WO2021187744A1

WO2021187744A1 - Electronic device and control method therefor

Info

Publication number: WO2021187744A1
Application number: PCT/KR2021/000912
Authority: WO
Inventors: 차상길; 김도혁; 김수민; 김홍식
Original assignee: 삼성전자주식회사; 한국과학기술원
Priority date: 2020-03-19
Filing date: 2021-01-22
Publication date: 2021-09-23
Also published as: KR20210117408A

Abstract

A method for controlling an electronic device is disclosed. A control method according to the present disclosure comprises the steps of: acquiring trace data for a target program; acquiring one or more first functions on the basis of the trace data; identifying a second function corresponding to a first basic block in which fuzzing starts among the one or more first functions; acquiring a third function by abstracting the second function; and performing the fuzzing on the basis of the trace data and the third function.

Description

Electronic device and its control method

The present disclosure relates to an electronic device and a control method thereof, and more particularly, to an electronic device performing fuzzing on a target program and a control method thereof.

In recent years, attack elements of software are increasing due to the proliferation of devices connected to the Internet, such as smart devices and IoT devices, and accordingly, research on technologies for finding vulnerabilities in software (or devices) is being actively conducted. am. A method called fuzzing is known as one of several methods for finding vulnerabilities, and fuzzing is performed by inputting several input values into software and checking whether the device handles the values well without vulnerabilities.

Meanwhile, in-memory fuzzing has recently been used as a method for more effectively performing fuzzing. In-memory fuzzing is a method to prevent the overhead caused by the existing fuzzing method of executing software from the beginning every time each fuzzing is performed. It refers to a method of performing fuzzing by restoring a memory snapshot when executing a new test case and inputting an input value to the basic block corresponding to the function.

However, through this in-memory fuzzing method, even if the user finds out the input value that caused the crash that was discovered during the fuzzing operation, when the input value is entered into the program, the crash is not repeated. There is a problem that the incidence rate is high.

Accordingly, there is a need for a technique for reducing the incidence of false positives for vulnerabilities in the in-memory fuzzing method.

SUMMARY OF THE INVENTION One technical problem to be solved by the present invention is to provide an electronic device and a method for controlling the same for acquiring a new function by abstracting a function constituting a target program, and performing fuzzing based on the acquired new function.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to an exemplary embodiment of the present disclosure for solving the above technical problem, there is provided a method of controlling an electronic device, the method comprising: acquiring trace data for a target program; obtaining at least one first function based on the trace data; identifying a second function corresponding to a first basic block in which fuzzing starts among the at least one first function; abstracting the second function to obtain a third function; and performing fuzzing based on the trace data and the third function.

According to another exemplary embodiment of the present disclosure for solving the above-described technical problem, an electronic device includes: a memory for storing at least one instruction; and a processor, wherein the processor obtains trace data for a target program, obtains at least one first function based on the trace data, and performs fuzzing among the at least one first function. An electron that identifies a second function corresponding to the starting first basic block, obtains a third function by abstracting the second function, and performs fuzzing based on the trace data and the third function A device may be provided.

The trace data includes at least one snapshot data for the target program, and the processor identifies, from among the at least one snapshot data, snapshot data corresponding to an execution time of the second function. and loading the identified snapshot data, obtaining a first input value for the first basic block based on the third function, and inputting the first input value into the first basic block to crash ( crash) can be detected.

When the crash is detected, the processor verifies the crash detection based on the first input value and the location information about the crash, and obtains location information about the second basic block in which the crash is detected, obtain a second input value for the target program based on the first input value and the third function, and verify the crash detection based on the location information on the second basic block and the second input value have.

When a crash is detected in the second basic block by inputting the second input value into the target program, the processor may determine that the crash detection is true detection.

When a crash is not detected in the second basic block by inputting the second input value to the target program, the processor may determine that the crash detection is erroneous.

The processor may obtain a solution of the second function and generate a third function based on the obtained solution of the second function.

The processor may identify at least one constraint included in the trace data, and obtain the first function based on the identified constraint.

The second function may correspond to an upper branch connected to the first basic block.

The solutions of the problems of the present disclosure are not limited to the above-described solutions, and solutions that are not mentioned will be clearly understood by those of ordinary skill in the art to which the present disclosure belongs from the present specification and the accompanying drawings. will be able

According to various embodiments of the present disclosure as described above, it is possible to effectively find a vulnerability of a target program, and it is possible to reduce the incidence of false positives for the vulnerability. Accordingly, user convenience and satisfaction may be improved.

In addition, the effects obtainable or predicted by the embodiments of the present disclosure are to be disclosed directly or implicitly in the detailed description of the embodiments of the present disclosure. For example, various effects predicted according to embodiments of the present disclosure will be disclosed in the detailed description to be described later.

1 is a flowchart illustrating an operation of an electronic device according to an embodiment of the present disclosure.

2 is a block diagram of a target program according to an embodiment of the present disclosure.

3 is a diagram for explaining a function abstraction operation of an electronic device according to an embodiment of the present disclosure.

4 is a view for explaining a purge operation according to an embodiment of the present disclosure.

5 is a block diagram illustrating a configuration of an electronic device according to an embodiment of the present disclosure.

6 is a flowchart illustrating a control method of an electronic device according to an embodiment of the present disclosure.

Terms used in this specification will be briefly described, and the present disclosure will be described in detail.

Terms used in the embodiments of the present disclosure are selected as currently widely used general terms as possible while considering the functions in the present disclosure, which may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, etc. . In addition, in a specific case, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the corresponding disclosure. Therefore, the terms used in the present disclosure should be defined based on the meaning of the term and the contents of the present disclosure, rather than the simple name of the term.

Embodiments of the present disclosure may apply various transformations and may have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the scope of the specific embodiments, and it should be understood to include all transformations, equivalents and substitutions included in the spirit and scope of the disclosed technology. In describing the embodiments, if it is determined that a detailed description of a related known technology may obscure the subject matter, the detailed description thereof will be omitted.

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as "comprises" or "consisting of" are intended to designate that the features, numbers, steps, operations, components, parts, or combinations thereof described in the specification exist, and are intended to indicate that one or more other It is to be understood that this does not preclude the possibility of addition or presence of features or numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, with reference to the accompanying drawings, embodiments of the present disclosure will be described in detail so that those of ordinary skill in the art to which the present disclosure pertains can easily implement them. However, the present disclosure may be implemented in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present disclosure in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Referring to FIG. 1 , the electronic device 100 includes a target program 10 , a trace data acquisition module 110 , a broker module 120 , a function acquisition module 130 , a function selection module 140 , and a function conversion module ( 150) and a purging module 160 may be included. For example, the electronic device 100 may be a personal computer (PC), but is not limited thereto. In addition, each module may be implemented as software, but may be implemented as a combination of software and hardware or may be implemented as hardware.

The electronic device 100 may acquire trace data for the target program 10 by using the trace data acquisition module 110 . The trace data acquisition module 110 may execute the target program 10 to extract trace data. Here, the trace data means state information of the electronic device 100 related to the execution of the target program 10 , and the state of the memory or register of the electronic device 100 during the execution of the target program 10 . may contain information. In addition, the trace data may include information on a constraint executed among a plurality of constraints included in the target program 10 and a basic block, and a plurality of snapshot data. . A basic block is a linear code sequence with no incoming branch except for entry and no outgoing branch except for exit, and includes at least one instruction or code. In addition, a constraint is a condition that limits an input value input to the basic block, and only an input value that satisfies the constraint may be input to the basic block.

The broker module 120 may acquire trace data and transmit it to the function acquisition module 130 . Also, the broker module 120 may obtain a program input value for the target program obtained through the fuzzing module 160 and transmit it to the target program 10 .

The electronic device 100 may acquire at least one first function by inputting the trace data transmitted through the broker module 120 into the function acquiring module 130 . The function acquisition module 130 may acquire at least one first function based on the trace data. Here, the first function (formula) means a function that limits the condition input to the basic block, and the function obtaining module 130 may generate the first function based on the constraint condition included in the trace data. Specifically, the function acquisition module 130 may perform symbolic execution to acquire the first function based on the constraint condition.

The electronic device 100 may obtain the second function by inputting at least one first function obtained through the function obtaining module 130 into the function selection module 140 . The function selection module 140 may select one function from among the at least one first function. Specifically, the function selection module 140 may identify a second function corresponding to a first basic block in which fuzzing starts among at least one first function. In this case, the function selection module 140 may randomly identify the second function. Alternatively, the function selection module 140 may identify the second function based on a user command.

The electronic device 100 may obtain the third function by inputting the second function obtained through the function selection module 140 into the function conversion module 150 . The function conversion module 150 may obtain a third function by abstracting the second function. Here, abstraction means simplifying a specific function. Specifically, the function transformation module 150 may obtain a solution of the second function, and generate a third function based on the obtained solution of the second function. In this case, the function transformation module 150 may obtain a solution of the second function using a Satisfiability Modulo Theories solver (SMT). Here, the SMT solver refers to software that obtains a solution that makes a logical expression true.

The fuzzing module 160 may perform fuzzing based on the third function. Specifically, the fuzzing module 160 may obtain a first input value that satisfies the third function. The fuzzing module 160 may detect a crash by inputting a first input value to a first basic block where purging starts. When a crash is detected, the fuzzing module 160 may store information on the second basic block in which the crash occurs (eg, location information of the second basic block) in the memory. Here, a crash means an abnormal termination of the target program 10 . Meanwhile, a more detailed description of the purge operation will be described later with reference to FIG. 4 .

The fuzzing module 160 may verify the crash detection based on the first input value causing the crash and the information on the second basic block in which the crash occurred. Specifically, the fuzzing module 160 may obtain a program input value for the target program 10 based on the first input value and the third function. The fuzzing module 160 may input a program input value into the target program 10 to identify whether the crash occurs again in the second basic block. At this time, if a crash occurs in the second basic block, the fuzzing module 160 may determine that the detection of the generated crash by inputting the first input value into the first basic block is true detection. On the other hand, if the crash does not occur or occurs in a basic block other than the second basic block, the fuzzing module 160 determines that the detection of the generated crash by inputting the first input value into the first basic block is erroneous. can judge

Meanwhile, in the above, it has been described that the program 10 and the trace data acquisition module 110 are included in the electronic device 100 , but this is only an embodiment, and the program 10 and the trace data acquisition module 110 are external. may be included in the device. For example, the program 10 and the trace data acquisition module 110 may be included in a mobile device or an IOT device capable of communicating with the electronic device 100 . In this case, the electronic device 100 may acquire trace data through the broker module 120 .

In the above, the operation of each module included in the electronic device 100 has been described. Hereinafter, a more specific operation of the electronic device 100 will be described with reference to FIG. 2 .

2 is a block diagram of a target program according to an embodiment of the present disclosure. Specifically, FIG. 2 is a diagram for explaining a method of acquiring the first function using the function acquiring module 130 . Meanwhile, basic blocks and branches included in the trace data are illustrated by solid lines, and basic blocks and branches not included in the trace data are illustrated by dotted lines.

Referring to FIG. 2 , the target program 10 includes a plurality of basic blocks B and a plurality of branches BL connecting the plurality of basic blocks. The target program 10 includes a first constraint condition C1 corresponding to the first branch BL1, a second constraint condition C2 corresponding to the second branch BL2, and a first constraint condition C2 corresponding to the third branch BL3. The third constraint C3 and the fourth constraint C4 corresponding to the fourth branch BL4 may be included.

In this case, the electronic device 100 may acquire the first function for each branch based on the constraint condition corresponding to each branch. Specifically, the electronic device 100 may acquire the first function by accumulating constraint conditions respectively corresponding to the branch corresponding to the first function and the upper branch thereof. The electronic device 100 may generate a first function including all constraint conditions corresponding to each branch as well as an upper branch. For example, when the electronic device 100 obtains the 1-2 th function F1 - 2 corresponding to the second branch BL2 , the first branch BL1 that is an upper branch of the second branch BL2 . A 1-2 function F1-2 may be obtained by accumulating the first constraint condition C1 corresponding to , and the second constraint condition C2 corresponding to the second branch BL2. In this case, the 1-2 function F1-2 may include both the first constraint condition C1 and the second constraint condition C2. Similarly, the electronic device 100 may acquire the 1-3 function F1-3 by accumulating the first to third constraint conditions C1, C2, and C3, and the first to fourth constraint conditions C1 , C2, C3, C4) may be accumulated to obtain a 1-4 th function (F1-4).

The electronic device 100 converts the 1-4 th function F1-4 corresponding to the first basic block B1 in which the fuzzing (ie, in-memory purge) starts among the obtained first functions to the second function. It can be obtained with (F2).

3 is a diagram for explaining a function abstraction operation of an electronic device according to an embodiment of the present disclosure. Referring to FIG. 3 , the electronic device 100 may include an SMT solver and a formula abstractor.

The electronic device 100 may obtain a solution 30 of the second function F2 by inputting the second function F2 to the SMT solver. Then, the electronic device 100 may obtain the third function F3 by inputting the obtained solution 30 to the function generating unit. The function generating unit may abstract the second function F2 to generate a third function F3 that is simpler than the second function F2. The electronic device 100 may perform in-memory fuzzing by inputting an input value that satisfies the abstracted third function F3 to the first basic block B1 . As described above, the time consumed for purging may be reduced by performing the purging based on the third function F3 instead of the second function F2.

The electronic device 100 may obtain a first input value x1 that satisfies the third function F3. The electronic device 100 may perform purging by inputting the obtained first input value x1 into the first basic block B1. That is, the electronic device 100 may perform in-memory purging. Specifically, the electronic device 100 may perform in-memory purge by using snapshot data included in the trace data. The electronic device 100 executes the first function F1 corresponding to the first branch BL1 connected to the first basic block B1 where in-memory purge starts among a plurality of snapshot data included in the trace data. You can get information about the time point. The electronic device 100 may identify snapshot data corresponding to the execution time of the first function F1 based on information on the execution time of the first function F1. The electronic device 100 loads the identified snapshot data into the memory, and repeatedly inputs at least one first input value x1 that satisfies the third function F3 into the first basic block B1 to cause a crash. occurrence can be identified. As described above, the electronic device 100 may prevent overhead by purging with the first basic block B1 as the starting point, rather than performing the purging by executing the target program 10 from the beginning. Also, the electronic device 100 may perform a verification operation for detecting a crash as described later by storing information on the second basic block B2 in which the crash occurs in a memory.

On the other hand, even if a crash occurs in the target program 10 due to the first input value x1, the first input value x1 is not an actual input value for the target program 10, so It is necessary to verify the crash detection to determine whether the detected crash is a true detection based on the actual input value of the . In conventional techniques using in-memory fuzzing, even if the first input value x1 is found, an actual input value for the target program 10 corresponding to the first input value x1 cannot be found. Accordingly, the conventional techniques have a problem in that the crash false positive rate is high.

Meanwhile, the electronic device 100 may reduce a crash false positive rate by performing a verification operation for crash detection. Specifically, the electronic device 100 may obtain the second input value IN1 that is the input value for the target program 10 by inputting the first input value x1 causing the crash to the fuzzing module 160 . . In addition, the electronic device 100 may identify whether a crash occurs in the second basic block B2 by inputting the obtained second input value IN1 into the target program 10 . When a crash occurs in the second basic block B2 , the electronic device 100 may determine that crash detection through in-memory purge is true detection. On the other hand, if a crash does not occur in the second basic block B2 , the electronic device 100 may determine that the crash detection through the in-memory purge is an erroneous detection.

In the above, the purging operation of the electronic device has been described. Hereinafter, the configuration of the electronic device will be described.

5 is a block diagram illustrating a configuration of an electronic device according to an embodiment of the present disclosure. Referring to FIG. 5 , the electronic device 500 may include a communication interface 510 , a memory 520 , and a processor 530 . The electronic device 500 corresponds to the electronic device 100 described with reference to FIGS. 1 to 4 , and each configuration of the electronic device 500 will be described below.

The communication interface 510 includes at least one circuit and may communicate with various types of external devices. The electronic device 500 may communicate with an external device through a wired or wireless method through the communication interface 510 . In this case, the external device may be a server, which is a device separate from the electronic device 500 . In particular, when the trace data for the target program 10 is generated by the external device, the electronic device 500 may receive the trace data from the external device through the communication interface 510 .

The memory 520 may store an operating system (OS) for controlling overall operations of the components of the electronic device 500 and commands or data related to the components of the electronic device 500 . To this end, the memory 520 may be implemented as a non-volatile memory (eg, a hard disk, a solid state drive (SSD), a flash memory), a volatile memory, or the like. In an embodiment according to the present disclosure, the memory 520 may store trace data and information on a basic block in which a crash occurs.

The processor 530 may control the overall operation of the electronic device 500 .

The processor 530 may acquire trace data. The processor 530 may obtain at least one first function based on the trace data. In this case, the processor 530 may identify at least one constraint included in the trace data, and obtain the first function based on the identified constraint.

The processor 530 may identify a second function corresponding to the first basic block in which the fuzzing starts from among the at least one first function. The second function may correspond to an upper branch connected to the first basic block.

The processor 530 may obtain the third function by abstracting the second function. In this case, the processor 530 may obtain a solution of the second function, and generate a third function based on the obtained solution of the second function.

The processor 530 may perform fuzzing based on the trace data and the third function. The processor 530 may identify the snapshot data corresponding to the execution time of the second function from among at least one snapshot data included in the trace data and load it into the memory 520 . In addition, the processor 530 may detect the crash by inputting an input value that satisfies the third function into the first basic block by changing the memory value.

When a crash is detected, the processor 530 may verify the crash detection based on the first input value and location information about the crash. The processor 530 may obtain location information on the second basic block in which the crash is detected. The processor 530 may obtain a second input value for the target program based on the first input value and the third function. When a crash is detected in the second basic block by inputting the second input value into the target program, the processor 530 may determine the crash detection as true detection. On the other hand, if a crash is not detected in the second basic block, the processor 530 may determine that the crash detection is a false detection.

Referring to FIG. 6 , the electronic device 100 may acquire trace data for a target program ( S610 ). Then, the electronic device 100 may acquire at least one first function based on the trace data (S620). Specifically, the electronic device 100 may generate the first function based on constraint conditions for the target program included in the trace data. Then, the electronic device 100 may identify a second function corresponding to the first basic block in which the fuzzing starts among the at least one first function ( S630 ). In this case, the electronic device 100 may randomly select a first basic block and identify a second function corresponding to an upper branch of the first basic block. Also, the electronic device 100 may obtain a third function by abstracting the identified second function ( S640 ). Specifically, the electronic device 100 may obtain a solution of the second function by using the SMT solver, and may generate a third function based on the obtained solution. Then, the electronic device 100 may perform fuzzing based on the trace data and the third function (S650). In this case, the electronic device 100 may obtain and load a memory snapshot corresponding to the second function included in the trace data. In addition, the electronic device 100 may perform in-memory purging by obtaining an input value that satisfies the third function and changing the memory based on the obtained input value.

Meanwhile, the various embodiments described above may be implemented in a recording medium readable by a computer or a similar device using software, hardware, or a combination thereof. In some cases, the embodiments described herein may be implemented by the processor itself. According to the software implementation, embodiments such as the procedures and functions described in this specification may be implemented as separate software modules. Each of the software modules may perform one or more functions and operations described herein.

Meanwhile, computer instructions for performing the processing operation according to various embodiments of the present disclosure described above may be stored in a non-transitory computer-readable medium. When the computer instructions stored in such a non-transitory computer-readable medium are executed by a processor, a specific device may perform the processing operation according to the above-described various embodiments.

The non-transitory computer-readable medium refers to a medium that stores data semi-permanently, rather than a medium that stores data for a short moment, such as a register, cache, memory, etc., and can be read by a device. Specific examples of the non-transitory computer-readable medium may include a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

Meanwhile, the device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory storage medium' is a tangible device and only means that it does not contain a signal (eg, electromagnetic wave). It does not distinguish the case where it is stored as For example, the 'non-transitory storage medium' may include a buffer in which data is temporarily stored.

According to an embodiment, the method according to various embodiments disclosed in this document may be provided as included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or through an application store (eg Play Store ^TM ) or on two user devices ( It can be distributed (eg downloaded or uploaded) directly, online between smartphones (eg: smartphones). In the case of online distribution, at least a portion of the computer program product (eg, a downloadable app) is stored at least in a machine-readable storage medium, such as a memory of a manufacturer's server, a server of an application store, or a relay server. It may be temporarily stored or temporarily created.

In the above, preferred embodiments of the present disclosure have been illustrated and described, but the present disclosure is not limited to the specific embodiments described above, and it is common in the technical field pertaining to the present disclosure without departing from the gist of the present disclosure as claimed in the claims. Various modifications may be made by those having the knowledge of

Claims

A method for controlling an electronic device, comprising:

acquiring trace data for a target program;

obtaining at least one first function based on the trace data;

identifying a second function corresponding to a first basic block in which fuzzing starts among the at least one first function;

abstracting the second function to obtain a third function; and

performing fuzzing based on the trace data and the third function; including

control method.
According to claim 1,

The trace data includes at least one snapshot data for the target program,

Performing the purging step,

identifying snapshot data corresponding to an execution time of the second function from among the at least one snapshot data, and loading the identified snapshot data;

obtaining a first input value for the first basic block based on the third function, and detecting a crash by inputting the first input value into the first basic block

control method.
3. The method of claim 2,

When the crash is detected, verifying the crash detection based on the first input value and the location information about the crash;

The verification step is

obtaining location information on the second basic block in which the crash is detected;

obtaining a second input value for the target program based on the first input value and the third function; and

verifying the crash detection based on the location information on the second basic block and the second input value

control method.
4. The method of claim 3,

The step of verifying the crash detection includes:

When a crash is detected in the second basic block by inputting the second input value into the target program, determining that the crash detection is a true detection

control method.
4. The method of claim 3,

The step of verifying the crash detection includes:

When a crash is not detected in the second basic block by inputting the second input value into the target program, determining that the crash detection is an erroneous detection

control method.
According to claim 1,

Obtaining the third function comprises:

obtaining a solution of the second function,

generating a third function based on the obtained solution of the second function

control method.
According to claim 1,

Obtaining the first function comprises:

identifying at least one constraint included in the trace data; and

obtaining the first function based on the identified constraint condition;

control method.
In an electronic device,

a memory storing at least one instruction; and

processor; including;

The processor is

Acquire trace data for the target program,

obtaining at least one first function based on the trace data;

Identifies a second function corresponding to a first basic block in which fuzzing starts among the at least one first function,

abstracting the second function to obtain a third function,

performing fuzzing based on the trace data and the third function

electronic device.
9. The method of claim 8,

The trace data includes at least one snapshot data for the target program,

The processor is

Identifies snapshot data corresponding to an execution time of the second function from among the at least one snapshot data, and loads the identified snapshot data;

obtaining a first input value for the first basic block based on the third function, and detecting a crash by inputting the first input value into the first basic block

electronic device.
10. The method of claim 9,

The processor is

When the crash is detected,

Verifies the crash detection based on the first input value and the location information about the crash,

acquiring location information about the second basic block in which the crash is detected,

obtaining a second input value for the target program based on the first input value and the third function;

To verify the crash detection based on the location information on the second basic block and the second input value

electronic device.
11. The method of claim 10,

The processor is

When a crash is detected in the second basic block by inputting the second input value into the target program, determining that the crash detection is a true detection

electronic device.
11. The method of claim 10,

The processor is

When a crash is not detected in the second basic block by inputting the second input value into the target program, determining that the crash detection is an erroneous detection

electronic device.
9. The method of claim 8,

The processor is

obtain a solution of the second function, and

generating a third function based on the obtained solution of the second function

electronic device.
9. The method of claim 8,

The processor is

identify at least one constraint included in the trace data;

obtaining the first function based on the identified constraint

electronic device.
9. The method of claim 8,

The second function is

corresponding to the upper branch connected to the first basic block

electronic device.