WO2020114347A1 - Procédé, appareil, dispositif et support de stockage pour la détection de relation d'appel de fonction - Google Patents

Procédé, appareil, dispositif et support de stockage pour la détection de relation d'appel de fonction Download PDF

Info

Publication number
WO2020114347A1
WO2020114347A1 PCT/CN2019/122370 CN2019122370W WO2020114347A1 WO 2020114347 A1 WO2020114347 A1 WO 2020114347A1 CN 2019122370 W CN2019122370 W CN 2019122370W WO 2020114347 A1 WO2020114347 A1 WO 2020114347A1
Authority
WO
WIPO (PCT)
Prior art keywords
function
detected
detection point
call
detection
Prior art date
Application number
PCT/CN2019/122370
Other languages
English (en)
Chinese (zh)
Inventor
李丹
裘绍翔
王佳琦
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2020114347A1 publication Critical patent/WO2020114347A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/75—Structural analysis for program understanding
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/40—Transformation of program code
    • G06F8/41—Compilation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/40—Transformation of program code
    • G06F8/41—Compilation
    • G06F8/44—Encoding
    • G06F8/443—Optimisation
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the invention relates to function calling, and in particular to a method, device, device and storage medium for detecting function calling relationships.
  • stack traceback depends on the characteristics of the compiler and is related to a specific platform. There are usually two methods. Taking the ARM stack traceback implemented by the linux kernel as an example, you can choose APCS or unwind by passing -mapcs or -fununwind-tables to gcc. One performs stack backtracking.
  • APCS ARMProcedureCallStandard
  • the calling standard regulates the use of ARM registers, and the function of pushing and popping out of the stack when the function is called
  • the stack backtracking can be accurately performed according to the standard in the stack, but in APCS, the function of the function Pushing in and pulling out of the stack consumes more of the stack and occupies more registers, and Unwind avoids this problem. Unwind keeps the offset of each function on the stack separately in a segment, and looks up the return address of the parent function on the stack by looking up the table when the stack is traced back.
  • APCS and Unwind are standard methods for stack backtracking, but they cannot solve the function call problem in certain specific scenarios.
  • Stack backtracking needs to be carried out step by step. For the scenario of A->B->C (calling the B function in A and calling the C function in B), sometimes we only pay attention to the calling relationship between A and C. C backtracks to B and then back to A, which is relatively inefficient for multi-level calls or recursive calls.
  • Both methods depend on the compiler. In some situations, only a specific function needs to be backtraced. It is difficult to optimize only some functions during compilation. 3.
  • Unwind determines the starting address of the function through ARM.unwind_idx, both of which determine its parent function through the range of the function address where the LR is located, and the child functions in the same function are doing Ambiguity will occur when calling path detection, and needs to be handled separately for different functions. 4.
  • the Unwind method will save the first addresses of all functions in the kernel, which poses a great security risk. If APCS is configured with a symbol table, the same problem exists.
  • An object of the present invention is to provide a function call relationship detection scheme to solve at least one of the above problems.
  • a method for detecting a function call relationship which is used to detect whether there is a call relationship between a function to be detected and a detection point function, including: adding a static function to the function to be detected, and the static function is defined as When called, an entry including the return address of the current call and the checkpoint function is generated; the action of calling the function to be checked is modified to call a static function, so that the static function calls the function to be checked.
  • the method further includes: renaming the function to be detected to identify the function to be detected.
  • the method further includes: in response to the detection point function being called, saving a mark corresponding to the detection point function.
  • the method further includes: in response to the detection point function being returned after being called, clearing the mark corresponding to the detection point function.
  • the method further includes: adding a detection module to the function to be detected, and the detection module is configured to detect whether a call relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.
  • the step of detecting whether there is a calling relationship between the function to be detected and the detection point function includes: according to the return address of the current call, searching for the detection point function in the entry corresponding to the return address of the current call; when the detection point is found In the case of a function, check whether there is a mark corresponding to the detection point function.
  • the method further includes: determining that there is a calling relationship between the function to be detected and the detection point function when a mark corresponding to the detection point function is detected.
  • a method for detecting a function call relationship comprising: acquiring an entry generated during compilation, the entry includes a return address and a detection point function, wherein the entry is in a static state corresponding to the function to be detected Generated when the function is called, the function to be detected is called by calling a static function; according to the return address when the function to be detected is called, the detection point function is searched from the entry corresponding to the return address; based on the search result, the function to be detected is judged Whether there is a calling relationship with the checkpoint function.
  • the step of determining whether the function to be detected has a calling relationship with the detection point function based on the search result includes: when the detection point function is found, detecting whether there is a mark corresponding to the detection point function; when the presence and detection are detected In the case of the mark corresponding to the point function, it is determined that there is a calling relationship between the function to be detected and the detection point function.
  • a function call relationship detection device including: an adding module for adding a static function to the function to be detected, the static function is defined as being called, generating a return address including the current call And the entry of the checkpoint function; and the call adjustment module, which is used to modify the action of calling the function to be checked into calling a static function, so that the static function can call the function to be checked.
  • the device further includes a naming module for renaming the function to be detected to identify the function to be detected.
  • the device further includes: a saving module configured to save a mark corresponding to the detection point function in response to the detection point function being called.
  • the device further includes: a clearing module, configured to clear the mark corresponding to the detection point function in response to returning after the detection point function is called.
  • a clearing module configured to clear the mark corresponding to the detection point function in response to returning after the detection point function is called.
  • the device further includes: a detection module, configured to detect whether a calling relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.
  • a detection module configured to detect whether a calling relationship exists between the function to be detected and the detection point function in response to the function to be detected being called.
  • the detection module includes: a search module for searching the detection point function in an entry corresponding to the currently called return address according to the return address of the current call; and a check module for finding the detection point function In the case of, check whether there is a mark corresponding to the detection point function.
  • the detection module determines that there is a calling relationship between the function to be detected and the detection point function.
  • a function call relationship detection device including: an acquisition module for acquiring an entry generated during compilation, the entry includes a return address and a detection point function, wherein the entry is in Generated when the static function corresponding to the detection function is called, the function to be detected is called by calling the static function; the search module is used to find the detection point from the entry corresponding to the return address according to the return address when the function to be detected is called Function; and a judgment module for judging whether the function to be detected has a calling relationship with the detection point function based on the search result.
  • the judgment module when the detection point function is found, the judgment module also detects whether a mark corresponding to the detection point function is present, and when a mark corresponding to the detection point function is detected, determines There is a calling relationship between the function to be detected and the function of the detection point.
  • a computing device including: a processor; and a memory on which executable code is stored, and when the executable code is executed by the processor, the processor is executed as in the present invention The method mentioned in the first aspect or the second aspect.
  • a non-transitory machine-readable storage medium on which executable code is stored, and when the executable code is executed by the processor of the electronic device, the processor is executed as The method described in the first aspect or the second aspect of the invention.
  • the invention modifies the specific function to be detected, so that when the function to be detected is called, an item including the return address of the current call and the detection point function can be obtained, so as to detect whether there is a function between the function to be detected and the detection point function
  • the call relationship provides the basis for implementation. In this way, in a scenario where it is only necessary to detect whether there is a calling relationship between specific functions, the present invention only needs to modify specific functions to meet the detection requirements without gradually backtracking to obtain all intermediate calling relationships.
  • FIG. 1 is a schematic flowchart illustrating a method for detecting a function call relationship according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart illustrating a method for detecting a function call relationship according to another embodiment of the present invention.
  • FIG. 3 is a schematic diagram illustrating a detection process according to an embodiment of the present invention.
  • FIG. 4 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to another embodiment of the present invention.
  • FIG. 6 shows a schematic structural diagram of a computing device that can be used to implement the above function call relationship detection method according to an embodiment of the present invention.
  • Call path The call path of a function is the collection of all functions in the current function stack traceback.
  • Stack backtrace The return address of the function and local variables are stored in the stack. The stack backtrace is used to determine the calling relationship and calling sequence of the function from these return addresses.
  • Function to be detected the function whose function call relationship needs to be detected.
  • Detection point function a function that needs to detect whether there is a calling relationship with the function to be detected.
  • the invention proposes a function calling relationship detection scheme, which is used to detect whether the function to be detected has a calling relationship with the detection point function, that is, to detect whether the function to be detected is on the calling path of the detection point function.
  • the present invention modifies the function to be detected so that when the function to be detected is called, an item including the return address of the current call and the detection point function can be obtained.
  • a static function is defined as being called, an entry including the return address of the current call and the detection point function is generated, and the action of calling the function to be detected is modified to call a static function, so that the static
  • the function calls the function to be detected.
  • the function to be detected can be called by calling a static function, and in this process, items including the return address of the current call and the function of the detection point can be obtained.
  • the function call relationship detection scheme of the present invention can be used to detect whether a specific function has a call relationship between a certain return address and a detection point function. Compared with APCS/Unwind, it is more lightweight and relatively safer. For example, for the calling relationship of A->B->C, when it is only necessary to detect whether there is a calling relationship between function A and function C, the present invention only needs to modify function C to meet the detection requirements , Without having to step back and get all the intermediate call relationships.
  • the present invention can be used to detect the calling path of key functions (especially the key functions in the kernel).
  • the detection functions need to be processed item by item, the number of key functions in the kernel is controllable, so the present invention It also has good practicality and avoids the problems caused by APCS and UNWIND mentioned above.
  • FIG. 1 is a schematic flowchart illustrating a method for detecting a function call relationship according to an embodiment of the present invention.
  • step S110 a static function is added to the function to be detected.
  • the static function is defined as being called, an entry including the return address of the current call and the detection point function is generated.
  • the return address of the current call in the entry generated when the static function is called that is, the return address when the function to be detected is called.
  • the checkpoint function in the entry may be the address of the checkpoint function, such as the first address of the checkpoint function.
  • step S120 the action of calling the function to be detected is modified to call a static function, so that the static function calls the function to be detected.
  • the function that originally called the function to be detected can be called directly by calling the static function.
  • the static function added to the function C to be detected is represented as E
  • the logical calling relationship after performing step S120 is: A->B-> E->C.
  • the static function can be regarded as the inline function of the function to be detected. According to the characteristics of the inline function, the actual calling relationship is still A->B->C, but the call process will generate entries including the return address and the checkpoint function .
  • the return address in the entry generated when the static function E is called is the return address when the function C to be detected is called.
  • the present invention can also rename the function to be detected to identify the function to be detected, for example, before performing step S110, the function to be detected can be renamed.
  • the function to be detected can be renamed based on certain naming rules, which can facilitate the detection of the calling relationship of the function to be detected, such as finding all the calls of the function to be detected during compilation.
  • the mark corresponding to the detection point function may be saved in response to the detection point function being called.
  • the storage location of the mark is not limited by the present invention, for example, it can be stored in the current process stack or process structure.
  • the mark corresponding to the detection point function can be cleared so as not to affect the next detection.
  • the checkpoint function is a function in the kernel, the flag can also be cleared when the system call returns.
  • the function to be checked will also be called when the checkpoint function is called, and when the checkpoint function is called, a mark corresponding to the checkpoint function will be generated.
  • the detection function an entry including the return address of the current call and the detection point function is generated. Therefore, in response to the function to be detected being called, it can be detected whether the detection point function exists in the corresponding entry, and further detecting whether there is a mark corresponding to the detection point function in the entry, so according to the detection result, the function to be detected and the detection can be judged Whether there is a function call relationship between point functions.
  • a detection module can be added to the function to be detected, and optionally, the detection module can be inserted into the function to be detected in the form of a function.
  • the detection module may be used to detect whether there is a calling relationship between the function to be detected and the detection point function in response to the function to be detected being called.
  • the detection module may search for the detection point function in the entry corresponding to the return address of the current call according to the return address of the current call, and in the case of finding the detection point function, may further check Whether there is a mark corresponding to the detection point function, when it is detected that there is a mark corresponding to the detection point function, it can be determined that there is a calling relationship between the function to be detected and the detection point function, that is, the function call path of the function to be detected at the detection point function It can be determined that the function to be detected has a calling relationship with the detection point function at a certain return address.
  • the method shown in FIG. 1 can be executed during program compilation, that is, the calling relationship between functions can be detected during program compilation.
  • the function called in the present invention refers to being used by a compiler to compile it. For example, suppose the function C to be detected has the following calling relationship: A->B->C. When the compiler starts to compile function A, it is considered that function A is called. When the function A is compiled, the function needs to be called B, when compiling function B, it is considered that function B is called.
  • FIG. 2 is a schematic flowchart illustrating a method for detecting a function call relationship according to another embodiment of the present invention.
  • step S210 an entry generated during compilation is obtained, and the entry includes a return address and a checkpoint function.
  • the entry is generated when the static function corresponding to the function to be detected is called.
  • the static function please refer to the related description above, which will not be repeated here.
  • step S220 according to the return address when the function to be detected is called, the detection point function is searched from the entry corresponding to the return address.
  • step S230 based on the search result, it is determined whether the function to be detected has a calling relationship with the detection point function.
  • function C has the following calling relationships: A->B->C; A->D->C
  • the purpose of detection is to check whether function C has a calling relationship with function A
  • function C can be called a function to be tested Function A is called the checkpoint function.
  • the following modification operations can be performed, so as to facilitate subsequent judgment whether the detection function C has a calling relationship with the function A to provide an implementation basis.
  • the function C can be renamed to __btf_C through the macro processing command, so that all calls to the function C can be found during compilation.
  • __btf_C The renamed __btf_C is defined as:
  • the static function can be set as a call to the static function will generate a new entry in the system, the entry can be called __k_bttab, the entry content is the return address of the current call and the checkpoint function (such as the input checkpoint function address).
  • the C function call in the B/D function can be modified through the macro definition as follows:
  • the call in function B is changed from C(p) to BACKTRACECALL(C, AB, p)
  • the call in function D is modified from C(p) to BACKTRACECALL(C, AD, p)
  • a mark corresponding to the function A can be added, indicating that the function A is called, and the result of the mark can be recorded in different locations, such as the current process stack or the process structure.
  • a detection function can be added to the function __btf_C.
  • the detection function can be expressed as BT_CHECK().
  • the detection function can be used to respond to the function __btf_C being called. Check whether the function __btf_C has a calling relationship with the function A. For the detection mechanism, see The above description will not be repeated here. Among them, the specific definition of the detection function can be set according to the actual situation, and will not be repeated here.
  • FIG. 3 is a schematic diagram illustrating a detection process according to an embodiment of the present invention.
  • All __k_bttab segment entries generated during compilation can be obtained through the vmlinux.ld.S script, and then all __k_bttab entries can be sorted for subsequent search, for example, all __k_bttab entries can be sorted during system initialization. Among them, you can sort by the return address in the __k_bttab entry.
  • the function A When the function A is called, you can add the function A called mark (mark A) to the process stack or process structure. When the function A call returns, you can clear the function mark A in the process stack or process structure. Prepare for the next test.
  • the function __btf_C the calling path can be checked by the detection function (BT_CHECK function) in the function __btf_C.
  • the specific detection operation of BT_CHECK is to accurately find the detection point function corresponding to the return address in the __k_bttab table according to the current function return address. If there is no detection point function, the detection fails. If there is a checkpoint function, it is further checked whether the mark of the checkpoint function A exists in the process stack or the process structure. If there is a mark, the stack backtracking detection is successful.
  • the present invention can produce at least the following technical effects:
  • the present invention is implemented for specific functions, and can be compiled and optimized only for key functions that need to perform stack backtracking.
  • the invention can also be implemented as a function call relationship detection device.
  • the function module of the function call relationship detection device may be implemented by hardware, software or a combination of hardware and software that implements the principles of the present invention.
  • the functional modules described in FIG. 4 can be combined or divided into sub-modules, so as to implement the principles of the above invention. Therefore, the description herein may support any possible combination, division, or further definition of the functional modules described herein.
  • FIG. 4 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to an embodiment of the present invention.
  • the function call relationship detection device 400 includes an addition module 410 and a call adjustment module 420.
  • the adding module 410 is used to add a static function to the function to be detected.
  • a static function is defined as being called, an entry including the return address of the current call and the detection point function is generated.
  • the call adjustment module 420 is used to modify the action of calling the function to be detected to call a static function, so that the static function calls the function to be detected.
  • the function call relationship detection apparatus 400 may optionally further include a naming module 430 shown by a dotted frame in the figure.
  • the naming module 430 is used to rename the function to be detected to identify the function to be detected.
  • the function calling relationship detection apparatus 400 may optionally further include a saving module 440 shown by a dotted box in the figure, the saving module 440 is used to save and detect the point function in response to the detection point function being called Corresponding mark.
  • the function call relationship detection apparatus 400 may optionally further include a clearing module 450 shown by a dotted frame in the figure.
  • the clearing module 450 is used to return, clear and detect in response to the detection point function being called The mark corresponding to the point function.
  • the function call relationship detection apparatus 400 may optionally further include a detection module 460 shown by a dotted frame in the figure, which is used to detect the function to be detected and the detection point function in response to the function to be detected being called Whether there is a calling relationship between them.
  • the detection module 460 may include a search module and an inspection module (not shown in the figure). The search module is used to search for the detection point function in the entry corresponding to the return address of the current call according to the return address of the current call, and the check module is used to check whether there is a detection point function corresponding to the detection point function when the detection point function is found mark.
  • the detection module may determine that there is a calling relationship between the function to be detected and the detection point function.
  • FIG. 5 is a schematic block diagram showing the structure of a function call relationship detection apparatus according to another embodiment of the present invention.
  • the function call relationship detection device 500 includes an acquisition module 510, a search module 520 and a judgment module 530.
  • the obtaining module 510 is used to obtain an entry generated during compilation, and the entry includes a return address and a detection point function, wherein the entry is generated when a static function corresponding to the function to be detected is called, and the function to be detected is called by calling the static function .
  • the search module 520 is used to search for the detection point function from the entry corresponding to the return address according to the return address when the function to be detected is called.
  • the judgment module 530 is used to judge whether the function to be detected has a calling relationship with the detection point function based on the search result.
  • the judgment module 530 when the detection point function is found, the judgment module 530 also detects whether there is a mark corresponding to the detection point function, and when a mark corresponding to the detection point function is detected, It is determined that there is a calling relationship between the function to be detected and the function of the detection point.
  • FIG. 6 shows a schematic structural diagram of a computing device that can be used to implement the above function call relationship detection method according to an embodiment of the present invention.
  • the computing device 600 includes a memory 610 and a processor 620.
  • the processor 620 may be a multi-core processor or may include multiple processors.
  • the processor 620 may include a general-purpose main processor and one or more special co-processors, such as a graphics processor (GPU), a digital signal processor (DSP), and so on.
  • the processor 620 may be implemented using a customized circuit, such as an application specific integrated circuit (ASIC, Application Integrated Circuit) or field programmable logic gate array (FPGA, Field Programmable Gate Arrays).
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Arrays
  • the memory 610 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices.
  • the ROM may store static data or instructions required by the processor 620 or other modules of the computer.
  • the permanent storage device may be a readable and writable storage device.
  • the permanent storage device may be a non-volatile storage device that does not lose stored instructions and data even after the computer is powered off.
  • the permanent storage device uses a mass storage device (eg, magnetic or optical disk, flash memory) as the permanent storage device.
  • the permanent storage device may be a removable storage device (e.g., floppy disk, optical drive).
  • the system memory can be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory.
  • the system memory can store some or all instructions and data required by the processor during operation.
  • the memory 610 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), magnetic disks, and/or optical disks may also be used.
  • the memory 610 may include readable and/or writeable removable storage devices, such as compact discs (CD), read-only digital versatile discs (eg, DVD-ROM, dual-layer DVD-ROM), Read-only Blu-ray discs, ultra-density discs, flash memory cards (such as SD cards, min SD cards, Micro-SD cards, etc.), magnetic floppy disks, etc.
  • the computer-readable storage medium does not contain carrier waves and instantaneous electronic signals transmitted through wireless or wired.
  • Executable code is stored on the memory 610.
  • the processor 620 can cause the processor 620 to execute the function call relationship detection method described above.
  • the method according to the present invention may also be implemented as a computer program or computer program product, the computer program or computer program product including computer program code instructions for performing the above steps defined in the above method of the present invention.
  • the present invention may also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) on which executable code (or computer program, or computer instruction code) is stored ), when the executable code (or computer program, or computer instruction code) is executed by the processor of the electronic device (or computing device, server, etc.), the processor is caused to perform each step of the above method according to the present invention .
  • each block in the flowchart or block diagram may represent a module, program segment, or part of code that contains one or more of the Executable instructions.
  • the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in reverse order, depending on the functions involved.
  • each block in the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts can be implemented with dedicated hardware-based systems that perform specified functions or operations Or, it can be realized by a combination of dedicated hardware and computer instructions.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)
  • Facsimiles In General (AREA)

Abstract

La présente invention concerne un procédé, un appareil, un dispositif et un support de stockage pour la détection de relation d'appel de fonction, qui sont utilisés pour détecter si une relation d'appel existe entre une fonction à détecter et une fonction de point de détection, le procédé comprenant les étapes consistant à : ajouter une fonction statique pour une fonction à détecter, la fonction statique étant définie comme générant une entrée comprenant une adresse de retour actuellement appelée et une fonction de point de détection lorsqu'elle est appelée (S110) ; et modifier une action pour appeler la fonction à détecter en un appel de la fonction statique de façon à appeler la fonction à détecter au moyen de la fonction statique (S120). Ainsi, pour une fonction qui appelle à l'origine directement une fonction à détecter, la fonction à détecter peut être appelée par l'appel d'une fonction statique, et pendant le processus décrit, une entrée comprenant une adresse de retour actuellement appelée et une fonction de point de détection peut être obtenue, ainsi une base de mise en œuvre peut être fournie pour détecter si une relation d'appel existe entre la fonction à détecter et la fonction de point de détection.
PCT/CN2019/122370 2018-12-03 2019-12-02 Procédé, appareil, dispositif et support de stockage pour la détection de relation d'appel de fonction WO2020114347A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811468332.7A CN111258630B (zh) 2018-12-03 2018-12-03 函数调用关系检测方法、装置、设备及存储介质
CN201811468332.7 2018-12-03

Publications (1)

Publication Number Publication Date
WO2020114347A1 true WO2020114347A1 (fr) 2020-06-11

Family

ID=70946623

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/122370 WO2020114347A1 (fr) 2018-12-03 2019-12-02 Procédé, appareil, dispositif et support de stockage pour la détection de relation d'appel de fonction

Country Status (3)

Country Link
CN (1) CN111258630B (fr)
TW (1) TW202022603A (fr)
WO (1) WO2020114347A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130061212A1 (en) * 2011-09-06 2013-03-07 Microsoft Corporation Modern Application Tracing
CN103761089A (zh) * 2014-01-14 2014-04-30 清华大学 基于寄存器传输语言确定动态函数调用关系的方法
CN103970659A (zh) * 2014-05-16 2014-08-06 刘玉光 基于插桩技术的安卓应用软件自动化测试方法
CN105468508A (zh) * 2014-09-04 2016-04-06 阿里巴巴集团控股有限公司 代码检测方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100478915C (zh) * 2007-09-20 2009-04-15 福建星网锐捷网络有限公司 一种基于mips架构cpu的异常点定位诊断方法
CN103019787B (zh) * 2012-12-14 2016-08-10 华为技术有限公司 函数调用关系确定方法、热补丁升级方法及装置
US9250881B1 (en) * 2014-09-30 2016-02-02 International Business Machines Corporation Selection of an entry point of a function having multiple entry points

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130061212A1 (en) * 2011-09-06 2013-03-07 Microsoft Corporation Modern Application Tracing
CN103761089A (zh) * 2014-01-14 2014-04-30 清华大学 基于寄存器传输语言确定动态函数调用关系的方法
CN103970659A (zh) * 2014-05-16 2014-08-06 刘玉光 基于插桩技术的安卓应用软件自动化测试方法
CN105468508A (zh) * 2014-09-04 2016-04-06 阿里巴巴集团控股有限公司 代码检测方法及装置

Also Published As

Publication number Publication date
CN111258630A (zh) 2020-06-09
CN111258630B (zh) 2023-05-30
TW202022603A (zh) 2020-06-16

Similar Documents

Publication Publication Date Title
US10019240B2 (en) Method and apparatus for detecting code change
US8468497B2 (en) Automated defect classification
US8612944B2 (en) Code evaluation for in-order processing
US9134977B2 (en) Compiler operation for handling conditional statements
US8141050B2 (en) Deadlock detection by lock classification
CN105760292A (zh) 一种用于单元测试的断言验证方法和装置
CN110287696A (zh) 一种反弹shell进程的检测方法、装置和设备
CN111027054A (zh) 基于安卓系统判断应用程序在多开环境中运行方法、系统
KR20230130089A (ko) 취약한 소프트웨어 패키지의 선택 및 발견을 위한 시스템및 방법
US9471583B2 (en) Data race analysis with improved detection filtering
US20150324202A1 (en) Detecting data dependencies of instructions associated with threads in a simultaneous multithreading scheme
US9921951B2 (en) Optimizations for regression tracking and triaging in software testing
CN107589960B (zh) 一种基于寄存器访问冲突检测的dsp指令模拟方法
JP6352386B2 (ja) 定数キャッシュを使用してより効率的にリテラル生成データを従属命令に転送するための方法および装置
CN106201859A (zh) 一种回归测试方法及系统
WO2020114347A1 (fr) Procédé, appareil, dispositif et support de stockage pour la détection de relation d'appel de fonction
US20150095897A1 (en) Method and apparatus for converting programs
US20140189656A1 (en) Flow Analysis in Program Execution
CN113778838A (zh) 二进制程序动态污点分析方法及装置
US8427854B2 (en) Utilization of memory refresh cycles for pattern matching
US11449317B2 (en) Detection of semantic equivalence of program source codes
CN108959085B (zh) 一种检测内核模块在原子上下文中休眠错误的方法及系统
US8561031B2 (en) Synchronization coverage in logic code
CN111510457A (zh) 函数攻击的检测方法、装置、电子设备及可读介质
US8533694B2 (en) Identification of read/write chains during static analysis of computer software

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19892022

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19892022

Country of ref document: EP

Kind code of ref document: A1