WO2020114347A1

WO2020114347A1 - Function call relationship detection method, apparatus, device and storage medium

Info

Publication number: WO2020114347A1
Application number: PCT/CN2019/122370
Authority: WO
Inventors: 李丹; 裘绍翔; 王佳琦
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2018-12-03
Filing date: 2019-12-02
Publication date: 2020-06-11
Also published as: CN111258630A; TW202022603A; CN111258630B

Abstract

A function call relationship detection method, apparatus, device and storage medium, which are used for detecting whether a call relationship exists between a function to be detected and a detection point function, the method comprising: adding a static function for a function to be detected, the static function being defined as generating an entry comprising a currently called return address and a detection point function when called (S110); and modifying an action for calling the function to be detected into calling the static function so as to call the function to be detected by means of the static function (S120). Thus, for a function that originally directly calls a function to be detected, the function to be detected may be called by means of calling a static function, and during the described process, an entry comprising a currently called return address and a detection point function may be obtained, thus a basis of implementation may be provided for detecting whether a call relationship exists between the function to be detected and the detection point function.

Description

Function calling relationship detection method, device, equipment and storage medium

This application requires the priority of the Chinese patent application submitted on December 03, 2018 with the application number 201811468332.7 and the invention titled "function call relationship detection method, device, equipment and storage medium", the entire content of which is incorporated by reference in this application in.

Technical field

The invention relates to function calling, and in particular to a method, device, device and storage medium for detecting function calling relationships.

Background technique

The implementation of stack traceback depends on the characteristics of the compiler and is related to a specific platform. There are usually two methods. Taking the ARM stack traceback implemented by the linux kernel as an example, you can choose APCS or unwind by passing -mapcs or -fununwind-tables to gcc. One performs stack backtracking.

The use of APCS (ARMProcedureCallStandard) in the process of ARM stack backtracking, the calling standard regulates the use of ARM registers, and the function of pushing and popping out of the stack when the function is called, the stack backtracking can be accurately performed according to the standard in the stack, but in APCS, the function of the function Pushing in and pulling out of the stack consumes more of the stack and occupies more registers, and Unwind avoids this problem. Unwind keeps the offset of each function on the stack separately in a segment, and looks up the return address of the parent function on the stack by looking up the table when the stack is traced back.

APCS and Unwind are standard methods for stack backtracking, but they cannot solve the function call problem in certain specific scenarios. For example: 1. Stack backtracking needs to be carried out step by step. For the scenario of A->B->C (calling the B function in A and calling the C function in B), sometimes we only pay attention to the calling relationship between A and C. C backtracks to B and then back to A, which is relatively inefficient for multi-level calls or recursive calls. 2. Both methods depend on the compiler. In some situations, only a specific function needs to be backtraced. It is difficult to optimize only some functions during compilation. 3. APCS needs to determine the starting address of the function through the symbol table, Unwind determines the starting address of the function through ARM.unwind_idx, both of which determine its parent function through the range of the function address where the LR is located, and the child functions in the same function are doing Ambiguity will occur when calling path detection, and needs to be handled separately for different functions. 4. The Unwind method will save the first addresses of all functions in the kernel, which poses a great security risk. If APCS is configured with a symbol table, the same problem exists.

Summary of the invention

An object of the present invention is to provide a function call relationship detection scheme to solve at least one of the above problems.

According to the first aspect of the present invention, a method for detecting a function call relationship is provided, which is used to detect whether there is a call relationship between a function to be detected and a detection point function, including: adding a static function to the function to be detected, and the static function is defined as When called, an entry including the return address of the current call and the checkpoint function is generated; the action of calling the function to be checked is modified to call a static function, so that the static function calls the function to be checked.

Optionally, the method further includes: renaming the function to be detected to identify the function to be detected.

Optionally, the method further includes: in response to the detection point function being called, saving a mark corresponding to the detection point function.

Optionally, the method further includes: in response to the detection point function being returned after being called, clearing the mark corresponding to the detection point function.

Optionally, the method further includes: adding a detection module to the function to be detected, and the detection module is configured to detect whether a call relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.

Optionally, the step of detecting whether there is a calling relationship between the function to be detected and the detection point function includes: according to the return address of the current call, searching for the detection point function in the entry corresponding to the return address of the current call; when the detection point is found In the case of a function, check whether there is a mark corresponding to the detection point function.

Optionally, the method further includes: determining that there is a calling relationship between the function to be detected and the detection point function when a mark corresponding to the detection point function is detected.

According to the second aspect of the present invention, there is also provided a method for detecting a function call relationship, comprising: acquiring an entry generated during compilation, the entry includes a return address and a detection point function, wherein the entry is in a static state corresponding to the function to be detected Generated when the function is called, the function to be detected is called by calling a static function; according to the return address when the function to be detected is called, the detection point function is searched from the entry corresponding to the return address; based on the search result, the function to be detected is judged Whether there is a calling relationship with the checkpoint function.

Optionally, the step of determining whether the function to be detected has a calling relationship with the detection point function based on the search result includes: when the detection point function is found, detecting whether there is a mark corresponding to the detection point function; when the presence and detection are detected In the case of the mark corresponding to the point function, it is determined that there is a calling relationship between the function to be detected and the detection point function.

According to the third aspect of the present invention, there is also provided a function call relationship detection device, including: an adding module for adding a static function to the function to be detected, the static function is defined as being called, generating a return address including the current call And the entry of the checkpoint function; and the call adjustment module, which is used to modify the action of calling the function to be checked into calling a static function, so that the static function can call the function to be checked.

Optionally, the device further includes a naming module for renaming the function to be detected to identify the function to be detected.

Optionally, the device further includes: a saving module configured to save a mark corresponding to the detection point function in response to the detection point function being called.

Optionally, the device further includes: a clearing module, configured to clear the mark corresponding to the detection point function in response to returning after the detection point function is called.

Optionally, the device further includes: a detection module, configured to detect whether a calling relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.

Optionally, the detection module includes: a search module for searching the detection point function in an entry corresponding to the currently called return address according to the return address of the current call; and a check module for finding the detection point function In the case of, check whether there is a mark corresponding to the detection point function.

Optionally, when a mark corresponding to the detection point function is detected, the detection module determines that there is a calling relationship between the function to be detected and the detection point function.

According to a fourth aspect of the present invention, there is also provided a function call relationship detection device, including: an acquisition module for acquiring an entry generated during compilation, the entry includes a return address and a detection point function, wherein the entry is in Generated when the static function corresponding to the detection function is called, the function to be detected is called by calling the static function; the search module is used to find the detection point from the entry corresponding to the return address according to the return address when the function to be detected is called Function; and a judgment module for judging whether the function to be detected has a calling relationship with the detection point function based on the search result.

Optionally, when the detection point function is found, the judgment module also detects whether a mark corresponding to the detection point function is present, and when a mark corresponding to the detection point function is detected, determines There is a calling relationship between the function to be detected and the function of the detection point.

According to a fifth aspect of the present invention, there is also provided a computing device, including: a processor; and a memory on which executable code is stored, and when the executable code is executed by the processor, the processor is executed as in the present invention The method mentioned in the first aspect or the second aspect.

According to the sixth aspect of the present invention, there is also provided a non-transitory machine-readable storage medium on which executable code is stored, and when the executable code is executed by the processor of the electronic device, the processor is executed as The method described in the first aspect or the second aspect of the invention.

The invention modifies the specific function to be detected, so that when the function to be detected is called, an item including the return address of the current call and the detection point function can be obtained, so as to detect whether there is a function between the function to be detected and the detection point function The call relationship provides the basis for implementation. In this way, in a scenario where it is only necessary to detect whether there is a calling relationship between specific functions, the present invention only needs to modify specific functions to meet the detection requirements without gradually backtracking to obtain all intermediate calling relationships.

BRIEF DESCRIPTION

The above and other objects, features, and advantages of the present disclosure will become more apparent by describing the exemplary embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. In the exemplary embodiments of the present disclosure, the same reference numerals generally represent The same parts.

FIG. 1 is a schematic flowchart illustrating a method for detecting a function call relationship according to an embodiment of the present invention.

2 is a schematic flowchart illustrating a method for detecting a function call relationship according to another embodiment of the present invention.

FIG. 3 is a schematic diagram illustrating a detection process according to an embodiment of the present invention.

4 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to an embodiment of the present invention.

FIG. 5 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to another embodiment of the present invention.

FIG. 6 shows a schematic structural diagram of a computing device that can be used to implement the above function call relationship detection method according to an embodiment of the present invention.

detailed description

Hereinafter, preferred embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although the drawings show preferred embodiments of the present disclosure, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

【Term Explanation】

Call path: The call path of a function is the collection of all functions in the current function stack traceback.

Stack backtrace: The return address of the function and local variables are stored in the stack. The stack backtrace is used to determine the calling relationship and calling sequence of the function from these return addresses.

Function to be detected: the function whose function call relationship needs to be detected.

Detection point function: a function that needs to detect whether there is a calling relationship with the function to be detected.

Return address: The address of the next execution statement after the function call ends.

[Overview of the program]

The invention proposes a function calling relationship detection scheme, which is used to detect whether the function to be detected has a calling relationship with the detection point function, that is, to detect whether the function to be detected is on the calling path of the detection point function.

The present invention modifies the function to be detected so that when the function to be detected is called, an item including the return address of the current call and the detection point function can be obtained. For example, you can add a static function to the function to be detected. When a static function is defined as being called, an entry including the return address of the current call and the detection point function is generated, and the action of calling the function to be detected is modified to call a static function, so that the static The function calls the function to be detected. Thus, for the function that originally called the function to be detected directly, the function to be detected can be called by calling a static function, and in this process, items including the return address of the current call and the function of the detection point can be obtained.

For the checkpoint function, you can save the mark corresponding to the checkpoint function when it is called. In this way, when the function to be detected is called, based on the return address of the current call, it can be found from the entry whether there is a detection point function, and if there is a detection point function, further search for whether there is a corresponding detection point function Mark to determine whether there is a calling relationship between the function to be detected and the detection point function, that is, whether the function to be detected is on the call path of the detection point function.

The function call relationship detection scheme of the present invention can be used to detect whether a specific function has a call relationship between a certain return address and a detection point function. Compared with APCS/Unwind, it is more lightweight and relatively safer. For example, for the calling relationship of A->B->C, when it is only necessary to detect whether there is a calling relationship between function A and function C, the present invention only needs to modify function C to meet the detection requirements , Without having to step back and get all the intermediate call relationships.

As an example, the present invention can be used to detect the calling path of key functions (especially the key functions in the kernel). Although the detection functions need to be processed item by item, the number of key functions in the kernel is controllable, so the present invention It also has good practicality and avoids the problems caused by APCS and UNWIND mentioned above.

The following further describes various aspects related to the present invention.

[Method of detecting function call relationship]

Referring to FIG. 1, in step S110, a static function is added to the function to be detected. When the static function is defined as being called, an entry including the return address of the current call and the detection point function is generated.

The return address of the current call in the entry generated when the static function is called, that is, the return address when the function to be detected is called. The checkpoint function in the entry may be the address of the checkpoint function, such as the first address of the checkpoint function.

In step S120, the action of calling the function to be detected is modified to call a static function, so that the static function calls the function to be detected.

By adding a static function to the function to be detected, and modifying the action of calling the function to be detected to call the static function, the function that originally called the function to be detected can be called directly by calling the static function. For example, assuming that the function C to be detected has the following calling relationship: A->B->C, the static function added to the function C to be detected is represented as E, then the logical calling relationship after performing step S120 is: A->B-> E->C. The static function can be regarded as the inline function of the function to be detected. According to the characteristics of the inline function, the actual calling relationship is still A->B->C, but the call process will generate entries including the return address and the checkpoint function . The return address in the entry generated when the static function E is called is the return address when the function C to be detected is called.

The present invention can also rename the function to be detected to identify the function to be detected, for example, before performing step S110, the function to be detected can be renamed. For example, the function to be detected can be renamed based on certain naming rules, which can facilitate the detection of the calling relationship of the function to be detected, such as finding all the calls of the function to be detected during compilation.

For the detection point function, the mark corresponding to the detection point function may be saved in response to the detection point function being called. The storage location of the mark is not limited by the present invention, for example, it can be stored in the current process stack or process structure. And, in response to the detection point function being returned after being called, the mark corresponding to the detection point function can be cleared so as not to affect the next detection. Among them, when the checkpoint function is a function in the kernel, the flag can also be cleared when the system call returns.

If the call path of the checkpoint function includes the function to be checked, the function to be checked will also be called when the checkpoint function is called, and when the checkpoint function is called, a mark corresponding to the checkpoint function will be generated. When the detection function is called, an entry including the return address of the current call and the detection point function is generated. Therefore, in response to the function to be detected being called, it can be detected whether the detection point function exists in the corresponding entry, and further detecting whether there is a mark corresponding to the detection point function in the entry, so according to the detection result, the function to be detected and the detection can be judged Whether there is a function call relationship between point functions.

Based on the above analysis, the present invention proposes that a detection module can be added to the function to be detected, and optionally, the detection module can be inserted into the function to be detected in the form of a function. The detection module may be used to detect whether there is a calling relationship between the function to be detected and the detection point function in response to the function to be detected being called. Specifically, in response to the function to be detected being called, the detection module may search for the detection point function in the entry corresponding to the return address of the current call according to the return address of the current call, and in the case of finding the detection point function, may further check Whether there is a mark corresponding to the detection point function, when it is detected that there is a mark corresponding to the detection point function, it can be determined that there is a calling relationship between the function to be detected and the detection point function, that is, the function call path of the function to be detected at the detection point function It can be determined that the function to be detected has a calling relationship with the detection point function at a certain return address.

So far, the implementation process of the function call relationship detection scheme of the present invention has been described with reference to FIG. 1. Among them, the method shown in FIG. 1 can be executed during program compilation, that is, the calling relationship between functions can be detected during program compilation. When the function call relationship detection scheme of the present invention is executed during program compilation, the function called in the present invention refers to being used by a compiler to compile it. For example, suppose the function C to be detected has the following calling relationship: A->B->C. When the compiler starts to compile function A, it is considered that function A is called. When the function A is compiled, the function needs to be called B, when compiling function B, it is considered that function B is called.

Referring to FIG. 2, in step S210, an entry generated during compilation is obtained, and the entry includes a return address and a checkpoint function. Wherein, the entry is generated when the static function corresponding to the function to be detected is called. For the description of the static function, please refer to the related description above, which will not be repeated here.

In step S220, according to the return address when the function to be detected is called, the detection point function is searched from the entry corresponding to the return address.

If there is no entry corresponding to the return address when the function to be detected is called among all the entries, it can be determined that there is no calling relationship between the function to be detected and the detection point function.

In step S230, based on the search result, it is determined whether the function to be detected has a calling relationship with the detection point function.

When an entry corresponding to the return address when the function to be detected is called is found, it may be further detected whether a mark corresponding to the detection point function in the found entry is present, and when a mark corresponding to the detection point function is detected In the case of, it can be determined that there is a calling relationship between the function to be detected and the detection point function.

【Specific application example】

Assuming that function C has the following calling relationships: A->B->C; A->D->C, the purpose of detection is to check whether function C has a calling relationship with function A, then function C can be called a function to be tested Function A is called the checkpoint function.

Modify operation

First, the following modification operations can be performed, so as to facilitate subsequent judgment whether the detection function C has a calling relationship with the function A to provide an implementation basis.

1. First, the function C can be renamed to __btf_C through the macro processing command, so that all calls to the function C can be found during compilation.

Suppose the definition of function C is:

intC(int*p);

The renamed __btf_C is defined as:

#define BACKTRACE_FUNCTION(x)__btf_##x

int BACKTRACE_FUNCTION(C)(int*p)

Among them, the specific definitions of the various fields of the function will not be repeated here. In this way, the C function will not exist after the modification, but will be renamed to __btf_C.

2. You can add two static functions for the __btf_C function through macro definition: __btf_C_AB and __btf_C_AD, which can be expressed as:

BACKTRACECALL_DEFINE1(int,C,AB,int*,p)

BACKTRACECALL_DEFINE1(int,C,AD,int*,p)

The static function can be set as a call to the static function will generate a new entry in the system, the entry can be called __k_bttab, the entry content is the return address of the current call and the checkpoint function (such as the input checkpoint function address).

The specific definition of the static function can be set according to the actual situation, and will not be repeated here.

3. The C function call in the B/D function can be modified through the macro definition as follows:

The call in function B is changed from C(p) to BACKTRACECALL(C, AB, p)

The call in function D is modified from C(p) to BACKTRACECALL(C, AD, p)

The following logic calling relationship exists in the modified system:

1) A->B->__btf_C_AB->__btf_C

2) A->B->__btf_C_AD->__btf_C

Due to the characteristics of inline functions, the actual calling relationship in the system is:

1) A->B->__btf_C

2) A->D->__btf_C

At the same time, these two calls will add two __k_bttab section entries to the system, which are:

{__btf_C function return address in function B __btf_C_LRB, function A address}

{__btf_C function return address in function D __btf_C_LRD, address of function A}

4. Make a mark in function A to indicate that the current function A is called

When the function A is called, a mark corresponding to the function A can be added, indicating that the function A is called, and the result of the mark can be recorded in different locations, such as the current process stack or the process structure.

5. A detection function can be added to the function __btf_C. The detection function can be expressed as BT_CHECK(). The detection function can be used to respond to the function __btf_C being called. Check whether the function __btf_C has a calling relationship with the function A. For the detection mechanism, see The above description will not be repeated here. Among them, the specific definition of the detection function can be set according to the actual situation, and will not be repeated here.

Testing process

All __k_bttab segment entries generated during compilation can be obtained through the vmlinux.ld.S script, and then all __k_bttab entries can be sorted for subsequent search, for example, all __k_bttab entries can be sorted during system initialization. Among them, you can sort by the return address in the __k_bttab entry.

When the function A is called, you can add the function A called mark (mark A) to the process stack or process structure. When the function A call returns, you can clear the function mark A in the process stack or process structure. Prepare for the next test. In addition, when the function __btf_C is called, the calling path can be checked by the detection function (BT_CHECK function) in the function __btf_C.

As an example, the specific detection operation of BT_CHECK is to accurately find the detection point function corresponding to the return address in the __k_bttab table according to the current function return address. If there is no detection point function, the detection fails. If there is a checkpoint function, it is further checked whether the mark of the checkpoint function A exists in the process stack or the process structure. If there is a mark, the stack backtracking detection is successful.

As shown in Figure 3, when function B calls the _btf_C function by calling the static function __btf_C_AB (not shown in the figure), the current return address is return address 1, and return address 1 can be expressed as __btf_C_LRB. When the static function __btf_C_AD (not shown in the figure) calls the _btf_C function, the current return address is return address 2, and return address 2 can be expressed as __btf_C_LRD. In response to the _btf_C function being called, the return address 1 and function A, return address 2 and function A can be recorded in the __k_bttab table. You can use the detection function set in the _btf_C function to find the detection point function A corresponding to the current return address from the __k_bttab table, and then find whether the mark of the detection point function A exists from the saved tags. In the case of the mark of the detection point function A, it indicates that there is a calling relationship between the detection point function A and the function C, and it can be further determined that the functions B and D are both on the calling path of the detection point function A.

Compared with the existing stack backtracking solution, the present invention can produce at least the following technical effects:

1. Stack backtracking needs to be carried out step by step. For the scenario of A->B->C (calling B function in A and calling C function in B), sometimes we only pay attention to the calling relationship between A and C. At this time, we need to backtrack from C Going back to B and then back to A is relatively inefficient for multi-level calls or recursive calls. This scheme is applicable to the detection of key functions of the kernel. You can specify that the calling relationship between function C and function A at a certain point (a certain return address) should be detected. 2. Both methods depend on the compiler. In some situations, only a specific function needs to be backtraced. It is difficult to optimize only some functions during compilation. The present invention is implemented for specific functions, and can be compiled and optimized only for key functions that need to perform stack backtracking. 3. APCS needs to determine the starting address of the function through the symbol table, and Unwind determines the starting address of the function through ARM.unwind_idx, both of which determine its parent function through the function address range where the LR (connection register) is located. Sub-functions will produce ambiguity when calling path detection, and need to be handled separately for different functions. The invention can accurately match the specific return address, and for different return addresses, different matching functions can be specified without ambiguity. 4. The Unwind method will save the first addresses of all functions in the kernel, which poses a great security risk. If APCS is configured with a symbol table, the same problem exists. The invention can only save the first address of the used function in the kernel, which alleviates the security risks brought by the above methods.

【Function call relationship detection device】

The invention can also be implemented as a function call relationship detection device. Among them, the function module of the function call relationship detection device may be implemented by hardware, software or a combination of hardware and software that implements the principles of the present invention. Those skilled in the art can understand that the functional modules described in FIG. 4 can be combined or divided into sub-modules, so as to implement the principles of the above invention. Therefore, the description herein may support any possible combination, division, or further definition of the functional modules described herein.

The function modules that the function call relationship detection device can have and the operations that each function module can perform are briefly described. For the details involved, please refer to the above description, which will not be repeated here.

Referring to FIG. 4, the function call relationship detection device 400 includes an addition module 410 and a call adjustment module 420.

The adding module 410 is used to add a static function to the function to be detected. When the static function is defined as being called, an entry including the return address of the current call and the detection point function is generated. The call adjustment module 420 is used to modify the action of calling the function to be detected to call a static function, so that the static function calls the function to be detected.

In an embodiment of the present invention, the function call relationship detection apparatus 400 may optionally further include a naming module 430 shown by a dotted frame in the figure. The naming module 430 is used to rename the function to be detected to identify the function to be detected.

In an embodiment of the present invention, the function calling relationship detection apparatus 400 may optionally further include a saving module 440 shown by a dotted box in the figure, the saving module 440 is used to save and detect the point function in response to the detection point function being called Corresponding mark.

In an embodiment of the present invention, the function call relationship detection apparatus 400 may optionally further include a clearing module 450 shown by a dotted frame in the figure. The clearing module 450 is used to return, clear and detect in response to the detection point function being called The mark corresponding to the point function.

In an embodiment of the present invention, the function call relationship detection apparatus 400 may optionally further include a detection module 460 shown by a dotted frame in the figure, which is used to detect the function to be detected and the detection point function in response to the function to be detected being called Whether there is a calling relationship between them. Optionally, the detection module 460 may include a search module and an inspection module (not shown in the figure). The search module is used to search for the detection point function in the entry corresponding to the return address of the current call according to the return address of the current call, and the check module is used to check whether there is a detection point function corresponding to the detection point function when the detection point function is found mark. Optionally, in the case where a mark corresponding to the detection point function is detected, the detection module may determine that there is a calling relationship between the function to be detected and the detection point function.

Referring to FIG. 5, the function call relationship detection device 500 includes an acquisition module 510, a search module 520 and a judgment module 530. The obtaining module 510 is used to obtain an entry generated during compilation, and the entry includes a return address and a detection point function, wherein the entry is generated when a static function corresponding to the function to be detected is called, and the function to be detected is called by calling the static function . The search module 520 is used to search for the detection point function from the entry corresponding to the return address according to the return address when the function to be detected is called. The judgment module 530 is used to judge whether the function to be detected has a calling relationship with the detection point function based on the search result.

Optionally, when the detection point function is found, the judgment module 530 also detects whether there is a mark corresponding to the detection point function, and when a mark corresponding to the detection point function is detected, It is determined that there is a calling relationship between the function to be detected and the function of the detection point.

【Computer equipment】

Referring to FIG. 6, the computing device 600 includes a memory 610 and a processor 620.

The processor 620 may be a multi-core processor or may include multiple processors. In some embodiments, the processor 620 may include a general-purpose main processor and one or more special co-processors, such as a graphics processor (GPU), a digital signal processor (DSP), and so on. In some embodiments, the processor 620 may be implemented using a customized circuit, such as an application specific integrated circuit (ASIC, Application Integrated Circuit) or field programmable logic gate array (FPGA, Field Programmable Gate Arrays).

The memory 610 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. The ROM may store static data or instructions required by the processor 620 or other modules of the computer. The permanent storage device may be a readable and writable storage device. The permanent storage device may be a non-volatile storage device that does not lose stored instructions and data even after the computer is powered off. In some embodiments, the permanent storage device uses a mass storage device (eg, magnetic or optical disk, flash memory) as the permanent storage device. In other embodiments, the permanent storage device may be a removable storage device (e.g., floppy disk, optical drive). The system memory can be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. The system memory can store some or all instructions and data required by the processor during operation. In addition, the memory 610 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), magnetic disks, and/or optical disks may also be used. In some embodiments, the memory 610 may include readable and/or writeable removable storage devices, such as compact discs (CD), read-only digital versatile discs (eg, DVD-ROM, dual-layer DVD-ROM), Read-only Blu-ray discs, ultra-density discs, flash memory cards (such as SD cards, min SD cards, Micro-SD cards, etc.), magnetic floppy disks, etc. The computer-readable storage medium does not contain carrier waves and instantaneous electronic signals transmitted through wireless or wired.

Executable code is stored on the memory 610. When the executable code is processed by the processor 620, the processor 620 can cause the processor 620 to execute the function call relationship detection method described above.

The function calling relationship detection method, device and device according to the present invention have been described in detail above with reference to the drawings.

In addition, the method according to the present invention may also be implemented as a computer program or computer program product, the computer program or computer program product including computer program code instructions for performing the above steps defined in the above method of the present invention.

Alternatively, the present invention may also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) on which executable code (or computer program, or computer instruction code) is stored ), when the executable code (or computer program, or computer instruction code) is executed by the processor of the electronic device (or computing device, server, etc.), the processor is caused to perform each step of the above method according to the present invention .

Those skilled in the art will also understand that the various exemplary logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or a combination of both.

The flowchart and block diagrams in the drawings show the possible implementation architecture, functions, and operations of systems and methods according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, program segment, or part of code that contains one or more of the Executable instructions. It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented with dedicated hardware-based systems that perform specified functions or operations Or, it can be realized by a combination of dedicated hardware and computer instructions.

The embodiments of the present invention have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the illustrated embodiments. The selection of terms used herein is intended to best explain the principles, practical applications or improvements to the technology in the embodiments of the embodiments, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

A function call relationship detection method, used to detect whether there is a call relationship between the function to be detected and the detection point function, which is characterized by including:

Add a static function to the function to be detected, the static function is defined as being called, generating an entry including the return address of the current call and the detection point function;

Modifying the action of calling the function to be detected to call the static function to call the function to be detected by the static function.
The function call relationship detection method according to claim 1, further comprising:

Rename the function to be detected to identify the function to be detected.
The function call relationship detection method according to claim 1, further comprising:

In response to the detection point function being called, a mark corresponding to the detection point function is saved.
The method for detecting a function call relationship according to claim 3, further comprising:

In response to the detection point function being returned after being called, the mark corresponding to the detection point function is cleared.
The method for detecting a function call relationship according to claim 3, further comprising:

A detection module is added to the function to be detected, and the detection module is configured to detect whether a calling relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.
The function call relationship detection method according to claim 5, wherein the step of detecting whether a call relationship exists between the function to be detected and the detection point function includes:

According to the return address of the current call, find the checkpoint function in the entry corresponding to the return address of the current call;

When the detection point function is found, it is checked whether there is a mark corresponding to the detection point function.
The method for detecting a function call relationship according to claim 6, further comprising:

When it is detected that there is a mark corresponding to the detection point function, it is determined that the function to be detected and the detection point function have a calling relationship.
A method for detecting function call relationships, which is characterized by:

Obtain an entry generated during compilation, the entry including a return address and a checkpoint function, wherein the entry is generated when a static function corresponding to the function to be detected is called, and the static function is called to call the Function to be detected;

Searching for the detection point function from the entry corresponding to the return address according to the return address when the function to be detected is called;

Based on the search result, it is determined whether the function to be detected has a calling relationship with the detection point function.
The function call relationship detection method according to claim 8, wherein the step of determining whether the function to be detected has a call relationship with the detection point function based on the search result includes:

When the detection point function is found, detecting whether there is a mark corresponding to the detection point function;

When it is detected that there is a mark corresponding to the detection point function, it is determined that the function to be detected and the detection point function have a calling relationship.
A function call relationship detection device, which is characterized by comprising:

Adding a module for adding a static function to the function to be detected, the static function being defined as being called, generating an entry including the return address of the current call and the detection point function; and

The call adjustment module is configured to modify the action of calling the function to be detected to call the static function to call the function to be detected by the static function.
A function call relationship detection device, which is characterized by comprising:

An acquisition module for acquiring an entry generated during compilation, the entry including a return address and a checkpoint function, wherein the entry is generated when a static function corresponding to the function to be detected is called, by calling the static function To call the function to be detected;

A search module, configured to search for a detection point function from the entry corresponding to the return address according to the return address when the function to be detected is called; and

The judgment module is used for judging whether the function to be detected has a calling relationship with the detection point function based on the search result.
A computing device, including:

Processor; and

A memory on which executable code is stored, and when the executable code is executed by the processor, causes the processor to perform the method according to any one of claims 1-9.
A non-transitory machine-readable storage medium having executable code stored thereon, when the executable code is executed by a processor of an electronic device, the processor is caused to execute any one of claims 1 to 9. The method.