KR101412200B1 - Computer system, adress redirection method and system function monitoring method for thereof - Google Patents

Abstract

The present invention discloses a computer system, a method for moving an address of the computer system, and a system function monitoring method for the computer system. Embodiments of the present invention provide a method of accessing a memory device having a memory access module that supports a memory area approach that supports a number of bits that is less than the number of bits corresponding to the total address range of the memory device, It is possible to effectively use the entire address range of the memory device by storing the address transfer function for moving to the remaining address range which can not be specified within some possible address range. By implementing system function monitoring based on this, the 32 bit OS Which is capable of providing the same level of security as 32-bit OS by hooking in kernel mode.

Description

TECHNICAL FIELD [0001] The present invention relates to a computer system, a method of moving an address of a computer system, and a method of monitoring a system function of a computer system.

Embodiments of the present invention are technologies that can effectively utilize the entire address range by redirection to an address range that can not be accessed by an address range designation (access) limit, Address transfer function for moving to a remaining address range that can not be specified within a certain address range that can be specified in the entire address range of the memory device when a memory access module that supports a smaller bit number memory region access method is used, It is possible to effectively utilize the entire address range of the memory device and realizes monitoring of the system function based on this, so that the 64-bit OS can hook up in the kernel mode like the 32-bit OS, thereby providing the same level of security as the 32-bit OS Related technologies.

As the functions of computer systems have diversified recently, the operating system (OS) environment has developed from a 32-bit environment to a 64-bit environment. In a 64-bit OS environment, the system function table structure has been changed from an absolute addressing method to a relative addressing method.

However, in the present computer system which is a transition period in which the OS environment evolves from 32 bits to 64 bits, there is a case where only a 32-bit memory area access (addressing) method is supported for a structural reason in a 64-bit OS environment. In the case of 64-bit OS, if the 32-bit addressing method is supported for structural reasons, the address range of the entire address range provided by the 64-bit memory is limited.

이다. 따라서, 32bit 메모리영역 접근 방식을 지원하는 메모리접근모듈에 의한 시스템함수테이블을 기초로 64bit OS 환경의 메모리에서 상대주소 지정방식에 따라 접근 가능한 주소범위는

이며, 전체 주소범위

중 나머지 주소범위에는 접근할 수 없는 한계를 갖는다. For example, as shown in FIG. 1, based on the system function table by the memory access module supporting the x bit memory area access method, the address range accessible in the memory according to the relative address specification method is

to be. Therefore, based on the system function table by the memory access module supporting the 32-bit memory area access method, the address range accessible by the relative addressing method in the memory of the 64-bit OS environment is

And the entire address range

The remaining address ranges have inaccessible limits.

Accordingly, the present invention proposes a method of effectively using the entire address range by redirecting to an address range that is inaccessible due to limitation of the address range specification.

Embodiments of the present invention are technologies that can effectively utilize the entire address range by redirection to an address range that is inaccessible due to the limitation of the address range designation. The present invention can reduce the number of bits corresponding to the entire address range of the memory device, If the memory access module supports a bit number memory area access method, it stores an address transfer function to move the memory device to the remaining address range which can not be specified within the accessible address range of the entire address range of the memory device This makes it possible to effectively utilize the entire address range of the memory device and realizes monitoring of the system function based on this. Thus, it is possible to hook up in the kernel mode like the 32-bit OS even in the 64-bit OS environment, I would like to propose a plan.

According to a first aspect of the present invention, there is provided a computer system comprising: a memory device; And a memory access module accessible to some of the entire memory areas of the memory device; The memory device stores an address transfer function for accessing at least one first memory area in the partial memory area and at least one second memory area in the remaining memory areas excluding the partial memory area of the entire memory area And accessing the at least one first memory area based on address information addressed to the at least one first memory area in the memory access module to call the address transfer function, To access the second memory area of the memory.

According to a second aspect of the present invention, there is provided a method for moving an address of a computer system, the method comprising: in at least one first memory area in a memory area accessible by a memory access module among all memory areas of the memory device, Storing an address transfer function for accessing at least one second memory area in a memory area other than the memory area, among the entire memory areas; And accessing the at least one first memory region based on address information addressed to the at least one first memory region in the memory access module to invoke the address transfer function, To access a second memory area of the memory.

According to a third aspect of the present invention, there is provided a method for monitoring a system function of a computer system, the method comprising the steps of: Storing a monitoring function for performing a specific monitoring in a second memory area; Storing an address transfer function for accessing the at least one second memory area in at least one first memory area in the partial memory area of the memory device; The address information of a specific system function identified as an object of performing the specific monitoring is stored in a system function table including address information addressed to a memory area stored in the memory device for each system function, Changing address information addressed to a first memory area; And accessing the at least one first memory area based on the changed address information of the specific system function identified in the system function table when the memory access module requests a call of the specific system function, Calling; And accessing the at least one second memory area by the address transfer function in the memory access module to call the monitoring function.

According to a fourth aspect of the present invention, there is provided a system function monitoring method for a computer system, the method comprising the steps of: storing a plurality of memory areas in a memory area other than a memory area accessible by a memory access module, Storing each monitoring function mapped by each system function identification information in a memory area; An address for accessing a specific memory area in which a handler gateway function for relaying access to the plurality of second memory areas is stored in a first memory area in the partial memory area of the memory device according to the system function identification information, Storing a movement function; The system function table including address information indicating an address stored in the memory device for each system function, the address of each system function corresponding to each system function identification information identified as an object of monitoring according to each monitoring function Changing information to address information addressed to the one first memory area in which the address transfer function is stored; Wherein the memory access module accesses the one memory area based on the changed address information of the specific system function identified in the system function table when the memory access module requests to call a specific system function among the system functions, Calling a movement function; Accessing the specific memory area based on the specific address information by the address transfer function in the memory access module and calling the handler gateway function; And the memory access module accesses a second memory area in which a specific monitoring function mapped to the system function identification information of the specific system function is stored by the handler gateway function in the plurality of second memory areas to call the specific monitoring function .

Embodiments of the present invention provide a method of accessing a memory device having a memory access module that supports a memory area approach that supports a number of bits that is less than the number of bits corresponding to the total address range of the memory device, By storing an address transfer function (e.g., a jumper code) for moving to a desired address in the remaining address range that can not be specified within some possible address range, the entire address range of the memory device can be effectively utilized, Function monitoring enables hooking in kernel mode as in 32bit OS even in 64bit OS environment, so it can provide same level of security function as 32bit OS.

FIG. 1 is an exemplary diagram showing address ranges accessible according to a relative addressing scheme at x bits.
2 is a block diagram illustrating a configuration of a computer system according to a preferred embodiment of the present invention.
FIG. 3 is a block diagram illustrating address movement in a computer system according to a first preferred embodiment of the present invention. Referring to FIG.
FIG. 4 is a block diagram illustrating address movement in a computer system according to a second preferred embodiment of the present invention. Referring to FIG.
5 is a flowchart illustrating an address moving method of a computer system according to a preferred embodiment of the present invention.
6 is a flowchart illustrating a method of monitoring a system function of a computer system according to a first embodiment of the present invention.
7 is a flowchart illustrating a method of monitoring a system function of a computer system according to a second preferred embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

2 illustrates a computer system in accordance with a preferred embodiment of the present invention.

1, a computer system according to the present invention includes a memory device 120 and a memory access module 110 that is accessible to some memory areas of the entire memory area of the memory device 120. As shown in FIG.

Here, in the computer system according to the present invention, the memory device 120 is provided with at least one first memory area within the partial memory area accessible by the memory access module 110, And an address transfer function for accessing at least one second memory area in the remaining memory area is stored so that the memory access module (110) can access the at least one first memory area based on the address information addressed to the at least one first memory area When the address moving function is accessed by accessing the memory area, the at least one second memory area may be accessed by the address moving function.

Hereinafter, it is common that address information is addressed in a memory area of the memory device 120. Therefore, for convenience of description, a memory area in which a function is stored and an address in which a function is stored are mixed, and a range and an address range of a memory area are mixed You may.

중 일부 메모리영역에 어드레싱되는 일부 주소범위

에 대해서만 접근할 수 밖에 없다. For example, a computer system in which a memory access module that supports a 32-bit memory area access (addressing) mode is adopted while an OS environment has evolved from a 32-bit environment to a 64-bit environment is provided in a memory device 120 of a 64-bit environment The entire address range addressed to the entire memory area

Some address ranges addressed to some memory areas

I can only access it.

As such, the present invention is intended to apply to a computer system having a memory access module 110 that supports a memory area approach of a number of bits corresponding to the total address range of the memory device 120, that is, the number of bits smaller than the OS environment.

Here, the memory access module 110 is a module for accessing a specific memory area of the entire memory area of the memory device 120, for example, a function call handler module for calling a system function stored in the memory device 120 (Eg, a KiSystemService () function), a CPU, a program, and the like.

Hereinafter, for convenience of description, the memory device 120 of the 64-bit environment and the memory access module 110 of the 32-bit memory area access method will be described.

As described above, in the memory device 120 according to the computer system of the present invention, at least one first memory area in some memory area accessible from the memory access module 110, And an address transfer function for accessing at least one second memory area in the remaining memory areas except the first memory area.

내의 적어도 하나의 제1주소에, 메모리장치(120)의 전체 메모리영역에 어드레싱되는 전체 주소범위

중 나머지 메모리영역에 어드레싱되는 나머지 주소범위 내 적어도 하나의 제2주소로 접근시키는 주소이동함수가 저장될 수 있다.In other words, the memory device 120 may include some address ranges addressed to some memory areas accessible by the memory access module 110

At least one first address in the memory device 120, a total address range addressed to the entire memory area of the memory device 120

An address transfer function for accessing at least one second address within the remaining address range addressed to the remaining memory area may be stored.

At this time, the address transfer function includes address information of a specific second address and accesses a specific second address based on address information of a specific second address when the address transfer function is called. For example, . ≪ / RTI >

The memory access module 110 may store address information for accessing each memory area in the memory area 120 based on the number of bits smaller than the number of bits corresponding to the entire memory area of the memory device 120 .

개의 주소에 접근하기 위해 32bit를 기초로 하는 구조를 가질 것이다.At this time, if the memory access module 110 supports the 32-bit memory area access method as described above, the address information stored in the memory access module 110,

It will have a structure based on 32 bits to access the addresses.

중 상대주소 지정방식에 따라 일부 주소범위

내의 주소에만 접근(지정)이 가능하였다.The memory access module 110 preferably accesses each memory area in a memory area of the memory device 120 according to a relative address access method based on the stored address information. The memory access module 110 then determines whether the entire address range of the memory device 120

Depending on the relative addressing scheme, some address ranges

Only the address in the address can be specified.

However, according to the present invention, among the entire memory areas of the memory device 120, the memory access module 110 stores an address transfer function for moving the first memory area accessible to the second memory area, Module 110 accesses the first memory area based on the address information addressed to the accessible first memory area and calls the address transfer function to redirect the address transfer function to the second memory area, It is possible to obtain a result of accessing the second memory area which is inaccessible by the address transfer function.

내에 접근(지정) 불가능한 나머지 주소범위로 이동시키기 위한 주소이동함수를 저장함으로써, 메모리접근모듈(110)은, 메모리장치(120)의 전체 주소범위

중 접근(지정) 가능한 일부 주소범위

내의 제1주소에 접근함으로써 주소이동함수를 호출하게 되면, 주소이동함수가 특정 제2주소로 이동(redirection)시켜, 주소이동함수에 의해 접근(지정) 불가능한 나머지 주소범위 내의 제2주소로 접근하는 결과를 얻을 수 있다. In other words, in other words, according to the present invention,

The memory access module 110 may store the address transfer function to move the entire address range of the memory device 120

Some address ranges that can be accessed (assigned)

The address movement function is redirected to a specific second address to access a second address within the remaining address range that can not be accessed (designated) by the address movement function Results can be obtained.

중 접근(지정) 가능한 일부 주소범위

내에 접근(지정) 불가능한 나머지 주소범위로 이동시키기 위한 주소이동함수를 저장함으로써 메모리장치(120)의 전체 주소범위를 효과적으로 이용할 수 있다.Thus, according to the computer system of the present invention, if the memory access module 110 has a memory access module 110 that supports a memory area approach of a number of bits corresponding to the total address range of the memory device 120, The entire address range of the device 120

Some address ranges that can be accessed (assigned)

It is possible to effectively utilize the entire address range of the memory device 120 by storing an address transfer function for moving the memory device 120 to a remaining address range that can not be accessed.

Hereinafter, with reference to FIG. 3, a first embodiment in which redirection to an address that can not be specified (accessible) as described above in the computer system of the present invention is applied to the system function monitoring method will be described.

First, the system function monitoring method will be briefly described.

System functions are functions whose purpose is to enable the operating system to efficiently manage hardware resources and to enable application programs to use hardware resources easily and securely. However, malicious programs have the problem of exploiting these system functions.

In situations where you can not completely trust all the processes running on the operating system, it is essential to monitor the system functions provided by the operating system. For example, if an arbitrary process A uses an illegal method to read a memory-related function, it can read the memory area of another process. Therefore, it is necessary to prevent illegal calling of a system function. To do this, it is necessary to monitor a certain system function to be called and the number of times a system function is called.

Thus, the system function monitoring method uses a hooking method in which the address of the system function stored in the system function table is replaced with the address of the monitoring function, and the system function is called from the monitoring function.

A concrete configuration of applying the system function monitoring method to the computer system of the present invention will be described as follows.

The memory access module 110 includes a system function table 115 and is operable to determine whether a particular system function is requested based on the address information of the particular system function identified in the system function table 115, Can access the stored memory area and call the specific system function.

Here, the system function table 115 includes address information addressed to a memory area stored in the memory device 120 for each system function. More specifically, the system function table 115 stores system function identification information (e.g., function index) and address information stored in the memory device 120 in correspondence with each system function stored in the memory device 120 .

The memory access module 110 stores the system function 1 based on the address information of the system function func1 based on the system function table 115, for example, when a call of the system function func1 is requested You can access the memory area and call system function 1. The memory access module 110 is preferably a function call handler module.

The computer system 100 according to the present invention may further include a monitoring control module 130 for controlling the execution of system function monitoring.

The monitoring control module 130 may include address information addressed to the at least one second memory area in the at least one first memory area of the memory device 120, Store the address transfer function.

For example, the monitoring control module 130 stores the monitoring function 1 in the second memory area, which is not accessible from the memory access module 110, among the entire memory areas of the memory device 120. [

The monitoring control module 130 stores the address information addressed to the second memory area in which the monitoring function 1 is stored in the first memory area accessible by the memory access module 110 among the entire memory areas of the memory device 120 It can store an address movement function (jumper) that contains it.

내의 제1주소에, 특정 모니터링을 수행하는 모니터링함수1이 저장된 제2주소로 접근시키는 주소이동함수가 저장되는 것이다.That is, the memory device 120 may include some address ranges accessible from the memory access module 110

An address transfer function for accessing a second address stored in the first address in the monitoring function 1 performing the specific monitoring is stored.

In addition, the monitoring control module 130 may store the address information of the specific system function identified as the target of the specific monitoring in the system function table 115 in the at least one first memory area in which the address movement function is stored Change to addressed address information.

For example, if the monitoring function to be monitored by the monitoring function 1 is a system function (func1), the monitoring control module 130 sets the address information of the system function func1 as an address movement function (jumper) in the system function table 115, This addressed address information can be changed. For example, the monitoring control module 130 reads the system function identification information (e.g., function index) of the system function func1 on the system function identification information (e.g., function index) and the address information of the system function func1 in the system function table 115 (Eg, function index) and the address information of the first address to override the Myfunc1 function and change the address information.

The memory access module 110 accesses the first memory area based on the changed address information of the system function func1 based on the system function table 115 when the system function func1 call is requested, A jumper may be called and a second memory area may be accessed based on the address information addressed to the second memory area by an address movement function to call the stored monitoring function.

That is, when a call to the system function (func1), which is the monitoring target of the monitoring function 1, is requested, the memory access module 110 accesses the first address (first address) according to the changed address information of the system function func1 based on the system function table 115 And the address transfer function is redirected to the second address stored in the monitoring function 1 to access the second address within the remaining address range which can not be accessed (designated) by the address transfer function You can get the result and call the monitoring function 1.

The monitoring function 1 performs the monitoring function set in the monitoring function 1 (for example, recording the process information requested to call the system function func1, recording the number of times the system function func1 is called, etc.) Call system function 1.

중 메모리접근모듈(110)이 접근(지정) 불가능한 주소범위에 모니터링함수들을 저장하고 접근(지정) 가능한 일부 주소범위

내에 모니터링함수가 저장된 주소로 이동시키기 위한 주소이동함수를 저장함으로써, 메모리장치(120)의 전체 주소범위를 효과적으로 이용하여 후킹 방식을 통한 시스템함수 모니터링을 실현할 수 있도록 한다. Thus, the computer system of the present invention is capable of storing the entire address range

Memory access module 110 stores the monitoring functions in an address range that is not accessible (assignable), and some address ranges

The system function monitoring through the hooking method can be realized by effectively using the entire address range of the memory device 120 by storing the address movement function for moving the address function to the address where the monitoring function is stored.

As described above, system function monitoring applied in the computer system of the present invention described above with reference to FIG. 3 requires an address movement function for each monitoring function, and if the number of monitoring functions is 100, Address, respectively, so that the inefficient operation of memory resources is a concern.

Hereinafter, referring to FIG. 4, a description will be made of a second embodiment for improving the inefficient operation concern of memory resources due to the increase of the address of the address transfer function.

The monitoring control module 130 stores a plurality of monitoring functions mapped to each system function identification information in a first memory area accessible from the memory access module 110 among the entire memory areas of the memory device 120 Stores the address transfer function including specific address information addressed to a specific memory area in which a handler gateway function for relaying access to the second memory area is stored.

중 메모리접근모듈(110)에서 접근 불가능한 나머지 주소범위 내의 주소인 것이 바람직하다.At this time, the specific address of the specific memory area in which the handler gateway function is stored is an address having the same meaning as the above-mentioned second address, and is stored in the remaining memory area which is inaccessible from the memory access module 110, The addressed address, i.e., the entire address range of the memory device 120

The address within the remaining address range that is inaccessible to the middle memory access module 110 is desirable.

For example, the monitoring control module 130 stores each monitoring function 1 and the monitoring function 2 in a plurality of second memory areas, which are not accessible from the memory access module 110, among the entire memory areas of the memory device 120. [

The monitoring control module 130 stores the handler gateway function in a specific memory area (an area having the same meaning as the second memory area) that is not accessible from the memory access module 110 among the entire memory areas of the memory device 120 .

The monitoring control module 130 stores a specific address addressed to a specific memory area in which the handler gateway function is stored in a first memory area accessible from the memory access module 110 among the entire memory areas of the memory device 120, And an address movement function (jumper) including information.

The monitoring control module 130 then updates the address information of each system function corresponding to each system function identification information identified as a target of monitoring according to each monitoring function in the system function table 115, To the address information addressed to the one first memory area in which the function is stored.

For example, the monitoring control module 130 determines whether the monitoring function 1 is to be monitored by the system function func1 and the monitoring function 2 is monitored by the system function func2. In the system function table 115, The address information of the system function func1 and the address information of the system function func2 can be changed to the address information addressed by the address jumper function.

The memory access module 110 accesses the first memory area based on the changed address information of the system function func1 identified in the system function table 115 when the system function func1 call is requested A jumper is called by an address movement function to access the specific memory area based on the specific address information to call a handler gateway function, and the handler gateway function calls a plurality of second memories It is possible to access the second memory area in which the monitoring function 1 mapped to the system function identification information of the system function func1 is accessed to call the monitoring function 1.

Of course, the memory access module 110 may access the first memory area based on the changed address information of the system function func1 identified in the system function table 115 when a call to the system function func2 is requested A jumper is called by an address movement function to access the specific memory area based on the specific address information to call a handler gateway function, and the handler gateway function calls a plurality of second memories It is possible to access the second memory area in which the monitoring function 2 mapped to the system function identification information of the system function func2 is accessed and call the monitoring function 2.

That is, the memory access module 110 accesses the same one first address based on the system function table 115, whether the system function func1 is called or the system function func2 is called, And the address transfer function redirects to a specific address stored in the handler gateway function to obtain a result of accessing a specific address within the remaining address range which can not be accessed by the address transfer function, And the corresponding monitoring function 1 or monitoring function 2 can be called by the handler gateway function.

Therefore, the monitoring function 1 performs the monitoring function set in itself, and then calls the original system function 1. Thereafter, the monitoring function 2 performs the monitoring function set in itself as it is, Call system function 2.

내에 핸들러게이트웨이함수가 저장된 주소로 이동시키기 위한 주소이동함수 1개를 저장함으로써, 메모리장치(120)의 전체 주소범위를 효과적으로 이용하여 후킹 방식을 통한 시스템함수 모니터링을 실현할 수 있도록 한다.Thus, the computer system of the present invention is capable of storing the entire address range The memory access module 110 stores a handler gateway function that stores monitoring functions in an address range that can not be accessed (designated) and relays them to each monitoring function,

The system function monitoring through the hooking method can be realized by effectively using the entire address range of the memory device 120 by storing one address transfer function for moving the handler gateway function to an address where the handler gateway function is stored.

As described above, according to the present invention, when the memory access module 110 has a memory access module 110 that supports a memory area access method with a bit number corresponding to the entire address range of the memory device 120, that is, It is possible to effectively utilize the entire address range of the memory device 120 by storing an address transfer function for moving to the remaining address range that can not be specified within the entire address range of the device 120 , It is possible to hook up in kernel mode like 32bit OS even in 64bit OS environment by realizing system function monitoring based on this, and it is possible to provide the same level of security function as 32bit OS.

Hereinafter, an address moving method and a system function monitoring method of a computer system according to the present invention will be described with reference to FIG. 5 to FIG. Here, for convenience of description, the configurations shown in FIGS. 1 to 4 will be described with reference to corresponding reference numerals.

First, referring to FIG. 5, a method of moving an address of a computer system according to a preferred embodiment of the present invention will be described.

The method for moving an address of a computer system according to the present invention is a method for moving an address in at least one first memory area within a partial memory area accessible from a memory access module 110 among the entire memory areas of the memory device 120, And an address transfer function for accessing at least one second memory area in the remaining memory areas excluding some memory areas is stored.

중 메모리접근모듈(110)에서 접근 가능한 일부 주소범위

내의 적어도 하나의 제1주소에, 메모리장치(120)의 전체 주소범위

중 상기 일부 주소범위

를 제외한 나머지 주소범위 내 적어도 하나의 제2주소로 접근시키는 주소이동함수를 저장한다(S10).That is, a method for moving an address of a computer system according to the present invention includes:

Some address ranges accessible from the memory access module 110

At least one first address within the memory device 120,

Some of the above address ranges

(Step S10). In step S10, the address transfer function is accessed.

If the address transfer function is accessed by accessing the first memory area based on the address information addressed to the first memory area accessible by the memory access module 110, The address transfer function may be redirected to the second memory region to obtain access to the second memory region that is inaccessible by the address transfer function.

중 접근(지정) 가능한 일부 주소범위

내의 제1주소에 접근하면(S20), 제1주소에 저장된 주소이동함수를 호출하게 되고, 주소이동함수가 특정 제2주소로 이동(redirection)시켜, 주소이동함수에 의해 접근(지정) 불가능한 나머지 주소범위 내의 제2주소로 접근하는 결과를 얻을 수 있다(S30).That is, a method for moving an address of a computer system according to the present invention is a method for moving an address range of a memory device 120 in a memory access module 110,

Some address ranges that can be accessed (assigned)

(S20), the address movement function stored in the first address is called, the address movement function is redirected to a specific second address, and the address movement function is accessed (designated) by the address movement function The result of accessing the second address within the address range can be obtained (S30).

Hereinafter, a system function monitoring method of a computer system according to a first embodiment of the present invention will be described with reference to FIG.

The method of monitoring a system function of a computer system according to the present invention stores a monitoring function 1 for performing a specific monitoring on a second memory area that is inaccessible from the memory access module 110 among the entire memory areas of the memory device 120.

중 메모리접근모듈(110)에 의해 접근 가능한 일부 주소범위

를 제외한 나머지 주소범위 내 적어도 하나의 제2주소에 특정 모니터링을 수행하는 모니터링함수를 저장한다(S100).That is, a method of monitoring system functions of a computer system according to the present invention includes:

Lt; RTI ID = 0.0 > 110 < / RTI >

A monitoring function for performing a specific monitoring on at least one second address within the remaining address range excluding the first address (S100).

The system function monitoring method of a computer system according to the present invention further includes a step of storing a monitoring function 1 in a first memory area accessible from the memory access module 110 among the entire memory areas of the memory device 120, And may store an address transfer function (jumper) including addressed address information.

내의 적어도 하나의 제1주소에, 특정 모니터링을 수행하는 모니터링함수가 저장된 적어도 하나의 제2주소로 접근시키는 주소이동함수를 저장한다(S110).That is, a method of monitoring a system function of a computer system according to the present invention includes:

(S110). The address transfer function accesses the at least one first address in the at least one first address in the at least one second address.

Accordingly, in the system function monitoring method of the computer system according to the present invention, in the system function table 115, the address information of the system function func1 can be changed to the address information addressed by the address jumper function.

That is, in order to perform specific monitoring of the system function func1, the method of monitoring the system function of the computer system according to the present invention is a method in which the address information of the system function func1 is stored in the system function table 115, The address information of the first address is changed.

The method for monitoring a system function of a computer system according to the present invention is characterized in that when a system function (func1) call is requested, on the basis of the changed address information of the system function (func1) Area to access a second memory area based on the address information addressed to the second memory area by an address movement function (jumper) to call the stored monitoring function 1 .

That is, in the system function monitoring method of the computer system according to the present invention, when a system function (func1) call is requested, the system function (func1) is notified to the first address based on the changed address information of the system function And then calls the address transfer function (S130).

The system function monitoring method according to the present invention is a method for monitoring a system function of a computer system by redirecting an address movement function to a second address where a monitoring function 1 is stored to obtain a second address in a remaining address range The result of accessing is obtained (S140), and the monitoring function 1 can be called (S150).

The monitoring function 1 performs the monitoring function set in the monitoring function 1 (for example, recording the process information requested to call the system function func1, recording the number of times the system function func1 is called, etc.) Call system function 1.

Hereinafter, a system function monitoring method of a computer system according to a second embodiment of the present invention will be described with reference to FIG.

The method of monitoring a system function of a computer system according to the present invention is a method of monitoring a system function of a computer system including a plurality of monitoring functions such as a monitoring function 1 and a monitoring function 2 / RTI >

중 메모리접근모듈(110)에 의해 접근 가능한 일부 주소범위

를 제외한 나머지 주소범위 내 적어도 하나의 제2주소에 특정 모니터링을 수행하는 각 모니터링함수1,2를 저장한다(S200). That is, a method of monitoring system functions of a computer system according to the present invention includes:

Lt; RTI ID = 0.0 > 110 < / RTI >

The monitoring functions 1 and 2 for performing specific monitoring on at least one second address within the remaining address range except for the first address are stored (S200).

The method of monitoring a system function of a computer system according to the present invention is a method for monitoring a system function of a computer system in which a specific memory area (an area having the same meaning as the second memory area) Handler can store gateway functions.

A method for monitoring a system function of a computer system according to the present invention is a method for monitoring a system function of a computer system in which a memory area of a memory unit 120 is stored in a first memory area accessible from a memory access module 110, And an address movement function (jumper) including specific address information addressed to the address.

내의 제1주소에, 시스템함수식별정보 별로 매핑된 각 모니터링함수가 저장된 다수의 제2주소에 대하여 접근을 중계하는 핸들러게이트웨이함수가 저장된 특정 주소로 접근시키는 주소이동함수를 저장한다(S210).In other words, the system function monitoring method of a computer system according to the present invention is characterized in that some address ranges accessible from the memory access module 110

In step S210, an address transfer function for accessing a specific address stored in a first address in the handler gateway function, which relays access to a plurality of second addresses stored for each monitoring function mapped by the system function identification information, in step S210.

The method of monitoring a system function of a computer system according to the present invention is characterized in that in the system function table 115, address information of each system function corresponding to each system function identification information identified as a target of monitoring according to each monitoring function Into address information addressed to the one first memory area in which the address transfer function is stored.

For example, in the system function monitoring method of the computer system according to the present invention, when the object to be monitored by the monitoring function 1 is the system function func1 and the object of monitoring by the monitoring function 2 is the system function func2, The address information of the system function func1 and the address information of the system function func2 may be changed to address information in which the address movement function jumper is addressed.

That is, the method of monitoring a system function of a computer system according to the present invention is characterized in that, in order to perform specific monitoring on the system function func1 and the system function func2, the address information of the first address (func2) is changed to the address information of the first address in which the address transfer function is stored (S220).

The method of monitoring a system function of a computer system according to the present invention is characterized in that when a system function (func1) call is requested, the system function (func1) 1 memory area, calls an address movement function (jumper), accesses the specific memory area based on the specific address information by an address movement function (jumper), calls a handler gateway function, The second memory area in which the monitoring function 1 mapped to the system function identification information of the system function func1 among the plurality of second memory areas is accessed can call the monitoring function 1. [

That is, in the system function monitoring method of the computer system according to the present invention, when a system function (func1) call is requested, the system function (func1) is notified to the first address based on the changed address information of the system function And the address transfer function is called (S230).

The system function monitoring method of a computer system according to the present invention is characterized in that the address movement function redirects to a specific address stored in the handler gateway function so that a specific address within the remaining address range which can not be accessed The handler gateway function is called at step S240 and the second address mapped to the system function identification information of the system function func1 is accessed by the handler gateway function at step S250. (S260). Therefore, the monitoring function 1 performs the monitoring function set in itself, and then calls the original system function 1.

In the meantime, when the system function (func2) call is requested, the method of monitoring the system function of the computer system according to the present invention further includes the step of changing the system function func1 checked in the system function table 115 Accesses a first memory area based on address information to call an address movement function and accesses the specific memory area based on the specific address information by an address movement function, And the second memory area in which the monitoring function 2 mapped to the system function identification information of the system function func2 among the plurality of second memory areas is accessed by the handler gateway function is called to call the monitoring function 2. [

That is, the method of monitoring a system function of a computer system according to the present invention includes the steps of accessing the same one first address based on the system function table 115, whether the system function func1 is called or the system function func2 is called The address transfer function is redirected to a specific address where the handler gateway function is stored, and the result is obtained by accessing a specific address within the remaining address range which can not be accessed (designated) by the address transfer function The handler gateway function is called, and the corresponding monitoring function 1 or 2 can be called by the handler gateway function.

As described above, according to the present invention, it is possible to support a memory area access method with a bit number corresponding to the entire address range of the memory device 120, that is, a bit number smaller than that of the OS environment (in the case of having the memory access module 110, The entire address range of the memory device 120 can be effectively utilized by storing an address transfer function for moving the memory device 120 to a remaining address range that can not be specified within a certain address range that can be specified within the entire address range of the memory device 120 Based on this, system function monitoring can be realized, so it is possible to hook in kernel mode like 32bit OS even in 64bit OS environment, and it can provide same level of security function as 32bit OS.

A method of moving an address of a computer system and a system function monitoring method of a computer system according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

100: Computer system
110: memory access module 120: memory device
130: Monitoring control module

Claims (15)

A memory device;
Storing address information of a structure based on the number of bits smaller than the number of bits corresponding to the entire memory area of the memory device and storing the address information in a memory area of the entire memory area of the memory device based on the stored address information An accessible memory access module; And
Wherein the monitoring function stores at least one monitoring function in at least one second memory area in the remaining memory areas excluding the partial memory area among the entire memory areas, And a memory control module for storing an address transfer function including address information addressed to the at least one second memory area,
Wherein the memory access module comprises a system function table including address information addressed to a memory area stored in the memory device for each system function,
Wherein the monitoring control module is configured to address the address information addressed to the memory area in which the specific system function confirmed as the execution target of the specific monitoring is stored in the at least one first memory area in which the address movement function is stored, Address information,
The memory access module,
When the calling of the specific system function is requested, accessing the at least one first memory area instead of executing the specific system function, based on the changed address information of the specific system function identified in the system function table, Calling the address transfer function and calling the monitoring function by accessing the at least one second memory area based on the address information addressed to the at least one second memory area by the address transfer function Computer system.
delete The method according to claim 1,
The memory access module comprising:
And accessing each memory area in the partial memory area according to a relative address access method based on the stored address information.
delete delete delete delete A memory device;
Storing address information of a structure based on the number of bits smaller than the number of bits corresponding to the entire memory area of the memory device and storing the address information in a memory area of the entire memory area of the memory device based on the stored address information An accessible memory access module; And
Storing a plurality of monitoring functions mapped to respective system function identification information in a plurality of second memory areas in a memory area other than the memory area in the entire memory area, And a monitoring control module for storing an address transfer function including specific address information addressed to a specific memory area storing a handler gateway function for relaying access to the plurality of second memory areas in which each monitoring function is stored;
Wherein the memory access module comprises a system function table including address information addressed to a memory area stored in the memory device for each system function,
Wherein the monitoring control module is operable to determine, in the system function table, address information of each system function corresponding to each system function identification information identified as an object of monitoring according to the monitoring function, To the address information addressed to the first memory area,
The memory access module,
When a call to a specific system function among the system functions is requested, the system function table is stored in the first memory area instead of executing the specific system function, based on the changed address information of the specific system function identified in the system function table And accessing the specific memory area based on the specific address information by the address transfer function to call the handler gateway function, and the handler gateway function calls the plurality of second memories And a second memory area in which a specific monitoring function mapped to system function identification information of the specific system function is stored is accessed to call the specific monitoring function.
delete delete 9. The method of claim 8,
Wherein the specific memory area, in which the handler gateway function is stored,
Said memory device belonging to said remaining memory area of said entire memory area of said memory device. delete Storing, in the monitoring control module, a monitoring function for performing a specific monitoring in at least one second memory area in a remaining memory area excluding some memory areas accessible by the memory access module among the entire memory areas of the memory device;
The monitoring control module stores an address transfer function including address information addressed to the at least one second memory area in which the monitoring function is stored in at least one first memory area in the memory area of the memory device ;
In the monitoring control module, in a system function table including address information addressed to a memory area stored in the memory device for each system function, an address addressed to a memory area in which a specific system function confirmed as the execution target of the specific monitoring is stored Changing information to address information addressed to the at least one first memory area in which the address transfer function is stored;
Wherein, in the memory access module, if a call to the particular system function is requested, based on the modified address information of the particular system function identified in the system function table, Accessing a memory area and calling the address transfer function; And
And in the memory access module, accessing the at least one second memory area based on address information addressed to the at least one second memory area by the address transfer function to call the monitoring function;
The memory access module comprising:
Storing address information of a structure based on the number of bits smaller than the number of bits corresponding to the entire memory area of the memory device and storing the address information in the memory area of the memory device Wherein the system function is accessible to the computer system. In the monitoring control module, each monitoring function mapped by each system function identification information is stored in a plurality of second memory areas in a remaining memory area excluding a memory area accessible by the memory access module among the entire memory areas of the memory device step;
Wherein the monitoring control module is operable to store a plurality of monitoring functions in a specific memory area in which a handler gateway function for relaying access to the plurality of second memory areas, Storing an address transfer function including addressed specific address information;
In the monitoring control module, in a system function table including address information addressed to a memory area stored in the memory device for each system function, the system function table identifies each system function identification information Changing the address information of each system function corresponding to the address function to the address information addressed to the one first memory area in which the address movement function is stored;
Wherein, in the memory access module, when a call of a specific system function among the system functions is requested, based on the changed address information of the specific system function identified in the system function table, Accessing a first memory area of the memory and calling the address transfer function;
In the memory access module, accessing the specific memory area based on the specific address information by the address transfer function and calling the handler gateway function; And
The memory access module accesses a second memory area in which a specific monitoring function mapped to the system function identification information of the specific system function is stored by the handler gateway function to call the specific monitoring function ≪ / RTI >
The memory access module comprising:
Storing address information of a structure based on the number of bits smaller than the number of bits corresponding to the entire memory area of the memory device and storing the address information in the memory area of the memory device Wherein the system function is accessible to the computer system. A computer-readable recording medium recording a program for performing the method of claim 13 or 14.

Images