes the main body of the detected API function (S910).

  The case where the unauthorized access by the attack code shown in FIG. 5 is detected by the process shown in FIG. 9 will be described. First, in the state S2 shown in FIG. 6, when the call detection unit 40 detects a call to the VirtualProtect function, the process shown in FIG. 9 is started. Then, the return address acquisition unit 42 refers to the stack area and acquires the return address 0x650401123 (S901). The VirtualProtect function executed in the state S2 in FIG. 6 is a memory attribute change function (S902: YES), and assigns an execution attribute to the area of the static variable 1 in the data area shown in FIG. 4 (S903). : YES) Also, as shown in FIG. 4, the previous instruction pointed to by the acquired return address 0x650401123 is not a call instruction (S904: NO). Therefore, the attribute change detection unit 44 stores the address range 0x654480000 to 0x65480FFF of the area to which the execution attribute is given by the VirtualProtect function in the address range storage unit 46 (S905).

  Since the return address 0x65401123 is not included in the stored address range 0x6548000-0x65480FFF (S906: NO), the unauthorized access detection unit 48 executes unauthorized access detection processing by another general method (S909). . Then, the return address acquisition unit 42 attempts to acquire the next return address, but the base address stored in the stack is overwritten with another value due to buffer overflow, and thus is determined to be an illegal address. Therefore, the loop of the back trace process ends here, and the call detection unit 40 calls the main body of the API function, that is, the VirtualProtect function, and executes the attribute change process (S910). As a result, the execution attribute is given to the area of the static variable 1 in the data area.

  Thereafter, the API function is not called until the transition to the state S9 shown in FIG. 8, so the processing shown in FIG. 9 is not executed. Then, in the state S9 shown in FIG. 8, when the call detection unit 40 detects a call to the WinExec function, the process shown in FIG. 9 is started. When the WinExec function is called, the address of the instruction next to the call instruction that calls the WinExec function is stored as a return address in the stack area. The return address acquisition unit 42 refers to the stack area and acquires this return address (S901). Since the WinExec function is not a memory attribute change function (S902: NO), the unauthorized access detection unit 48 determines whether the return address is included in the stored address range 0x655480000 to 0x65480FFF (S906).

  Here, since the call instruction for calling the WinExec function is in the area of the static variable 1 in which the attribute change is performed, the return address is also in the area. That is, the return address is included in the stored address range 0x654480000 to 0x65480FFF (S906: YES). Therefore, the unauthorized access detection unit 48 determines that unauthorized access using an attack code has been performed (S907). Then, the unauthorized access detection unit 48 outputs the unauthorized access determination result (S908) and forcibly terminates the process. Thus, the main body of the WinExec function is not executed, and unauthorized access can be prevented.

  According to the present embodiment, the function detected by the call detection unit 40 is a function (for example, VirtualProtect) that assigns an executable attribute to an area in a specified address range on the memory, and the destination address indicated by the return address is 1 When the previous instruction is not a function call instruction, the address range is stored in the address range storage unit 46. When the return address is within the address range stored in the address range storage unit 46, it is determined that unauthorized access is being performed.

  Therefore, even if the destination indicated by the return address looks similar to the memory area for storing the program code, unauthorized access can be detected. Furthermore, even if the destination attribute pointed to by the return address is writable, if the previous instruction pointed to by the return address of the function to which the execution attribute is assigned to the area is a function call instruction, illegal access is assumed. There is no false detection. For this reason, it is possible to prevent erroneous detection of processing by a normal program that develops another program code in the data area on the memory as unauthorized access. Thus, according to the present embodiment, it is possible to improve the detection accuracy of unauthorized access.

  Further, according to the present embodiment, unauthorized access can be detected even when the destination indicated by the return address is not the beginning of the function. Furthermore, in the present embodiment, it is not simply determined that an unauthorized access has been performed when the instruction immediately preceding the return address is not a call instruction. For this reason, it is possible to prevent erroneous detection of processing by a normal program that calls a function without using a call instruction as unauthorized access. Therefore, according to the present embodiment, it is possible to improve the detection accuracy of unauthorized access.

  Further, according to the present embodiment, the return address acquisition unit 42 can sequentially acquire a plurality of return addresses stored in the stack area by backtrace. Then, as shown in FIG. 9, the process by the attribute change detection unit 44 and the process by the unauthorized access detection unit 48 are executed for each return address acquired sequentially. Accordingly, even when a plurality of functions are called hierarchically, it is possible to detect unauthorized access in the same manner.

  Note that this embodiment is intended to facilitate understanding of the present invention and is not intended to limit the present invention. The present invention can be changed / improved without departing from the spirit thereof, and the present invention includes equivalents thereof.

DESCRIPTION OF SYMBOLS 10 Information apparatus 20 Processor 22 Memory 24 Storage device 26 Input interface 28 Data interface 30 Communication interface 32 Display device 40 Call detection part 42 Return address acquisition part 44 Attribute change detection part 46 Address range storage part 48 Unauthorized access detection part

Claims (4)

Computer
A call detection unit for detecting a call to a predetermined function;
A return address acquisition unit for acquiring a return address stored in the stack area when the function is detected;
When the detected function is a function that assigns an executable attribute to an area in a specified address range on the memory, and the previous instruction pointed to by the return address is not a function call instruction, An attribute change detection unit for storing the address range in the address range storage unit;
An unauthorized access detection unit that determines that unauthorized access is performed when the return address is within the address range stored in the address range storage unit;
Program to make it function. The program according to claim 1,
The return address acquisition unit sequentially acquires a plurality of return addresses stored in the stack area when the function is detected,
The attribute change detection unit is a function in which, for each of the sequentially acquired return addresses, the detected function is a function that assigns an executable attribute to an area in a specified address range on the memory. If the previous instruction to be pointed to is not a function call instruction, the address range is stored in the address range storage unit,
The unauthorized access detection unit determines that unauthorized access has been performed for each of the sequentially acquired return addresses when the return address is within the address range stored in the address range storage unit. To
program. A call detection unit for detecting a call to a predetermined function;
A return address acquisition unit for acquiring a return address stored in the stack area when the function is detected;
When the detected function is a function that assigns an executable attribute to an area in a specified address range on the memory, and the previous instruction pointed to by the return address is not a function call instruction, An attribute change detection unit for storing the address range in the address range storage unit;
An unauthorized access detection unit that determines that unauthorized access is performed when the return address is within the address range stored in the address range storage unit;
Information equipment equipped with. Computer
Detect calls to a given function,
When the function is detected, the return address stored in the stack area is acquired,
When the detected function is a function that assigns an executable attribute to an area in a specified address range on the memory, and the previous instruction pointed to by the return address is not a function call instruction, Store the address range in the address range storage unit,
When the return address is within the address range stored in the address range storage unit, it is determined that unauthorized access has been performed.
Unauthorized access detection method.

Images