CN118228249A - Static injection hook method and device based on LuaJIT byte code format analysis - Google Patents

Abstract

The invention provides a static injection hook method and a device based on LuaJIT byte code format analysis, which often require static or dynamic modification of a corresponding Lua source file to update a code operation effect when software development and network security attack and defense research are performed in a LuaJIT operation scene. The invention builds and merges new binary files on the standard LuaJIT virtual machine based on the binary format analysis of LuaJIT byte codes, and can be compatible with the operating systems including Windows, android, IOS, macOS and the like and CPU architectures including X86, ARM, RISCV and the like.

Description

A static injection hook method and device based on LuaJIT bytecode format parsing

Technical Field

The present invention belongs to the technical field of network security, and in particular relates to a static injection hook method and device based on LuaJIT bytecode format parsing.

Background technique

Lua is a lightweight and compact scripting language written in standard C language and open in source code form. It is designed to be embedded in applications, providing flexible extension and customization capabilities for applications. Lua has features such as automatic memory management, complete lexical scope, closures, iterators, coroutines, correct tail calls, and very practical data processing using associative arrays. Lua's syntax is concise and elegant, easy to learn and use. Lua can be integrated with C or other commonly used programming languages, taking advantage of what other languages have done well, while providing high-level abstraction, dynamic structure, simple testing and other functions that languages such as C are not good at. Lua is highly portable and can run on various platforms, including Windows, Linux, Mac OS X, Android, iOS, etc. Lua is not only a scripting language that can run as a standalone program, but also an embedded language that can be embedded in other applications. Lua is widely used in game development, standalone application scripts, web application scripts, extensions and database plug-ins.

LuaJIT is a high-performance Lua language implementation that uses just-in-time compilation technology to convert Lua code into machine code for execution. Its operating efficiency is much faster than that of the original Lua, so LuaJIT is also widely used in actual software development. LuaJIT's bytecode format is an intermediate representation. LuaJIT's bytecode format is a low-level, platform-independent, portable format that acts as a bridge between Lua code and machine code. Compared with Lua's intermediate code structure, LuaJIT's intermediate code structure is more compact and the meaning of each instruction is more abstract, so it is more difficult to understand. This also leads to fewer LuaJIT-related open source projects than native Lua.

Static injection hook is a technology that modifies the code or data of the target program before it runs. It can monitor, control or expand the target program. The advantage of static injection hook is that it does not require runtime injection, will not cause abnormalities or crashes in the target program, and will not be detected by the protection mechanism of the target program. The difficulty of static injection hook is that it requires precise analysis and modification of the code or data of the target program to avoid destroying its original functions and logic.

At present, the existing technologies at home and abroad have not conducted detailed research and analysis on the LuaJIT bytecode level. For security and performance reasons, Lua files will be compiled into LuaJIT bytecode for loading in some scenarios. If the plain text source code is missing and you just want to simply relocate and fine-tune some functions and instructions, it will be difficult to achieve.

The static injection hook method based on LuaJIT bytecode format parsing is a technology that uses the bytecode format characteristics of LuaJIT to statically inject hooks into LuaJIT-compiled programs. The core idea of this technology is to parse the bytecode format of LuaJIT, find the key functions or variables of the target program, and then insert custom bytecodes before and after them to hook the target program. The advantage of this technology is that it can perform lossless static injection hooks into LuaJIT-compiled programs without affecting their normal operation and without requiring additional runtime support.

Summary of the invention

The purpose of the present invention is to address the deficiencies of the prior art and provide a static injection hook method and device based on LuaJIT bytecode format parsing.

The object of the present invention is to achieve the following technical solution: a static injection hook method based on LuaJIT bytecode format parsing, comprising the following steps:

(1) Prepare the target source LuaJIT binary file _F1 to be patched and the LuaJIT file _F2 to be injected, then parse and extract the structure information _S1 of the LuaJIT binary file _F1 , the structure information _S1 including the header meta information And proto structure information collection /> That is/>

(2) Proto structure information collection based on LuaJIT's binary file format Split and obtain the structural information of each proto, that is /> Where i＝1,2,…,i,…,n-1,n,/> It is a collection of proto structure information /> Any proto structure information in; /> It is the empty proto structure information mark at the end of the LuaJIT binary file _F1 . /> It is the semantically outermost proto structure information of LuaJIT binary file _F1 ;

(3) Parse the target proto structure information to be patched based on the binary file format of LuaJIT Get the target proto structure information to be patched/> The structure header meta information, instruction table IT and constant table CT;

(4) Patch the end of the constant table CT and insert the require string and the file name string of the LuaJIT file _F2 ; then analyze the instruction table IT according to the actual production requirements, find the FNEW instruction and GSET instruction corresponding to the function that needs to be hooked in the LuaJIT binary file _F1 ; then insert three LuaJIT hard-coded instructions in sequence after the position of the GSET instruction to obtain the patched LuaJIT binary file _F1 ;

(5) Finally, the patched LuaJIT binary file _F1 and LuaJIT file _F2 are placed in the loading path of LuaJIT to complete the static injection hook.

Furthermore, the LuaJIT file _F2 is text and binary compatible.

Furthermore, the LuaJIT hard-coded instructions are GGET, KSTR, CALL instructions or other equivalent logics.

The present invention also includes a static injection hook device based on LuaJIT bytecode format parsing, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used for the above-mentioned static injection hook method based on LuaJIT bytecode format parsing.

The present invention also includes a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the above-mentioned static injection hook method based on LuaJIT bytecode format parsing is implemented.

The beneficial effects of the present invention are:

1) The injected LuaJIT file is compatible with text and binary. The internal hook code can use either the Lua internal library method debug.hook or the global G-table replacement method;

2) It is possible to perform static injection hooks on LuaJIT-compiled programs without affecting their normal operation and without requiring additional runtime support;

3) Only the files loaded by LuaJIT are patched without making any changes to the LuaJIT engine itself, so it is compatible with all operating systems and CPUs that standard LuaJIT can run on.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a static injection hook method based on LuaJIT bytecode format parsing;

FIG2 is a Lua source code diagram of the target source LuaJIT binary file _F1 waiting to be patched;

FIG3 is a Lua source code diagram of the LuaJIT file _F2 that needs to be injected;

FIG. 4 is a structural diagram of a static injection hook device based on LuaJIT bytecode format parsing.

Detailed ways

In order to make the purpose, technical scheme and advantages of the present invention more clear, the present invention is further described in detail in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

Example 1

As shown in FIG1 , the present invention provides a static injection hook method based on LuaJIT bytecode format parsing, comprising the following steps:

(1) Prepare the target source LuaJIT binary file _F1 to be patched and the LuaJIT file _F2 to be injected. In the actual execution scenario, the Lua source code of the target source LuaJIT binary file _F1 to be patched as shown in FIG2 will be compiled into LuaJIT bytecode, and the Lua source code of the LuaJIT file _F2 to be injected as shown in FIG3 can _be in the form of a text file or LuaJIT bytecode. Then parse and extract the structural information _S1 of the LuaJIT binary file _F1 , which includes header meta information And proto structure information collection /> That is/>

Specifically, the header meta information It is a 5-byte block, first of all, there is a fixed signature of 1B 4C 4A, followed by a 1-byte version and a 1-byte flag. proto structure information set/> A proto array.

The LuaJIT file _F2 is compatible with text and binary. The internal hook code can use the Lua internal library method debug.hook and the global G-table replacement method.

(2) Proto structure information collection based on LuaJIT's binary file format Split and obtain the structural information of each proto, that is /> Where i＝1,2,…,i,…,n-1,n,/> It is a collection of proto structure information /> Any proto structure information in; it is worth noting that/> It is the empty proto structure information mark at the end of the LuaJIT binary file _F1 . /> It is the semantically outermost proto structure information of the LuaJIT binary file _F1 .

The general target to be repaired is When the patch target is any proto structure information, it is necessary to locate and analyze the specific information according to the needs/> The value of i in .

Specifically, the proto array (proto structure information collection) in the LuaJIT bytecode file ) is compact, and the source code of the LuaJIT binary file _F1 will be treated as the outermost proto corresponding structure information when compiling, that is, The arrangement order is nested layer by layer according to the function. Since there is no field to identify the number of protos, LuaJIT will parse each proto when loading the proto array. When the proto header is marked with a size of 0, it means that the proto structure information has been loaded at the end of the binary file _F1 /> For example, when there are 3 proto structures in the LuaJIT binary file _F1 , where /> Corresponding to the Add function, /> Corresponding to the entire outer proto, /> It is the ending empty proto identifier.

(3) Parse the target proto structure information to be patched based on the binary file format of LuaJIT Get the proto structure header meta information /> proto instruction table IT and proto constant table CT, that is/> Among them,/> The target proto structure information to be patched/> proto structure header meta information, IT is the target proto structure information to be patched/> proto instruction table, CT is the target proto structure information to be patched/> proto constant table.

Specifically, any proto structure information There is a proto structure header meta information in each file that identifies the organizational structure of the proto. In the example, the target proto structure information to be patched in the LuaJIT binary file _F1 /> In the proto structure header meta information/> The size is 8 bytes, the first byte is 0x58. It is worth noting that the number identifying the size in the LuaJIT bytecode file is a variable-length number of type uleb128, which also makes it more difficult to read and modify the entire bytecode file; the second byte is the flag identifier, and the FLAG_HAS_JIT in the flag identifier indicates the target proto structure information to be patched/> When loaded into the LuaJIT virtual machine, it can be optimized by the just in time mechanism. The FLAG_HAS_CHILD bit indicates the target proto structure information to be patched/> The previous proto structure information is /> The third, fourth and fifth bytes are uchar bytes, which respectively identify the target proto structure information to be patched/> The number of parameters, the number of registers required at run time, and the number of upvalues. Then three uleb128 variable-length numbers follow, identifying complex_constant_count, numeric_constant_count, and instruction_count. After completing step (3), it should be noted that due to the length of the uleb128 number, any modification operation may cause the entire file structure to be misaligned, so here only the number of complex_constant_count and its position in the bytecode file are recorded.

(4) Patch the end of the constant table CT and insert the require string and the file name string of the LuaJIT file _F2 ; then analyze the instruction table IT according to the actual production requirements, find the FNEW instruction and GSET instruction corresponding to the function that needs to be hooked in the LuaJIT binary file _F1 ; then insert three LuaJIT hard-coded instructions in sequence after the position of the GSET instruction to obtain the patched LuaJIT binary file _F1 .

The LuaJIT hard-coded instructions are GGET, KSTR, and CALL instructions, and their main purpose is to introduce the LuaJIT file F _2. Therefore, other instruction combinations can also be used to implement equivalent logic.

The step (4) specifically includes the following sub-steps:

(4.1) The Add function in the Lua source code will generate two instructions, FNEW and GSET, when it is compiled into bytecode by LuaJIT. Its meaning is to create a runtime closure and bind the symbol Add to the global variable table _G. So after parsing the target proto structure information to be patched, proto structure header meta information/> After that, you need to locate the positions of the two instructions FNEW and GSET corresponding to the hooked Lua function in the proto instruction table IT and record them. To avoid confusion, two orders are defined here: structure order and addressing order. The structure order is the spatial order in the LuaJIT bytecode file, and the addressing order is the order that LuaJIT reads during actual runtime. The two orders are opposite.

(4.2) Then parse the information of the proto constant table CT. There are many types of constants, and the corresponding numbers in the instruction code are the subscripts of the proto constant table CT calculated from the back to the front, and the subscripts start counting from 0. For example, the byte code of the 5th GSET instruction in the proto instruction table IT is 35 00 03 00, where 03 is the subscript of the constant table, and the corresponding specific item is the Add string. The rule of the constant table is a byte type that identifies the type of the complex_constant, and the specific value that follows it, where the constant identifier of the string is 0x5+len(constant), and it is a uleb128 variable-length number.

(4.3) After parsing the information of the proto constant table CT, you can start the patching work. Specifically, you need to insert the require string and the file name string of the LuaJIT file _F2 . In order to avoid the constant table data dislocation caused by the insertion, the insertion here should comply with the LuaJIT constant addressing order rule, that is, insert it at the structure order table header of the constant table. The hexadecimal strings of the two are 0C 72 65 71 75 69 72 65 and 07 46 32 respectively.

(4.4) Then insert the instruction table. At this time, take out the positions of the two previously recorded FNEW and GSET instructions in the proto instruction table IT. After the position of the GSET instruction (the FNEW instruction and the GSET instruction will appear in pairs in the binary file), insert three instructions GGET, KSTR, and CALL in sequence. The parameter carried by the first GGET instruction is the addressing order subscript of the require string after the proto constant table CT is modified. The second KSTR instruction is the same as the previous instruction. The parameter carried by this instruction is the addressing order subscript of the F2 string after the proto constant table CT is modified. The third CALL instruction is a function call with require as the function name and F2 as the parameter. The specific register subscript needs to be selected according to the actual situation. Here it is CALL 0 1 2, which means that register 0 is selected as the function name, register 1 is the parameter, and there is no return value. It is worth noting that the instruction selection here is not limited to these types, including the GGET and KSTR instructions here are equivalent.

(4.5) After the proto instruction table IT and the proto constant table CT are patched, the target proto structure information to be patched is also required proto structure header meta information/> (That is, in this example, the target proto structure information to be patched proto structure header meta information/> ) is repaired, wherein the value of complex_constant_count that needs to be repaired is complex_constant_count+2, and the value of instruction_count is instruction_count+3, and a patched LuaJIT binary file F ₁ is obtained.

(5) After all patching work is completed, the patched LuaJIT binary file _F1 and LuaJIT file _F2 are placed in the loading path of LuaJIT to complete the static injection hook.

The static injection hook method based on LuaJIT bytecode format parsing proposed by the present invention only patches the files loaded by LuaJIT without making any modifications to the LuaJIT engine itself, so it is compatible with all operating systems and CPUs that can run on standard LuaJIT.

Example 2

The present embodiment relates to a static injection hook device based on LuaJIT bytecode format parsing, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, a static injection hook method based on LuaJIT bytecode format parsing of the above-mentioned embodiment 1 is used; the device embodiment can be applied to any device with data processing capabilities, and the any device with data processing capabilities can be a device or apparatus such as a computer.

As shown in Figure 4, at the hardware level, the knowledge distillation device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the method shown in Figure 1 above. Of course, in addition to software implementations, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask a chip manufacturer to design and make a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present invention may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

Example 3

An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a static injection hook method based on LuaJIT bytecode format parsing of the above-mentioned embodiment 1 is implemented.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims (5)

1. A static injection hook method based on LuaJIT byte code format parsing, comprising the steps of:

(1) The target source LuaJIT binary file F ₁ waiting for repair and the LuaJIT file F ₂ to be injected are prepared, and then the structure information S ₁ of the LuaJIT binary file F ₁ is parsed and extracted, wherein the structure information S ₁ comprises header meta information And proto Structure information set/>I.e./>

(2) Proto structure information set according to LuaJIT binary file formatSplitting to obtain structural information of each proto, namely/>Wherein i=1, 2, …, i, …, n-1, n, p _i ¹ is the proto structure information set/>Any one of the proto structure information; /(I)For LuaJIT binary F ₁, the end empty proto structure information flag,/>The corresponding structural information of the proto of the semantically outermost layer of the LuaJIT binary file F ₁;

(3) Analyzing the target proto structure information P _i ¹ to be repaired according to the binary file format of LuaJIT to obtain the structure header meta information, the instruction table IT and the constant table CT of the target proto structure information P _i ¹ to be repaired;

(4) Repairing and inserting a required character string and a file name character string of LuaJIT file F ₂ at the tail of the constant table CT; then analyzing an instruction table IT according to actual production requirements, and finding FNEW instructions and GSET instructions which are required to be corresponding to the hook functions of the LuaJIT binary file F ₁; sequentially inserting three LuaJIT hard-coded instructions after the GSET instruction to obtain a repaired LuaJIT binary file F ₁;

(5) Finally, the patched LuaJIT binary files F ₁ and LuaJIT file F ₂ are placed on the loading path of LuaJIT to complete the static injection hook.

2. The static injection hook method based on LuaJIT bytecode format parsing of claim 1, wherein the LuaJIT file F ₂ is text and binary compatible.

3. The static injection hook method based on LuaJIT bytecode format parsing of claim 1, wherein the LuaJIT hard-coded instruction is GGET, KSTR, CALL instruction or other equivalent logic.

4. A static injection hook device based on LuaJIT bytecode format parsing, comprising a memory and one or more processors, wherein the memory stores executable code, and the one or more processors are configured to implement a static injection hook method based on LuaJIT bytecode format parsing as claimed in any one of claims 1-3 when the executable code is executed by the one or more processors.

5. A computer readable storage medium having stored thereon a program which, when executed by a processor, implements a LuaJIT byte code format parsing based static injection hook method as claimed in any one of claims 1 to 3.