CN112199298B - Single-step debugging detection method and device and computer readable storage medium - Google Patents
Single-step debugging detection method and device and computer readable storage medium Download PDFInfo
- Publication number
- CN112199298B CN112199298B CN202011203473.3A CN202011203473A CN112199298B CN 112199298 B CN112199298 B CN 112199298B CN 202011203473 A CN202011203473 A CN 202011203473A CN 112199298 B CN112199298 B CN 112199298B
- Authority
- CN
- China
- Prior art keywords
- application program
- machine code
- step debugging
- debugging
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/362—Software debugging
Abstract
The embodiment of the invention discloses a detection method, a detection device and a detection medium for single-step debugging.A self-modifying machine code is pre-stored in a self-modifying area of a memory; in a full-speed debugging mode, an original machine code of an application program is executed firstly, and data of a specified address is cached into a preset cache at the moment; in the single-step debugging mode, the self-modifying machine code is called to replace the original machine code with the modified machine code, and the data of the specified address cannot be cached in the cache at the moment. Acquiring a clock cycle consumed by loading data of a specified address; if the clock period is greater than the preset threshold, it indicates that the data corresponding to the specified address is not cached in the cache, and at this time, the detection result of the application program executing the single step debugging can be output. According to the difference of the data execution operations corresponding to the specified address in the full-speed debugging and the single-step debugging, whether the application program is executed with the single-step debugging can be accurately identified.
Description
Technical Field
The present invention relates to the field of debug detection technologies, and in particular, to a single-step debug detection method, device, and computer-readable storage medium.
Background
The single step debugging refers to a debugging means generally adopted in program development to find out the bug (bug) of a program, and the debugging means tracks the flow of program execution step by step and finds out the cause of an error according to the value of a variable.
However, in the current scene of protecting personal/company software, the problem that software cracking is realized by human malice through single-step debugging exists, and the problem is not solved, which may cause the risk that personal/company charging software is used freely, and even malicious codes are inserted into the personal/company charging software to cause malicious software propagation in the social range.
The conventional anti-debugging method is based on a windows official Application Programming Interface (API) to realize debugging detection, but the method cannot detect single-step debugging.
It can be seen that how to identify single-step debugging is a problem that needs to be solved by those skilled in the art.
Disclosure of Invention
Embodiments of the present invention provide a method and an apparatus for detecting a single step debug, and a computer-readable storage medium, which can identify the single step debug.
To solve the foregoing technical problem, an embodiment of the present invention provides a single-step debugging detection method, including:
pre-storing self-modifying machine codes in a self-modifying area of a memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in a single-step debugging mode, calling the self-modifying machine code to replace the original machine code with a modified machine code, wherein the data of the specified address is not cached in the cache;
acquiring a clock cycle consumed by loading data of a specified address;
judging whether the clock period is greater than a preset threshold value or not;
and if the clock period is greater than a preset threshold value, outputting a detection result of the application program executing the single step debugging.
Optionally, after the outputting the detection result of the application program performing single step debugging, the method further includes:
replacing the original machine code of the application program with a preset modified machine code, and clearing data in the cache; wherein the modified machine code does not cache the data at the specified address in a predetermined cache during execution.
Optionally, after the outputting the detection result of the application program performing single step debugging, the method further includes:
and deleting the application program.
Optionally, after the outputting the detection result of the application program performing single step debugging, the method further includes:
and controlling the application program to exit the current single-step debugging process.
Optionally, the step of outputting the detection result of the application program performing single step debugging is further included
Transmitting alarm information to the terminal equipment; wherein, the alarm information carries log data of the application program executing single step debugging.
The embodiment of the invention also provides a detection device for single step debugging, which comprises a storage unit, an acquisition unit, a judgment unit and an output unit;
the storage unit is used for pre-storing the self-modifying machine code on a self-modifying area of the memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in a single-step debugging mode, calling the self-modifying machine code to replace the original machine code with a modified machine code, wherein the data of the specified address is not cached in the cache;
the acquisition unit is used for acquiring the clock period consumed by loading the data of the specified address;
the judging unit is used for judging whether the clock period is greater than a preset threshold value or not;
and the output unit is used for outputting the detection result of the application program executing the single step debugging if the clock period is greater than a preset threshold value.
Optionally, a replacement unit and a clearing unit are also included;
the replacing unit is used for replacing the original machine code of the application program with a preset modified machine code after the detection result of the single step debugging of the application program is output; wherein, the modified machine code will not cache the data of the specified address into a preset cache when executing;
the clearing unit is used for clearing the data in the cache.
Optionally, a deleting unit is further included;
the deleting unit is used for deleting the application program after the detection result of the application program executing the single step debugging is output.
Optionally, an exit unit is further included;
the exit unit is used for controlling the application program to exit the current single step debugging process after the detection result of the single step debugging executed by the application program is output.
Optionally, a transmission unit is further included;
the transmission unit is used for transmitting alarm information to the terminal equipment after the detection result of the application program executing single step debugging is output; wherein, the alarm information carries log data of the application program executing single step debugging.
The embodiment of the invention also provides a detection device for single step debugging, which comprises:
a memory for storing a computer program;
a processor for executing said computer program to implement the steps of the single-step debugging detection method as described in any one of the above.
An embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program implements the steps of the single-step debugging detection method according to any one of the above.
According to the technical scheme, the self-modifying machine codes are pre-stored in the self-modifying area of the memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in the single-step debugging mode, the self-modifying machine code is called to replace the original machine code with the modified machine code, and the data of the specified address cannot be cached in the cache at the moment. Therefore, in the technical scheme, the clock cycle consumed by loading the data of the specified address can be acquired; and judging whether the clock period is greater than a preset threshold value. If the clock period is greater than the preset threshold, it indicates that the data corresponding to the specified address is not cached in the cache, and at this time, the detection result of the application program executing the single step debugging can be output. According to the difference of the data execution operations corresponding to the specified address by full-speed debugging and single-step debugging, whether the application program is executed with single-step debugging or not can be accurately identified, and the problem that single-step debugging detection cannot be realized in the prior art is solved.
Drawings
In order to illustrate the embodiments of the present invention more clearly, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings can be obtained by those skilled in the art without inventive effort.
FIG. 1 is a flowchart of a single-step debugging detection method according to an embodiment of the present invention;
FIG. 2 is a schematic structural diagram of a single-step debugging detection apparatus according to an embodiment of the present invention;
fig. 3 is a schematic diagram of a hardware structure of a single step debugging detection apparatus according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without any creative work belong to the protection scope of the present invention.
In order that those skilled in the art will better understand the disclosure, the invention will be described in further detail with reference to the accompanying drawings and specific embodiments.
Next, a single-step debugging detection method provided by the embodiment of the invention is described in detail. Fig. 1 is a flowchart of a single-step debugging detection method according to an embodiment of the present invention, where the method includes:
s101: the self-modifying machine code is pre-stored on a self-modifying region of the memory.
In the full-speed debugging mode, when an application program is debugged, the first step of operation is to execute the original machine code of the application program, so as to cache the data of the specified address into a preset cache.
In the single-step debugging mode, the self-modifying machine code is stored in the self-modifying area of the memory, so that the CPU executes the self-modifying machine code in the self-modifying area first, and the self-modifying machine code has the function of replacing the original machine code with the modified machine code, so that the data of the specified address cannot be cached in the cache.
Taking a software scenario as an example, in practical applications, when a person or a company develops charging software, a full-speed debugging mode is often adopted when an application program corresponding to the software is detected. When someone wants to maliciously crack the software, the software can be cracked in a single-step debugging mode when the software is used freely.
The flow of the full-speed debugging mode comprises the steps of executing original machine code of an application program, replacing the original machine code with modified machine code by calling self-modifying machine code, rolling back the execution result of the original machine code, and executing the modified machine code. In practical applications, when the original machine code is available for loading data, the data at the specified address is cached in a predetermined cache when the original machine code is executed. Although the rollback operation is set in the full-speed debugging mode, the rollback is the result of the original machine code before execution and does not rollback the data of the cache.
The flow of the single-stepping mode includes replacing the original machine code with the modified machine code by calling the self-modifying machine code, and executing the modified machine code. The original machine code of the application program is not executed in the single-step debugging mode, and therefore, the operation of caching the data of the specified address to a preset cache is not involved.
S102: the clock cycles consumed to load the data at the specified address are acquired.
In practical application, when an application program executes full-speed debugging, data of a specified address is cached in a preset cache; when the application performs the single step debugging, the data of the specified address is not cached in the cache memory.
In the embodiment of the invention, based on the difference of the full-speed debugging and the single-step debugging in the data execution operation corresponding to the specified address, the clock cycle consumed by loading the data of the specified address can be acquired, and whether the application program is executed with the single-step debugging or not is detected depending on the clock cycle.
S103: and judging whether the clock period is greater than a preset threshold value.
The preset threshold may be set based on the time it takes to read data from the cache.
When the clock period is less than or equal to the preset threshold, it indicates that the data corresponding to the specified address is cached in the cache, so that the data of the specified address can be acquired in a short time, and the operation executed on the application program belongs to a normal operation flow.
When the clock period is greater than the predetermined threshold, it indicates that the data corresponding to the designated address is not cached in the cache, and S103 may be executed.
S104: and outputting the detection result of the application program executing the single step debugging.
According to the technical scheme, the self-modifying machine codes are pre-stored in the self-modifying area of the memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly so as to cache data of a specified address into a preset cache; in the single-step debugging mode, the self-modifying machine code is called to replace the original machine code with the modified machine code, and the data of the specified address cannot be cached in the cache at the moment. Therefore, in the technical scheme, the clock cycle consumed by loading the data of the specified address can be acquired; and judging whether the clock period is greater than a preset threshold value. If the clock period is greater than the preset threshold, it indicates that the data corresponding to the specified address is not cached in the cache, and at this time, the detection result of the application program executing the single step debugging can be output. According to the difference of the data execution operations corresponding to the specified address by full-speed debugging and single-step debugging, whether the application program is executed with single-step debugging or not can be accurately identified, and the problem that single-step debugging detection cannot be realized in the prior art is solved.
In the embodiment of the present invention, after the detection result of the application executing the single step debugging is output, in order to block the analysis of the automation tool on the application, operations such as dead cycle and the like may be adopted to achieve the purpose of protecting the application.
In a specific implementation, the original machine code of the application program can be replaced by the preset modified machine code, and the data in the cache is cleared; when the modified machine code is executed, the data of the specified address is not cached in the preset cache.
In addition, the application program can be deleted or the application program can be controlled to exit the current single-step debugging process, so that the operation of the automatic tool for carrying out the single-step debugging on the application program is blocked.
After the application program is found to execute the single step debugging, the single step debugging operation of the automation tool on the application program is blocked in time, the application program can be prevented from being illegally cracked, and the safety of the application program is effectively improved.
In the embodiment of the invention, in order to facilitate the manager to know the current safety state of the application program in time, after the detection result of the application program executing single step debugging is output, the warning information can be transmitted to the terminal equipment; the alarm information carries log data of the application program for executing single step debugging.
In the embodiment of the invention, the alarm information carrying the log data is transmitted to the terminal equipment, so that on one hand, a manager can find the risk of malicious cracking of the application program in time, and on the other hand, the manager can know the operation of the automation tool on the application program, thereby making a more effective protection means to prevent the automation tool from cracking the application program.
Fig. 2 is a schematic structural diagram of a single-step debugging detection apparatus according to an embodiment of the present invention, including a storage unit 21, an obtaining unit 22, a determining unit 23, and an output unit 24;
a storage unit 21, configured to store a self-modifying machine code in advance in a self-modifying area of a memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in a single step debugging mode, firstly calling self-modifying machine codes to replace original machine codes with modified machine codes, wherein data of a specified address is not cached in the cache;
an acquisition unit 21 configured to acquire a clock cycle consumed to load data of a specified address; when the application program executes full-speed debugging, caching data of the specified address into a preset cache; when the application program executes the single step debugging, the data of the specified address is not cached in the cache;
a judging unit 22, configured to judge whether a clock period is greater than a preset threshold;
and the output unit 23 is configured to output a detection result of the application executing the single step debugging if the clock cycle is greater than the preset threshold.
Optionally, a replacement unit and a clearing unit are also included;
the replacing unit is used for replacing the original machine code of the application program with the preset modified machine code after outputting the detection result of the application program executing the single step debugging; when the modified machine code is executed, the data of the specified address is not cached in a preset cache;
and the clearing unit is used for clearing the data in the cache.
Optionally, a deleting unit is further included;
and the deleting unit is used for deleting the application program after the detection result of the application program executing the single step debugging is output.
Optionally, an exit unit is further included;
and the exit unit is used for controlling the application program to exit the current single-step debugging process after outputting the detection result of the single-step debugging executed by the application program.
Optionally, a transmission unit is further included;
the transmission unit is used for transmitting alarm information to the terminal equipment after outputting the detection result of the application program executing the single step debugging; the alarm information carries log data of the application program for executing single step debugging.
The description of the features in the embodiment corresponding to fig. 2 may refer to the related description of the embodiment corresponding to fig. 1, and is not repeated here.
According to the technical scheme, the self-modifying machine codes are pre-stored in the self-modifying area of the memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly so as to cache data of a specified address into a preset cache; in the single-step debugging mode, the self-modifying machine code is called to replace the original machine code with the modified machine code, and the data of the specified address cannot be cached in the cache at the moment. Therefore, in the technical scheme, the clock cycle consumed by loading the data of the specified address can be acquired; and judging whether the clock period is greater than a preset threshold value. If the clock period is greater than the preset threshold, it indicates that the data corresponding to the specified address is not cached in the cache, and at this time, the detection result of the application program executing the single step debugging can be output. According to the difference of the data execution operations corresponding to the specified address by full-speed debugging and single-step debugging, whether the application program is executed with single-step debugging or not can be accurately identified, and the problem that single-step debugging detection cannot be realized in the prior art is solved.
Fig. 3 is a schematic diagram of a hardware structure of a single-step debugging detection apparatus 30 according to an embodiment of the present invention, including:
a memory 31 for storing a computer program;
a processor 32 for executing a computer program for implementing the steps of the single-step detection method as described in any of the embodiments above.
The embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the single-step debugging detection method described in any of the above embodiments are implemented.
The method, the apparatus and the computer-readable storage medium for single-step debugging provided by the embodiments of the present invention are described in detail above. The embodiments are described in a progressive mode in the specification, the emphasis of each embodiment is on the difference from the other embodiments, and the same and similar parts among the embodiments can be referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description. It should be noted that, for those skilled in the art, it is possible to make various improvements and modifications to the present invention without departing from the principle of the present invention, and those improvements and modifications also fall within the scope of the claims of the present invention.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
Claims (10)
1. A single-step debug detection method, comprising:
pre-storing self-modifying machine codes in a self-modifying area of a memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in a single step debugging mode, calling the self-modifying machine code to replace the original machine code with a modified machine code, wherein the data of the specified address is not cached in the cache;
acquiring a clock cycle consumed by loading data of a specified address;
judging whether the clock period is greater than a preset threshold value or not;
and if the clock period is greater than a preset threshold value, outputting a detection result of the application program executing the single step debugging.
2. The method for detecting single step debugging of claim 1, further comprising, after said outputting the detection result of single step debugging executed by said application program:
replacing the original machine code of the application program with a preset modified machine code, and clearing data in the cache; wherein the modified machine code does not cache the data at the specified address in a predetermined cache during execution.
3. The method for detecting single step debugging of claim 1, further comprising, after said outputting the detection result of single step debugging executed by said application program:
and deleting the application program.
4. The method for detecting single step debugging of claim 1, further comprising, after said outputting the detection result of single step debugging executed by said application program:
and controlling the application program to exit the current single-step debugging process.
5. The single-step debugging detection method according to any one of claims 1-4, further comprising outputting the detection result of the application program performing single-step debugging
Transmitting alarm information to the terminal equipment; the alarm information carries log data for executing single step debugging of the application program.
6. The detection device for single step debugging is characterized by comprising a storage unit, an acquisition unit, a judgment unit and an output unit;
the storage unit is used for pre-storing the self-modifying machine code on a self-modifying area of the memory; in a full-speed debugging mode, original machine codes of an application program are executed firstly, so that data of a specified address are cached in a preset cache; in a single step debugging mode, calling the self-modifying machine code to replace the original machine code with a modified machine code, wherein the data of the specified address is not cached in the cache;
the acquisition unit is used for acquiring the clock period consumed by loading the data of the specified address;
the judging unit is used for judging whether the clock period is greater than a preset threshold value or not;
and the output unit is used for outputting the detection result of the application program executing the single step debugging if the clock period is greater than a preset threshold value.
7. The single-step debugging detection device according to claim 6, further comprising a replacement unit and a clearing unit;
the replacing unit is used for replacing the original machine code of the application program with a preset modified machine code after the detection result of the application program executing single step debugging is output; wherein, the modified machine code will not cache the data of the specified address into a preset cache when executing;
the clearing unit is used for clearing the data in the cache.
8. The single-step debugging detection device according to claim 6, further comprising a deletion unit;
the deleting unit is used for deleting the application program after the detection result of the application program executing the single step debugging is output.
9. A single-step testing apparatus, comprising:
a memory for storing a computer program;
processor for executing said computer program for carrying out the steps of the single-step debugging detection method according to any one of claims 1 to 5.
10. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, carries out the steps of the single-step debugging detection method according to one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011203473.3A CN112199298B (en) | 2020-11-02 | 2020-11-02 | Single-step debugging detection method and device and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011203473.3A CN112199298B (en) | 2020-11-02 | 2020-11-02 | Single-step debugging detection method and device and computer readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112199298A CN112199298A (en) | 2021-01-08 |
| CN112199298B true CN112199298B (en) | 2022-05-13 |
Family
ID=74011165
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011203473.3A Active CN112199298B (en) | 2020-11-02 | 2020-11-02 | Single-step debugging detection method and device and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112199298B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113189933B (en) * | 2021-03-29 | 2022-09-06 | 大族激光科技产业集团股份有限公司 | Teaching track modification method, device, equipment and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001318787A (en) * | 2000-05-08 | 2001-11-16 | Toshiba Corp | Microprocessor and multi-task execution method and multi-thread execution method using the same |
| CN101667154A (en) * | 2004-04-29 | 2010-03-10 | 爱特梅尔公司 | Apparatus and method for improving emulation speed of high-level languages in on-chip emulation systems |
| CN106055983A (en) * | 2016-07-27 | 2016-10-26 | 北京鼎源科技有限公司 | Anti-debugging method of android application based on IDA communication |
| CN108984392A (en) * | 2018-06-12 | 2018-12-11 | 珠海市杰理科技股份有限公司 | Single-step debug method and debugger |
| CN109684795A (en) * | 2018-12-25 | 2019-04-26 | 成都卫士通信息产业股份有限公司 | The method, apparatus and electronic equipment of application program anti-debug |
| CN110018965A (en) * | 2019-04-12 | 2019-07-16 | 广东虹勤通讯技术有限公司 | A kind of BIOS single-step debug control method, apparatus and system |
-
2020
- 2020-11-02 CN CN202011203473.3A patent/CN112199298B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001318787A (en) * | 2000-05-08 | 2001-11-16 | Toshiba Corp | Microprocessor and multi-task execution method and multi-thread execution method using the same |
| CN101667154A (en) * | 2004-04-29 | 2010-03-10 | 爱特梅尔公司 | Apparatus and method for improving emulation speed of high-level languages in on-chip emulation systems |
| CN106055983A (en) * | 2016-07-27 | 2016-10-26 | 北京鼎源科技有限公司 | Anti-debugging method of android application based on IDA communication |
| CN108984392A (en) * | 2018-06-12 | 2018-12-11 | 珠海市杰理科技股份有限公司 | Single-step debug method and debugger |
| CN109684795A (en) * | 2018-12-25 | 2019-04-26 | 成都卫士通信息产业股份有限公司 | The method, apparatus and electronic equipment of application program anti-debug |
| CN110018965A (en) * | 2019-04-12 | 2019-07-16 | 广东虹勤通讯技术有限公司 | A kind of BIOS single-step debug control method, apparatus and system |
Non-Patent Citations (2)
| Title |
|---|
| IDA静态分析与动态分析;Seasoninthesun;《https://zhuanlan.zhihu.com/p/38983223》;20180704;第1-14页 * |
| 破解原理;蓝点;《http://www.pc6.com/infoview/Article_20820.html》;20041015;第1-4页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112199298A (en) | 2021-01-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR101519845B1 (en) | Method For Anti-Debugging | |
| KR101759379B1 (en) | Memory dump with expanded data and user privacy protection | |
| KR100897849B1 (en) | Apparatus and Method for finding malicious process | |
| CN108197032B (en) | Main thread jamming monitoring method, medium, equipment and system for IOS application | |
| US20130096880A1 (en) | System test method | |
| CN110661863B (en) | Request processing method and device, electronic equipment and storage medium | |
| CN109255240B (en) | Vulnerability processing method and device | |
| JP2010515177A (en) | Automatic vulnerability detection and response | |
| US9594617B2 (en) | Method and apparatus for positioning crash | |
| US9619376B2 (en) | Monitoring and capturing early diagnostic data | |
| US8752025B2 (en) | Protecting breakpoints in a software debugger | |
| CN105302714A (en) | Method and apparatus for monitoring memory leak in test process | |
| CN108073499B (en) | Application program testing method and device | |
| CN112199298B (en) | Single-step debugging detection method and device and computer readable storage medium | |
| CN111641601A (en) | Firewall management method, device, equipment and storage medium | |
| CN107871079A (en) | A kind of suspicious process detection method, device, equipment and storage medium | |
| CN105404813B (en) | A kind of daily record generation method of Intrusion Detection based on host system of defense, apparatus and system | |
| US11422916B2 (en) | Usage amount monitoring method and monitoring unit of electronic control unit for vehicle | |
| CN107291617B (en) | Vulnerability analysis method based on implicit taint propagation | |
| CN113221119B (en) | Embedded processor branch prediction vulnerability detection method, computer device and medium | |
| CN110569177B (en) | Method and device for testing log coverage mechanism | |
| CN110908869B (en) | Application program data monitoring method, device, equipment and storage medium | |
| CN110888799B (en) | Software testing method and device | |
| CN109445877B (en) | Method for detecting same virtual machine used by multiple threads of game server | |
| CN112153375A (en) | Front-end performance testing method, device, equipment and medium based on video information |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |