CN105718357B - A kind of method of internal memory monitoring - Google Patents
A kind of method of internal memory monitoring Download PDFInfo
- Publication number
- CN105718357B CN105718357B CN201610041986.6A CN201610041986A CN105718357B CN 105718357 B CN105718357 B CN 105718357B CN 201610041986 A CN201610041986 A CN 201610041986A CN 105718357 B CN105718357 B CN 105718357B
- Authority
- CN
- China
- Prior art keywords
- address
- page
- monitoring
- instruction
- trap
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3034—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a storage system, e.g. DASD based or network based
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Mathematical Physics (AREA)
- Quality & Reliability (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
A kind of method of internal memory monitoring, comprising: S1. records page information where address information and monitoring address to be monitored, and the attribute of page is set as read-only where monitoring address；If S2. CPU triggers page fault, set read-write for page attribute where the address for causing page fault, if discovery causes the address of page fault for monitoring address during processing, obtains and record call stack relevant information, and be inserted into trap instruction；S3.CPU goes to trap instruction, triggers trap abnormality processing, and the attribute of page reverts to read-only where monitoring address, and removes trap instruction.The present invention monitors whether certain section of memory is written over, and can monitor that address range is larger, process is simple, and actual operation is strong.
Description
Technical field
The present invention relates to calculator memory technical field, in particular to a kind of method of internal memory monitoring.
Background technique
In computer application field, to monitor whether certain section of memory is written over, the general internal memory monitoring using profession is soft
Part is realized.But after its detection is destroyed, mistake could be found when needing memory to discharge or distributing resource, causing cannot be timely
Mistake is reported, does not have real-time, will greatly affect program in this way removes wrong progress.Therefore, problem to be solved at present
It is how to monitor whether memory is written in real time, and do not destroy currently running system.
At present in internal memory monitoring technology, the mode of Hardware Breakpoint and software breakpoint is generallyd use to realize the real-time prison of memory
Control.Hardware Breakpoint processing speed is fast, but can monitor that address range is small, and whether supports that data breakpoint is related with processor.
Software breakpoint, which can increase breakpoint quantity, can monitor address range, and what is generallyd use is that page protection mechanism is come
It realizes.But currently used page protection mechanism, usually by the way that scattered monitoring address is added to some physical modulated
It tries in page, triggers page fault when reading and writing data in debugging page, process is more complicated, therefore adopts this method practical behaviour
The property made is not strong.
Summary of the invention
In view of the deficiencies in the prior art, the purpose of the present invention is to provide a kind of method of internal memory monitoring, monitoring
Whether certain section of memory is written over, and can monitor that address range is larger, process is simple, and actual operation is strong.
To achieve the above objectives, a kind of method that the present invention takes internal memory monitoring, comprising steps of S1. record it is to be monitored
Page information where address information and monitoring address, the attribute of page is set as read-only where monitoring address；If S2. CPU triggering lacks
Page is abnormal, sets read-write for page attribute where the address for causing page fault, if discovery causes to skip leaf during processing
Abnormal address is monitoring address, then obtains and record call stack relevant information, and be inserted into trap instruction；S3.CPU goes to sunken
Trap instruction, triggers trap abnormality processing, and the attribute of page reverts to read-only where monitoring address, and removes trap instruction.
Based on the above technical solution, in step S1, a monitoring address information table is set, monitors address information table
For storing all monitoring address informations in monitoring address range.
Based on the above technical solution, in step S1, a page address information table is set, page address information table is used for
Page information where storing all monitoring addresses.
Based on the above technical solution, in step S2, when the program of address to be monitored is to the page of read only attribute
When address carries out write operation, then CPU triggers page fault.
Based on the above technical solution, the program of address to be monitored carries out writing behaviour to the memory page address of read only attribute
The instruction of work is present instruction, and insertion trap instruction, which specifically acts, is, by next instruction of present instruction according to the CPU of application
Platform modifying is corresponding trap instruction.
Based on the above technical solution, the address of page fault is caused not to be prison if CPU is detected during processing
It is directly corresponding trap instruction according to the CPU platform modifying of application by next instruction of present instruction depending on address.
Based on the above technical solution, described when being revised as corresponding trap instruction, the instruction of logging trap instruction
Address and the command information modified.
Based on the above technical solution, in step S3, trap instruction is removed, that is, believe by the trap correlation of record
Trap instruction, is reduced to the instruction modified by breath.
The beneficial effects of the present invention are: page information where recording address information and monitoring address to be monitored, so that removing
It monitors except address, the access of other internal storage datas will not trigger exception, will not influence system；It is read and write when to read-only memory page
When, then page fault processing is triggered, call stack information when memory is rewritten can be recorded in real time, effectively improves certain section of memory prison
Depending on real-time.Applicability of the invention is wide, is suitable for most of embedded systems.
Detailed description of the invention
Fig. 1 is the flow chart of the method for internal memory monitoring of the embodiment of the present invention；
Fig. 2 is the detail flowchart of step S2 in Fig. 1.
Specific embodiment
Invention is further described in detail with reference to the accompanying drawings and embodiments.
As shown in Figure 1, the method for internal memory monitoring of the present invention, specifically comprises the following steps:
S1., one monitoring address information table and a page address information table are set, records address to be monitored respectively and (supervises
Depending on address) page information where information and monitoring address, wherein in monitoring address range, monitoring address information table is for storing
All monitoring address informations, page address information table is for page information where storing all monitoring addresses.Also, it will monitor address
The attribute of place page is set as read-only.
If S2. CPU triggers page fault, set read-write for page attribute where the address for causing page fault, if
Discovery causes the address of page fault for monitoring address in treatment process, then obtains and record call stack relevant information, and be inserted into
Trap instruction.
As shown in Fig. 2, specific steps are as follows:
S201. when memory page address of the program of address to be monitored to read only attribute carries out write operation, CPU triggering is skipped leaf
It is abnormal.
S202. set read-write for page attribute where the address for causing page fault.
S203. it checks and causes whether the address of page fault is address to be detected, that is, whether in monitoring address information table
The corresponding address for causing page fault is found, if so, into S204；If it is not, into S205.
S204. actual registers information is analyzed, call stack information is obtained and is recorded, into S205.
It S205. is corresponding trap instruction according to the CPU platform modifying of application by next instruction of present instruction.Its
In, present instruction are as follows: the program of address to be monitored carries out the instruction of write operation to the memory page address of read only attribute.Also, it needs
The IA for wanting logging trap to instruct and the command information modified.
S3. when CPU goes to trap instruction, trap abnormality processing is triggered, the attribute of page restores where monitoring address
It is read-only.And remove trap instruction, that is, by the trap relevant information of record, trap instruction is reduced to the finger modified
It enables.
Above-mentioned steps S1 to S3 is the process for being inserted into breakpoint, when needing to delete breakpoint, address will be monitored from monitoring address
It is deleted in information table, and sets read-write for corresponding attribute in the page address information of place page.
The present invention is not limited to the above-described embodiments, for those skilled in the art, is not departing from
Under the premise of the principle of the invention, several improvements and modifications can also be made, these improvements and modifications are also considered as protection of the invention
Within the scope of.The content being not described in detail in this specification belongs to the prior art well known to professional and technical personnel in the field.
Claims (4)
1. a kind of method of internal memory monitoring, which is characterized in that comprising steps of
S1. page information where recording address information and monitoring address to be monitored, the attribute of page is set as where monitoring address
It is read-only；One monitoring address information table is set, and monitoring address information table is used to store all monitoring in monitoring address range
Address information；One page address information table is set, and page address information table is for page information where storing all monitoring addresses；
If S2. CPU triggers page fault, set read-write for page attribute where the address for causing page fault, if handling
Discovery causes the address of page fault for monitoring address in the process, then obtains and record call stack relevant information, and be inserted into trap
Instruction；
When memory page address of the program of address to be monitored to read only attribute carries out write operation, then CPU triggers page fault；
The instruction that the program of address to be monitored carries out write operation to the memory page address of read only attribute is present instruction, is inserted into trap
The specific movement of instruction is that instructing next of present instruction according to the CPU platform modifying of application is corresponding trap instruction；
S3.CPU goes to trap instruction, triggers trap abnormality processing, and the attribute of page reverts to read-only where monitoring address, and
Remove trap instruction.
2. the method for internal memory monitoring as described in claim 1, it is characterised in that: cause to lack if CPU is detected during processing
The abnormal address of page is not monitoring address, is directly pair according to the CPU platform modifying of application by next instruction of present instruction
The trap instruction answered.
3. the method for internal memory monitoring as claimed in claim 1 or 2, it is characterised in that: described to be revised as corresponding trap instruction
When, the IA of logging trap instruction and the command information modified.
4. the method for internal memory monitoring as described in claim 1, it is characterised in that: in step S3, remove trap instruction, that is, logical
Trap instruction, is reduced to the instruction modified by the trap relevant information of overwriting.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610041986.6A CN105718357B (en) | 2016-01-22 | 2016-01-22 | A kind of method of internal memory monitoring |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610041986.6A CN105718357B (en) | 2016-01-22 | 2016-01-22 | A kind of method of internal memory monitoring |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105718357A CN105718357A (en) | 2016-06-29 |
| CN105718357B true CN105718357B (en) | 2018-12-28 |
Family
ID=56154932
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610041986.6A Active CN105718357B (en) | 2016-01-22 | 2016-01-22 | A kind of method of internal memory monitoring |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105718357B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108255746A (en) * | 2017-12-29 | 2018-07-06 | 北京元心科技有限公司 | Memory rewrites detection method and device |
| CN111400096B (en) * | 2020-03-16 | 2023-05-02 | 杭州涂鸦信息技术有限公司 | Memory mirroring method based on linux page-missing mechanism and system and device thereof |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1924826A (en) * | 2005-09-02 | 2007-03-07 | 中兴通讯股份有限公司 | Detecting method for illegal memory reading and writing |
| CN101561775A (en) * | 2009-05-12 | 2009-10-21 | 华为技术有限公司 | Method and device for monitoring memory |
| CN102388368A (en) * | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | Method and device for monitoring memory |
| US8688917B2 (en) * | 2008-12-30 | 2014-04-01 | Intel Corporation | Read and write monitoring attributes in transactional memory (TM) systems |
| CN105159838A (en) * | 2015-08-27 | 2015-12-16 | 华为技术有限公司 | Memory access method and computer system |
-
2016
- 2016-01-22 CN CN201610041986.6A patent/CN105718357B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1924826A (en) * | 2005-09-02 | 2007-03-07 | 中兴通讯股份有限公司 | Detecting method for illegal memory reading and writing |
| US8688917B2 (en) * | 2008-12-30 | 2014-04-01 | Intel Corporation | Read and write monitoring attributes in transactional memory (TM) systems |
| CN101561775A (en) * | 2009-05-12 | 2009-10-21 | 华为技术有限公司 | Method and device for monitoring memory |
| CN102388368A (en) * | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | Method and device for monitoring memory |
| CN105159838A (en) * | 2015-08-27 | 2015-12-16 | 华为技术有限公司 | Memory access method and computer system |
Non-Patent Citations (1)
| Title |
|---|
| "Linux内核中的内存访问监控框架的设计与实现";何川，陈莉君;《微电子学与计算机》;20150831;第32卷(第8期);正文第142-145页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105718357A (en) | 2016-06-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Bell et al. | Solid state drives: the beginning of the end for current practice in digital forensic recovery? | |
| CN102388368B (en) | Method and device for monitoring memory | |
| CN105302478B (en) | A kind of date storage method and electronic equipment | |
| US8037529B1 (en) | Buffer overflow vulnerability detection and patch generation system and method | |
| US7765526B2 (en) | Management of watchpoints in debuggers | |
| CN112017723B (en) | Power failure test method and device for memory, readable storage medium and electronic equipment | |
| US20080222215A1 (en) | Method for Deleting Virus Program and Method to Get Back the Data Destroyed by the Virus | |
| CN101046765A (en) | Method for positioning fault of software | |
| CN103927126B (en) | The collocation method of a kind of Disk Array and assembling and disk insertion process method | |
| CN103984506A (en) | Method and system for data writing of flash memory storage equipment | |
| CN113268427B (en) | Crash analysis method and system for binary program | |
| US20120246518A1 (en) | Operating a computer system | |
| US20130104108A1 (en) | Protecting breakpoints in a software debugger | |
| CN101251822A (en) | Supervising method of internal memory being rewrited | |
| CN105718357B (en) | A kind of method of internal memory monitoring | |
| CN105700999A (en) | method and system for recording processor operation | |
| US8972794B2 (en) | Method and apparatus for diagnostic recording using transactional memory | |
| CN113987507A (en) | Heap memory vulnerability detection method and device, storage medium and electronic equipment | |
| US20230132278A1 (en) | File data access method, apparatus, and computer-readable storage medium | |
| CN107315661B (en) | Deleted file recovery method and device for cluster file system | |
| CN109542341B (en) | Read-write IO monitoring method, device, terminal and computer readable storage medium | |
| CN110688245A (en) | Information acquisition method, device, storage medium and equipment | |
| CN104978241B (en) | A kind of data reconstruction method and device of COW type file systems | |
| CN104657088B (en) | A kind of acquisition methods and device of hard disk bad block message | |
| CN103236938A (en) | Method and system for user action collection based on cache memory and asynchronous processing technology |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20180323 Address after: 430074 Wuhan, Hongshan Province District Road, Department of mail, No. 88 hospital Applicant after: Fenghuo Communication Science &. Technology Co., Ltd. Applicant after: WUHAN FIBERHOME TECHNICAL SERVICES CO., LTD. Address before: 430074 East Lake Development Zone, Hubei, Optics Valley Venture Street, No. 67, No. Applicant before: Fenghuo Communication Science &. Technology Co., Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |