JP2004038312A - Log acquisition method, program, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a log acquisition method for easily acquiring a processing log of software and reducing the manhour for analyzing a bug. <P>SOLUTION: This log acquisition method for acquiring the log under execution in a program 91 having a function FuncAA is provided with a process of rewriting the address of the loaded function FuncAA into the address of a function 92 for acquiring the log. The function 92 for acquiring the log is provided with a process 101 of calling 96 the address of the function FuncAA, implementing 97 a prescribed process, and delivering the received implementation result 98 to the program 91; a process of determining whether or not pointer parameters are defined by a prescribed definition method in a function definition in the program 91; and a process of, when they are defined, recording the contents of a memory specified by the pointer parameters as the log based on the definition method. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technique for acquiring a processing log of software divided into a plurality of modules.
[0002]
[Prior art]
Conventionally, for a software failure with a low recall rate, a processing log of the software has been acquired, and the processing log has been analyzed to determine the cause of the failure and take countermeasures.
[0003]
[Problems to be solved by the invention]
However, the conventional processing log acquisition has the following problems.
(1) In order to continue to get the even log in the user's operating environment, tweaked to the module itself software must be added the process log acquisition routine, the workload for processing log acquisition is large.
(2) Since the processing log is obtained for each module, the generated log is for each module, and it is difficult to obtain the processing of the entire software as a completely chronological log. For this reason, the prospect of the entire processing log is poor, and the process of analyzing the log and finding the cause of the failure requires a lot of man-hours.
[0004]
The present invention has been made in view of the above problems, to get the processing log software that the plurality of modules divided easily and can reduce the man-hours for analysis of causes of the failure of the software It is an object of the present invention to provide a simple log acquisition method, a program for realizing the method by a computer, and a storage medium storing the program.
[0005]
[Means for Solving the Problems]
Log acquisition method according to the present invention in order to achieve the above object has the following arrangement. That is,
A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining in the function definition in the program whether or not the pointer parameter is defined by a predetermined definition method;
Recording the contents of the memory pointed to by the pointer parameter as a log based on the definition method when the pointer parameter is defined by a predetermined definition method.
[0006]
BEST MODE FOR CARRYING OUT THE INVENTION
[First Embodiment]
This embodiment is a mechanism when a function call that exists from one module within another module takes place, by using the import function address stored in the memory or virtual function address table, (Virtual Address Table) By hooking function calls between modules and recording them in a log, it is possible to acquire the processing of the entire software as a log in chronological order without changing the software module itself. . This will be specifically described below.
[0007]
<System configuration>
Figure 1 is a diagram showing the configuration of the computer (software evaluation system) that implements the log acquisition method according to the embodiments of the present invention. For simplicity of explanation, in the present embodiment, the software evaluation system is built inside one PC, but the feature of the log acquisition method of the present invention is built inside one PC. or, alternatively it is effective regardless of the plurality of PC to either constructed as a network system.
[0008]
A computer on which the software evaluation system is mounted includes a CPU 1, a chip set 2, a RAM 3, a hard disk controller 4, a display controller 5, a hard disk drive 6, a CD-ROM drive 7, and a display 8. Further, a signal line 11 connecting the CPU and the chipset, a signal line 12 connecting the chipset 2 and the RAM 3, a peripheral device bus 13 connecting the chipset 2 and various peripheral devices, and a signal connecting the hard disk controller 4 and the hard disk drive 6. A line 14, a signal line 15 connecting the hard disk controller 4 and the CD-ROM drive 7, and a signal line 16 connecting the display controller 5 and the display 8 are mounted.
[0009]
<Acquisition of processing log for function processing>
In order to explain a software evaluation system for realizing the log acquisition method according to the first embodiment of the present invention, first, referring to FIG. 2, how the software divided into a plurality of modules is loaded into the memory in a normal state. Explain.
[0010]
Usually, the software divided into a plurality of modules is divided into an executable file EXE (23) for controlling the whole and a dynamic link library DLL (27) which exists as a module and plays a complementary role of EXE, and Is loaded with both EXE and DLL. EXE consists of a code segment (28), a data segment (29), and an import function address table (22). Furthermore, import function address table is divided by the DLL belonging function (21, 24), addresses each of the function for each DLL is loaded is written (30-35). The entity of the DLL function is loaded separately (25, 26) for each DLL, and each function is loaded as a part of the corresponding DLL (36-41). In this figure, one EXE is A.D. DLL and B.I. Shows an example using the functions in two dynamic link libraries DLL, actually function used is turned Func AA, Func AB, Func AC, Func BA, Func BB, and six Func BC ing.
[0011]
When a code in the EXE code segment calls the function Func AA, first, the address (30) of the Func AA written in the import function address table is read. Here, A. The address of the Func AA code (36) read as a part of the DLL is written, and by calling the address, the code of EXE becomes A.D. The DLL Func AA can be called.
[0012]
FIG. 3 is a diagram illustrating a memory configuration of a software evaluation system that implements the log acquisition method according to the first embodiment of the present invention. FIG. 2 illustrates an IAT Patch (Import Address) for a log acquisition code. The difference is that the function call is redirected using a method called “Table Patch”.
[0013]
When logging is started, the memory is a DLL for IAT Patch C. DLL (58) is loaded. C. DLL is the address of a function written in the import function address in the table (52), C. The log acquisition code in the DLL is rewritten with the addresses of Func CAA, Func CAB, Func CAC, Func CBA, Func CBB, and Func CBC (61 to 66). C. Func CAA in DLL, Func CAB, Func CAC, Func CBA, Func CBB, Func CBC code (73 to 78), as well as logging, has been loaded into the memory to receive the original function call, the appropriate Function Func AA, Func AB, Func AC, Func BA, Func BB, Func BC (67-72).
[0014]
Figure 4A is a diagram representing the processing of the IAT Patch in FIG. 3, FIG. 4B is a flow chart showing the flow of a log acquisition process. For simplicity of explanation, EXE in FIG. An example of how the log acquisition code by IAT Patch operates when calling Func AA in the DLL is shown.
[0015]
When EXE (91 in FIG. 4A) calls Func AA (94 in FIG. 4A), C.I. The log acquisition code in the DLL saves the DLL name / function name in the memory (step S402 in FIG. 4B), saves the call time in the memory, saves the parameter at the time of the call in the memory, and stores the pointer parameter at the time of the call. The content of the memory pointed to is stored in another memory (95 in FIG. 4A, step S403 in FIG. 4B). Thereafter, C.I. The DLL was supposed to be called. DLL calls the Func AA in (93 in FIG. 4A) (96 in Fig. 4A, step S404 in FIG. 4B). A. Func AA process DLL (97 in FIG. 4A) is completed, C. When control returns to the DLL (98 in FIG. 4A), C. The DLL saves the time at the time of return to the memory, saves the return value to the memory, and saves the memory contents indicated by the pointer parameter to another memory at the time of return (99 in FIG. 4A). Thereafter, C.I. DLL writes the saved log information to a file (100 in FIG. 4A, step S405 in FIG. 4B), though A. The program returns to EXE as if the Func AA of the DLL ended normally (101).
[0016]
Figure 5 is a diagram showing the internal configuration of the software evaluation system that implements the log acquisition method according to the first embodiment of the present invention. Normally, the executable EXE (113) calls a function in DLL-1 (116) or DLL-2 (117). Here, a log acquisition code called an API tracer is embedded (114), and a processing log is generated. (115). API tracer, a file that describes the function definition of DLL-1 and DLL-2 (111), which DLL throat function import function of setting the scenario to retrieve log by rewriting the table (Trace scenario 112) based on Works.
[0017]
<Process log acquisition for method processing>
Next, in the software evaluation system that implements the log acquisition method according to the first embodiment of the present invention, when the instance creation interface being exported by executable EXE (118) is COM (Component Object Model) server, which In order to explain how the memory is loaded, first, how the memory is loaded in a normal state will be described with reference to FIG.
[0018]
Normally, when an instance of an interface is created, the required interface (121, 122) and its method (: a program describing a procedure to be executed by an object in object-oriented programming, 130 to 135) are created in the COM server. Created, they are both loaded into memory. Here, a virtual address table (virtual address table) is created for each created interface (118, 120), and is passed to the EXE that made the creation request. In the virtual address table, addresses where the respective methods are created are written (124 to 129). EXE uses these information to call each interface. In this figure, one EXE has created instances of two interfaces Interface A and Interface B, shows an example using the method of internal its interfaces, methods that are actually used , Method AA, Method AB, Method AC, Method BA, Method BB, and Method BC.
[0019]
When the EXE code calls the function Method AA, first, the address (124) of the Method AA written in the virtual address table is read. Here actually it is written the address of created as part the Method AA code (130) of the Interface A of COM server by calling the address, the Method AA of the EXE Code Interface A Can be called.
[0020]
FIG. 7 is a diagram illustrating a memory configuration of a software evaluation system that implements the log acquisition method according to the first embodiment of the present invention. FIG. 6 illustrates a VTable Patch (virtual address) for a log acquisition code. The method is different in that the method call is redirected using a method called “table patch”.
[0021]
When the log acquisition is started, the DLL (143) for VTable Patch is loaded into the memory. This DLL virtual address table the address of the method written in (136, 138), a log acquisition code in the DLL Method A'A, Method A'B, MethodA'C, Method B'A, Method B 'B, rewrites the address of Method B'C (145~150). Method A'A in DLL, Method A'B, Method A'C, Method B'A, Method B'B, Method B'C code (157-162), as well as logging, original method The corresponding methods, Method AA, Method AB, Method AC, Method BA, Method BB, Method, which are loaded in memory to receive the call
Call the BC (157~162).
[0022]
FIG. 8A is a diagram showing the process of VTable Patch in FIG. 7, and FIG. 8B is a flowchart showing the flow of the log acquisition process. For simplicity of the description, this figure shows an example of how the log acquisition code by VTable Patch operates when EXE calls MethodA of Interface A in the COM server.
[0023]
When the EXE (163 in FIG. 8A) calls the Method AA (166 in FIG. 8A), the log acquisition code stored in the DLL saves the module name / interface name / method name in the memory (step S802 in FIG. 8B) and calls it. Save the time in the memory, to save the parameters of time of the call in the memory, the memory content pointed to parameters of time of the call, is stored in a separate memory (167 in FIG. 8A, step S803 in FIG. 8B)). After that, the DLL calls the Method AA in the COM server (165 in FIG. 8A), which should have been called originally (168 in FIG. 8A, step S804 in FIG. 8B). When the Method AA processing of the COM server (169 in FIG. 8A) is completed and control returns to the DLL (170 in FIG. 8A), the DLL saves the time at the time of return in the memory, saves the return value in the memory, and returns. the sometimes memory contents pointer parameter points, is stored in another memory (171 in FIG. 8A). Thereafter, DLL writes the saved log information in a file (in FIG. 8A 172, step S805 in FIG. 8B), as if Method AA of COM server terminates normally, the process returns to the EXE (in FIG. 8A 173).
[0024]
FIG. 9 is a diagram illustrating an internal configuration of the software evaluation system according to the first embodiment of the present invention. Normally, the executable EXE (176) calls a method in the COM server 1 (179) or the COM server 2 (180). Here, a log acquisition code called an API tracer is embedded (177), and a processing log is generated. (178). The API tracer sets a file (174) in which the function definitions of the COM server 1 (179) and the COM server 2 are described, and a setting scenario of rewriting the virtual address table of which method of which interface of which COM server to acquire the log. It operates based on (175).
[0025]
As apparent from the above description, according to the log acquisition method according to the present embodiment, the acquisition module Graded software processing log plurality in, without making changes to the module itself, are provided in the module were it becomes possible to record a call function / method as a log, it is possible to reduce the workload for processing log acquisition. Further, the generated log can be acquired as a log in chronological order, and the log can be easily analyzed. Therefore, the number of steps for analyzing the cause of the software failure can be reduced.
[0026]
[Second embodiment]
In the present embodiment, in the normal, describe the case of logging data pointer parameters that can not be acquired as a binary.
[0027]
FIG. 10 is an example of a function definition of a software evaluation system for realizing the log acquisition method according to the present embodiment, which is described in IDL, which is generally widely used. In a software evaluation system that realizes the log acquisition method according to the present embodiment, a type library file obtained by tokenizing the IDL is used as a function definition file.
[0028]
11, in the function definition of the software evaluation system that implements the log acquisition method according to the present embodiment, by specifying the binary obtained for pointer parameter, obtains the actual data of the pointer parameter as a log This is a description by IDL for performing the operation.
[0029]
In the definition of the FuncbinidId function, custom (PAT_PARAM_ATTR_ID, "binid_is ()") is declared for long * lplParam (201). Here, PAT_PARAM_ATTR_ID (200) is an identifier for use by the present software evaluation system in IDL. Here, by defining “binid_is ()”, data of the data type size (here, long type) of the parameter from the pointer pointed to by this parameter is stored in the log as binary data.
[0030]
In the definition of the FuncSizeIs function, custom (PAT_PARAM_ATTR_ID, "size_is (dwCount)") is declared for int * lplParam (202). Here, by defining “size_is (dwCount)”, this parameter is treated as having dwCount data as the first parameter. Then, from the pointer pointed to by this parameter, data of (dwCount × the data type size of the parameter (here, int type)) is stored in the log as binary data.
[0031]
In the definition of FuncLengthIs function, it has been declared custum (PAT_PARAM_ATTR_ID, "length_is (dwLength)") to the char * lpszParam (203). Here, by defining “length_is (dwLength)”, this parameter is treated as having dwLength data as the first parameter. Then, data corresponding to (dwLength × data type size of parameter (char type in this case)) from the pointer indicated by this parameter is stored in the log as binary data.
[0032]
In the definition of FuncBytesIs function, has been declared custum (PAT_PARAM_ATTR_ID, "bytes_is (dwSize)") with respect to void * lpParam (204). Here, by defining “bytes_is (dwSize)”, this parameter is treated as having dwSize bytes of data as the first parameter. Then, dwSize bytes of data are stored in the log as binary data from the pointer indicated by this parameter.
[0033]
In the definition of FuncBytesIs1 function, has been declared custum (PAT_PARAM_ATTR_ID, "bytes_is (12)") with respect to void * lpParam (205). Here, by defining "bytes_is (12)", this parameter is treated as having the specified data of 12 bytes. Then, from the pointer pointed to by this parameter, 12 bytes of data are stored in the log as binary data.
[0034]
FIG. 12 is a diagram showing a flow of acquiring a log when a function is defined as shown in FIG. 11 in the software evaluation system for realizing the log acquisition method according to the present embodiment.
[0035]
When the process is started (step S1), log acquisition is started, and the module name, interface name, and function / method name are stored in the HDD (step S2). Then log acquisition code stores the call time, the contents of the memory pointed to parameters and pointer parameter to HDD (step S3). Then, it is judged whether the setting of the binary acquisition function definition exists (step S4), and if present, each defining the memory size to store calculated (binid_is, size_is, length_is, bytes_is) for each (step S5 ), The contents of the memory pointed to by the pointer parameter are stored in the HDD by the calculated size (step S6). Subsequently, the original function is called (step S7). When returning from the function, the log acquisition code saves the time at the time of return, the return value, and the contents of the memory indicated by the pointer parameter in the HDD (step S8). Then, it is judged whether the setting of the binary acquisition function definition exists (step S9), and if present, each defining the memory size to store calculated (binid_is, size_is, length_is, bytes_is) for each (step S10 ), The contents of the memory pointed to by the pointer parameter are stored in the HDD by the calculated size (step S11). The process when there is an instruction of termination from the user (step S12) is terminated.
[0036]
Figure 13 is the software evaluation system that implements the log acquisition method according to the present embodiment, a diagram of the acquired log data by the definition of FIG.
[0037]
The function definition, logs can be obtained when there is no set of binary acquisition (210) is a portion excluding the DataID. Then, when performing the setting of the binary acquisition, DataID and binary data log (211) can be obtained. For example, comparing the log FuncSizeIs, when there is no set of binary acquisition, the data pointed to by the pointer parameter lpParam only one minute in an int can be acquired. However, in practice this data points to the array of ten int type data. Therefore, when the setting of binary acquisition is performed, it is possible to acquire a total of 40 bytes of data of 4 bytes × 10, which is the size of int type data.
[0038]
As apparent from the above description, according to this embodiment, by associating the size and pointer parameter, in normal, the log can acquire data pointer parameters that can not be acquired as a binary.
[0039]
[Third Embodiment]
In the present embodiment, a case will be described in which a function that is not exported, such as a callback function, is acquired as a log.
[0040]
FIG. 14 is a description by IDL for acquiring a function that is not exported, such as a callback function, as a log in the function definition of the software evaluation system that implements the log acquisition method according to the present embodiment.
[0041]
In the definition of the FuncSetCallBack function, DWORD pfnFuncCallBack is declared to be custom (PAT_PARAM_ATTR_ID, "funcname_is (FuncCallBack)") (221). The FuncSetCallBack function is a function for setting a callback function for a module, and the DWORD pfnFuncCallBack is a parameter for setting the address of the callback function. Here, by defining a "funcname_is (FuncCallBack)", the log acquisition process recognizes the value passed in the parameter as FuncCallBack address of the function (222) is replaced with the address of the log acquisition process. Also, to save the original value to call the original callback function when the log acquisition process. As a result, the log of the callback function that is not exported it is possible to get.
[0042]
In the definition of the GetFuncPointer function, DWORD pfnFuncInternal is declared as custom (PAT_PARAM_ATTR_ID, “funcname_is (FuncInternal))” (223). The GetFuncPointer function, which does not acquire a pointer inside the module, is a function that does not obtain the pointer inside the module. in and, DWORD PfnFuncInternal is a parameter for obtaining the pointer to the non-export function. here, by defining a "funcname_is (FuncInternal)", the log acquisition process is passed to the parameter value It was recognized as the address of FuncInternal function (224), the address of the log acquisition process To conversion. Further, stores the original values in order to call the original non-exported function when the log acquisition process. Thus, the log of the function of the internal module which is not exported is obtainable.
[0043]
GetFuncPointeArray function (225) is a function for obtaining the exported non address of the function groups of the internal modules FUNCPOINTERARRAY structure (220). Here, custom (PAT_PARAM_ATTR_ID, “funcname_is (FuncInternational1 to 4)”) is declared for the definition of each member of FUNCPOINTERARRAY. Here, by defining a "funcname_is (FuncInternal1~4)"), the value passed to members of this structure is recognized as the address of FuncInternal1～4 function (226), substituting the address of the log acquisition process . Also, to save the original value to call the original non-exported functions during log acquisition process. This allows obtaining a log of the function group of internal modules that are not exported.
[0044]
Figure 15 is a diagram showing the memory configuration of the software evaluation system that implements the log acquisition method according to the present embodiment, and FIG. 3, with the difference that the log code for obtaining the hidden function is added . A. The FuncAD (231) in the DLL is an unexported function, and therefore does not exist in the Import Address Table (230). At this time, if funcname_is is defined for FuncAD, C.I. The FuncCAD (232) for log acquisition is generated in the DLL, and the address of the FuncCAD is used when replacing the value of the parameter defined by funcname_is that returns the address of the FuncAD.
[0045]
FIG. 16 is a diagram illustrating a flow of acquiring a log when a function is defined as shown in FIG. 14 in the software evaluation system that implements the log acquisition method according to the present embodiment.
[0046]
When the process is started (step S21), log acquisition is started, and the module name, interface name, and function / method name are stored in the HDD (step S22). Next, the log acquisition code saves the time at the time of calling, the parameter, and the contents of the memory indicated by the pointer parameter in the HDD (step S23). Then, it is determined whether the setting of funcname_is exists in the function definition (step S24). If so, the function definition defined by funcname_is is acquired from the function definition file, and the log acquisition processing is performed based on the definition. Is generated (step S25). Then, the value in which funcname_is is defined is stored and replaced with the address of the generated log acquisition code (step S26).
[0047]
Subsequently, the original function is called (step S27). Upon return from the function, the log acquisition code saves the time at the time of return, the return value, and the contents of the memory indicated by the pointer parameter in the HDD (step S28). Then, it is determined whether the setting of funcname_is exists in the function definition (step S29). If so, the definition of the function defined by funcname_is is acquired from the function definition file, and the log acquisition processing is performed based on the definition. Is generated (step S30). Then, to save the value funcname_is is defined, it replaced the generated log acquisition code address (step S31). The process when there is an instruction of termination from the user (step S32) is terminated.
[0048]
When the parameter set in funcname_is is replaced with the address of the generated log acquisition code, the original function that is subsequently called using that address will be processed in the same way as a normal log (ie, , generated log acquisition code, calls a function that is not exported, the process is running, with pass execution results received, the predetermined information when calling a function that is not exported, when receiving the execution result Is recorded as a log).
[0049]
FIG. 17 is a diagram of log data acquired when the definition of FIG. 14 is not performed in the software evaluation system that implements the log acquisition method according to the present embodiment. If you do not want to set at the function definition file, callback function, the internal functions that are not export the log can not be retrieved.
[0050]
FIG. 18 is a diagram of log data acquired from the definition of FIG. 14 in the software evaluation system that implements the log acquisition method according to the present embodiment. In function definition file, the callback function, since the set to obtain an internal function that is not exported, and FuncCallBack function, FuncInternal function, log non exported functions such FuncInternal4 function is obtainable.
[0051]
According to this embodiment, effects are obtained that it becomes possible to acquire a log of the non-exported functions that can not be acquired in the usual way.
[0052]
[Fourth embodiment]
In the present embodiment, as the log of the functions that can not be acquired in the usual way, we described a case of acquiring a log of the parameters of the variable-length sequences.
[0053]
FIG. 19 is a description by IDL for obtaining a variable-length array parameter as a log in the function definition of the software evaluation system that realizes the log obtaining method according to the present embodiment.
[0054]
In the definition of the FuncArrayIs function, it is declared that int * lpnParam is custom (PAT_PARAM_ATTR_ID, "array_is (dwCount)") (240). Here, by defining "array_is (dwCount)", this pointer parameter is treated as an int type array for dwCount which is the first parameter. Then, a pointer to this pointer parameter and dwCount pieces of type int and stores data in a log.
[0055]
FIG. 20 is a flowchart for acquiring a log when a function is defined as shown in FIG. 19 in the software evaluation system that realizes the log acquisition method according to the present embodiment.
[0056]
When the processing is started (step S41), log acquisition is started, and the module name, interface name, and function / method name are stored in the HDD (step S42). Next, it is determined whether or not the setting of variable length array acquisition (array_is) exists in the function definition (step S43), and if so, the parameter defined by the pointer parameter is treated as an array definition (step S44). stores the call time, the contents of the memory pointed to parameters and pointer parameter to HDD (step S45). And, subsequently, call the original function (step S46). Upon returning from the function, the log acquisition code determines whether the setting of variable-length array acquisition (array_is) exists in the function definition (S47). If so, the parameter defined by the pointer parameter is defined in the array definition. (Step S48), and the time at the time of return, the return value, and the contents of the memory pointed to by the pointer parameter are stored in the HDD (step S49). The process when there is an instruction of termination from the user (step S50) is terminated.
[0057]
FIG. 21 shows log data (250) obtained when the definition of FIG. 19 is not performed and log data (250) obtained by the definition of FIG. 19 in the software evaluation system that realizes the log obtaining method according to the present embodiment. 251) is a view of. If the setting is not performed in the function definition file, only the first data is obtained because the pointer parameter cannot be handled as an array, but if the setting is performed in the function definition file, since the pointer parameter is treated as an array, all the data sequences have been acquired.
[0058]
As described above, according to the present embodiment, an effect is obtained that a log of a parameter of a variable length array can be obtained as a log of a function that cannot be obtained by a normal method.
[0059]
[Fifth Embodiment]
In the present embodiment, in a normal function definition, the function can not obtain the parameter, the case of acquiring the log.
[0060]
FIG. 22 is a software evaluation system that realizes the log acquisition method according to the present embodiment, and is an example of a function for which parameters cannot be acquired with a normal function definition.
[0061]
Three types of structures, STRUCTSIZE1, STRUCTSIZE2, and STRUCTSIZE3, are defined, and the DWORD dwSize member of each structure needs to include the size of its own structure. The FuncGetData function sets which of the above three types of structure pointers is passed to the first parameter dwKind and the second parameter lpBuf. When the first parameter is 1, the FuncGetData function performs processing by treating lpBuf as a pointer of STRUCTURESIZE1, and when the first parameter is 2, performs processing by treating lpBuf as a pointer of STRUCTSIZE2. if the parameter is 3, performs processing deals with lpBuf as a pointer STRUCTSIZE3. In this case, if FuncGetData is defined by a normal function definition, lpBuf becomes a void-type pointer, and data cannot be acquired.
[0062]
FIG. 23 is a memory diagram showing how each structure of STRUCTURESIZE1, STRUCTSIZE2, and STRUCTSIZE3 uses a memory in FIG. Structure STRUCTSIZE1 of (260), each member is to offset 0x000 DWORD dwSize (261), DWORD dwParam1 (262) to 0x0004, DWORD dwParam3 is present in the DWORD DwParam2,0x000C to 0x0008. The structure STRUCTURESIZE2 (265) is the same as the STRUCTURESIZE1 from DWORD dwSize to DWORD dwParam3 (266 to 269), and a DWORD dwParam 4 (270) exists at 0x0010. STRUCTSIZE3 (271) is the same as STRUCTSIZE2 from DWORD dwSize to DWORD dwParam4 (272 to 276), and DWORD dwParam5 (277) exists at 0x0014. As described above, the memory arrangement from dwSize to dwParam4 of STRUCTSIZE3 is the same as that of STRUCTSIZE2, and the memory arrangement from dwSize to dwParam3 of STRUCTSIZE2 is the same as that of STRUCTSIZE1.
[0063]
FIG. 24 is a software evaluation system for realizing the log acquisition method according to the present embodiment, which is a description in IDL for acquiring a log of function parameters as shown in FIG.
[0064]
In the original function, a structure separated from Structsize1, Structsize2, and Structsize3 is defined as one structure called Structsize (291). This definition is the same as that of STRUCTURESIZE3 because, from the memory arrangement in FIG. 23, STRUCTURESIZE3 has the same memory arrangement part as STRUCTSIZE1 and STRUCTSIZE2. Then, [custom (PAT_PARAM_ID, "structsize_is ()")] is set for DWORD dwSize, which is a member of this structure and indicates the size of the structure. In this, log acquisition process when performing data analysis of the structure, it is possible to know the size of the structure. Further, in FuncGetData function, you define lpBuf second parameter as STRUCTSIZE type. Thereby, in the case of storing the parameter as a log processing is performed as STRUCTSIZE type. If the function definition file is described so as to acquire the data of STRUCTURESIZE3 without using this method, if GetFuncData is called with dwKind = 1 or 2, the data of STRUCTSIZE1 or STRUCTSIZE2 must exist. now, in order to result in trying to get the data of dwParam3 and dwParam4 in the log, the memory exception occurs.
[0065]
FIG. 25 is a diagram illustrating a flow of acquiring a log when a function is defined as illustrated in the software evaluation system that realizes the log acquisition method according to the present embodiment.
[0066]
When the process is started (step S61), log acquisition is started, and the module name, interface name, and function / method name are stored in the HDD (step S62). Next, it is determined whether or not the setting of the structure size designation (structsize_is) exists in the function definition (step S63). If there is, the data of the set structure parameter is set by the size designation (structsize_is) setting. analyzing in a data size range defined (step S64). Then, to save the call time, the contents of the memory pointed to parameters and pointer parameter to HDD (step S65). And, subsequently, call the original function (step S66). When returning from the function, it is determined whether or not the setting of the structure size specification (structsize_is) exists in the function definition (step S67). If so, the data of the set structure parameter is specified by the size specification (structsize_is). is in the set defined analyzed in the data size range is (step S68). Then, to save the return time, the contents of the memory pointed return value and pointer parameter to HDD (step S69). The process when there is an instruction of termination from the user (step S70) is terminated.
[0067]
Figure 26 is a diagram showing the details of the structure parameter analysis performed in FIG. 25 based on the memory configuration.
[0068]
When GetFuncData is used with dwKind = 1 in an actual program, a STRUCTURESIZE1 structure (300) is used, and the memory usage of each member (301 to 304) at that time is as shown in the figure. When the function is defined as shown in FIG. 24, the software evaluation system recognizes the function as a STRUCTURESIZE structure (305), and estimates that the memory usage of each member (306 to 311) at that time is as shown in the figure. to. Then, when the size specification (structsize_is) setting exists, by checking the value of dwSize, it is possible to know that the size of the structure is dwSize bytes. only the data of 312) to get as a log.
[0069]
Figure 27 is the software evaluation system that implements the log acquisition method according to the present embodiment, a diagram of the acquired log data by the definition of FIG. 24. In a normal function definition, data of a structure that is void * and data of only a pointer can be obtained is obtained as a log depending on the type of the structure used.
[0070]
Thus, according to this embodiment, effects are obtained that it becomes possible to acquire the log can not be acquired parameter in the usual way.
[0071]
[Sixth embodiment]
FIG. 28 is a software evaluation system that realizes the log acquisition method according to the present embodiment, and is an example of a function for which parameters cannot be acquired with a normal function definition.
[0072]
Three types of structures, STRUCTKIND1, STRUCTKIND2, and STRUCTKIND3, are defined. The GetFuncData function sets which of the above three types of structure pointers is passed to the second parameter lpBuf for the first parameter dwKind. When the first parameter is 1, the FuncGetData function handles lpBuf as a pointer to STRUCTKIND1, and when the first parameter is 2, handles lpBuf as a pointer to STRUCTKIND2. if the parameter is 3, performs processing deals with lpBuf as a pointer STRUCTKIND3. In this case, if FuncGetData is defined by a normal function definition, lpBuf becomes a void-type pointer, and data cannot be acquired.
[0073]
FIG. 29 is a diagram showing the memory arrangement of each structure of STRUCTKIND1, STRUCTKIND2, and STRUCTKIND3 in FIG. Each member of the structure STRUCTKIND1 (330) has a charParam (331) at offset 0x0000, a DWORD dwParam (332) at 0x0001, and a short shParam (333) at 0x0005. Each member of the structure STRUCTKIND2 (334) has a short shParam (335) at offset 0x0000, a DWORD dwParam (336) at 0x0002, and a char chParam (337) at 0x0006. Structure STRUCTKIND3 of (338), each member is to offset 0x0000 char chParam (339), short shParam to 0x0001 (340), DWORD dwParam to 0x0003 (341), long lParam to 0x0007 (342), is int nParam the 0x000B exist. As described above, since there is no size information in each structure and the memory structure of the structure data is different, the method described in the fifth embodiment cannot be used.
[0074]
FIG. 30 is a software evaluation system for realizing the log acquisition method according to the present embodiment, which is a description by IDL for acquiring a log of function parameters as shown in FIG.
[0075]
Each structure is defined in the usual way. [Custum (PAT_PARAM_ID, "structkind_is (dwKind: 1: STRUCTKIND1 *, 2: STRUCTKIND2 *, 3: STRUCTKIND3 *)")] for the second parameter void * 1pBuf of FuncGetData function to be set. As a result, the data type of lpBuf is treated as STRUCTKIND1 * when the value of the first parameter dwKind is 1, as STRUCTKIND2 * when it is 2, and as STRUCTKIND3 * when it is 3, and saved as a log. It is.
[0076]
FIG. 31 is a diagram showing a flow of acquiring a log when a function is defined as shown in FIG. 30 in a software evaluation system for realizing the log acquisition method according to the present embodiment.
[0077]
When the process is started (step S81), log acquisition is started, and the module name, interface name, and function / method name are stored in the memory (step S82). Next, it is determined whether or not the setting of the structure type designation (structkind_is) exists in the function definition (step S83). If so, the data of the set structure parameter is determined by the type designation (structkind_is) setting. analyzing the data types defined (step S84). Then, to save the call time, the contents of the memory pointed to parameters and pointer parameter in memory (step S85). And, subsequently, call the original function (step S86). When returning from the function, it is determined whether or not the setting of the structure type designation (structkind_is) exists in the function definition (step S87). If there is, the data of the set structure parameter is designated (structkind_is). analyzing the data types defined in the set (step S88). Then, to save the return time, the contents of the memory pointed return value and pointer parameter in memory (step S89). The process when there is an instruction of termination from the user (step S90) is terminated.
[0078]
Figure 32 is the software evaluation system that implements the log acquisition method according to the present embodiment, a diagram of the acquired log data by the definition of FIG. 30. In a normal function definition, data of a structure that is void * and data of only a pointer can be obtained is obtained as a log depending on the type of the structure used.
[0079]
According to this embodiment, effects are obtained that it becomes possible to acquire the log can not be acquired parameter in the usual way.
[0080]
[Other embodiments]
Note that the present invention is applied to a system including a plurality of devices (for example, a host computer, an interface device, a reader, a printer, etc.), but a device including one device (for example, a copying machine, a facsimile machine, etc.) it may be applied to.
[0081]
Further, an object of the present invention is to provide a storage medium storing a program code of software for realizing the functions of the above-described embodiments to a system or an apparatus, and a computer (or CPU or MPU) of the system or apparatus to store the storage medium. It is needless to say that the present invention can also be achieved by reading and executing the program code stored in the program.
[0082]
In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the storage medium storing the program code constitutes the present invention.
[0083]
As a storage medium for supplying the program code, for example, a floppy (registered trademark) disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, magnetic tape, nonvolatile memory card, ROM, or the like is used. be able to.
[0084]
When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also an OS (Operating System) running on the computer based on the instruction of the program code. It goes without saying that a part or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing.
[0085]
Further, after the program code read from the storage medium is written into a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function expansion is performed based on the instruction of the program code. It goes without saying that a CPU or the like provided in the board or the function expansion unit performs part or all of the actual processing, and the processing realizes the functions of the above-described embodiments.
[0086]
【The invention's effect】
As described above, according to the present invention, a processing log of software divided into a plurality of modules can be easily obtained, and the number of steps for analyzing the cause of a software failure can be reduced.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration of a computer (software evaluation system) that implements a log acquisition method according to a first embodiment of the present invention.
FIG. 2 is a diagram illustrating a normal memory configuration at the time of loading a function, for explaining a log acquisition method according to the first embodiment of the present invention;
FIG. 3 is a diagram illustrating a memory configuration when an IAT Patch is used in a software evaluation system that implements the log acquisition method according to the first embodiment of the present invention.
FIG. 4A is a diagram showing a state when using the IAT Patch of the software evaluation system for realizing the log acquisition method according to the first embodiment of the present invention.
FIG. 4B is a diagram showing a flow of a log acquisition process of the software evaluation system for realizing the log acquisition method according to the first embodiment of the present invention.
FIG. 5 is a diagram illustrating an internal configuration when using the IAT Patch of the software evaluation system according to the first embodiment of the present invention.
FIG. 6 is a diagram illustrating a normal memory configuration at the time of creating an instance of a COM server interface, for explaining a log acquisition method according to the first embodiment of the present invention.
FIG. 7 is a diagram illustrating a memory configuration when a VTable Patch is used in a software evaluation system that implements the log acquisition method according to the first embodiment of the present invention.
8A is a diagram showing a state during use VTable Patch first software evaluation system that implements such a log acquisition method in the embodiment of the present invention.
FIG. 8B is a diagram showing a flow of a log acquisition process of the software evaluation system for realizing the log acquisition method according to the first embodiment of the present invention.
FIG. 9 is a diagram illustrating an internal configuration of a software evaluation system that implements the log acquisition method according to the first embodiment of the present invention.
10 is a diagram showing an example of a function definition software evaluation system that implements the log acquisition method according to a second embodiment of the present invention.
FIG. 11 is a diagram showing a function definition of a software evaluation system for realizing a log acquisition method according to a second embodiment of the present invention. it is a diagram illustrating a description in IDL for acquiring the entity as a log.
FIG. 12 is a diagram illustrating a flow of acquiring a log when a function is defined as shown in FIG. 11 in a software evaluation system that implements a log acquisition method according to the second embodiment of the present invention. .
FIG. 13 is a diagram of log data acquired according to the definition in FIG. 11 in the software evaluation system that implements the log acquisition method according to the second embodiment of the present invention.
FIG. 14 is a diagram showing a function definition of a software evaluation system for realizing a log acquisition method according to the third embodiment of the present invention, in which IDL for acquiring a function not exported such as a callback function as a log is used. it is a diagram illustrating a description.
15 is a diagram representing the memory configuration of the software evaluation system that implements such a log acquisition method in the third embodiment of the present invention.
FIG. 16 is a diagram illustrating a flow of acquiring a log when a function is defined as shown in FIG. 14 in a software evaluation system that implements a log acquisition method according to the third embodiment of the present invention. .
FIG. 17 is a diagram of log data acquired when the definition in FIG. 14 is not performed in the software evaluation system that implements the log acquisition method according to the third embodiment of the present invention.
FIG. 18 is a diagram of log data acquired from the definition in FIG. 14 in the software evaluation system that implements the log acquisition method according to the third embodiment of the present invention.
[19] In the fourth function definition software evaluation system that implements such a log acquisition method in the embodiment of the present invention, is a diagram illustrating a description in IDL for acquiring the parameters of the variable-length sequences as a log .
FIG. 20 is a diagram showing a flow of acquiring a log when a function is defined as shown in FIG. 19 in a software evaluation system for realizing a log acquisition method according to the fourth embodiment of the present invention; .
FIG. 21 shows log data (250) obtained when the definition in FIG. 19 is not performed and the log data obtained by the definition in FIG. is a diagram of the log data (251) that is.
FIG. 22 is a diagram illustrating an example of a function for which a parameter cannot be obtained by a normal function definition in a software evaluation system that realizes a log obtaining method according to a fifth embodiment of the present invention.
FIG. 23 is a diagram showing how each structure of STRUCTURESIZE1, STRUCTSIZE2, and STRUCTSIZE3 uses a memory in FIG. 22;
FIG. 24 is a diagram showing a description by IDL for acquiring a log of a parameter of a function as shown in FIG. 22 in a software evaluation system for realizing a log acquisition method according to a fifth embodiment of the present invention;
FIG. 25 is a diagram illustrating a flow of acquiring a log when a function is defined as illustrated in the software evaluation system that implements the log acquisition method according to the fifth embodiment of the present invention.
The [26] Figure 25 details carried out of a structure parameter analysis with a view showing based memory arrangement.
FIG. 27 is a diagram of log data acquired according to the definition in FIG. 24 in the software evaluation system that implements the log acquisition method according to the fifth embodiment of the present invention.
FIG. 28 is a diagram illustrating an example of a function for which a parameter cannot be acquired with a normal function definition in a software evaluation system that implements a log acquisition method according to the sixth embodiment of the present invention.
In FIG. 29 FIG. 28 is a diagram showing how STRUCTKIND1, STRUCTKIND2, each structure STRUCTKIND3 will look like memory arrangement.
FIG. 30 is a diagram showing a description by IDL for acquiring a log of a parameter of a function as shown in FIG. 28 in a software evaluation system for realizing a log acquisition method according to a sixth embodiment of the present invention;
FIG. 31 is a diagram showing a flow of acquiring a log when a function is defined as shown in FIG. 30 in a software evaluation system for realizing a log acquisition method according to a sixth embodiment of the present invention; .
FIG. 32 is a diagram of log data acquired according to the definition in FIG. 30 in the software evaluation system that implements the log acquisition method according to the sixth embodiment of the present invention.
[Explanation of symbols]
1: CPU
2: Chipset
3: RAM
4: Hard disk controller
5: Display controller
6: Hard disk drive
7: CD-ROM drive
8: Display
11: signal line connecting the CPU and chip set
12: signal line which connects the chipset and RAM
13: peripheral bus that connects the chip set and the various peripheral devices
14: signal line that connects the hard disk controller and hard disk drive
15: signal line that connects the hard disk controller and the CD-ROM drive
16: signal line connecting the display controller and the display

Claims (14)

A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining in the function definition in the program whether or not the pointer parameter is defined by a predetermined definition method;
Recording the contents of the memory pointed to by the pointer parameter based on the definition method when the pointer parameter is defined by a predetermined definition method. The function for acquiring a log further includes a step of calculating a memory size based on the definition method, and the recording step includes recording the contents of the memory pointed to by the pointer parameter by the calculated memory size. 2. The log acquisition method according to claim 1, wherein: A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
A step of recording predetermined information when calling a function for performing the predetermined processing, and predetermined information when receiving the execution result,
A step of determining the presence or absence of a function which has not been exported based on a function defined in said program,
If there is a function that has not been exported, a new function for acquiring a log corresponding to the function is newly generated, and the address of the function that has not been exported is rewritten with the address of the newly generated function. ,
The newly generated function is
Calling the non-exported function, executing the predetermined process, and passing the received execution result to the program;
Recording a predetermined information when calling the function not exported and a predetermined information when receiving the execution result. A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining whether or not a pointer parameter is defined as a variable-length array in a function definition in the program;
Recording the contents of the memory pointed to by the pointer parameter in the specified array when the pointer parameter is defined as a variable length array. A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining whether a pointer parameter is specified as a structure in a function definition in the program;
Recording the contents of the memory pointed to by the pointer parameter as a log of the size of the structure defined in the function definition in the program when the pointer parameter is specified as the structure. Log acquisition method. A log acquisition method for acquiring a log during the execution of a program with a function for performing predetermined processing,
Rewriting the address of the loaded function for performing the predetermined processing to the address of a function for obtaining a log,
The log acquisition function is
Calling a function for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
In a function definition in the program, a step of determining whether a pointer parameter whose type is specified as a structure is defined,
Recording a content of a memory pointed to by the pointer parameter as a type-specified data type when a pointer parameter whose type is specified as a structure is defined. Method. A log acquisition method for acquiring a log during the execution of a program comprising a method for performing predetermined processing,
Rewriting the address of the loaded method for performing the predetermined process to the address of a method for acquiring a log,
The method for acquiring the log is
Calling a method for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining in the function definition in the program whether or not the pointer parameter is defined by a predetermined definition method;
Recording the contents of the memory pointed to by the pointer parameter based on the definition method when the pointer parameter is defined by a predetermined definition method. The method for acquiring a log further includes a step of calculating a memory size based on the definition method, and the recording step includes recording the contents of the memory pointed to by the pointer parameter by the calculated memory size. 8. The log acquisition method according to claim 7, wherein A log acquisition method for acquiring a log during the execution of a program comprising a method for performing predetermined processing,
Rewriting the address of the loaded method for performing the predetermined process to the address of a method for acquiring a log,
The method for acquiring the log is
Calling a method for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
A step of recording predetermined information when calling a method for performing the predetermined processing, and predetermined information when receiving the execution result,
Based on the function definition in the program, determining whether there is a method that is not exported,
If there is a method that has not been exported, a method for newly generating a method for acquiring a log corresponding to the method, and rewriting the address of the method that has not been exported to the address of the newly generated method; ,
The newly created method is
Calling the non-exported method, executing the predetermined process, and passing the received execution result to the program;
Log acquisition method characterized by comprising the step of recording the predetermined information when calling a method that is not the export, the predetermined information when having received the execution result. A log acquisition method for acquiring a log during the execution of a program comprising a method for performing predetermined processing,
Rewriting the address of the loaded method for performing the predetermined process to the address of a method for acquiring a log,
The method for acquiring the log is
Calling a method for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining whether or not a pointer parameter is defined as a variable-length array in a function definition in the program;
Recording the contents of the memory pointed to by the pointer parameter in the specified array when the pointer parameter is defined as a variable length array. A log acquisition method for acquiring a log during the execution of a program comprising a method for performing predetermined processing,
Rewriting the address of the loaded method for performing the predetermined process to the address of a method for acquiring a log,
The method for acquiring the log is
Calling a method for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
Determining whether a pointer parameter is specified as a structure in a function definition in the program;
Recording the contents of the memory pointed to by the pointer parameter as a log of the size of the structure defined in the function definition in the program when the pointer parameter is specified as the structure. Log acquisition method. A log acquisition method for acquiring a log during the execution of a program comprising a method for performing predetermined processing,
Rewriting the address of the loaded method for performing the predetermined process to the address of a method for acquiring a log,
The method for acquiring the log is
Calling a method for performing the predetermined processing, causing the predetermined processing to be executed, and passing the received execution result to the program;
In a function definition in the program, a step of determining whether a pointer parameter whose type is specified as a structure is defined,
Recording a content of a memory pointed to by the pointer parameter as a type-specified data type when a pointer parameter whose type is specified as a structure is defined. Method. A storage medium storing a control program for causing a computer to implement the log acquisition method according to any one of claims 1 to 12. A control program for causing a computer to implement the log acquisition method according to any one of claims 1 to 12.

Images