CN111552959B

CN111552959B - Program feature sequence generation method and device

Info

Publication number: CN111552959B
Application number: CN202010558726.2A
Authority: CN
Inventors: 杨祎巍; 匡晓云; 洪超; 黄开天; 陈霖
Original assignee: China South Power Grid International Co ltd; China Southern Power Grid Co Ltd
Current assignee: China South Power Grid International Co ltd; China Southern Power Grid Co Ltd
Priority date: 2020-06-18
Filing date: 2020-06-18
Publication date: 2023-08-29
Anticipated expiration: 2040-06-18
Also published as: CN111552959A

Abstract

The application discloses a program feature sequence generation method and device, which are used for judging whether a running program is tampered or not. The application comprises the following steps: when a program is scanned, scanning an unscanned program instruction with the minimum instruction sequence number in a plurality of program instructions, and judging the instruction type of the currently scanned program instruction; when the instruction type is a jump instruction, generating a jump relation number pair of the currently scanned program instruction, and storing the jump relation number pair; judging whether the instruction sequence number of the currently running program instruction is equal to a preset threshold value or not; if not, jumping to the step of scanning the non-scanned program instruction with the minimum instruction sequence number in the plurality of program instructions; if yes, the feature sequence is generated by using the saved jump relation number pairs, and the scanning program is stopped.

Description

Program feature sequence generation method and device

Technical Field

The present application relates to the field of program feature analysis technologies, and in particular, to a method and an apparatus for generating a program feature sequence.

Background

Before the program is run, a trusted check needs to be made to check whether the program has been tampered with to ensure that the running program is the intended program. During the running process of the program, the program also needs to be subjected to credibility check, so that the running behavior of the program is ensured to be consistent with the expected behavior.

In the prior art, a program signature method is mostly adopted to check whether a program is tampered, but the method is only suitable for checking before the program runs. In the running process of the program, since the instruction part, the data part and the stack part are all different and the data part is changed at any time, it is difficult to check whether the program is tampered in the running process of the program.

Disclosure of Invention

The application provides a program feature sequence generation method and device, which solve the problem that whether a program is tampered or not is difficult to check in the running process of the program in the prior art.

The application provides a method for generating a program characteristic sequence, wherein the program comprises a plurality of program instructions; the program instructions respectively have corresponding instruction serial numbers; the method comprises the following steps:

when the program is scanned, scanning an unscanned program instruction with the minimum instruction sequence number in the plurality of program instructions, and judging the instruction type of the currently scanned program instruction;

when the instruction type is a jump type instruction, generating a jump relation number pair of the currently scanned program instruction, and storing the jump relation number pair;

judging whether the instruction sequence number of the currently running program instruction is equal to a preset threshold value;

if not, jumping to the step of scanning the non-scanned program instruction with the minimum instruction sequence number in the plurality of program instructions;

if yes, the stored jump relation number pairs are adopted to generate a characteristic sequence, and the scanning of the program is stopped.

Optionally, the plurality of program instructions further have corresponding instruction addresses; and when the instruction type is a jump instruction, generating a jump relation number pair of the currently scanned program instruction, and storing the jump relation number pair, wherein the jump relation number pair comprises the following steps:

when the instruction type is a jump instruction, extracting a jump address from the currently scanned program instruction;

calculating a difference between the jump address and an instruction address of the currently scanned program instruction;

acquiring a current counter value of a preset counter;

and generating a jump relation number pair of the program instruction of the current scanning by adopting the current counter value and the difference value, and storing the jump relation number pair.

Optionally, the method further comprises:

if the instruction type is a non-jump instruction, jumping to a step of scanning an unscanned program instruction with the minimum instruction sequence number in the plurality of program instructions.

Optionally, the jump class instruction includes a conditional jump instruction; the step of extracting the jump address from the currently scanned program instruction when the instruction type is a jump instruction includes:

and when the instruction type is a conditional jump instruction, extracting a jump address from the currently scanned program instruction.

Optionally, the jump class instruction further includes an unconditional jump instruction; the method further comprises the steps of:

and when the instruction type is an unconditional jump instruction, jumping to a step of scanning an unscanned program instruction with the minimum instruction sequence number in the plurality of program instructions.

The application provides a program characteristic sequence generating device, wherein the program comprises a plurality of program instructions; the program instructions respectively have corresponding instruction serial numbers; comprising the following steps:

the instruction type judging module is used for scanning an unscanned program instruction with the minimum instruction sequence number in the plurality of program instructions when the program is scanned, and judging the instruction type of the currently scanned program instruction;

the jump relation number pair generating module is used for generating the jump relation number pair of the currently scanned program instruction when the instruction type is a jump instruction, and storing the jump relation number pair;

the judging module is used for judging whether the instruction sequence number of the currently running program instruction is equal to a preset threshold value;

the first jump module is used for jumping to the step of scanning the non-scanned program instruction with the minimum instruction sequence number in the plurality of program instructions if not;

and the characteristic sequence generating module is used for generating a characteristic sequence by adopting the saved jump relation number pairs if yes, and stopping scanning the program.

Optionally, the plurality of program instructions further have corresponding instruction addresses; the jump relation number pair generating module comprises:

the jump address extraction sub-module is used for extracting a corresponding jump address from the currently scanned program instruction when the instruction type is a jump instruction;

a difference value calculation sub-module, configured to calculate a difference value between the jump address and an instruction address of the currently scanned program instruction;

the current counter value acquisition module is used for acquiring the current counter value of the preset counter;

and the jump relation number pair generation sub-module is used for generating the jump relation number pair of the currently scanned program instruction by adopting the current counter value and the difference value, and storing the jump relation number pair.

Optionally, the apparatus further comprises:

and the second jump module is used for jumping to the step of scanning the non-scanned program instruction with the minimum instruction sequence number in the plurality of program instructions if the instruction type is a non-jump instruction.

Optionally, the jump class instruction includes a conditional jump instruction; the jump address extraction sub-module comprises:

and the jump address extraction unit is used for extracting the jump address from the currently scanned program instruction when the instruction type is a conditional jump instruction.

Optionally, the jump class instruction further includes an unconditional jump instruction; the jump address extraction submodule further comprises:

and the jump unit is used for jumping to the step of scanning the non-scanned program instruction with the minimum instruction sequence number in the plurality of program instructions when the instruction type is the unconditional jump instruction.

From the above technical scheme, the application has the following advantages: when the program is scanned, the program instructions are scanned in sequence, and when the program instructions are jump instructions, the difference value between the instruction addresses of the program instructions and the jump addresses is calculated; and generating a jump relation number pair by adopting the difference value and a counter value corresponding to the program instruction, so as to generate a characteristic sequence according to the jump relation number pair. And thus whether the running program is tampered with by judging whether the feature sequence is an expected feature sequence.

Drawings

In order to more clearly illustrate the embodiments of the application or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are only some embodiments of the application, and that other drawings can be obtained from these drawings without inventive faculty for a person skilled in the art.

FIG. 1 is a flowchart illustrating steps of an embodiment of a method for generating a program feature sequence according to the present application;

fig. 2 is a block diagram of an embodiment of a program feature sequence generating apparatus according to the present application.

Detailed Description

The embodiment of the application provides a method and a device for generating a program feature sequence, which are used for solving the technical problem that whether a program is tampered or not is difficult to check in the running process of the program in the prior art.

In order to make the objects, features and advantages of the present application more comprehensible, the technical solutions in the embodiments of the present application are described in detail below with reference to the accompanying drawings, and it is apparent that the embodiments described below are only some embodiments of the present application, but not all embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

Referring to fig. 1, fig. 1 is a flowchart illustrating steps of a method for generating a program feature sequence according to an embodiment of the present application.

The application provides a method for generating a program characteristic sequence, wherein the program comprises a plurality of program instructions; the program instructions respectively have corresponding instruction serial numbers and instruction addresses; the method comprises the following steps:

step 101, when the program is scanned, scanning an unscanned program instruction with the smallest instruction sequence number in the plurality of program instructions, and judging the instruction type of the currently scanned program instruction;

in practical applications, for the purpose of ensuring information security, it is necessary to detect whether a program is tampered with when the program is run. In the running process of the program, the instruction part, the data part and the stack part are all different, and the data part is changed at any time, so that whether the program is tampered is difficult to detect. According to the program characteristic sequence generation method provided by the application, the program jump condition and the like are analyzed, a sequence describing the program instruction address change is established and is used as the characteristic fingerprint for distinguishing the program, and when the characteristic fingerprint is inconsistent with the preset program characteristic fingerprint, the program jump condition is characterized to change, and the program is tampered.

In the embodiment of the application, the program instruction has a corresponding instruction sequence number and instruction address according to the scanning sequence. The instruction serial number is used for representing the scanned program instruction of which number the program instruction is; the instruction address characterizes the memory address of the program instruction.

The program instructions may include a skip instruction and a non-skip instruction, where the skip instruction records an instruction address of the program instruction that needs to be skipped after the program instruction is scanned, and is used for performing corresponding skip after the program instruction is scanned.

Based on the above teaching, when the program starts to run, it needs to determine whether the program instruction is a jump instruction one by one, so as to record the jump condition of the program.

Step 102, generating a jump relation number pair of the currently scanned program instruction, and storing the jump relation number pair.

In the embodiment of the application, when the program instruction currently being scanned is a jump instruction in the process of traversing the program instruction from small to large according to the instruction sequence number of the program instruction, the jump relation of the jump instruction currently being scanned can be extracted, and a jump relation digital pair is generated and used for representing the jump relation of the jump instruction currently being scanned.

In an embodiment of the present application, step 102 may comprise the sub-steps of:

s11, when the instruction type is a jump instruction, extracting a corresponding jump address from the currently scanned program instruction;

in the embodiment of the application, when the program instruction currently being scanned is a jump instruction in the process of traversing the program instruction from small to large according to the instruction sequence number of the program instruction, the jump address of the program instruction currently being scanned is extracted, but the jump operation is not scanned, and the number of scanned instructions of the program instruction currently being scanned is recorded. For identifying whether the scanning order of the program instructions has been tampered with.

In the embodiment of the present application, when the instruction type is a non-jump instruction, the method jumps to a step of scanning an unscanned program instruction with the smallest instruction sequence number in the plurality of program instructions.

Specifically, when the instruction type is a non-jump instruction, the program instruction for current scanning does not include jump information, so that the next program instruction is scanned sequentially without recording the jump condition.

In an embodiment of the present application, the jump class program instructions include conditional jump instructions and unconditional jump instructions. When the currently scanned program sequence is a conditional jump instruction, the step of extracting the jump address from the currently scanned program instruction comprises: when the instruction type is a conditional jump instruction, the jump address is extracted from the currently scanned program instruction. When the currently scanned program sequence is an unconditional jump instruction, the next instruction is scanned sequentially.

S12, calculating a difference value between the jump address and an instruction address of the currently scanned program instruction;

after the jump address of the program instruction being scanned and the instruction address thereof are acquired, the difference between the jump address of the program instruction and the instruction address can be calculated for determining whether the jump content of the program instruction is tampered.

In one example, when the instruction address of the program instruction being scanned is N1 and the jump address is N5, the difference between the jump address and the instruction address is (N5-N1).

S13, acquiring a current counter value of a preset counter;

in an embodiment of the present application, the number of scanned program instructions may be counted by a counter.

In one example, when the program starts running, the counter value N of the counter is set to 0.

The program instructions are parsed starting from the start address of the program. The counter value of the counter is increased by 1, and the analysis of the 1 st program instruction is started. After the analysis of the first instruction is finished, the counter value of the counter is increased by 1 again, and the analysis of the 2 nd program instruction is started. The counter value is used to characterize what number of scanned program instructions the currently scanning program instruction is.

S14, generating a jump relation number pair of the currently scanned program instruction by adopting the current counter value and the difference value, and storing the jump relation number pair;

after the current counter value of the preset counter and the difference between the instruction address and the jump address of the currently scanned program instruction are obtained, a jump relation number pair for representing the scanning sequence and the jump condition of the currently scanned program instruction can be generated.

During program execution, each of the hopping relationship number pairs generated during the process may be saved to construct a signature sequence that characterizes the program hopping.

Step 103, judging whether the instruction sequence number of the currently running program instruction is equal to a preset threshold value;

in practical applications, the number of instructions of the program is fixed, so that whether the program is scanned can be determined by determining whether to traverse to the last program instruction. Specifically, the determination may be made by determining whether the instruction sequence number of the program instruction currently scanned is the instruction signal of the last program set.

Step 104, if not, jumping to a step of scanning the non-scanned program instruction with the smallest instruction sequence number in the plurality of program instructions;

when all the program instructions of the program are not scanned completely, the program instructions to be scanned need to be determined according to the scanning sequence of the program instructions. Therefore, after one program instruction is scanned, the program instruction to be scanned is the program instruction with the minimum sequence number in the program instruction which is not scanned.

And step 105, if yes, generating a characteristic sequence by using the saved jump relation number pairs, and stopping scanning the program.

If the currently scanned program instruction is the last program instruction of the program, the instruction sequence number of the currently scanned program instruction is represented as a threshold value of a preset instruction sequence number, and all the program instructions of the program are characterized to finish scanning. At this time, the program is run, all jump relation numbers generated in the process of running the program are saved in a sequence form, and a characteristic sequence representing the jump condition of the program is generated. By this feature sequence, it can be judged whether the program is tampered with.

When the program runs, the method sequentially scans the program instructions, and when the program instructions are jump instructions, the difference value between the instruction addresses of the program instructions and the jump addresses is calculated; and generating a jump relation number pair by adopting the difference value and a counter value corresponding to the program instruction, so as to generate a characteristic sequence according to the jump relation number pair. And judging whether the running program is tampered according to the characteristic sequence.

In order to facilitate understanding of embodiments of the present application by those skilled in the art, a description will be given below by way of specific examples.

As shown in table 1, assuming that the program has 1 to N10 program instructions, the counter value N of the preset counter is set to 0, i.e., let n=0, before starting the running of the program.

When the trigger program is run, it is,

the first step: the counter value N=1, scan the 1 st program instruction, judge the 1 st program instruction is the non-jump instruction, analyze the second program instruction sequentially;

and a second step of: the counter value N=2, scan the 2 nd program instruction, judge the 2 nd program instruction is jump type instruction, jump address is N1, record and jump the relation number pair (2, N1-2);

……

step N2: the counter value N=N2, scan the N2 instruction, judge the N2 program instruction is jump instruction, jump address is N6, record the jump relation digital pair (N2, N6-N2), the characteristic sequence is [ (2, N1-2), (N2, N6-N2) ];

……

step N5: the counter value N=N5, scan the Nth instruction, judge the Nth instruction is jump type instruction, jump address is N1, record jump relation digital pair (N5, N1-N5), the characteristic sequence is [ (2, N1-2), (N2, N6-N2), (N5, N1-N5) ];

……

step N8: the counter value N=N8, scan the N8 th instruction, judge the N8 th instruction is jump instruction, jump address is N10, record jump relation digital pair (N8, N10-N8), the characteristic sequence is [ (2, N1-2), (N2, N6-N2), (N5, N1-N5), (N8, N10-N8) ];

……

step N10: the counter value N=N10, the N10 program instruction is scanned, the N10 program instruction is judged to be a non-jump instruction, and the program operation is ended after the scanning is finished because N10 is the last program instruction.

Instruction address	Instructions for	Jump address
			1	Non-jump class instruction
2	Jump class instruction	N1
			...	...
N1	Non-jump class instruction
			N2	Jump class instruction	N6
N3	Non-jump class instruction
			...	...
N4	Non-jump class instruction
			N5	Jump class instruction	N1
N6	Non-jump class instruction
			...	...
N7	Non-jump class instruction
			N8	Jump class instruction	N10
N9	Non-jump class instruction
			...	...
N10	Non-jump class instruction

TABLE 1

Referring to fig. 2, fig. 2 is a flowchart illustrating steps of a generating device for a program feature sequence according to an embodiment of the application.

The application provides a program characteristic sequence generating device, which comprises:

an instruction type judging module 201, configured to scan an unscanned program instruction with a smallest instruction sequence number among the plurality of program instructions and judge an instruction type of a currently scanned program instruction when the program is scanned;

a jump relation number pair generating module 202, configured to generate a jump relation number pair of the currently scanned program instruction when the instruction type is a jump instruction, and store the jump relation number pair;

a judging module 203, configured to judge whether an instruction sequence number of the currently running program instruction is equal to a preset threshold;

a first skip module 204, configured to skip to scan the non-scanned program instruction with the smallest instruction sequence number in the plurality of program instructions if not;

and the feature sequence generating module 205 is configured to generate a feature sequence by using the saved skip relation number pair if yes, and stop scanning the program.

In the embodiment of the application, the program instructions also have corresponding instruction addresses; the jump relation number pair generating module 202 includes:

In an embodiment of the present application, the apparatus further includes:

In the embodiment of the application, the jump instruction comprises a conditional jump instruction; the jump address extraction sub-module comprises:

In the embodiment of the application, the jump instruction further comprises an unconditional jump instruction; the jump address extraction submodule further comprises:

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical functional division, and there may be additional divisions in actual implementation, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted, or not scanned. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The above embodiments are only for illustrating the technical solution of the present application, and not for limiting the same; although the application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A program feature sequence generation method, wherein the program includes a plurality of program instructions; the program instructions respectively have corresponding instruction serial numbers; the method comprises the following steps:

judging whether the instruction sequence number of the currently scanned program instruction is equal to a preset threshold value;

if yes, generating a characteristic sequence by adopting the saved jump relation number pairs, and stopping scanning the program;

wherein the plurality of program instructions further have corresponding instruction addresses; and when the instruction type is a jump instruction, generating a jump relation number pair of the currently scanned program instruction, and storing the jump relation number pair, wherein the jump relation number pair comprises the following steps:

acquiring a current counter value of a preset counter;

2. The method of claim 1, wherein the method further comprises:

if the instruction type is a non-jump instruction, jumping to an unscanned program instruction with the minimum instruction sequence number in the plurality of program instructions.

3. The method of claim 1, wherein the jump class instruction comprises a conditional jump instruction; the step of extracting the jump address from the currently scanned program instruction when the instruction type is a jump instruction includes:

4. The method of claim 3, wherein the jump class instruction further comprises an unconditional jump instruction; the method further comprises the steps of:

5. A program feature sequence generating apparatus, wherein the program comprises a plurality of program instructions; the program instructions respectively have corresponding instruction serial numbers; comprising the following steps:

the judging module is used for judging whether the instruction sequence number of the currently scanned program instruction is equal to a preset threshold value;

the feature sequence generating module is used for generating a feature sequence by adopting the saved jump relation number pairs if yes, and stopping scanning the program;

wherein the plurality of program instructions further have corresponding instruction addresses; the jump relation number pair generating module comprises:

6. The apparatus of claim 5, wherein said apparatus further comprises:

7. The apparatus of claim 5, wherein the jump class instruction comprises a conditional jump instruction; the jump address extraction sub-module comprises:

8. The apparatus of claim 7, wherein the jump class instruction further comprises an unconditional jump instruction; the jump address extraction submodule further comprises: