KR20150127334A - Run-time fault detecting method using execution hooking and information tag - Google Patents

Abstract

The present invention discloses a run-time fault detecting method and a recording medium recording a run-time fault detecting program. According to one embodiment of the present invention, the run-time detecting method includes the following steps: (a) loading fault detecting modules corresponding to monitoring object modules, to which an information tagging function and a fault detecting function are added; (b) hooking execution paths of the monitoring object modules to the fault detecting modules; and (c) detecting a run-time fault by tagging an information tag to data generated according to the execution of the fault detecting modules and examining the information tag at a time when the data is used.

Description

[0001] The present invention relates to a method for detecting a run-time fault using execution hooking and information tagging,

The present invention relates to a method for detecting a run-time fault, and more particularly, to a method for detecting a run-time fault using execution hooking and information tagging.

A run-time defect is a defect that occurs during the execution of a process, which may cause the system to crash or to halt program execution. In order to analyze such run-time defects, generally attempts are made to reproduce defects by collecting data at the moment of occurrence of defects.

In the case of the embedded system, the data input from the external environment as well as the user input vary in the data for determining the execution time, while the input of the user input is large in the general system. For example, in an AVN (Audio Video Navigation) system mounted on a vehicle, there are various inputs from an external environment such as a GPS coordinate value received from a satellite center, a radio frequency received from a broadcasting station, and a TPEG signal indicating traffic conditions. Such external inputs have a significant impact on the performance of the system. In this way, it is not easy to recreate defects on the basis of data gathering related to occurrence defects because of the variety of data that determines execution in an embedded system.

On the other hand, to reproduce run-time faults, techniques for dumping the system state at the time of occurrence of a defect, and techniques for storing an execution history and backtracking through rollback are widely used.

Dumping information helps to analyze the run-time state of the system at that moment when the system goes down. In general, however, it is not easy to determine the location of source code for debugging by dumping information alone, since the point at which the system goes down does not coincide with the point at which the actual defect occurred.

In order to track the defect location, the execution history must be stored. In particular, in the case of the embedded system, since the execution is determined by the external input in many cases, the size of the data to be stored is not only large but also the time It is difficult to determine how deep the execution history should be stored.

In addition, in the case of a potential defect in which the system is not brought down and deadlocked or a defect such as a memory leak is not exposed, there is a limitation that no dump information is generated at all. Therefore, debugging against run-time faults becomes more difficult if system down does not occur.

It is an object of the present invention to provide a defect type and debugging information by detecting defects during execution of the system, and improving the accuracy of run-time defect detection, It is to provide a plan that can be done.

According to an aspect of the present invention, there is provided a method for monitoring a plurality of modules, the method comprising: (a) loading defect detection modules corresponding to modules to be monitored and to which an information tagging function and a defect detection function are added; (b) hooking the execution path of the monitoring target modules to the defect detection modules; And (c) tagging the information tag with data generated according to the execution of the defect detection modules and inspecting the information tag at the time of use of the data to detect a run-time defect. ≪ / RTI >

The step (c) includes the steps of: (c1) tagging the information tag with data generated according to execution of the defect detection modules; (c2) inspecting the tag information at the time of use of the data to detect a run-time defect; (c3) recording the type of the detected run-time defect and debugging information; And (c4) performing the original function of the monitored module.

The method may further include: (d) analyzing the type of the detected run-time defect and debugging information, and providing the analysis result to a user.

The steps (a), (b), and (c) may be performed in a monitored system, and the step (d) may be performed in a host device communicating with the monitored system in a wired or wireless manner.

In the information tag, a data address space, data initialization status, and effective size of an address space may be recorded.

In order to attain the above object, the present invention provides a recording medium on which a run-time defect detection program is recorded, wherein the run-time defect detection program corresponds to monitoring target modules and includes an information tagging function and a defect detection function Defect detection modules; A component management module for loading the defect detection modules; And a hooking module for hooking the execution path of the monitoring target modules to the defect detection modules, wherein the defect detection modules are configured to tag the information tag with data generated according to the execution of the defect detection modules, And a run-time defect is detected by inspecting the information tag at the time of use, and a run-time defect detection program is recorded.

The run-time fault detection program may further include an analysis module for analyzing the type of the detected run-time fault and debugging information, and providing the analysis result to the user.

According to the present invention, defect occurrence is detected in a run-time in which a process is executed using an information tagging technique without analyzing a defect through defect reproduction after occurrence of a defect, so that accuracy of code location information search requiring debugging is greatly improved And it is possible to minimize the effort to search for the location information.

According to the present invention, a method of determining the possibility of occurrence of a defect at run-time through information tagging and selectively providing only detected defects as the result of the determination is provided as debugging information. Therefore, The problems of memory space overhead and performance overhead generated in the technique can be solved.

According to the present invention, since the defect is detected at the run-time in which the process is executed, it is possible to detect a defect when the system is down, and to detect a defect such as a deadlock state or a memory leak, There is an advantage that defect detection can be performed.

Further, according to the present invention, since the method of reproducing defects is not adopted, it can be particularly usefully applied to an embedded system such as a navigation system for a vehicle in which various external inputs other than user input are received.

1 is a view for explaining an example of an information tag according to the present invention.
2 is a block diagram illustrating a run-time fault detection program according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a run-time fault according to an embodiment of the present invention.
4 is a flowchart specifically illustrating a fourth step (defect detection step) of the run-time defect detection method.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described more fully hereinafter with reference to the accompanying drawings.

The present invention proposes a method for providing a defect type and a debugging point by detecting the possibility of occurrence of a defect during run-time, that is, at run-time, out of a method of reproducing a defect after occurrence of a defect for debugging a run-time defect .

The method proposed by the present invention is to hook an execution moment of process modules related to a run-time defect and to tag data that is essential for defect detection at run-time during the execution of the process, It is a method to detect run-time faults based on information.

It should be noted that the method proposed by the present invention uses 'execution hooking' and 'information tagging' techniques for run-time defect analysis. Hereinafter, the 'hooking' and the 'information tagging' will be described, and then an embodiment of the present invention will be described in detail.

monitoring  Point Hooking :

'Hooking' refers to a programming technique that intercepts the operation and control of the system at runtime for a specific purpose and changes it to the desired direction. It is a useful method for monitoring the execution status of a process run-time.

In general, calls to program modules used when a process is executed are managed through a process control block (PCB) belonging to the system's kernel space. When a process calls a module to execute a module, the process control block (PCB) provides the address where the called module is stored so that the called module can be executed.

 In the case of the present invention, when there is a call to a monitored module, an alternative module with an additional function for run-time defect detection in addition to the original function of the module is called instead of a so-called ' A method of hooking the address of the module to be monitored on the basis of the address of the defect detection module is used. Since the process control block information necessary for hooking is an internal data structure of the kernel, a hooking module is required as a kernel driver for hooking the called module address to access the kernel space in order to apply such a hooking method.

For example, in the case of memory defect detection, the program modules described in [Table 1] below can be selected as monitoring target modules.

Purpose of Monitoring
Monitored module

Crash Point
monitoring
Signal handlers for SIGSEGV, SIGABRT, and SIGFPE



Debugging point
monitoring


MEMORY
(), memchr (), memalign (), memcove (), malloc (), calloc (), realloc
STRING
(), strcm (), strchr (), strcat

I / O

open (), close (), read (), write ()

Most operating systems generate signals related to system crashes, such as SIGSEGV, SIGABRT, and SIGFPE, in case of a run-time fault that causes the system to crash, and signal handlers It is designed to dump system state information. Therefore, when a crash point is to be monitored, it is necessary to select SIGSEGV, SIGABRT, and SIGFPE signal handlers as shown in [Table 1] as monitoring target modules and to monitor when the target modules are called .

In order to obtain information about the debugging point at which the defect actually starts, the state information at the time of calling the signal handler is insufficient and history information that has been executed before is needed. Therefore, for debugging point monitoring, functions such as malloc (), calloc (), realloc (), strlen (), strcpy (), open (), close It is necessary to monitor the execution timing of the modules (modules).

SIGSEGV, SIGABRT, and SIGFPE signal handlers can be selected as target modules for the purpose of crash point monitoring. Target modules for debugging point monitoring include malloc (), calloc (), realloc (), strlen ), open (), close (), etc. In order to monitor the execution time of the target modules, the present invention employs a hooking technique to additionally have a defect detection function at the execution time of each target module Hooks to the above-described defect detection module. For example, if 'malloc ()' is called, the execution time of the malloc () module can be monitored by executing the fault detection module corresponding to the malloc () module instead of executing the module.

Run-time information tagging :

It is possible to determine the system crash location, or crash point, through data dumped by a system crash, but it is not sufficient to identify the debugging point. In addition, a crash dump file is not generated even if the system appears to be down, but in the case of a hang-up state with real deadlocks, potential defects that do not exhibit symptoms of defects such as memory leaks, and the process seems to operate normally.

Accordingly, the present invention proposes a 'run-time information tagging' method in order to more easily grasp the debugging point and to allow the debugging point to be grasped even when the system crash does not occur. In this run-time information tagging, an additional field in which information necessary for a defect judgment called an 'information tag' is recorded in the original data is determined in order to judge whether the defect is generated by judging the validity of the data at the run- .

Referring to FIG. 1 showing an example of an information tag, an information tag 2 is tagged with original data 1 as a field in which a data attribute necessary for run-time combination detection is stored. For example, if the purpose is to detect memory defects, data address space (a), data initialization (u), and effective size (s) of the address space are stored in the information tag 2 as shown in FIG. 1 .

In the present invention, this information tagging is performed by the above-described defect detection module, and the tag generated by such information tagging is also accessible only by the defect detection module. Specifically, when a monitoring target module (for example, malloc (), calloc (), etc.) is hooked to the corresponding defect detection module, the defect detection module is executed instead in the process execution process, When the data related to the execution is generated, the extended data 3 tagged with the information tag 2 is generated in the original data 1 without generating only the original data 1. The defect detection module predicts the possibility of a run-time defect from the defect detection information stored in the information tag 2 of the extended data 3 at the time when the extended data 3 is used. As such, the defect detection module has an information tagging function and an additional defect detection function, thereby detecting run-time defects unlike a general process module.

Time fault detection program and run-time fault detection method according to the present invention will be described below with reference to the above description of monitoring point-in-time hooking and run-time information tagging.

First, an embodiment of a run-time fault detection program according to the present invention will be described with reference to FIG.

Referring to FIG. 2, a run-time fault detection program 100 according to an exemplary embodiment of the present invention includes a component management module 110, a hooking module 120, defect detection modules 130, ).

The component management module 110 initializes the other components 120, 130, and 140 and performs a call to the test target process.

The hooking module 120 is a kernel driver accessible to the kernel space and hooks the modules to be monitored to the corresponding defect detection modules 130. As described above, the monitoring point hooking by the hooking module 120 can be achieved by hooking the address of the monitoring target module stored in the process control block (PCB) to the address of the defect detecting module.

The defect detection module 130 is an alternative module to which an information tagging function and a defect detection function are added, and is executed in place of the corresponding monitoring target modules when the run-time defect detection program 100 is executed.

The analysis module 140 is a module for analyzing a test result and analyzes the test log in which the defect type and debugging information collected and recorded by the defect detection module 130 are analyzed to notify the user or the developer of the location and cause of the defect, Device, and so on.

The analysis module 140 may be executed in the test target system or in a separate host device capable of communicating with the test target system by wire or wireless. When the analysis module 140 is executed in a separate host device, the run-time defect detection program 100 may be composed of only the modules 110, 120, and 130 except for the analysis module 140.

Such a run-time defect detection program 100 can be stored and used in a recording medium readable by a digital processing apparatus. Here, the recording medium refers to all recording means readable by a digital processing apparatus such as a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical disk and the like, .

Next, an embodiment of a method for detecting a run-time fault using the run-time fault detection program 100 described above with reference to Figs. 3 and 4 will be described. FIG. 3 is a flowchart illustrating a method for detecting a run-time fault according to an embodiment of the present invention. FIG. 4 is a flowchart illustrating a fourth step (defect detection step) of the method for detecting a run-time.

When the run-time fault detection method shown in FIG. 3 is started, the hooking module 120 is driven in the kernel of the test object system through the component management module 110 in step S10.

Next, in step S20, the defect management module 110 loads the defect detection modules 130 into the memory space of the processes that are to perform the run-time defect test. As described above, the defect detection modules 130 additionally have an information tagging function and a defect detection function in addition to the functions of corresponding monitoring target modules.

Next, in step S30, the execution path of the monitoring target modules is hooked to the defect detection modules 130 through the hooking module 120. [ When this module hooking step is performed, the corresponding defect detection modules 130 are executed instead at the execution time of the monitoring target modules.

Next, in step S40, information on the generated data is tagged through the defect detection modules 130, and tag information is checked at the time of data use to detect a run-time defect. Referring to FIG. 4, in operation S40, information tagging is performed on generated data S41. In operation S42, a run-time defect is detected by checking tag information when data is used. A step S43 of writing the defect type and the debugging information to the task log, and a step S44 of performing the original function of the monitoring target module.

Finally, in step S50, the fault type and debugging information recorded in the task log are analyzed through the analysis module 140, the code position information is provided to the user by distinguishing the crash point from the debugging point, and the defect occurrence time and defects The process name, the cause of the defect, and the debugging information used for the defect determination. Information provision by the analysis module 140 may be performed through a display device, and such a display device may be integrated in a monitored system or may be provided in a separate host device.

As described above, according to the run-time defect detection method of the present invention, the target modules to be monitored are hooked to the defect detection modules, and the information tagging of the defect detection modules and the defect detection Detects type and debugging information.

As described above, since the run-time defect detection method according to the present invention does not analyze the defect through the reproduction of the history after occurrence of the defect but detects the occurrence of the defect at the run-time in which the process is executed using the information tagging technique, The accuracy of the code position information search can be greatly improved and the effort of searching for the position information can be minimized.

Prior to the present invention, as a method for debugging, a technique called " Shadow memory " was used to store memory information used in a run-time in a separate memory space. However, the shadow memory technique stores all the memory information used at the time of executing the process in a separate address, which causes not only a lot of space overhead but also a large performance delay overhead.

On the other hand, according to the run-time defect detection method of the present invention, it is possible to determine the possibility of occurrence of a defect at run-time through information tagging and to selectively provide only detected defects as debugging information Therefore, the space addition overhead and the performance delay overhead problem generated in the above-described shadow memory technique can be solved.

According to the run-time defect detection method of the present invention, since a defect is detected at a run-time at which a process is executed, it is possible to detect a defect when the system is down, and also to detect a defect symptom such as a deadlock state or a memory leak There is also the advantage of detecting defects for these seemingly unexplained potential defects.

Further, the method of detecting run-time faults according to the present invention does not take a method of reproducing defects, and thus can be particularly usefully applied to an embedded system such as a navigation system for a vehicle in which various external inputs are received in addition to user input.

2: Information tag
3: Extended data
100: Run-time defect prevention program
110: Component management module
120: Hooking module
130: Defect detection module
140: Analysis module

Claims (7)

(a) loading defect detection modules corresponding to monitoring target modules and having an information tagging function and a defect detection function added thereto;
(b) hooking the execution path of the monitoring target modules to the defect detection modules; And
(c) tagging the information tag with data generated according to the execution of the defect detection modules and inspecting the information tag at the time of use of the data to detect a run-time defect .
The method according to claim 1,
The step (c)
(c1) tagging the information tag with data generated according to the execution of the defect detection modules;
(c2) inspecting the tag information at the time of use of the data to detect a run-time defect;
(c3) recording the type of the detected run-time defect and debugging information; And
(c4) performing the original function of the module to be monitored.
The method according to claim 1,
(d) analyzing the type of detected run-time fault and debugging information, and providing the analysis result to a user.
The method of claim 3,
Wherein the steps (a), (b), and (c) are performed in a monitoring target system, and the step (d) .
The method according to claim 1,
Wherein a data address space, data initialization status, and an effective size of an address space are recorded in the information tag.
A recording medium on which a run-time defect detection program is recorded,
Wherein the run-time defect detection program comprises:
A defect detection module corresponding to the monitoring target modules and having an information tagging function and a defect detection function added thereto;
A component management module for loading the defect detection modules; And
And a hooking module for hooking the execution path of the monitoring target modules to the defect detection modules,
Wherein the defect detection modules perform tagging an information tag to data generated according to the execution of the defect detection modules and inspecting the information tag at the time of use of the data to detect a run-time defect, A recording medium on which a program is recorded.
The method according to claim 6,
Wherein the run-time defect detection program further comprises an analysis module for analyzing the type of the detected run-time defect and debugging information and providing the analysis result to the user.

Images