CN116225537A

CN116225537A - Stack repair method, stack repair device, electronic device and computer readable storage medium

Info

Publication number: CN116225537A
Application number: CN202310250833.2A
Authority: CN
Inventors: 王明广; 王丹阳; 郭夏宾
Original assignee: Qianxin Technology Group Co Ltd; Qianxin Safety Technology Zhuhai Co Ltd
Current assignee: Qianxin Technology Group Co Ltd; Qianxin Safety Technology Zhuhai Co Ltd
Priority date: 2023-03-15
Filing date: 2023-03-15
Publication date: 2023-06-06

Abstract

The application provides a stack repair method, a stack repair device, an electronic device and a computer readable storage medium, wherein the stack repair method comprises the following steps: under the condition of stack backtracking failure, acquiring function information of a first objective function; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position; searching a stack consumption value of the first objective function from a preset resource consumption table according to the function information; and determining the actual return address and the actual ebp value of the first target stack frame according to the stack consumption value. The stack restoration method and device can achieve stack restoration, so that stack backtracking can be performed correctly.

Description

Stack repair method, stack repair device, electronic device and computer readable storage medium

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a stack repair method, a stack repair device, an electronic device, and a computer readable storage medium.

Background

Stack backtracking is a common technology, and can print out call stacks of functions through stack backtracking, thereby being very helpful for analyzing function calls, debugging system anomalies and even detecting anomaly attacks. In practical applications, however, there may be situations where the pointer register value in the stack frame is modified, for example, when the stack pointer optimization function is turned on during the compilation process, which may result in the occurrence of the above situation. And once the situation occurs, stack backtracking failure is caused, so that the stack needs to be repaired to obtain the correct return address of each stack frame needed in the stack backtracking process.

Disclosure of Invention

An object of an embodiment of the present application is to provide a stack repair method, apparatus, electronic device, and computer readable storage medium for performing stack repair.

The embodiment of the application provides a stack repairing method, which comprises the following steps: under the condition of stack backtracking failure, acquiring function information of a first objective function; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position; searching a stack consumption value of the first objective function from a preset resource consumption table according to the function information; and determining the actual return address of the first target stack frame according to the stack consumption value.

In the implementation manner, after the function information of the function (i.e., the first objective function) possibly having the abnormality is obtained under the condition that the stack trace back fails, the stack consumption value of the first objective function is found out through the preset resource consumption table, so that the actual return address of the first objective stack frame can be deduced by using the stack consumption value based on the growth rule of the function stack, and the stack trace back can be correctly performed.

Further, the stack consumption value of the first objective function includes a first consumption value; the first consumption value is a stack consumption value generated when the first objective function calls a next-layer function;

Determining an actual return address of the first target stack frame from the stack consumption value, comprising: the actual return address of the first target stack frame is determined from the first consumption value and the value of ebp (extended base pointer, extended base pointer register) of the next layer function.

Further, determining the actual return address of the first target stack frame from the first consumption value and the value of ebp of the next layer function comprises: determining the value of ebp in the first target stack frame when the first target function calls the next layer function according to the value of ebp of the next layer function; and determining the actual return address of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the first consumption value.

Further, determining the actual return address of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the first consumption value includes: calculating the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, and obtaining a second target address; acquiring the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

It can be understood that the stack frame-based generation mechanism can estimate the stack top pointer position of the first target stack frame of the first target function based on the ebp value of the next-layer function, and the first consumption value is a stack consumption value generated when the first target function calls the next-layer function, so that the actual position of the return address can be obtained based on the stack top pointer position and the first consumption value. Therefore, based on the mode, the determination of the actual return address and the actual ebp value of the first target stack frame can be rapidly and accurately realized, and the repair of the stack can be realized, so that the stack backtracking can be correctly performed.

Further, the stack consumption value of the first objective function further includes a second consumption value; the second consumption value is a stack consumption value of the first objective function executing the push ebp instruction; the method further comprises the steps of: and determining the actual ebp value of the first target stack frame according to the ebp value of the next layer function, the first consumption value and the second consumption value.

It can be understood that after analysis of a large amount of disassembly codes, the ebp of the stack frame is found to perform a push ebp operation before modification, so for an exception function, the size of the actual upward generated stack after the call of the next layer function should be the difference between the first consumption value and the second consumption value, and the stack frame-based generation mechanism can estimate the stack top pointer position of the first target stack frame of the first target function based on the ebp value of the next layer function, so that the actual ebp value of the first target stack frame can be estimated based on the stack top pointer position and the size of the actual upward generated stack. Therefore, based on the mode, the determination of the actual return address and the actual ebp value of the first target stack frame can be rapidly and accurately realized, and the repair of the stack can be realized, so that the stack backtracking can be correctly performed.

Further, determining an actual ebp value of the first target stack frame according to the ebp value of the next layer function, the first consumption value and the second consumption value, including: determining the value of ebp in the first target stack frame when the first target function calls the next layer function according to the value of ebp of the next layer function; determining a value of stack up growth after the first objective function calls the next layer of function according to the first consumption value and the second consumption value; and determining the actual ebp value of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the value of stack up-growth after the first target function calls the next layer function.

Further, determining the actual ebp value of the first target stack frame according to the ebp value in the first target stack frame when the first target function calls the next layer function and the value of stack up growth after the first target function calls the next layer function, including: calculating the sum of the value of ebp in the first target stack frame when the first target function calls the next layer function and the value of stack upward growth after the first target function calls the next layer function, and obtaining a first target address; acquiring the content in the first target address; the content in the first target address is the actual ebp value of the first target stack frame.

As the analysis is performed, based on the implementation manner, the determination of the actual ebp value of the first target stack frame can be rapidly and accurately realized, and the stack repair is realized, so that the stack backtracking can be correctly performed.

Further, the method further comprises: and re-performing stack backtracking according to the actual return address of the first target stack frame.

Further, the method further comprises: if the stack backtracking fails, acquiring an ebp value of a second target stack frame; the second target stack frame is a stack frame with an ebp value without errors; and traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

It can be understood that, in some cases, based on the situations that repair failure may occur in the foregoing embodiments (for example, the preset resource consumption table does not record the first consumption value and the second consumption value of the first objective function, etc.), by traversing all the stack trace paths in this implementation manner, a stack trace path that makes stack trace successful may be found (each ebp and return address that make up the stack trace path is considered to be correct at this time), so that recovery of an abnormal ebp and return address may be at least partially achieved, and repair of a stack may be achieved to a certain extent.

Further, the stack trace-back traversal formula includes: ebp (n+1) = [ ebp (n) ], ret (n+1) = [ ebp (n) +m ], ebp (j) = ebp (j) +m; the method comprises the steps that k1 to k2 are sequentially taken by n, k1 is the number of layers of a second target stack frame in a function call chain, k2 is the second largest number of layers in the function call chain, ebp (n) is an ebp value of an n-th stack frame, ebp (n+1) is an ebp value of an n+1-th stack frame, ret (n+1) is a return address of an n+1-th stack frame, m is a preset constant, a middle bracket in a formula indicates contents in an address in a middle bracket, ebp (j) =ebp (j) +m represents a value of ebp (j) of a new round obtained by adding m to the original value of ebp (j), and ebp (j) is an ebp which needs to be updated in the round of traversal, and k1 is not more than k2.

In the implementation manner, based on the formula, stack backtracking can be performed under the condition that only the second target stack frame is acquired as the ebp value, and the ebp value in the traversal process is updated, so that the traversal process can be effectively realized.

Further, the value of ebp (j) of the new round satisfies the following condition: the value of the new round of ebp (j) is smaller than the stack bottom address and larger than the minimum address of the stack, and the value of ebp (j+1) obtained based on the new round of ebp (j) is larger than the value of the new round of ebp (j).

Based on the limitation of the conditions, unlimited update of the ebp can be avoided, and the updated ebp value can be ensured to conform to the stack generation rule, so that the accuracy of scheme execution is ensured.

Further, the method comprises: and when the function to which the return address of the stack frame at the highest level in the function call chain belongs is a third target function, determining that the stack backtracking is successful.

Further, the stack consumption value of the first objective function includes a third consumption value; the third consumption value is a memory value consumed by a stack frame of the first objective function;

determining an actual return address of the first target stack frame from the stack consumption value, comprising: determining an actual RSP value of the first target stack frame according to the third consumption value and an RSP (reextended stack pointer, stack top pointer register) value of a next-layer function called by the first target function; and determining the actual return address of the first target stack frame according to the actual RSP value of the first target stack frame.

It will be appreciated that for a 64-bit process system, when performing stack trace back, the OS (operating system) scans the memory map of the executable file for the RUNTIME_FUNCTION structure whose range contains the current instruction address. The running _ FUNCTION architecture based operating system can know how the stack should be unwound, i.e., can know the stack memory consumption of the FUNCTION stack frame (i.e., the memory value consumed by the stack frame). And once the runntime_function structure is not obtained in the backtracking process, the backtracking will fail. Therefore, in the above manner of the embodiment of the present application, the correct stack consumption value of each function is configured in advance in the resource consumption table, so that when the stack trace fails, the actual RSP value of the first target stack frame can be determined by searching the third consumption value of the first target function from the preset resource consumption table, and further the actual return address of the first target stack frame is determined, thereby realizing stack repair.

Further, determining an actual RSP value of the first target stack frame according to the third consumption value and an RSP value of a next layer function called by the first target function, including: and calculating the sum of the third consumption value and the RSP value of the next-layer function called by the first target function to obtain the actual RSP value of the first target stack frame.

The embodiment of the application also provides a stack backtracking method, which comprises the following steps: under the condition of stack backtracking failure, acquiring an ebp value of an extended base address pointer register of a second target stack frame; the second target stack frame is a stack frame with an ebp value without errors; and traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

In the implementation manner, by traversing all stack trace-back paths, a stack trace-back path which enables the stack trace-back to be successful (each ebp and return address constituting the stack trace-back path are considered to be correct at this time) can be found, so that the recovery of abnormal ebp and return address can be at least partially realized, and the repair of the stack can be realized to a certain extent.

The embodiment of the application also provides a stack repairing device, which comprises: the first acquisition module is used for acquiring function information of a first objective function under the condition of stack backtracking failure; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position; the searching module is used for searching the stack consumption value of the first objective function from a preset resource consumption table according to the function information; and the correction module is used for determining the actual return address of the first target stack frame according to the stack consumption value.

The embodiment of the application also provides a stack backtracking device, which comprises: the second acquisition module is used for acquiring an ebp value of an extended base address pointer register of a second target stack frame under the condition of stack backtracking failure; the second target stack frame is a stack frame with an ebp value without errors; and the traversing module is used for traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

The embodiment of the application also provides electronic equipment, which comprises a processor and a memory; the processor is configured to execute the program stored in the memory, so as to implement any one of the stack repair method or the stack trace-back method.

Embodiments of the present application also provide a computer readable storage medium storing one or more programs executable by one or more processors to implement any one of the above stack restoration method or stack trace-back method.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic flow chart of a stack repair method according to an embodiment of the present application;

fig. 2 is a flow chart of a stack backtracking method according to an embodiment of the present application;

Fig. 3 is a schematic structural diagram of a stack repair device according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of a stack trace-back device according to an embodiment of the present application;

fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

In order to realize stack repair, so that stack backtracking can be correctly performed, the requirements of services such as function call analysis, system exception debugging, exception attack detection and the like are met, and the following stack repair methods are provided in the embodiment of the application.

Referring to fig. 1, fig. 1 is a schematic flow chart of a stack repair method provided in an embodiment of the present application, including:

s101: and under the condition of stack backtracking failure, acquiring function information of the first objective function.

In this embodiment of the present application, the first objective function is a function to which the first objective stack frame belongs, where the first objective stack frame includes a stack frame where backtracking fails.

In the embodiment of the application, when stack backtracking is performed, whether stack backtracking fails or not can be determined at least through the following two ways:

mode one: and judging whether the function to which the return address of the stack frame of the highest level in the function call chain belongs is a specific third target function or not when the stack backtracking is completed. If the stack trace is a specific third objective function, the stack trace is determined to be successful, otherwise, the stack trace is truly failed.

It should be understood that the function call chain refers to a call chain formed by functions that are expected to be traced back by stack trace back at this time. For example, function a calls function B, function B calls function C, function C calls function D, and then function a, function B, function C, and function D form a function call chain. When the stack backtracking is performed, the stack frame of the function D is backtracked forward (because the stack grows upward (i.e. continuously expands toward a low address) on the address space of the memory), and the stack backtracking is performed downward on the stack until the stack frame of the function a is backtracked.

It will be appreciated that normally, upon successful stack trace-back, the function to which the return address of the stack frame at the highest level in the function call chain belongs is a specific function (i.e. the third objective function) which is determined by the system architecture and process bit width employed. For example, for an x86 architecture, 32-bit process system, the third objective function should be ntdll-! RtlInitializeExceptionChain, ntdll-! Rtlouserthreeatstart (ntdll is a module name and rtlousitailzeexceptionchain and rtlouserthreeatstart are function names). Thus, when the function to which the return address of the stack frame of the highest level in the function call chain belongs is not the third objective function, a stack trace-back failure can be determined.

It is further understood that the highest hierarchy in the function call chain refers to the hierarchy in which the starting function in the function call chain is located, and taking the function call chain formed by the function a, the function B, the function C, and the function D as an example, the hierarchy in which the function a is located is the highest hierarchy in the function call chain, and the hierarchy in which the function D is located is the lowest hierarchy in the function call chain.

Mode two: and judging whether the return address obtained by backtracking of each level is a function address in a specific module in the stack backtracking process. If not, the stack trace back is considered to be failed.

It is understood that by a specific module is meant a module in which a function call chain and a function are located that performs stack trace back.

It may be appreciated that in the embodiment of the present application, after the stack trace is completed, whether the stack trace fails may be determined based on the first mode or the second mode, and after the stack trace fails is determined, the first objective function may be determined based on a stack frame (i.e., the first objective stack frame) whose return address is not a function address in the specific module.

In addition, optionally, in the embodiment of the present application, the second mode may also be adopted to perform the determination in the stack trace-back process, after it is determined that a return address does not belong to a function address in a specific module, stack trace-back is stopped, and the stack frame in which the return address is not a function address in the specific module is repaired by adopting the scheme of embodiment of fig. 1 of the present application, and after the actual return address and the actual ebp value of the stack frame are obtained, stack trace-back is performed continuously based on the actual return address and the actual ebp value of the stack frame. The process is repeated until the stack backtracking is completed.

In the embodiment of the present application, the obtained function information may be identification information of the first objective function, for example, a function name, etc., but is not limited thereto.

S102: and searching a stack consumption value of the first objective function from a preset resource consumption table according to the function information.

In the embodiment of the present application, the resource consumption table may be recorded in advance when compiling each function, or in a process of collecting a white list library of instruction sequences (typically, the library will be collected in a technology of attack detection, and a collection process of the library will call each function). In the resource consumption table, function information (e.g., function name) and stack consumption values may be associated and recorded, so that the stack consumption value of the first objective function may be obtained subsequently based on a function information lookup table of the first objective function.

S103: the actual return address of the first target stack frame is determined from the stack consumption value of the first target function.

In some implementations of the embodiments of the present application, the stack consumption value of the first objective function may include a first consumption value. The first consumption value is a stack consumption value generated when the first objective function calls a next-layer function.

At this time, step S103 may be to determine the actual return address of the first target stack frame according to the first consumption value and the value of ebp of the next layer function called by the first target function.

It can be appreciated that in the embodiment of the present application, the ebp value of the next layer function called by the first objective function may be obtained. Specifically, an ebp value used when tracing back to the first target stack frame in the stack tracing process can be found, and the value is the ebp value of the next layer function called by the first target function.

Optionally, in this embodiment of the present application, the value of ebp in the first target stack frame when the first target function calls the next-layer function may be determined according to the ebp value of the next-layer function, and the actual return address of the first target stack frame may be determined together according to the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next-layer function.

For example, the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function may be calculated to obtain the second target address. Content within the second target address is then obtained. The content in the second target address is the actual return place of the first target stack frame.

It will be appreciated that the specific manner in which the value of ebp in the first target stack frame is determined when the first target function calls the next-layer function is determined from the value of ebp of the next-layer function is determined by the system architecture and process bit width employed. For example, for an x86 architecture, 32-bit process system, the ebp value +8 of the next-layer function may be obtained from the ebp value in the first target stack frame when the next-layer function is called by the first target function.

In some alternative implementations of the embodiments of the present application, the stack consumption value of the first objective function may further include a second consumption value. The second consumption value is a stack consumption value of the first objective function executing the push ebp instruction.

It can be understood that a push ebp instruction refers to an instruction that executes a push ebp operation, which is an operation of pushing a stack bottom pointer of a function.

It is further understood that in the embodiment of the present application, the first consumption value and the second consumption value refer to consumption of space of the stack, which is essentially an occupied amount of the storage space.

In this optional embodiment, the actual ebp value of the first target stack frame may be determined according to the ebp value, the second consumption value, and the first consumption value of the next layer function.

Optionally, the value of ebp in the first target stack frame when the first target function calls the next-layer function may be determined according to the value of ebp of the next-layer function, and the value of stack up growth after the first target function calls the next-layer function may be determined according to the first consumption value and the second consumption value.

And determining the actual ebp value of the first target stack frame according to the ebp value in the first target stack frame when the first target function calls the next-layer function and the upward stack growth value after the first target function calls the next-layer function.

For example, the sum of the value of ebp in the first target stack frame when the first target function calls the next-layer function and the value of stack up-growth after the first target function calls the next-layer function may be calculated to obtain the first target address. Then, the content in the first target address is acquired. The content in the first target address is the actual ebp value of the first target stack frame.

It can be understood that, based on the above embodiment, after function information of a function (i.e., a first objective function) that may have an exception is obtained in the case of stack trace back failure, a first consumption value generated when the first objective function calls a next layer function and a second consumption value of executing a push ebp instruction are found out through a preset resource consumption table, so that an actual return address and an actual ebp value of a first objective stack frame can be estimated based on the first consumption value and the second consumption value, and repair of a stack is realized, so that stack trace back can be performed correctly.

Referring to fig. 2, fig. 2 is a schematic flow chart of a stack backtracking method provided in an embodiment of the present application, including:

s201: and under the condition of stack backtracking failure, acquiring an extended base address pointer register ebp value of the second target stack frame.

It will be appreciated that how to determine whether the stack trace-back has failed is described above and will not be described in detail herein.

In the embodiment of the present application, the second target stack frame is a stack frame with no error in the ebp value. In the embodiment of the application, the traced stack frame before the first target stack frame in the stack tracing process can be taken as the second target stack frame, so that the first target stack frame with errors can be covered in the traversal process.

S202: and traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

It can be appreciated that in the embodiment of the present application, the stack trace-back traversal formula includes two parts, i.e., a stack trace-back formula and an ebp value update formula. Wherein the stack trace back formula is determined by the system architecture and process bit width employed.

For example, in the system of the x86 architecture and 32-bit process, a stack trace formula is ebp (n+1) = [ ebp (n) ], ret (n+1) = [ ebp (n) +4], wherein ebp (n) is an ebp value of a stack frame of an n-th layer, ebp (n+1) is an ebp value of a stack frame of an n+1-th layer, ret (n+1) is a return address of a stack frame of an n+1-th layer, a bracket table in the formula solicits contents in an address in a bracket, and n sequentially takes 0 to k2, and k2 is a second largest layer number in a function call chain of the stack trace. For example, for the function call chain formed by the function a, the function B, the function C and the function D, the function a is the 3 rd level, the function D is the 0 th level, and k2 is equal to 2. The formula shows that ebp (k2+1) = [ ebp (k 2) ], ret (k2+1) = [ ebp (k 2) +4] is obtained by sequentially iterating from n equal to 0.

In this embodiment of the present application, the stack trace-back formula may be ebp (n+1) = [ ebp (n) ], ret (n+1) = [ ebp (n) +m ], and m is a constant, and its specific value is determined according to the system architecture and process bit width adopted. For example, in the x86 architecture, the system m of the 32-bit process takes a value of 4.

In this embodiment of the present application, when the stack trace-back formula is adopted to perform stack repair, since the second target stack frame may not be the stack frame corresponding to the function of the lowest level in the function call chain, the value of n may not need to be taken from 0. When the stack backtracking formula is adopted to carry out stack repair, n can sequentially take k1 to k2, and k1 is the number of layers of the second target stack frame in the function call chain.

In the embodiment of the present application, the ebp value update formula may be ebp (j) =ebp (j) +m. ebp (j) =ebp (j) +m characterization traversal adds m to the original value of ebp (j) to obtain the value of ebp (j) of a new round, wherein ebp (j) is the ebp which needs to be updated in the traversal of the round, and k1 is not less than j and not more than k2.

It will be appreciated that the stack is size limited and therefore in the present embodiment ebp (j) cannot grow indefinitely, in the present embodiment the value of ebp (j) for the new round should meet the following condition: the value of ebp (j) of the new round is smaller than the stack bottom address (stack base) and larger than the minimum address (stack limit) of the stack, and the value of ebp (j+1) obtained based on ebp (j) of the new round is larger than the value of ebp (j) of the new round.

It may be further understood that in this embodiment of the present application, after each round of traversal, it may be determined whether a function to which a return address of a stack frame of a highest level in a function call chain obtained by the round of traversal belongs is a third objective function, if so, it is determined that the round of traversal stack backtracking is successful, or else it is determined that the round of traversal stack backtracking fails.

It will also be appreciated that multiple stack trace-back formulas are required during each traversal, and that it is not necessary to update the ebp value each time the stack trace-back formulas are used. Specifically, since ebp (n+1) = [ ebp (n) ], that is, the previous ebp value is obtained according to the next ebp value, after the next ebp value is changed, the previous ebp value is also changed, and the ebp value from the k1 level is traced back to the ebp value of the k2+1 level, so that a stack tracing path is formed. Therefore, changing the ebp value of any stage in the stack trace-back path results in a new stack trace-back path. Thus, during each round of traversal, only the combination of the updated ebp values need be different from the combination of the changed ebp values in the stack trace-back path of the traversed procedure. It should be noted, however, that for stack frames whose ebp value is correct, the ebp value is not updated.

For example, the update may be performed from a low level ebp value to a high level ebp value. Taking the function call chain formed by the function a, the function B, the function C and the function D as an example, assuming that the trace back abnormality is assumed at the function C, that is, the stack frame corresponding to the function C is the first target stack frame, the stack frame corresponding to the function D is the second target stack frame, and k1 is 0. Assuming an x86 architecture, 32-bit process system, the traversal procedure is as follows:

calculating ebp (1) = [ ebp (0) ], ret (1) = [ ebp (0) +4], continuing to calculate ebp (2) = [ ebp (1) ], ret (2) = [ ebp (2) +4], continuing to calculate ebp (3) = [ ebp (2) ], ret (3) = [ ebp (2) +4], and judging whether ret (3) is (ntdll | RtlInitializeExceptionChain, ntdll | rtlnuserthredstart. If not, after the ebp (0) is added with 4, the process is re-executed until the stack trace of the ebp (0) is successful or the ebp (0) can not be added any more.

If the stack trace is still unsuccessful, ebp (0) returns to the initial value, ebp (1) = [ ebp (0) ], ret (1) = [ ebp (0) +4] is calculated, after ebp (1) is added with 4, ebp (2) = [ ebp (1) ], ret (2) = [ ebp (2) +4] is continuously calculated, ebp (3) = [ ebp (2) ], ret (3) = [ ebp (2) +4] is continuously calculated, and whether ret (3) is (ntdll | RtlInitializeExceptionChain, ntdll | rtlnusertthredstart is judged. If not, after the ebp (0) is added with 4, the process is re-executed until the stack trace of the ebp (0) is successful or the ebp (0) can not be added any more.

If the stack trace is still unsuccessful, ebp (0) returns to the initial value, ebp (1) = [ ebp (0) ], ret (1) = [ ebp (0) +4] is calculated, after ebp (1) is added with 8, ebp (2) = [ ebp (1) ], ret (2) = [ ebp (2) +4] is continuously calculated, ebp (3) = [ ebp (2) ], ret (3) = [ ebp (2) +4] is continuously calculated, and whether ret (3) is (ntdll | RtlInitializeExceptionChain, ntdll | rtlnusertthredstart is judged. If not, after the ebp (0) is added with 4, the process is re-executed until the stack trace of the ebp (0) is successful or the ebp (0) can not be added any more.

Repeating the above process until traversing to obtain a path for enabling the stack to trace back successfully.

In this embodiment of the present application, in the manner of fig. 2, by traversing all stack trace paths, a stack trace path that makes stack trace successful (each ebp and return address that make up the stack trace path are considered to be correct at this time) may be found, so that recovery of an abnormal ebp and return address may be at least partially achieved, and repair of a stack may be achieved to a certain extent.

It will be appreciated that the stack restoration method and stack trace-back method described above may be used in combination. Specifically, the stack repair method shown in fig. 1 may be first adopted for repair, and after the stack repair method based on fig. 1 is adopted for repair, stack backtracking is performed again according to the actual return address and the actual ebp value of the first target stack frame. If the stack trace-back still fails (for example, the second consumption value and the first consumption value of the first objective function are not recorded in the preset resource consumption table), the stack trace-back mode shown in fig. 2 can be adopted to repair again, so that the reliability and the possibility of repair are further improved.

It will be appreciated that for a 64-bit process system, when performing stack trace, the OS (operating system) will scan the memory map of the executable file for the RUNTIME_FUNCTION structure whose range contains the current instruction address. The running _ FUNCTION architecture based operating system can know how the stack should be unwound, i.e., can know the stack memory consumption of the FUNCTION stack frame (i.e., the memory value consumed by the stack frame). And once the runntime_function structure is not obtained in the backtracking process, the backtracking will fail.

To this end, in some alternative implementations of the embodiments of the present application, the stack consumption value of the first objective function may include a third consumption value. The third consumption value is a memory value consumed by a stack frame of the first objective function.

Thereafter, for step S103, an actual RSP value of the first target stack frame may be determined based on the third consumption value and the RSP value of the next layer function called by the first target function. And then determining the actual return address of the first target stack frame according to the actual RSP value of the first target stack frame.

Specifically, the sum of the third consumption value and the RSP value of the next layer function called by the first objective function may be calculated, to obtain the actual RSP value of the first objective stack frame.

Then, the actual return address of the first target stack frame is obtained according to the formula ret= [ Rsp-8 ].

It can be understood that Ret refers to the actual return address of the first target stack frame, rsp is the actual Rsp value of the first target stack frame, and the formula ret= [ Rsp-8] represents the content in the address obtained after Rsp-8 is taken, where the content is the actual return address of the first target stack frame.

Based on the same inventive concept, two

stack repair apparatuses

300 and 400 are also provided in the embodiments of the present application. Referring now to fig. 3 and 4, fig. 3 illustrates a stack restoration apparatus 300 employing the method illustrated in fig. 1, and fig. 4 illustrates a stack trace-back apparatus 400 employing the method illustrated in fig. 2. It should be appreciated that the specific functions of the

apparatus

300 and 400 may be found in the above description, and detailed descriptions are omitted here as appropriate to avoid repetition. The

devices

300 and 400 include at least one software functional module that can be stored in memory in the form of software or firmware or cured in the operating system of the

devices

300 and 400. Specifically:

referring to fig. 3, the apparatus 300 may include:

the first obtaining module 301 is configured to obtain function information of a first objective function in case of stack trace-back failure; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position;

A searching module 302, configured to find a stack consumption value of the first objective function from a preset resource consumption table according to the function information;

and the correction module 303 is configured to determine an actual return address of the first target stack frame and an actual ebp value of an extended base pointer register according to the stack consumption value.

In an alternative implementation of the embodiment of the present application, the stack consumption value of the first objective function includes a first consumption value; the first consumption value is a stack consumption value generated when the first objective function calls a next-layer function. The correction module 303 is specifically configured to: and determining the actual return address of the first target stack frame according to the first consumption value and the value of an extended base address pointer register ebp of the next-layer function.

In the above alternative embodiment, the correction module 303 is specifically configured to: determining the value of ebp in the first target stack frame when the first target function calls the next layer function according to the value of ebp of the next layer function; and determining the actual return address of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the first consumption value.

In the above alternative embodiment, the correction module 303 is specifically configured to: calculating the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, and obtaining a second target address; acquiring the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

In the above alternative embodiment, the stack consumption value of the first objective function further includes a second consumption value; and the second consumption value is a stack consumption value of the first objective function executing the push ebp instruction. The correction module 303 is specifically further configured to: and determining the actual ebp value of the first target stack frame according to the ebp value of the next layer function, the first consumption value and the second consumption value.

In the above alternative embodiment, the correction module 303 is specifically configured to:

determining the value of ebp in the first target stack frame when the first target function calls the next layer function according to the value of ebp of the next layer function;

determining a value of stack up growth after the first objective function calls the next layer of function according to the first consumption value and the second consumption value;

And determining the actual ebp value of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the value of stack up-growth after the first target function calls the next layer function.

calculating the sum of the value of ebp in the first target stack frame when the first target function calls the next layer function and the value of stack upward growth after the first target function calls the next layer function, and obtaining a first target address;

acquiring the content in the first target address; the content in the first target address is the actual ebp value of the first target stack frame.

In the embodiment of the present application, the correction module 303 is specifically configured to: calculating the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, and obtaining a second target address; acquiring the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

In this embodiment of the present application, the apparatus 300 may further include a backtracking control module, configured to perform stack backtracking again according to the actual return address of the first target stack frame.

In this embodiment of the present application, the first obtaining module 301 may be further configured to obtain an ebp value of the second target stack frame in the case of a stack trace-back failure; and the second target stack frame is a stack frame with an ebp value without errors. And the backtracking control module is further used for sequentially traversing all stack backtracking paths according to the ebp value of the second target stack frame and a preset stack backtracking traversing formula until the stack backtracking is successful.

In this embodiment of the present application, the stack trace-back traversal formula includes: ebp (n+1) = [ ebp (n) ], ret (n+1) = [ ebp (n) +m ], ebp (j) = ebp (j) +m; the method comprises the steps that k1 to k2 are sequentially taken by n, k1 is the number of layers of a second target stack frame in a function call chain, k2 is the second largest number of layers in the function call chain, ebp (n) is an ebp value of an n-th stack frame, ebp (n+1) is an ebp value of an n+1-th stack frame, ret (n+1) is a return address of an n+1-th stack frame, m is a preset constant, a middle bracket in a formula indicates contents in an address in a middle bracket, ebp (j) =ebp (j) +m represents a value of ebp (j) of a new round obtained by adding m to the original value of ebp (j), and ebp (j) is an ebp which needs to be updated in the round of traversal, and k1 is not more than k2.

In the embodiment of the present application, the value of ebp (j) of the new round satisfies the following condition: the value of the new round of ebp (j) is smaller than the stack bottom address and larger than the minimum address of the stack, and the value of ebp (j+1) obtained based on the new round of ebp (j) is larger than the value of the new round of ebp (j).

In this embodiment of the present application, the traceback control module is further configured to determine that the traceback is successful when a function to which a return address of a stack frame at a highest level in the function call chain belongs is a third objective function.

In another alternative implementation of the embodiment of the present application, the stack consumption value of the first objective function includes a third consumption value; the third consumption value is a memory value consumed by a stack frame of the first objective function.

The correction module 303 is specifically configured to: determining an actual RSP value of the first target stack frame according to the third consumption value and an RSP value of a stack top pointer register of a next-layer function called by the first target function; and determining the actual return address of the first target stack frame according to the actual RSP value of the first target stack frame.

In one example of the above alternative embodiment, the correction module 303 is specifically configured to: and calculating the sum of the third consumption value and the RSP value of the next-layer function called by the first target function to obtain the actual RSP value of the first target stack frame.

Referring to fig. 4, the stack trace-back apparatus 400 may include:

a second obtaining module 401, configured to obtain an ebp value of an extended base address pointer register of a second target stack frame in case of a stack trace-back failure; the second target stack frame is a stack frame with an ebp value without errors;

and a traversing module 402, configured to sequentially traverse all stack trace-back paths according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula, until the stack trace-back is successful.

In the embodiment of the present application, the traversal module 402 is specifically configured to: and when the function to which the return address of the stack frame at the highest level in the function call chain belongs is a third target function, determining that the stack backtracking is successful.

It should be understood that, for simplicity of description, some of the descriptions in the method embodiments are omitted from description in the device embodiments.

Based on the same inventive concept, an embodiment of the present application further provides an electronic device, as shown in fig. 5, which includes a processor 501 and a memory 502. Wherein:

the processor 501 is configured to execute one or more programs stored in the memory 502 to implement the stack restoration method or the stack trace-back method described in the above embodiment.

It will be appreciated that the configuration shown in fig. 5 is merely illustrative, and that the electronic device may also include more or fewer components than shown in fig. 5, or have a different configuration than shown in fig. 5.

For example, the connection between the processor 501 and the memory 502 may be by way of a communication bus. For another example, the electronic device may also include components such as a display, a mouse, a keyboard, and the like.

In the embodiment of the present application, the processor 501 may be a central processing unit, a microprocessor, a single chip, etc., but is not limited thereto. The memory 502 may be, but is not limited to, random access memory, read only memory, programmable read only memory, erasable read only memory, electrically erasable read only memory, and the like.

In the embodiment of the application, the electronic device may be, but is not limited to, a physical device such as a desktop, a notebook, a smart phone, an intelligent wearable device, a vehicle-mounted device, or a virtual device such as a virtual machine. In addition, the electronic device is not necessarily a single device, but may be a combination of a plurality of devices, for example, a server cluster, or the like.

The present embodiment also provides a computer-readable storage medium, such as a floppy disk, an optical disk, a hard disk, a flash memory, a usb disk, an SD (Secure Digital Memory Card, secure digital Card) Card, an MMC (Multimedia Card) Card, or the like, in which one or more programs implementing the above steps are stored, and the one or more programs may be executed by one or more processors to implement the stack restoration method or the stack trace-back method of the above embodiments. And will not be described in detail herein.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The above-described apparatus embodiments are merely illustrative, for example, the division of the units is merely a logical function division, and there may be other manners of division in actual implementation, and for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed.

The functional modules in the embodiments of the present application may be integrated together to form a single part, or each module may exist alone, or two or more modules may be integrated to form a single part.

In this document, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

Herein, a plurality refers to two or more.

The foregoing is merely exemplary embodiments of the present application and is not intended to limit the scope of the present application, and various modifications and variations may be suggested to one skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method of stack repair, comprising:

under the condition of stack backtracking failure, acquiring function information of a first objective function; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position;

searching a stack consumption value of the first objective function from a preset resource consumption table according to the function information;

and determining the actual return address of the first target stack frame according to the stack consumption value.

2. The stack repair method of claim 1, wherein the stack consumption value of the first objective function comprises a first consumption value; the first consumption value is a stack consumption value generated when the first objective function calls a next-layer function;

determining an actual return address of the first target stack frame from the stack consumption value, comprising:

and determining the actual return address of the first target stack frame according to the first consumption value and the value of an extended base address pointer register ebp of the next-layer function.

3. The stack repair method of claim 2, wherein determining the actual return address of the first target stack frame from the first consumption value and the value of ebp of the next layer function comprises:

and determining the actual return address of the first target stack frame according to the value of ebp in the first target stack frame when the first target function calls the next layer function and the first consumption value.

4. The stack repair method of claim 3, wherein determining the actual return address of the first target stack frame based on the value of ebp in the first target stack frame when the next layer function is called by the first target function and the first consumption value comprises:

calculating the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, and obtaining a second target address;

acquiring the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

5. The stack repair method of claim 2, wherein the stack consumption value of the first objective function further comprises a second consumption value; the second consumption value is a stack consumption value of the first objective function executing the push ebp instruction;

The method further comprises the steps of:

and determining the actual ebp value of the first target stack frame according to the ebp value of the next layer function, the first consumption value and the second consumption value.

6. The stack repair method of claim 5, wherein determining the actual ebp value of the first target stack frame based on the value of ebp of the next layer function, the first consumption value, and the second consumption value comprises:

7. The stack repair method of claim 6, wherein determining the actual ebp value of the first target stack frame based on the value of ebp in the first target stack frame when the first target function calls the next layer function and the value of stack up-growth after the first target function calls the next layer function comprises:

8. The stack repair method of any one of claims 1-7, further comprising:

and re-performing stack backtracking according to the actual return address of the first target stack frame.

9. The stack repair method of claim 8, wherein the method further comprises:

if the stack backtracking fails, acquiring an ebp value of a second target stack frame; the second target stack frame is a stack frame with an ebp value without errors;

and traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

10. The stack repair method of claim 9, wherein the stack trace-back traversal formula comprises:

ebp(n+1)＝[ebp(n)]，ret(n+1)＝[ebp(n)+m]，ebp(j)＝ebp(j)+m；

the method comprises the steps that k1 to k2 are sequentially taken by n, k1 is the number of layers of a second target stack frame in a function call chain, k2 is the second largest number of layers in the function call chain, ebp (n) is an ebp value of an n-th stack frame, ebp (n+1) is an ebp value of an n+1-th stack frame, ret (n+1) is a return address of an n+1-th stack frame, m is a preset constant, a middle bracket in a formula indicates contents in an address in a middle bracket, ebp (j) =ebp (j) +m represents a value of ebp (j) of a new round obtained by adding m to the original value of ebp (j), and ebp (j) is an ebp which needs to be updated in the round of traversal, and k1 is not more than k2.

11. The stack repair method of claim 10, wherein the value of ebp (j) of the new round satisfies the following condition:

the value of the new round of ebp (j) is smaller than the stack bottom address and larger than the minimum address of the stack, and the value of ebp (j+1) obtained based on the new round of ebp (j) is larger than the value of the new round of ebp (j).

12. The stack repair method of claim 9, wherein the method comprises:

and when the function to which the return address of the stack frame at the highest level in the function call chain belongs is a third target function, determining that the stack backtracking is successful.

13. The stack repair method of claim 1, wherein the stack consumption value of the first objective function comprises a third consumption value; the third consumption value is a memory value consumed by a stack frame of the first objective function;

determining an actual RSP value of the first target stack frame according to the third consumption value and an RSP value of a stack top pointer register of a next-layer function called by the first target function;

and determining the actual return address of the first target stack frame according to the actual RSP value of the first target stack frame.

14. The stack repair method of claim 13, wherein determining an actual RSP value for the first target stack frame based on the third consumption value and an RSP value for a next layer function called by the first target function comprises:

and calculating the sum of the third consumption value and the RSP value of the next-layer function called by the first target function to obtain the actual RSP value of the first target stack frame.

15. A stack backtracking method, the method comprising:

under the condition of stack backtracking failure, acquiring an ebp value of an extended base address pointer register of a second target stack frame; the second target stack frame is a stack frame with an ebp value without errors;

16. The stack trace-back method according to claim 15, wherein the stack trace-back traversal formula comprises:

ebp(n+1)＝[ebp(n)]，ret(n+1)＝[ebp(n)+m]，ebp(j)＝ebp(j)+m；

17. The stack trace-back method according to claim 16, wherein the value of ebp (j) of the new round satisfies the following condition:

18. A stack trace back method as claimed in any one of claims 15 to 17, the method comprising:

19. A stack repair device, comprising:

the first acquisition module is used for acquiring function information of a first objective function under the condition of stack backtracking failure; the first objective function is a function to which the first objective stack frame belongs, and the first objective stack frame comprises a stack frame at a backtracking failure position;

the searching module is used for searching the stack consumption value of the first objective function from a preset resource consumption table according to the function information;

and the correction module is used for determining the actual return address of the first target stack frame according to the stack consumption value.

20. A stack trace-back device, comprising:

the second acquisition module is used for acquiring an ebp value of an extended base address pointer register of a second target stack frame under the condition of stack backtracking failure; the second target stack frame is a stack frame with an ebp value without errors;

and the traversing module is used for traversing all stack trace-back paths in sequence according to the ebp value of the second target stack frame and a preset stack trace-back traversing formula until the stack trace-back is successful.

21. An electronic device, comprising: a processor and a memory; the processor is configured to execute a program stored in the memory to implement the stack restoration method according to any one of claims 1 to 14, or the stack trace-back method according to any one of claims 15 to 18.

22. A computer readable storage medium storing one or more programs executable by one or more processors to implement the stack restoration method of any one of claims 1 to 14 or the stack trace-back method of any one of claims 15 to 18.