CN102799523A - Method, apparatus and computer system for dynamically detecting program execution route - Google Patents
Method, apparatus and computer system for dynamically detecting program execution route Download PDFInfo
- Publication number
- CN102799523A CN102799523A CN2012102274789A CN201210227478A CN102799523A CN 102799523 A CN102799523 A CN 102799523A CN 2012102274789 A CN2012102274789 A CN 2012102274789A CN 201210227478 A CN201210227478 A CN 201210227478A CN 102799523 A CN102799523 A CN 102799523A
- Authority
- CN
- China
- Prior art keywords
- instruction
- transinformation
- ter
- locator
- processor
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the invention provides a method, an apparatus and a computer system for dynamically detecting a program execution route, which can realize real-time dynamic detection on the program execution route and have generality for application programs and kernel mode programs. The method comprises the following steps: acquiring an instruction transfer information set of a detected program from an instruction transfer information set recorded in a processor according to a process feature code of the detected program, wherein the instruction transfer information set includes at least one instruction transfer information, each instruction transfer information includes symbol tables of functions, to which the instruction belongs, and the symbol tables run before and after the instruction is transferred; and generating the program execution route of the detected program according to the symbol tables of the functions, to which the instruction belongs, wherein the symbol tables run before and after each instruction is transferred, and the program execution route of the detected program includes a function invoking relationship during running of the detected program. The embodiment of the invention is applicable to the technical field of information.
Description
Technical field
The present invention relates to areas of information technology, relate in particular to a kind of method, device and computer system of dynamic instrumentation program execution path.
Background technology
In the modern computer technology, application program uses the debugging acid can detection application program implementation path in the development phase, knows the implementation of application program, understands inner operation logic, thereby can detect vulnerability of application program.The kernel state program adopts the method that in kernel program, adds sensing point in advance, surveys the execution route of kernel program, detects the leak of application program according to said program implementation path.
Yet, for application program, use the detection mode of debugging acid not to be suitable for the formal problem that produces afterwards of using of trace routine, can't real-time detection.For the kernel state program, use the method that in kernel program, adds sensing point in advance, can make that the performance consumption of system is bigger, and this method only is applicable to that static state is provided with in advance, can't dynamically increase the sensing point real-time detection.
Summary of the invention
Embodiments of the invention provide a kind of method, device and computer system of dynamic instrumentation program execution path, can realize that the dynamic real-time of program execution path is surveyed, and have versatility for application program and kernel state program.Further, for application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
For achieving the above object, embodiments of the invention adopt following technical scheme:
On the one hand; The invention provides a kind of method of dynamic instrumentation program execution path; Said method is applied to have the computer system that the processor of writing function is shifted in instruction; The instruction transinformation set of each program of moving on the said computer system of said processor for recording, said method comprises:
Saidly gathered according to from the set of the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Symbol table according to the function under the instruction that moves before and after said each said each instruction transfer of instructing transinformation to comprise; Generate saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
Accordingly, the present invention also provides a kind of device of dynamic instrumentation program execution path, and said device comprises: acquiring unit and generation unit;
Said acquiring unit; Be used for saidly being gathered by the instruction transinformation of locator(-ter) according to being obtained from the set of the instruction transinformation of processor for recording by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Said generation unit; The symbol table of the function under the instruction that said each instruction that each the instruction transinformation that is used for gathering according to the said instruction transinformation that said acquiring unit obtains comprises moves before and after shifting; Obtain saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
On the other hand; The embodiment of the invention also provides a kind of computer system, comprises having the processor that writing function is shifted in instruction the instruction transinformation set of each program of moving on the said computer system of said processor for recording; It is characterized in that said processor also is used for:
Saidly gathered according to from the set of the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Symbol table according to the function under the instruction that moves before and after said each said each instruction transfer of instructing transinformation to comprise; Generate saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
The embodiment of the invention provides a kind of method, device and computer system of dynamic instrumentation program execution path; This method is applied to have the computer system that the processor of writing function is shifted in instruction; Said instruction transinformation with program of moving on the said computer system of processor for recording of instruction transfer writing function; This method is saidly gathered by the instruction transinformation of locator(-ter) according to being obtained by the process condition code of locator(-ter); Each instruction transinformation that said instruction transinformation is gathered comprises the symbol table of the function under the instruction that moves before and after said each instruction transfer; The symbol table of the function before and after shifting according to each said each instruction of instructing transinformation to comprise then under the instruction of operation, generation obtains said by the program execution path of locator(-ter).This method is gathered owing to from processor, having obtained by the instruction transinformation of locator(-ter) like this; Each bar instruction transinformation during this instruction transinformation is gathered has comprised the symbol table of the function under the instruction that moves before and after said each bar instruction transfer; Thereby computer system can be based on the process condition code of program; Program execution path according to the operational process each time of the instruction transinformation of processor for recording set dynamic real-time locator(-ter) has versatility for application program and kernel state program.Further, for application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
Description of drawings
In order to be illustrated more clearly in the embodiment of the invention or technical scheme of the prior art; To do to introduce simply to the accompanying drawing of required use in embodiment or the description of the Prior Art below; Obviously, the accompanying drawing in describing below only is some embodiments of the present invention, for those of ordinary skills; Under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
Fig. 1 provides a kind of method flow synoptic diagram of dynamic instrumentation program execution path for the embodiment of the invention;
Fig. 2 is by the execution route synoptic diagram of locator(-ter) Program1;
Fig. 3 provides a kind of apparatus structure block diagram of dynamic instrumentation program execution path for the embodiment of the invention;
A kind of computer system that Fig. 4 provides for the embodiment of the invention;
The method flow synoptic diagram of the another kind of dynamic instrumentation program execution path that Fig. 5 provides for the embodiment of the invention;
Fig. 6 for the method for the another kind of dynamic instrumentation program execution path that provides according to the embodiment of the invention generate by the execution route synoptic diagram of locator(-ter) Program1;
Fig. 7 provides the apparatus structure block diagram of another kind of dynamic instrumentation program execution path for the embodiment of the invention;
The another kind of computer system that Fig. 8 provides for the embodiment of the invention.
Embodiment
To combine the accompanying drawing in the embodiment of the invention below, the technical scheme in the embodiment of the invention is carried out clear, intactly description, obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills are not making the every other embodiment that is obtained under the creative work prerequisite, all belong to the scope of the present invention's protection.
Embodiment one,
The embodiment of the invention provides a kind of method of dynamic instrumentation program execution path; This method is applied to have the computer system that the processor of writing function is shifted in instruction; The instruction transinformation of each program of moving on the said computer system of said processor for recording; As shown in Figure 1, this method comprises:
101, saidly gathered according to from the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation.
Wherein, the instruction that each program possibly have in operational process is repeatedly shifted, for example ordinary instruction transfer, the instruction transfer of interrupting or causing unusually, and wherein common transfer instruction comprises redirect, calls and recursion instruction.
Enable the hardware monitoring function of processor in the computer system operational process, the program of moving in the monitoring computer system, and the instruction transinformation of the program of in the core buffer logger computer system of processor, moving.Simultaneously, each computer system is each program distribution process condition code of operation.Each instruction transinformation of processor for recording all has corresponding process condition code like this.Computer system is according to by the process condition code of locator(-ter), from the instruction transinformation of the core buffer record of processor, obtains saidly to be gathered by the instruction transinformation of locator(-ter).
The symbol table of the function before and after said each instruction that 102, comprises according to said each instruction transinformation is shifted under the instruction of operation; Obtain saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
Said each instruction transinformation comprise said instruction shift before and after the symbol table of function under the instruction of operation, the start address of each function of content representation of symbol table, this start address also are the end addresses of the function that links to each other with this function address.Computer system can be confirmed corresponding program according to symbol table like this, thereby can analyze and generate said by the program execution path of locator(-ter).
For instance, passed through 5 instructions in the operational process of locator(-ter) Program1 and shifted, the address redirect of instruction was followed successively by before and after these 5 times instructions were shifted: 003->010; 015->024; 028->012; 015->012; 015->035, the address that processor shifts the front and back instruction according to the symbol table (shown in the table 1) and these the 5 times instructions of the function that is comprised in the locator(-ter), corresponding record is A{Tran 1 by the set of the instruction transinformation of locator(-ter) successively, Tran 2; Tran 3, and Tran 4, Tran 5}, and wherein the symbol table that comprises of Tran 1 is (001; 009), the symbol table that comprises of Tran 2 is (009,021); The symbol table that Tran 3 comprises is (021,016), and the symbol table that Tran 4 comprises is (016; 016), the symbol table that comprises of Tran 5 is (016,031).The corresponding relation of following is-symbol table and function is as shown in table 1.
Table 1
| The functional symbol table | Corresponding function |
| 001 | A?1 |
| 009 | A2 |
| 016 | A3 |
| 021 | A4 |
| 031 | A5 |
Thus, can analyze, this by the program execution path of locator(-ter) Program1 is: A1->A2->A4->A3->A3->A5.
Need to prove that at this can being appeared with the mode of text by the program execution path of locator(-ter) of generation also can appear with the mode of figure.If adopt the mode of figure, referring to shown in Figure 2, the embodiment of the invention is not done concrete qualification to this.
The embodiment of the invention also provides a kind of device 30 of dynamic instrumentation program execution path, and is as shown in Figure 3, and this device comprises: acquiring unit 31 and generation unit 32.
Said acquiring unit 31; Be used for saidly being gathered by the instruction transinformation of locator(-ter) according to being obtained from the instruction transinformation of processor for recording by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation.
Wherein, the instruction that each program possibly have in operational process is repeatedly shifted, for example ordinary instruction transfer, the instruction transfer of interrupting or causing unusually, and wherein common transfer instruction comprises redirect, calls and recursion instruction.
Enable the hardware monitoring function of processor in the computer system operational process, the program of moving in the monitoring computer system, and the instruction transinformation of the program of in the core buffer logger computer system of processor, moving.Simultaneously, each computer system is each program distribution process condition code of operation.Each instruction transinformation of processor for recording all has corresponding process condition code like this.Said acquiring unit 31 is according to by the process condition code of locator(-ter), from the instruction transinformation of the core buffer record of processor, obtains saidly to be gathered by the instruction transinformation of locator(-ter).
Said generation unit 32; The symbol table of the function under the instruction that said each instruction that each the instruction transinformation that is used for gathering according to the said instruction transinformation that said acquiring unit 31 obtains comprises moves before and after shifting; Obtain saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
Said by each the instruction transinformation in the instruction transinformation of the locator(-ter) set comprise said each instruction shift before and after the symbol table of function under the instruction of operation; The start address of each function of content representation of symbol table, this start address also are the end addresses of the function that links to each other with this function address.Said like this generation unit 32 can be confirmed corresponding program according to symbol table, thereby can analyze and generate said by the program execution path of locator(-ter).
For instance, passed through 5 instructions in the operational process of locator(-ter) Program1 and shifted, the address redirect of instruction was followed successively by before and after these 5 times instructions were shifted: 003->010; 015->024; 028->012; 015->012; 015->035, the address that processor shifts the front and back instruction according to the symbol table (shown in the table 1) and these the 5 times instructions of the function that is comprised in the locator(-ter), corresponding record is by the instruction transinformation Tran 1 of locator(-ter) successively, and Tran 2; Tran 3, and Tran 4, and Tran 5, and wherein the symbol table that comprises of Tran 1 is (001; 009), the symbol table that comprises of Tran 2 is (009,021); The symbol table that Tran 3 comprises is (021,016), and the symbol table that Tran 4 comprises is (016; 016), the symbol table that comprises of Tran 5 is (016,031).The corresponding relation of following is-symbol table and function is as shown in table 1, and said then acquiring unit 31 by the process condition code of locator(-ter), obtains that { Tran 1 by the instruction transinformation set A of locator(-ter) according to said from processor; Tran 2; Tran 3, and Tran 4, Tran 5}.
Thus, said generation unit 32 can analyze, and this by the program execution path of locator(-ter) Program1 is: A1->A2->A4->A3->A3->A5.
Need to prove that at this what said generation unit 32 generated can be appeared with the mode of text by the program execution path of locator(-ter), also can appear with the mode of figure.If adopt the mode of figure, referring to shown in Figure 2, the embodiment of the invention is not done concrete qualification to this.
The embodiment of the invention also provides a kind of computer system 40; As shown in Figure 4; Comprise having the processor 41 that writing function is shifted in instruction, the instruction transinformation of each program of moving on the said computer system of said processor 41 records, said processor 41 also is used for:
Saidly gathered according to from the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Symbol table according to the function under the instruction that moves before and after said each said each instruction transfer of instructing transinformation to comprise; Generate saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
Method, device and the computer system of a kind of dynamic instrumentation program execution path that the embodiment of the invention provides; This method is applied to have the computer system that the processor of writing function is shifted in instruction; Said instruction transinformation with program of moving on the said computer system of processor for recording of instruction transfer writing function; This method is saidly gathered by the instruction transinformation of locator(-ter) according to being obtained by the process condition code of locator(-ter); Each instruction transinformation that said instruction transinformation is gathered comprises the symbol table of the function under the instruction that moves before and after said each instruction transfer; The symbol table of the function before and after shifting according to each said each instruction of instructing transinformation to comprise then under the instruction of operation, generation obtains said by the program execution path of locator(-ter).This method is gathered owing to can from processor, obtaining by the instruction transinformation of locator(-ter) like this; Each bar instruction transinformation during this instruction transinformation is gathered has comprised the symbol table of the function under the instruction that moves before and after said each bar instruction transfer; Thereby computer system can be based on the process condition code of program; Gather the dynamic real-time locator(-ter) program execution path of operational process each time according to the instruction transinformation of processor for recording, have versatility for application program and kernel state program.For application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
Embodiment two,
The embodiment of the invention also provides a kind of method of dynamic instrumentation program execution path, and is as shown in Figure 5, and this method comprises:
The instruction transinformation of the program of 501, moving on the said computer system with said processor for recording is stored in pre-configured memory block.
Wherein, the instruction that each program possibly have in operational process is repeatedly shifted, for example ordinary instruction transfer, the instruction transfer of interrupting or causing unusually, and wherein common transfer instruction comprises redirect, calls and recursion instruction.
Enable the hardware monitoring function of processor in the computer system operational process, the program of moving in the monitoring computer system, and the instruction transinformation of the program of in the core buffer logger computer system of processor, moving.Simultaneously, each computer system is each program distribution process condition code of operation.Each instruction transinformation of processor for recording all has corresponding process condition code like this.
But the space of the buffer zone of processor is limited; In order to guarantee that this can be by complete noting by the instruction transinformation in the locator(-ter) whole service process; Computer system can pre-configured memory block, and the instruction transinformation of the program that is used for moving on the said computer system with said processor for recording is stored in pre-configured memory block.
Wherein, this computer system can be passed through the instruction transinformation of the mode of interruption or poll from the buffer zone read processor record of processor, then the instruction transinformation that writes down in this buffer zone is stored in pre-configured memory block.
Preferably; After being switched by the process of locator(-ter); This address space corresponding physical internal memory by the process of locator(-ter) changes, and said pre-configured memory block is that operating system is in the spendable memory block of kernel state computer-chronograph system.
502, according to by in the instruction transinformation of the process condition code of locator(-ter) from be stored in pre-configured memory block; Obtain and saidly gathered by the instruction transinformation of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise said each instruction shift before and after symbol table and the privilege level of function of function under the instruction of operation.
503, judge whether comprise first kind instruction transinformation in the said instruction transinformation set, said first kind instruction transinformation is the identical instruction transinformation of symbol table of the function under the instruction of instructing before and after shifting.
If comprise first kind instruction transinformation in the said instruction transinformation set, carry out 504 steps; Otherwise, carry out 505 steps.
Wherein, the instruction that the symbol table of the function that the instruction before and after instruction is shifted is affiliated is identical is shifted to the instruction of non-function call and is shifted, and the instruction transfer for function call is shifted in the different instruction of the symbol table of the function under the instruction before and after the instruction transfer.
For instance; Referring to table 1 and shown in Figure 2; The symbol table that is comprised by the instruction transinformation Tran 4 of locator(-ter) Program1 is identical for the symbol table of the function under the instruction of operation before and after the instruction transfer of (016,016), explains that the function A3 of Program1 has only carried out instructing in the code of A3 shifting; And do not call other function, then to judge this instruction transinformation Tran 4 be first kind instruction transinformation to computer system.
504, filter said first kind instruction transinformation.
For fear of the instruction transinformation that is comprised non-function call in the set of the instruction transinformation of locator(-ter), said computer system can be filtered said first kind instruction transinformation.
Computer system can be filtered Tran 4 like this, and what filter out first kind instruction transinformation is that { Tran 1, and Tran 2, and Tran 3, Tran 5} by the instruction transinformation set A of locator(-ter) Program1.
505, judge whether said instruction transinformation comprises second type of instruction transinformation in gathering, said second type of instruction transinformation is the privilege level instruction transinformation different with pre-configured privilege level of the function under the instruction of instruction transfer back operation.
If comprise second type of instruction transinformation in the said instruction transinformation set, carry out 506 steps; Otherwise, carry out 507 steps.
Wherein, the processor of computer system provides four kinds of privilege levels usually: privilege level Ring0, Ring1, Ring2 and Ring3.Four kinds of privilege levels of processor are the function of corresponding different privilege levels respectively, and promptly function is divided into the function of Ring0, Ring1, Ring2 and four kinds of privilege levels of Ring3.Usually privilege level is that the function of Ring0 is kernel codes such as operating system program code, device driver code, and processor is in privilege level Ring0 when other function of operation Ring0 level; And privilege level Ring3 is the code of application program, and processor is in privilege level Ring3 when running application code.
If only need to survey by the function calls relation of locator(-ter) at a certain privilege level; This computer system can pre-configured privilege level, judges according to said pre-configured privilege level whether the privilege level of the function under the instruction of back operation is shifted in said each instruction identical with pre-configured privilege level.
506, filter said second type of instruction transinformation.
If comprise second type of instruction transinformation in the said instruction transinformation set, filter said second type of instruction transinformation.
For instance, if pre-configured privilege level is Ring3 and Ring0, represent that promptly computer system only need survey the function calling relationship that privilege level is Ring0 and Ring3.The symbol table and the privilege level of the function before and after the instruction that is comprised by each instruction transinformation of the instruction transinformation of locator(-ter) set of having filtered first kind instruction transinformation is shifted under the instruction of operation are respectively: Tran 1 (001-Ring3; 009-Ring3), and Tran2 (009-Ring3,021-Ring0); Tran 3 (021-Ring0; 016-Ring2), and Tran 5 (016-Ring2,031-Ring3).The instruction of Tran 3 is shifted to the instruction that jumps to Ring2 from Ring0 and is shifted like this, and this Tran 3 is second type of instruction transinformation.This computer system can be from being filtered out Tran3 the instruction transinformation set A of locator(-ter); What filter out second type of instruction transinformation like this is { Tran 1 (001-Ring3 by the instruction transinformation set A of locator(-ter) Program1; 009-Ring3), and Tran2 (009-Ring3,021-Ring0); Tran 5 (016-Ring2,031-Ring3) }.
507, generation is said by the program execution path of locator(-ter).
After having filtered first kind instruction transinformation and second type of instruction transinformation, computer system generates by the program execution path of locator(-ter): A1->A2->A4->A5.
Need to prove that at this can being appeared with the mode of text by the program execution path of locator(-ter) of generation also can appear with the mode of figure.If adopt the mode of figure, referring to shown in Figure 6, the embodiment of the invention is not done concrete qualification to this.
508, judge whether comprise the 3rd type of instruction transinformation in the said instruction transinformation set.
Wherein, said the 3rd type of instruction transinformation is the privilege level difference of the function under the instruction that moves before and after instructing transfer.
Content for the function call in the detail knowledge program execution path process more; The privilege level of the function before and after said computer system can shift according to each instruction under the instruction of operation confirms whether corresponding function call is shifted in each instruction is to comprise the 3rd type of instruction transinformation.
For example, generated said by the execution route of locator(-ter): A1-A2-A4-behind the A5, be { Tran 1 (001-Ring3 by the corresponding instruction transinformation set A of the execution route of locator(-ter) according to this; 009-Ring3), and Tran2 (009-Ring3,021-Ring0); Tran 5 (016-Ring2,031-Ring3) }, can confirm that Tran2 and Tran 5 are for striding the 3rd type of instruction transinformation of privilege level; And do with mark, supply the user to check analysis.
The privilege level of the function before and after wherein, said instruction is shifted under the instruction of operation can be judged according to the memory address at said code place.For example, in linux system, the address of 32 application programs is 0-0xC0000000, and privilege level is that the function address of Ring0 is 0xC0000001-0xFFFFFFFF.If the address at said code place is kept at the memory block of 0-0xC0000000, then linux system thinks that this function is the function of Ring3 privilege level like this; If said code is kept at the memory block of 0xC0000001-0xFFFFFFFF, then linux system thinks that this function is the function of Ring0 privilege level.The processor that Ring1 is different with the Ring2 privilege level has different definition, can distinguish according to the different definition of processor.
509, said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
Need explanation at this; In embodiments of the present invention; After the instruction transinformation set of obtaining program to be detected, computer system has been filtered first kind instruction transinformation successively earlier, refilters second type of instruction transinformation; The generator program execution route is confirmed the 3rd type of instruction transinformation more then.Certainly; Filter first kind instruction transinformation, second type of instruction transinformation and confirm that the 3rd type is instructed the order of transinformation arbitrarily to change; Purpose is intended to filter first kind instruction transinformation and second type of instruction transinformation; And confirm the 3rd type of instruction transinformation, so need not specific sequencing.
Further need to prove, in actual application, not necessarily need both filter first kind instruction transinformation and second type of instruction transinformation, also need confirm the 3rd type of instruction transinformation.Can choose any step as the case may be: filter first kind instruction transinformation, filter second type of instruction transinformation and confirm the 3rd type of instruction transinformation.
The method of a kind of dynamic instrumentation program execution path that the embodiment of the invention provides; This method is applied to have the computer system that the processor of writing function is shifted in instruction; Said instruction transinformation with program of moving on the said computer system of processor for recording of instruction transfer writing function; This method is saidly gathered by the instruction transinformation of locator(-ter) according to being obtained by the process condition code of locator(-ter); Each instruction transinformation that said instruction transinformation is gathered comprises the symbol table of the function under the instruction that moves before and after said each instruction transfer; The symbol table of the function before and after shifting according to each said each instruction of instructing transinformation to comprise then under the instruction of operation, generation obtains said by the program execution path of locator(-ter).This method is gathered owing to can from processor, obtaining by the instruction transinformation of locator(-ter) like this; Each bar instruction transinformation during this instruction transinformation is gathered has comprised the symbol table of the function under the instruction that moves before and after said each bar instruction transfer; Thereby computer system can be based on the process condition code of program; Instruction transinformation set dynamic real-time according to processor for recording is surveyed the program execution path of operational process each time, has versatility for application program and kernel state program.For application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
Embodiment three,
The embodiment of the invention provides a kind of device 70 of dynamic instrumentation program execution path, and said device 70 comprises: acquiring unit 71, first filter element 72, the 3rd filter element 73, generation unit 74 and definite unit 75.
Said acquiring unit 71 is used for the instruction transinformation of said processor for recording is stored in pre-configured memory block; Saidly gathered according to from be stored in the set of pre-configured instructions stored transinformation, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, described each instruction transinformation comprise said each instruction shift before and after symbol table and the privilege level of function of function under the instruction of operation.
Wherein, the instruction that each program possibly have in operational process is repeatedly shifted, for example ordinary instruction transfer, the instruction transfer of interrupting or causing unusually, and wherein common transfer instruction comprises redirect, calls and recursion instruction.
Enable the hardware monitoring function of processor in the computer system operational process, the program of moving in the monitoring computer system, and the instruction transinformation of the program of in the core buffer logger computer system of processor, moving.Simultaneously, each computer system is each program distribution process condition code of operation.Each instruction transinformation of processor for recording all has corresponding process condition code like this.
But the space of the buffer zone of processor is limited; In order to guarantee that this can be by complete noting by the instruction transinformation in the locator(-ter) whole service process; Computer system can pre-configured memory block, and the instruction transinformation of the program that said acquiring unit 71 moves at first can the said computer system with said processor for recording is stored in pre-configured memory block.
Preferably; After being switched by the process of locator(-ter); This address space corresponding physical internal memory by the process of locator(-ter) changes; Said pre-configured memory block be operating system in the spendable memory block of kernel state computer-chronograph system, the instruction transinformation of the program of moving on the said computer system of said like this acquiring unit 71 with said processor for recording is stored in operating system in the spendable memory block of kernel state computer-chronograph system.
Wherein, This said acquiring unit 71 can pass through the instruction transinformation of the mode of interruption or poll from the buffer zone read processor record of processor; Then the instruction transinformation that writes down in this buffer zone is stored in pre-configured memory block, thereby makes that said acquiring unit 71 can be according to being obtained by the instruction transinformation of locator(-ter) from pre-configured memory block by the process condition code of locator(-ter).
Said first filter element 72; Be used for judging whether the instruction transinformation set that said acquiring unit obtains comprises first kind instruction transinformation; Said first kind instruction transinformation is the identical instruction transinformation of symbol table of the function under the instruction before and after the instruction transfer; And, filter said first kind instruction transinformation if comprise first kind instruction transinformation in the set of said instruction transinformation.
Wherein, the instruction that the symbol table of the function that the instruction before and after instruction is shifted is affiliated is identical is shifted to the instruction of non-function call and is shifted, and the instruction transfer for function call is shifted in the different instruction of the symbol table of the function under the instruction before and after the instruction transfer.
For fear of the instruction transinformation that is comprised non-function call in the set of the instruction transinformation of locator(-ter) that said acquiring unit 71 obtains, said first filter element 72 can filter said first kind instruction transinformation.
For instance;, identical referring to table 1 by the symbol table of the function under the instruction of operation before and after the instruction of the instruction transinformation Tran 4 (016,016) of the locator(-ter) Program1 transfer with shown in Figure 2; The function A3 that Program1 is described has only carried out the instruction transfer in the code of A3; And not calling other function, then said first filter element 72 is judged this instruction transinformation Tran 4 (016,016) and is first kind instruction transinformation.Said like this first filter element 72 can filter Tran 4.What filter out first kind instruction transinformation is that { Tran 1, and Tran 2, and Tran 3, Tran 5} by the instruction transinformation set A of locator(-ter) Program1.
Said second filter element 73; Be used for judging whether the said instruction transinformation set that said first filter element filters said first kind instruction transinformation comprises first kind instruction transinformation, said first kind instruction transinformation shifts the privilege level second type instruction transinformation different with pre-configured privilege level of the function under the instruction of back operation for instruction; Comprise said second type of instruction transinformation if said first filter element filters in the said instruction transinformation set of said first kind instruction transinformation, filter said second type of instruction transinformation.
Wherein, the processor of computer system provides four kinds of privilege levels usually: privilege level Ring0, Ring1, Ring2 and Ring3.Four kinds of privilege levels of processor are the function of corresponding different privilege levels respectively, and promptly function is divided into the function of Ring0, Ring1, Ring2 and four kinds of privilege levels of Ring3.Usually privilege level is that the function of Ring0 is kernel codes such as operating system program code, device driver code, and processor is in privilege level Ring0 when other function of operation Ring0 level; And privilege level Ring3 is the code of application program, and processor is in privilege level Ring3 when running application code.
If only need to survey by the function calls relation of locator(-ter) at a certain privilege level; This computer system can pre-configured privilege level, and said second filter element 73 is used for judging according to said pre-configured privilege level whether the privilege level of the function under the instruction of back operation is shifted in said each instruction identical with pre-configured privilege level.Comprise in the said instruction transinformation set that instruction shifts the privilege level second type instruction transinformation different with pre-configured privilege level of the function under the instruction of back operation if said second filter element 73 is judged, filter said second type of instruction transinformation.
For instance, if pre-configured privilege level is Ring0 and Ring3, i.e. it is the function calling relationship of Ring0 and Ring3 that expression only needs to survey privilege level.Filtered first kind instruction transinformation by in the set of the instruction transinformation of locator(-ter), the symbol table and the privilege level of the function before and after instruction that each instruction transinformation comprises is shifted under the instruction of operation are respectively: Tran 1 (001-Ring3,009-Ring3); Tran2 (009-Ring3; 021-Ring0), and Tran 3 (021-Ring0,016-Ring2); Tran 5 (016-Ring2,031-Ring3).The instruction of Tran 3 is shifted to the instruction that jumps to Ring2 from Ring0 and is shifted like this, and said second filter element 73 judges that Tran 3 is second type of instruction transinformation.Said second filter element 74 can be from being filtered out Tran3 the instruction transinformation set A of locator(-ter); What filter out second type of instruction transinformation like this is { Tran 1 (001-Ring3 by the instruction transinformation set A of locator(-ter) Program1; 009-Ring3), and Tran2 (009-Ring3,021-Ring0); Tran 5 (016-Ring2,031-Ring3) }.
Said generation unit 74; The symbol table of the function under the instruction that said each instruction that each the instruction transinformation that is used for gathering according to said instruction transinformation comprises moves before and after shifting; Obtain saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
After first filter element 72 and second filter element 73 had filtered first kind instruction transinformation and second type of instruction transinformation respectively, said generation unit 74 generated by the program execution path of locator(-ter): A1->A2->A4->A5.
Need to prove that at this what said generation unit 74 generated can be appeared with the mode of text by the program execution path of locator(-ter), also can appear with the mode of figure.If adopt the mode of figure, referring to shown in Figure 6.The embodiment of the invention is not done concrete qualification to what said generation unit 75 generated by the presentation mode of the program execution path of locator(-ter).
Said definite unit 75; Whether the instruction transinformation that is used for judging the program execution path that said generation unit 74 generates comprises the 3rd type of instruction transinformation, and the function privilege level under the instruction that said the 3rd type of instruction transinformation is operation before and after instruction is shifted is different; If comprise said the 3rd type of instruction transinformation, said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
Content for the function call in the detail knowledge program execution path process more; The privilege level of the function before and after said definite unit 75 can shift according to each instruction under the instruction of operation confirms whether corresponding function call is shifted in each instruction is to comprise the 3rd type of instruction transinformation.
For example, generate by the execution route of locator(-ter): A1-at said generation unit A2-A4-behind the A5, be { Tran 1 (001-Ring3 by the corresponding instruction transinformation set A of the execution route of locator(-ter) according to this; 009-Ring3), and Tran2 (009-Ring3,021-Ring0); Tran 5 (016-Ring2,031-Ring3) }, can confirm that Tran2 and Tran 5 are for striding the 3rd type of instruction transinformation of privilege level; And do with mark, supply the user to check analysis.
The privilege level of the function before and after wherein, said instruction is shifted under the instruction of operation can be judged according to the memory address at said code place.For example, in linux system, the address of 32 application programs is 0-0xC0000000, and privilege level is that the function address of Ring0 is 0xC0000001-0xFFFFFFFF.If the address at said code place is kept at the memory field of 0-0xC0000000, then linux system thinks that this function is the function of Ring3 privilege level like this; If said code is kept at the memory field of 0xC0000001-0xFFFFFFFF, then linux system thinks that this function is the function of Ring0 privilege level.The processor that Ring1 is different with the Ring2 privilege level has different definition, can distinguish according to the different definition of processor.
Need explanation at this; In embodiments of the present invention; Obtain the instruction transinformation set of program to be detected at said acquiring unit 71 after; Computer system has been filtered first kind instruction transinformation through first filter element 72, and second filter element 73 filters second type of instruction transinformation, and the 3rd type of instruction transinformation confirmed in said definite unit 75.Certainly, in actual application, not necessarily need both comprise first filter element 72, second filter element 73, and also comprise and confirm unit 75.Said as the case may be device can be chosen any at least one: first filter element 72, second filter element 73 and definite unit 75.
The device of a kind of dynamic instrumentation program execution path that the embodiment of the invention provides, this device comprise acquiring unit, first filter element, second filter element, generation unit and definite unit.The instruction transinformation of acquiring unit according to all programs of being moved from the computer system of processor for recording by the process condition code of locator(-ter), obtain and saidly gathered by the instruction transinformation of locator(-ter).Can pass through first filter element, second filter element filtration first kind instruction transinformation and second type of instruction transinformation then; Generation unit is according to the instruction transinformation set of having filtered first kind instruction transinformation and second type of instruction transinformation like this; Generate this by the program execution path of locator(-ter), and confirm the instruction transinformation of striding privilege level in this program execution path through definite unit.Like this this device since each bar instruction transinformation that acquiring unit obtains by in the instruction transinformation of the locator(-ter) set comprised said each bar instruction shift before and after the symbol table of function under the instruction of operation; Thereby generation unit can be based on the process condition code of program; The execution route of gathering the operational process each time of dynamic real-time generator program according to the instruction transinformation of processor for recording; Has versatility for application program and kernel state program; And can also unwanted instruction transinformation be filtered according to each by the demands of different of locator(-ter), like first kind instruction transinformation and second type of instruction transinformation.Further, for application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
Embodiment four,
The embodiment of the invention also provides a kind of computer system 80, and is as shown in Figure 8, and this computer system comprises having the processor 81 and storer 82 that writing function is shifted in instruction.
Wherein, said processor 81 is used to write down the instruction transinformation of each program of moving on the said computer system.
Said storer 82 is used to store the instruction transinformation that said processor 81 writes down each program of operation.
Said processor 81; Also be used for saidly being gathered by the instruction transinformation of locator(-ter) according to being obtained from the instruction transinformation of said processor for recording by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise said each instruction shift before and after the symbol table of function under the instruction of operation.
Said processor 81; Also be used for if the set of said instruction transinformation comprises first kind instruction transinformation; Said first kind instruction transinformation is the identical instruction transinformation of symbol table of the function under the instruction before and after the instruction transfer, filters said first kind instruction transinformation.
Said processor 81; Also be used for if the set of said instruction transinformation comprises second type of instruction transinformation; Said second type of instruction transinformation shifts the privilege level second type instruction transinformation different with pre-configured privilege level of the function under the instruction of back operation for instruction, filter said second type of instruction transinformation.
Said processor 81; Also be used for if the set of said instruction transinformation comprises the 3rd type of instruction transinformation; The privilege level of the function under the instruction that said the 3rd type of instruction transinformation is operation before and after instruction is shifted is different, and said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
Said processor 81, the instruction transinformation of the program that also is used for moving on the computer system with said processor for recording is stored in the pre-configured memory block of storer 82.
Wherein, said pre-configured memory block is that operating system is in the spendable memory block of kernel state computer-chronograph system.
The embodiment of the invention also provides a kind of computer system, and this system comprises processor and storer.The instruction transinformation set of the said processor for recording of said cell stores, said processor are stored in the instruction transinformation set of processor for recording the pre-configured memory block of storer.Said then processor is saidly gathered by the instruction transinformation of locator(-ter) according to being obtained from store wherein the set of instructions stored transinformation by the process condition code of locator(-ter); Can filter first kind instruction transinformation and second type of instruction transinformation then; Like this according to the instruction transinformation set of having filtered first kind instruction transinformation and second type of instruction transinformation; Generate this by the program execution path of locator(-ter), and confirm the instruction transinformation of striding level of privilege in this program execution path.Like this since each bar instruction transinformation that this system obtains by in the instruction transinformation of the locator(-ter) set comprised said each bar instruction shift before and after the symbol table of function under the instruction of operation; Thereby the execution route of operational process each time that can the dynamic real-time generator program; Has versatility for application program and kernel state program; And can also be according to each by the demands of different of locator(-ter); Unwanted instruction transinformation is filtered, like first kind instruction transinformation and second type of instruction transinformation.Further, for application program, can both realize dynamic instrumentation program implementation path in the different operational phases of program; For the detection of kernel state program execution path, can reduce the performance loss of system.
One of ordinary skill in the art will appreciate that: all or part of step that realizes said method embodiment can be accomplished through the relevant hardware of programmed instruction; Aforesaid program can be stored in the computer read/write memory medium; This program the step that comprises said method embodiment when carrying out; And aforesaid storage medium comprises: various media that can be program code stored such as ROM, RAM, magnetic disc or CD.
The above; Be merely embodiment of the present invention, but protection scope of the present invention is not limited thereto, any technician who is familiar with the present technique field is in the technical scope that the present invention discloses; Can expect easily changing or replacement, all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection domain of said claim.
Claims (18)
1. the method for a dynamic instrumentation program execution path; Said method is applied to have the computer system that the processor of writing function is shifted in instruction; The instruction transinformation set of each program of moving on the said computer system of said processor for recording is characterized in that said method comprises:
Saidly gathered according to from the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Symbol table according to the function under the instruction that moves before and after said each said each instruction transfer of instructing transinformation to comprise; Generate saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
2. method according to claim 1 is characterized in that, saidly also comprises before by the program execution path of locator(-ter) generating:
Judge whether comprise first kind instruction transinformation in the said instruction transinformation set, said first kind instruction transinformation is the identical instruction transinformation of symbol table of the function under the instruction of instructing before and after shifting;
If comprise said first kind instruction transinformation in the said instruction transinformation set, by the said first kind instruction of filtration transinformation the set of the instruction transinformation of locator(-ter), obtain the set of first kind instruction transinformation from said.
3. method according to claim 1 and 2 is characterized in that, each instruction transinformation that said instruction transinformation is gathered also comprises the privilege level of the function under the instruction that moves before and after said each instruction transfer;
Saidly also comprise before by the program execution path of locator(-ter) generating:
Judge whether said instruction transinformation comprises second type of instruction transinformation in gathering, said second type of instruction transinformation is the privilege level instruction transinformation different with pre-configured privilege level of the function under the instruction of instruction transfer back operation;
If comprise said second type of instruction transinformation in the said instruction transinformation set, filter said second type of instruction transinformation.
4. method according to claim 3 is characterized in that, also comprises after by the program execution path of locator(-ter) in that said generation is said:
Judge whether comprise the 3rd type of instruction transinformation in the said instruction transinformation set, the privilege level of the function under the instruction that said the 3rd type of instruction transinformation is operation before and after instruction is shifted is different;
If comprise the 3rd type of instruction transinformation in the said instruction transinformation set, said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
5. according to each described method of claim 1-4, it is characterized in that, saidly also comprised by before the instruction transinformation of the locator(-ter) set according to being obtained by the process condition code of locator(-ter):
The instruction transinformation of the program of moving on the computer system with said processor for recording is stored in pre-configured memory block;
Saidly saidly be specially by the set of the instruction transinformation of locator(-ter) according to from the set of the instruction transinformation of said processor for recording, being obtained by the process condition code of locator(-ter):
According to by in the instruction transinformation set of the process condition code of locator(-ter) from be stored in pre-configured storage, obtain and saidly gathered by the instruction transinformation of locator(-ter).
6. method according to claim 5 is characterized in that, said pre-configured memory field is that operating system is in the spendable memory block of kernel state computer-chronograph system.
7. the device of a dynamic instrumentation program execution path is characterized in that, said device comprises: acquiring unit and generation unit;
Said acquiring unit; Be used for saidly being gathered by the instruction transinformation of locator(-ter) according to being obtained from the set of the instruction transinformation of processor for recording by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Said generation unit; The symbol table of the function under the instruction that said each instruction that each the instruction transinformation that is used for gathering according to the said instruction transinformation that said acquiring unit obtains comprises moves before and after shifting; Obtain saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
8. device according to claim 7; It is characterized in that; Said device also comprises first filter element; Be used for judging whether instruction transinformation set that said acquiring unit obtains comprises the identical instruction transinformation of symbol table of the function under the instruction of instruction before and after shifting, if comprise first kind instruction transinformation in the set of said instruction transinformation, filters said first kind instruction transinformation.
9. according to claim 7 or 8 described devices, it is characterized in that each instruction transinformation that said instruction transinformation is gathered also comprises the privilege level of the function under the instruction that moves before and after said each instruction transfer;
Said device also comprises second filter element, is used for judging whether said instruction transinformation set that said acquiring unit obtains comprises that instruction shifts the privilege level instruction transinformation different with pre-configured privilege level of the function under the instruction of back operation; If comprise said second type of instruction transinformation in the said instruction transinformation set, filter said second type of instruction transinformation.
10. device according to claim 9 is characterized in that, each instruction transinformation that said instruction transinformation is gathered also comprises the privilege level of the function under the instruction that moves before and after said each instruction transfer;
Said device also comprises definite unit; Be used for judging whether the instruction transinformation set that said acquiring unit obtains comprises the 3rd type of instruction transinformation, and the function privilege level under the instruction that said the 3rd type of instruction transinformation is operation before and after instruction is shifted is different; If comprise said the 3rd type of instruction transinformation in the said instruction transinformation set, said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
11., it is characterized in that said acquiring unit specifically is used for: the instruction transinformation set of said processor for recording is stored in pre-configured memory block according to each described device of claim 7-10;
According to by the process condition code of locator(-ter) from be stored in the set of pre-configured instructions stored transinformation, obtain and saidly gathered by the instruction transinformation of locator(-ter).
12. device according to claim 11 is characterized in that, said pre-configured memory block is that operating system is in the spendable memory block of kernel state computer-chronograph system.
13. a computer system comprises having the processor that writing function is shifted in instruction, the instruction transinformation set of each program of moving on the said computer system of said processor for recording is characterized in that said processor also is used for:
Saidly gathered according to from the set of the instruction transinformation of said processor for recording, being obtained by the instruction transinformation of locator(-ter) by the process condition code of locator(-ter); The set of said instruction transinformation comprises at least one instruction transinformation, said each instruction transinformation comprise instruction shift before and after the symbol table of function under the instruction of operation;
Symbol table according to the function under the instruction that moves before and after said each said each instruction transfer of instructing transinformation to comprise; Generate saidly by the program execution path of locator(-ter), said program execution path by locator(-ter) comprises said by the function calling relationship in the locator(-ter) operational process.
14. system according to claim 13; It is characterized in that; Said processor, also be used for generate said by the program execution path of locator(-ter) before, if comprise first kind instruction transinformation in the set of said instruction transinformation; Said first kind instruction transinformation is the identical instruction transinformation of symbol table of the function under the instruction before and after the instruction transfer, filters said first kind instruction transinformation.
15., it is characterized in that each instruction transinformation that said instruction transinformation is gathered also comprises the privilege level of the function under the instruction that moves before and after said each instruction transfer according to claim 13 or 14 described systems;
Said processor; Also be used for generate said by the program execution path of locator(-ter) before; If comprise second type of instruction transinformation in the said instruction transinformation set; Said second type of instruction transinformation is the privilege level instruction transinformation different with pre-configured privilege level of the function under the instruction of instruction transfer back operation, filters said second type of instruction transinformation.
16. system according to claim 15; It is characterized in that; Said processor, also be used for said generation said by the program execution path of locator(-ter) after, if comprise the 3rd type of instruction transinformation in the set of said instruction transinformation; The privilege level of the function under the instruction that said the 3rd type of instruction transinformation is operation before and after instruction is shifted is different, and said the 3rd type of corresponding function call of instruction transinformation confirmed as the function call of striding privilege level.
17. according to each described system of claim 13-16; It is characterized in that; Said system also comprises storer, said processor, and the instruction transinformation of the program that also is used for moving on the computer system with said processor for recording is stored in the pre-configured memory block of storage unit.
18. system according to claim 17 is characterized in that, said pre-configured memory block is that operating system is in the spendable memory block of kernel state computer-chronograph system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210227478.9A CN102799523B (en) | 2012-07-03 | 2012-07-03 | Method, apparatus and computer system for dynamically detecting program execution route |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210227478.9A CN102799523B (en) | 2012-07-03 | 2012-07-03 | Method, apparatus and computer system for dynamically detecting program execution route |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102799523A true CN102799523A (en) | 2012-11-28 |
| CN102799523B CN102799523B (en) | 2015-06-17 |
Family
ID=47198636
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210227478.9A Expired - Fee Related CN102799523B (en) | 2012-07-03 | 2012-07-03 | Method, apparatus and computer system for dynamically detecting program execution route |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102799523B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103269341A (en) * | 2013-05-08 | 2013-08-28 | 腾讯科技（深圳）有限公司 | Spyware analysis method and computer system |
| CN103761175A (en) * | 2013-11-25 | 2014-04-30 | 中国科学院计算技术研究所 | System and method for monitoring program execution paths under Linux system |
| CN104715190A (en) * | 2015-02-03 | 2015-06-17 | 中国科学院计算技术研究所 | Method and system for monitoring program execution path on basis of deep learning |
| CN106708732A (en) * | 2016-12-12 | 2017-05-24 | 中国航空工业集团公司西安航空计算技术研究所 | Software running detection method based on feature codes |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080256517A1 (en) * | 2006-10-18 | 2008-10-16 | International Business Machines Corporation | Method and System for Automatically Generating Unit Test Cases Which Can Reproduce Runtime Problems |
| CN101539883A (en) * | 2009-05-05 | 2009-09-23 | 北京和利时系统工程有限公司 | Error tracking method of embedded system and device thereof |
| CN102163143A (en) * | 2011-04-28 | 2011-08-24 | 北京北大众志微系统科技有限责任公司 | A method realizing prediction of value association indirect jump |
-
2012
- 2012-07-03 CN CN201210227478.9A patent/CN102799523B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080256517A1 (en) * | 2006-10-18 | 2008-10-16 | International Business Machines Corporation | Method and System for Automatically Generating Unit Test Cases Which Can Reproduce Runtime Problems |
| CN101539883A (en) * | 2009-05-05 | 2009-09-23 | 北京和利时系统工程有限公司 | Error tracking method of embedded system and device thereof |
| CN102163143A (en) * | 2011-04-28 | 2011-08-24 | 北京北大众志微系统科技有限责任公司 | A method realizing prediction of value association indirect jump |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103269341A (en) * | 2013-05-08 | 2013-08-28 | 腾讯科技（深圳）有限公司 | Spyware analysis method and computer system |
| CN103269341B (en) * | 2013-05-08 | 2016-02-17 | 腾讯科技（深圳）有限公司 | A kind of analytical method of spying program and computer system |
| CN103761175A (en) * | 2013-11-25 | 2014-04-30 | 中国科学院计算技术研究所 | System and method for monitoring program execution paths under Linux system |
| CN103761175B (en) * | 2013-11-25 | 2016-08-17 | 中国科学院计算技术研究所 | Program execution path monitoring system and method under a kind of linux system |
| CN104715190A (en) * | 2015-02-03 | 2015-06-17 | 中国科学院计算技术研究所 | Method and system for monitoring program execution path on basis of deep learning |
| CN104715190B (en) * | 2015-02-03 | 2018-02-06 | 中国科学院计算技术研究所 | A kind of monitoring method and system of the program execution path based on deep learning |
| CN106708732A (en) * | 2016-12-12 | 2017-05-24 | 中国航空工业集团公司西安航空计算技术研究所 | Software running detection method based on feature codes |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102799523B (en) | 2015-06-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3213217B1 (en) | Historical control flow visualization in production diagnostics | |
| CN100538656C (en) | The method and apparatus of debugging computer program in distributed debugger | |
| CN102650938B (en) | Management method for log system and log system | |
| CN102799523A (en) | Method, apparatus and computer system for dynamically detecting program execution route | |
| CN103049371A (en) | Testing method and testing device of Android application programs | |
| CN101122880A (en) | Embedded type system of embed type debugging device and embedded type system debugging method | |
| CN105468505A (en) | Coverage test method and coverage test device | |
| CN105446868A (en) | System compatibility testing method, test case management method and related devices | |
| CN104346274A (en) | Program debugger and program debugging method | |
| CN102486938B (en) | Method for rapid detection of memory and device | |
| CN101876939B (en) | System test method and device | |
| CN102207956A (en) | Database management method, database management system and program thereof | |
| CN105335407A (en) | Data automation test method and apparatus | |
| KR101976629B1 (en) | Commit sensitive tests | |
| CN104252402A (en) | Program debugging method and device | |
| CN105279092A (en) | Software testing method and apparatus | |
| CN104572431A (en) | Test method and test device | |
| US7086033B2 (en) | Software debugger having a monitor for monitoring conditional statements within a software program | |
| CN100470495C (en) | Automated test method and apparatus for quick positioning question | |
| CN110188023B (en) | Resource health check method and resource health check device | |
| CN103218297A (en) | Screening method and device of test data | |
| CN103309741B (en) | Call the method and apparatus of pin function | |
| CN101349994B (en) | Method, system and apparatus for positioning program error | |
| CN101853198B (en) | Detection method, equipment and system of address bus | |
| CN106326439A (en) | Real-time video storage and retrieval method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20150617 Termination date: 20180703 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |