KR20160107712A - Apparatus and method for anti-debugging - Google Patents

Abstract

The present invention relates to an apparatus and method for anti-debugging. The apparatus for anti-debugging according to the present invention comprises: a main process module including an anti-debugging process generating unit for generating an anti-debugging process module, and an anti-debugging process attaching unit for attaching a process module thereof to the anti-debugging process module generated by the anti-debugging process generating unit; and the anti-debugging process module including a main process attaching unit for attaching a process module thereof to the main process module, and an anti-debugging process information providing unit for providing the main process module with information indicating that the main process attaching unit has normally attached a process module thereof to the main process module. The apparatus for anti-debugging according to the present invention can fundamentally prevent a debugging caused by hacking.

Description

[0001] Apparatus and method for anti-debugging [0002]

The present invention relates to an anti-debugging apparatus and method, and more particularly, to an anti-debugging apparatus and method for creating and attaching an anti-debugging process when a program of a main process is executed.

Hacking begins by analyzing the program. Analyzing the program and understanding the logic can actually make a crack. There are two ways to analyze the program. One is the static analysis method and the other is the dynamic analysis method.

The static analysis method analyzes only the file itself without executing the program file, and analyzes the binary program file using a disassembly tool or a decompilation tool. These tools can translate binary program files into assemblies or other high-level language forms and analyze them to understand the logic of the program.

Unlike the static analysis method, the dynamic analysis method executes the program, and analyzes the program by looking at the code, memory state, register state, etc. of the program in the debugging tool. Debugger analysis method is easy to understand the logic of the program because it analyzes and analyzes the flow of executing code. It can judge the part where the actual code is executed and the part that does not. Also, It can also be modified.

The analysis method by debugging is widely used because it is broader than the static analysis method, such as the logical flow of the program or the data can be changed in real time during execution.

Anti-Debugging is a technique that hinders debugging and hinders program analysis. If you are debugging, you can stop the analysis by using various methods such as terminating the debugger program or generating an error. The conventional anti-debugging technique mainly checks whether the debugging program is being executed and prevents the debugging target program from being executed. However, according to this method, there is a problem that it is difficult to cope with an unexpected situation such as the appearance of a new debugging program.

Also, anti-debugging technology limited to a specific operating system or a processor is used. For example, in the Windows operating system, a method of judging whether debugging is performed by using IsDebuggerPresent (), CheckRemoteDebuggerPresent (), and NtGlobeFlag, which are application program interfaces (APIs) provided by Windows, is used. However, this method does not provide the same or similar API for Linux, Unix, OS X, etc., and thus can not be used.

Accordingly, the present inventors filed a Korean patent application No. 2013-0138644 for a technology for monitoring the state of a process and providing an anti-debugging method. However, the technology of Korean Patent Application No. 2013-0138644 does not provide anti-debugging completely.

In order to solve the above-described problems, it is an object of the present invention to provide an anti-debugging apparatus and method capable of preventing debugging by hacking.

In order to achieve the above object, an anti-debugging apparatus according to an embodiment of the present invention includes an anti-debugging process generating unit for generating an anti-debugging process module, an anti-debugging process module And an anti-debugging process attaching unit for attaching a process module of the process module to the process module, and a main process attaching unit attaching a process module of the process module to the main process module, And an anti-debugging process information providing unit for providing the main process module with information on whether the main process module is normally attached to the main process module.

The main process module may further include a malfunctioning execution unit for executing a malfunction until the main processing module receives information from the anti-debugging process module to normally attach to the main process module.

The main process module may further include a main process control unit for controlling the malfunctioning execution unit to execute a malfunction when the main program is executed and controlling the anti-debugging process generating unit to generate the anti-debugging process module.

The main process control unit may generate a decryption key modulated to execute a malfunction when the main program is executed and stop the malfunction if the modified original key for the decryption key modulated from the anti-debugging process module is provided.

The anti-debugging process module may provide the attachment result of the main process module to the main process module when the main process module is attached to the process module of the anti-debugging process module.

The main processor module may provide an attachment result of the anti-debugging process module to the anti-debugging process module when the process module is attached to the process module.

The anti-debugging process module may provide an antivirus program when it detects that an operation program of the main processor module is infected with a virus.

An anti-debugging method in an anti-debugging apparatus having a main process module and an anti-debugging process module according to another embodiment of the present invention includes: generating an anti-debugging process module in the main process module when the program is executed; Attaching a process module of the main process module itself to the anti-debugging process module generated in the step of creating the anti-debugging process module in the main process module; and in the anti-debugging process module, Attaching a process module of the anti-debugging process module itself to the main process module, and providing, in the anti-debugging process module, information about that the process module of the anti-debugging process module is normally attached to the main process module, Thereby, it is possible to achieve the above object.

With the above-described configuration, the present invention can not attach the hacking debugger program to the main process module, thereby protecting the operation of the main process module from hacking.

In addition, the present invention can protect the operation of the main process module from hacking without the main process module being attached to the anti-debugging process module.

In addition, the present invention can provide an antivirus program for an antivirus program even when the main program is infected with a virus.

1 is a block diagram of an anti-debugging apparatus according to an embodiment of the present invention.
Fig. 2 is a view showing the concept of process attachment described in Fig. 1. Fig.
FIG. 3 is a flowchart showing an anti-debugging method according to FIG. 1. FIG.
4 is a block diagram of an anti-debugging apparatus according to another embodiment of the present invention.
5 is a diagram for explaining a malfunction of the main process described in Fig.
6 is a flowchart showing an anti-debugging method according to FIG.
FIG. 7 is a process diagram showing the flow chart of FIG. 6. FIG.

Hereinafter, preferred embodiments of the anti-debugging apparatus and method according to the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, it is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the technical scope of the present invention. Will be.

1 is a block diagram of an anti-debugging apparatus according to an embodiment of the present invention.

As shown in FIG. 1, the anti-debugging apparatus includes a main process module 100 and an anti-debugging process module 150.

The main process module 100 includes an anti-debugging process generation unit 110 for generating an anti-debugging process module 150, and an anti-debugging process module 150 for generating an anti- A main process information providing unit 120 for informing that the anti-debugging process module 150 is attached to its own process module by the operation of the main process attaching unit 160; A main process storage unit 125 for storing status information of the main process module 100 and / or status information related to the anti-debugging process module 150 received from the anti-debugging process module 150, And a main process control unit 130 for controlling the operation of the main process using state information stored in the process storage unit 125. [

The anti-debugging process module 150 includes a main process attaching unit 160 for attaching its own process module to the main process module 100 and a main process attaching unit 160 for attaching anti-debugging information, An anti-debugging process information providing unit 165 for informing that the process module of the device is attached to the main process module 100 by the process module 160 and the status information of the anti-debugging process module 150 and / An anti-debugging process storage unit 170 for storing status information and the like related to the received main process module 100 and an operation of the anti-debugging process using status information stored in the anti-debugging process storage unit 170 And an anti-debugging process control unit 175 for controlling the anti-debugging process.

Fig. 2 is a view showing the concept of process attachment described in Fig. 1. Fig.

As shown in FIG. 2, the main process module 100 generates and attaches an anti-debugging process module 150, and the anti-debugging process module 150 is also attached to the main process module 100. In this case, since the anti-debugging process module 150 is attached to the main process module 100, another debugger program can not be attached. Thus, a hacking debugger program can not be attached to the main process module 100, so that the operation of the main process module 100 can be protected from hacking.

FIG. 3 is a flowchart showing an anti-debugging method according to FIG. 1. FIG.

When the main program is executed (S302), the main process control unit 130 operates the anti-debugging process generating unit 110 to generate the anti-debugging process module 150 (S304). The main process control unit 130 may store status information indicating that the anti-debugging process module 150 is being generated in the main process storage unit 125. [

The main process control unit 130 then executes the anti-debugging process attaching unit 115 when status information on generation of the anti-debugging process module 150 is provided from the anti-debugging process information providing unit 165. [ The anti-debugging process attaching unit 115 attaches its own process module to the anti-debugging process module 150 generated by the anti-debugging process generating unit 110 (S306). The anti-debugging process information providing unit 165 provides status information indicating that the main process module 100 is attached to its process module by the operation of the anti-debugging process attaching unit 115 (S308). The main process control unit 130 stores the status information provided from the anti-debugging process attaching unit 115 in the main process storage unit 125. [

When the state information of the anti-debugging process storage unit 170 has a predetermined value, the anti-debugging process control unit 175 operates the main process attaching unit 160 to attach its process module to the main process module 100 S310). The main process information providing unit 120 provides status information indicating that the anti-debugging process module 150 is attached to its process module by the operation of the main process attaching unit 160 (S312). The anti-debugging process control unit 175 stores the status information provided from the main process information providing unit 120 in the anti-debugging process storage unit 170.

If the anti-debugging process module 150 determines that the anti-debugging process module 150 is properly attached to its process module, the main process controller 130 normally executes the main program (S314).

However, if another process module is preempted by the debugger prevention process module described with reference to FIGS. 1 to 3 and the main process module 100 is attached, debugging by another process module, for example, a hacking debugger program, Lt; / RTI >

4 is a block diagram of an anti-debugging apparatus according to another embodiment of the present invention.

As shown in FIG. 4, the anti-debugging apparatus includes a main process module 410 and an anti-debugging process module 450.

The main process module 410 includes a malfunction execution unit 410 for executing a malfunction when the main program is executed, an anti-debugging process generator 415 for generating the anti-debugging process module 450, an anti- An anti-debugging process attaching unit 420 attaching its own process module to the anti-debugging process module 450 generated by the main process attaching unit 460 and the anti-debugging process module 450 by the operation of the main process attaching unit 460, A normal operation executing unit 430 for normally executing the main program of the main process module 410, and a status information generating unit 425 for generating status information of the main process module 410, A main process for storing status information related to the anti-debugging process module 450 received from the anti-debugging process module 450, And a main process control unit 440 for controlling the operation of the main process using state information stored in the main process storage unit 435 and the like.

The anti-debugging process module 450 includes a main process attaching unit 460 attaching its own process module to the main process module 410 and a main process attaching unit 460 attaching anti-debugging information, An anti-debugging process information providing unit 465 informing that the own process module is attached to the main process module 410 by means of the main process module 410, (470) for providing a normal operation information to the main process module (410), and a virus vaccine providing unit (475) for providing a virus vaccine capable of decrypting the main program when the main process module The status information of the anti-debugging process module 450 and / or the status information of the main process module 410 received from the main process module 410 An anti-debugging process control unit 480 for controlling the operation of the anti-debugging process using status information stored in the anti-debugging process storage unit 480, 485).

5 is a diagram for explaining a malfunction of the main process described in Fig.

5, the main process module 410 generates and attaches the anti-debugging process module 450, while the anti-debugging process module 450 displays the state that is not yet attached to the main process module 410 do. In this case, since the anti-debugging process module 450 is not attached to the main process module 410, another debugger program can be attached. In this case, the malfunction execution unit 410 shown in FIG. 4 terminates the program if the main process module 410 is not attached to the anti-debugging process module 450 during an infinite loop, a false program, can do. Therefore, even if the main process module 410 is not attached to the anti-debugging process module 450, the operation of the main process module 410 from the hacking can be protected.

Fig. 6 is a flowchart showing the anti-debugging method according to Fig. 4, and Fig. 7 is a process diagram showing the flowchart of Fig.

When the main program is executed (S602), the main process control unit 440 first causes the malfunction execution unit 410 to execute the malfunction of the main program (S604). To this end, as shown in FIG. 7, the malfunction execution unit 410 can generate a modulated decryption key to execute a malfunction.

The main process control unit 440 then operates the anti-debugging process generator 415 to generate the anti-debugging process module 450 (S606). The main process control unit 440 may store status information indicating that the anti-debugging process module 450 is currently being generated in the main process storage unit 435. [

The main process control unit 440 then executes the anti-debugging process attaching unit 420 when status information on generation of the anti-debugging process module 450 is provided from the anti-debugging process information providing unit 465. [ The anti-debugging process attaching unit 420 attaches its own process module to the anti-debugging process module 450 generated by the anti-debugging process generating unit 415 (S608). The anti-debugging process information providing unit 465 provides status information indicating that the main process module 410 is attached to its process module by the operation of the anti-debugging process attaching unit 420 (S610). The main process control unit 440 stores the status information provided from the anti-debugging process attaching unit 420 in the main process storage unit 435.

If the state information of the anti-debugging process storage unit 480 has a predetermined value, the anti-debugging process control unit 485 operates the main process attaching unit 460 to attach its process module to the main process module 410 S612). The main process information providing unit 425 provides status information indicating that the anti-debugging process module 450 is attached to its process module by the operation of the main process attaching unit 460 (S614). The anti-debugging process control unit 485 stores the status information provided from the main process information providing unit 425 in the anti-debugging process storage unit 480.

If the anti-debugging process module 450 determines that the anti-debugging process module 450 is normally attached to its own process module, the main process controller 440 executes the main program normally (S616). For this, as shown in FIG. 7, the normal operation information providing unit 470 modifies the modulated decryption key with the original key, and provides the modified original key to the main process module 410. When the main process control unit 440 receives the original key from the normal operation information providing unit 470, the main process control unit 440 controls the malfunction execution unit 410 to stop the malfunctioning operation and executes the normal operation execution unit 430 to execute the normal operation .

If the main process module 410 does not normally operate the program due to the virus infection (S618), the antivirus providing unit 475 provides the antivirus that can decrypt the main program (S620).

The anti-debugging apparatus according to an embodiment of the present invention may be applied to a personal computer (PC), a notebook computer, a tablet, a personal digital assistant (PDA), a game console, a portable multimedia player (PMP) Player, a PlayStation Portable (PSP), a wireless communication terminal, a smart phone, a TV, a media player, and the like.

The anti-debugging apparatus according to the present invention may be a server terminal such as an application server and a service server. (I) a communication device such as a communication modem for performing communication with various devices or wired / wireless communication networks, (ii) a memory for storing data for executing a program, (iii) ) Microprocessor for executing and controlling programs and the like. According to at least one embodiment, the memory may be a computer such as a random access memory (RAM), a read only memory (ROM), a flash memory, an optical disk, a magnetic disk, or a solid state disk Readable recording / storage medium. According to at least one embodiment, a microprocessor can be programmed to selectively perform one or more of the operations and functions described in the specification. In accordance with at least one embodiment, the microprocessor may be implemented in hardware, such as an Application Specific Integrated Circuit (ASIC), in wholly or partially of a particular configuration.

The embodiments of the present invention described above are merely illustrative of the technical idea of the present invention, and the scope of protection of the present invention should be interpreted according to the claims. It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention as defined by the appended claims. It should be interpreted that it is included in the scope of right.

100: main process module
110: Anti-debugging process generating unit
115: anti-debugging process attaching portion
120: main process information providing unit
125: main process storage unit
130: main process control section
150: Anti-debugging process module
160: main process attaching portion
165: Anti-debugging process information providing service
170: Anti-debugging process storage unit
175: Anti-debugging process control unit

Claims (10)

A main process module including an anti-debugging process generating unit for generating an anti-debugging process module, and an anti-debugging process attaching unit attaching the process module to the anti-debugging process module generated by the anti-
A main process attaching unit for attaching a process module of the main process module to the main process module; and an anti-debugging unit for providing the main process module with information about the fact that the process module of the self process module is normally attached to the main process module by the main process attaching unit. And an anti-debugging process module including a process information providing unit. The method according to claim 1,
Wherein the main process module further comprises a malfunctioning execution unit for executing a malfunction until receiving information on the normal attachment to the main process module from the anti-debugging process module. 3. The method of claim 2,
Wherein the main process module further comprises a main process control unit for controlling the malfunction execution unit to execute a malfunction when the main program is executed and controlling the anti-debugging process generating unit to generate the anti-debugging process module Debugging device. The method of claim 3,
Wherein the main process control unit generates a decryption key modulated to execute a malfunction when the main program is executed and stops the malfunction if the modified original key for the decryption key modulated from the anti-debugging process module is provided Anti-debugging device. 5. The method according to any one of claims 1 to 4,
Wherein the anti-debugging process module provides the attachment result of the main process module to the main process module when the main process module is attached to the process module of the anti-debugging process module by the operation of the anti-debugging process attaching unit. 6. The method of claim 5,
Wherein the main processor module provides an attachment result of the anti-debugging process module to the anti-debugging process module when the anti-debugging process module is attached to its own process module by the operation of the main process attaching unit. The method according to claim 6,
Wherein the anti-debugging process module provides an antivirus program when it detects that an operation program of the main processor module is infected with a virus. 1. An anti-debugging method in an anti-debugging apparatus having a main process module and an anti-debugging process module,
Generating, in the main process module, an anti-debugging process module when the program is executed;
Attaching a process module of the main process module to the anti-debugging process module generated in the step of creating the anti-debugging process module in the main process module;
Attaching the process module of the anti-debugging process module to the main process module in the anti-debugging process module; and
And providing the main process module with information about whether its process module is normally attached to the main process module in the anti-debugging process module. 9. The method of claim 8,
Further comprising the step of executing a malfunction in the main process module until receiving information on the normal attachment from the anti-debugging process module to the main process module. 10. The method of claim 9,
Generating, in the main process module, a decryption key modulated to execute a malfunction when a program is executed; and
Further comprising the step of stopping the malfunction if the modified original key is provided to the decryption key modulated with the information that the main process module is normally attached to the main process module.

Images