WO2021254243A1 - 代码构建方法、装置、设备和存储介质 - Google Patents

代码构建方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2021254243A1
WO2021254243A1 PCT/CN2021/099361 CN2021099361W WO2021254243A1 WO 2021254243 A1 WO2021254243 A1 WO 2021254243A1 CN 2021099361 W CN2021099361 W CN 2021099361W WO 2021254243 A1 WO2021254243 A1 WO 2021254243A1
Authority
WO
WIPO (PCT)
Prior art keywords
code
command
code construction
construction
construction command
Prior art date
Application number
PCT/CN2021/099361
Other languages
English (en)
French (fr)
Inventor
贺洪军
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to JP2022554637A priority Critical patent/JP7433464B2/ja
Priority to EP21826277.2A priority patent/EP4167076A4/en
Priority to US18/010,014 priority patent/US20230251952A1/en
Publication of WO2021254243A1 publication Critical patent/WO2021254243A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/362—Software debugging
    • G06F11/3624—Software debugging by performing operations on the source code, e.g. via a compiler
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/30—Creation or generation of source code
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3668—Software testing
    • G06F11/3672—Test management
    • G06F11/3688—Test management for test execution, e.g. scheduling of test suites
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3668—Software testing
    • G06F11/3672—Test management
    • G06F11/3684—Test management for test design, e.g. generating new test cases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3668—Software testing
    • G06F11/3672—Test management
    • G06F11/3692—Test management for test results analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/71—Version control; Configuration management
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present disclosure relates to, but is not limited to, the computer field.
  • Passive analysis The results of multiple code constructions are compared, and the analysis shows that the differences are caused by factors that do not affect the program logic, such as timestamps, random numbers, and file sequences, which indirectly prove that the code to be audited is binary equivalent.
  • Active defense Analyze the project source code in advance to find out the factors that may affect the binary equivalent of the code: timestamp, random number, file sequence, character set, etc., and modify it to a constant for repair or evasion without affecting the program logic. Makes the binary result of multiple builds consistent, so as to ensure that the audited code is binary equivalent.
  • the present disclosure provides a code construction method, including: generating at least two test construction commands according to different environment variables in the code construction command; respectively executing the at least two test construction commands on the code, and if the execution results are inconsistent, Then the code construction command is adjusted according to the environment variable in the code construction command; the adjusted code construction command is executed on the code.
  • the present disclosure provides a code construction device, including: a generation module configured to generate at least two test construction commands according to different environment variables in the code construction command; and an adjustment module configured to execute the at least two test construction commands respectively on the code If the execution results of a test construction command are inconsistent, the code construction command is adjusted according to the environment variables in the code construction command; the execution module is configured to execute the adjusted code construction command on the code.
  • the present disclosure provides a device including: one or more processors; a storage device configured to store one or more programs; when the one or more programs are used by the one or more processors When executed, the one or more processors are caused to implement any method as described herein.
  • the present disclosure provides a storage medium that stores a computer program, and when the computer program is executed by a processor, any one of the methods described herein is implemented.
  • Fig. 1 is a schematic flowchart of a code construction method provided by the present disclosure
  • Figure 2 is a schematic structural diagram of a code construction device provided by the present disclosure
  • Fig. 3 is a schematic structural diagram of a device provided by the present disclosure.
  • Passive analysis Compare the results of multiple code constructions. Analysis shows that the differences are caused by factors that do not affect the program logic, such as timestamps, random numbers, and file sequences. This indirectly proves that the code to be audited is binary equivalent.
  • This method of passive analysis after encountering differences has the following disadvantages: First, the timeliness is poor. If the differences are found and then analyzed, the time requirements of the user are often not met, and the difference analysis report cannot be provided to the user in time; Second, the reusability is poor. Due to the low reusability of analysis results, after replacing the project, it may be time-consuming and labor-intensive to repeat a large amount of analysis work; 3. The analysis efficiency is low.
  • Active defense Analyze the project source code in advance to find out the factors that may affect the binary equivalent of the code: timestamp, random number, file sequence, character set, etc., and modify it to a constant for repair or evasion without affecting the program logic. Makes the binary result of multiple builds consistent, so as to ensure that the audited code is binary equivalent. Disadvantages of this method: 1. The reusability is poor. The work of analyzing and modifying the project source code cannot be reused. After the project is replaced, the tedious engineering analysis and modification work must be repeated; 2. The analysis efficiency is low, and manual work is required to analyze the project. The amount is large and may be missed.
  • Figure 1 is a schematic flow diagram of a code construction method provided by the present disclosure.
  • the method can be applied to the case of code binary audit.
  • the method can be executed by a code construction device, which can be implemented by software and/or hardware. And integrated on the device.
  • the device may be a computer device.
  • the code construction method provided by the present disclosure includes steps S110, S120, and S130.
  • step S110 at least two test construction commands are generated according to different environment variables in the code construction commands.
  • the environment variable includes at least one of user name, system time, time stamp, random number, file sequence, and character set.
  • the environment variable is a variable included in the code building command.
  • the code building command is a command to generate a compressed file
  • the environment variable is a timestamp
  • the different environment variables may be different types of environment variables, or may be different values corresponding to the same type of environment variables, for example, the different environment variables may be timestamp A and timestamp B, or may be timestamps A and user name C are not limited in this disclosure.
  • the project construction process is tracked.
  • the project construction process refers to the process of binary conversion of the code, monitors the code construction commands in the project construction process, suspends the execution of the code construction commands, and generates at least two according to different environment variables.
  • a test construction command for example, tracking the project construction process
  • the project construction process refers to the process of binary conversion of the code, monitoring the code construction command during the project construction process, and suspend the execution of the code construction command.
  • a test build command is generated according to system time A, and a test build command is generated according to system time B; or, if the environment variables are system time A and user name C, it is generated according to system time A
  • a test build command generates a test build command based on the user name C; it can also be that if the environment variables are timestamp Q, random number M, and user name C, a test build command is generated based on the timestamp Q, based on the random number M Generate a test build command and generate a test build command based on user name C; or, if the environment variables are system time A, system time B, and system time P, then generate a test build command based on system time A, according to system time B generates a test build command, and generates a test build command according to the system time P.
  • step S120 the at least two test construction commands are respectively executed on the code, and if the execution results are inconsistent, the code construction commands are adjusted according to the environment variables in the code construction commands.
  • the at least two test construction commands are executed respectively on the code.
  • a test construction command is generated according to system time A
  • a test construction command is generated according to system time B.
  • Command execute the test construction command generated according to system time A on the code, and execute the test construction command generated according to system time B on the code;
  • the environment variables are system time A, system time B, and system time P, then generate according to system time A
  • a test build command a test build command is generated according to system time B
  • a test build command is generated according to system time P
  • the test build command generated according to system time A is executed on the code
  • the test build command generated according to system time B is executed on the code
  • the environment variables are timestamp Q, random number M, and user name C, then generate a test construction command according to the timestamp Q, and generate a test construction command according to the random number M
  • the environment variables are timestamp Q, random number M, and user name C
  • the code construction command is adjusted according to the environment variables in the code construction command. For example, if the environment variables are system time A and system time B, one is generated according to system time A Test build command, generate a test build command according to system time B, execute the test build command generated according to system time A on the code, execute the test build command generated according to system time B on the code, if the code is executed according to system time A
  • the execution result of the test build command is X
  • the execution result of the test build command generated according to the system time B for code execution is Y.
  • the execution result X and the execution result Y are different, and the execution results are inconsistent, adjust the code construction command according to the system time; If the environment variables are system time A, system time B, and system time P, a test build command is generated according to system time A, a test build command is generated according to system time B, and a test build command is generated according to system time P, and the code is executed According to the test construction command generated by the system time A, the test construction command generated by the system time B is executed on the code, the test construction command generated by the system time P is executed on the code, and the test construction command generated by the system time A is executed on the code.
  • the result is X
  • the execution result of the test construction command generated according to the system time B is Y for code execution
  • the execution result of the test construction command generated according to the system time P is Z
  • the environment variable is a timestamp Q, a random number M, and a user name C
  • a test construction command is generated according to the timestamp Q, according to the random
  • the number M generates a test build command
  • a test build command is generated based on the user name C
  • the test build command generated based on the timestamp Q is executed on the code
  • the test build command generated based on the random number M is executed on the code
  • the code is executed based on the user name
  • the test build command generated by C, the execution result of the test build command generated by the time stamp Q for code execution is X
  • step S130 the adjusted code construction command is executed on the code.
  • the adjusted code construction command is executed on the code. For example, if the environment variable is a timestamp, the system time of the code construction command is adjusted to a fixed value, and the system time of the code execution is adjusted to a fixed value. If the environment variable is the file list order, adjust the code construction command to use the sorting tool to sort the execution results after the execution result is obtained, and execute the adjusted code construction command for the code.
  • the code construction method provided by the present disclosure generates at least two test construction commands according to different environment variables in the code construction command; executes the at least two test construction commands on the code respectively, and if the execution results are inconsistent, then according to the The environment variables in the code construction command adjust the code construction command; executing the adjusted code construction command on the code can make multiple code construction results consistent, and automatically realize reproducible code construction.
  • adjusting the code construction command according to the environment variable in the code construction command includes: querying a database according to the code construction command to obtain the first adjustment rule corresponding to the code construction command; The first adjustment rule adjusts each environment variable in the code construction command.
  • a database about the correspondence between code construction commands and adjustment rules is established in advance.
  • the database may store code construction commands W and adjustment rules for all environment variables in code construction commands W; code construction commands G and The adjustment rules for all the environment variables in the code construction command G; the adjustment rules for all the environment variables in the code construction command K and the code construction command K.
  • the first adjustment rule may include the adjustment rule of all environment variables in the code construction command. For example, if the code construction command includes the environment variable D and the environment variable E, the first adjustment rule includes the environment variable D. Adjustment rules and adjustment rules of environmental variable E.
  • adjusting each environmental variable in the code construction command according to the first adjustment rule includes: if the code construction command includes a time stamp, setting the system time corresponding to the code construction command It is a fixed time; if the code construction command includes a random number, the target file system is constructed, and the file system corresponding to the code construction command is replaced with the target file system, so that the file to be archived has fixed node information; If the code construction command includes a file list order, at least one execution result corresponding to the code construction command is sorted using a sorting tool.
  • the code construction command may include at least one environment variable of a time stamp (environmental variable), a random number (environmental variable), and a file list order (environmental variable).
  • the system time corresponding to the code construction command is set to a fixed time; if the code construction command includes a random number, the target file system is constructed, Replace the file system corresponding to the code construction command with the target file system, so that the file to be archived has fixed node information; if the code construction command includes a file list sequence, at least one corresponding to the code construction command The execution results are sorted using a sorting tool.
  • the system time corresponding to the code construction command needs to be set to a fixed time; if the code construction command includes timestamp and random Number, the system time corresponding to the code building command needs to be set to a fixed time, and the target file system is constructed, and the file system corresponding to the code building command is replaced with the target file system, so that the file to be archived has a fixed node Information; if the code construction command includes a timestamp, random number, and file list sequence, the system time corresponding to the code construction command needs to be set to a fixed time, the target file system is constructed, and the file system corresponding to the code construction command Replace with the target file system, so that the file to be archived has fixed node information, and at least one execution result corresponding to the code construction command is sorted using a sorting tool.
  • adjusting the code construction command according to the environment variables in the code construction command includes: querying a database according to the environment variables corresponding to the at least two test construction commands to obtain the first corresponding to the environment variable Two adjustment rules; adjusting the environmental variables according to the second adjustment rules.
  • the database may include adjustment rules for environmental variables D and D, adjustment rules for environmental variables R and environmental variables R, and environmental variables H and H The adjustment rules of the environment variable H.
  • the second adjustment rule may include an adjustment rule of the environment variable corresponding to the test build command.
  • the environmental variables that lead to inconsistent execution results are determined in advance according to the test build command.
  • the environmental variables may be one or more than one type. For example, it may be determined according to the test build command to cause inconsistent execution results. If the environment variable is the environment variable D, the database is queried to obtain the adjustment rule of the environment variable D, and the environment variable D is adjusted according to the adjustment rule of the environment variable D.
  • the code construction command may include multiple environment variables, and the environment variables that cause inconsistent execution results can be one or multiple.
  • the code construction command includes environment variable Q, environment variable D, and environment.
  • Variable R the environment variable that causes inconsistent execution results is environment variable Q; it can also be that the code construction command includes environment variable Q and environment variable D, and the environment variables that cause inconsistent execution results are environment variable Q and environment variable D; if it causes The environment variables with inconsistent execution results are the environment variable Q and the environment variable D. Then, query the database according to the environment variable Q to obtain the adjustment rule of the environment variable Q, and query the database according to the environment variable D to obtain the adjustment rule of the environment variable D.
  • the test build command N1 is generated according to the environment variable Q1 in the code build command, and the test is generated according to the environment variable Q2 in the code build command Build command N2, generate test build command V1 according to the environment variable D1 in the code build command, generate test build command V2 according to the environment variable D2 in the code build command, generate test build command U1 according to the environment variable R1 in the code build command, and build the command according to the code
  • the environment variable R2 generates the test build command U2.
  • the execution result of the test build command N1 is consistent with the execution result of the test build command N2
  • the execution result of the test build command V1 and the test build command V2 are inconsistent
  • the test build command U1 and the test build command If the execution results of U2 are consistent, the database is queried according to the environment variable D to obtain the adjustment rule of the environment variable D, and the environment variable D is adjusted according to the adjustment rule of the environment variable D.
  • adjusting the environment variable according to the second adjustment rule includes: if the environment variable in the code construction command is a timestamp, setting the system time corresponding to the code construction command to a fixed time .
  • the fixed time may be set by the system or manually, which is not limited in the present disclosure.
  • the system time corresponding to the code construction command is set to a fixed time.
  • the tar tool generates a compressed package (when the tar command generates a compressed package file, it will generate a timestamp in the file header according to the current time of the system.
  • the compressed package file generated by the same tar command executed twice will be due to the file
  • the timestamp in the header is different but the binary is inconsistent); according to the query database to find the corresponding adjustment rules, such as the tar command to generate compressed files, the monitoring module builds a new tar command, and sets the system time for executing the tar command to a fixed time, Then, the compressed package file generated by executing the same tar command multiple times can keep the binary consistency.
  • adjusting the environment variable according to the second adjustment rule includes: if the environment variable in the code construction command is a random number, constructing a target file system; and constructing a file corresponding to the code construction command The system is replaced with the target file system so that the files to be archived have fixed node information.
  • the target file system is constructed; the file system corresponding to the code construction command is replaced with the target file system, so that the file to be archived has a fixed Node information, for example, detection of non-reproducible construction reasons caused by random numbers in the project: For example, when the cpio file is generated, the inode of the file packaged in the cpio is a random number; the corresponding adjustment rule is found according to the query database, For example, the random problem of generating the inode of the packaged file in cpio (build an independent file system, such as ext4, etc., copy the packaged files to this independent file system in order, so that the packaged file has a fixed inode value, and then The cpio file is generated in this independent file system, so that the cpio file generated during multiple builds keeps the binary consistency).
  • the environment variable in the code construction command is a random number
  • the target file system is constructed; the file system corresponding to the code construction command is replaced with the target file system, so that the
  • adjusting the environment variable according to the second adjustment rule includes: if the environment variable in the code construction command is in file list order, using at least one execution result corresponding to the code construction command Sorting tool for sorting.
  • At least one execution result corresponding to the code construction command is sorted using a sorting tool. For example, it may be detected that the file is in the project. Unreproducible construction caused by the order of the list: For example, find the search command, the order of the multiple results found is not fixed; find the corresponding adjustment method by searching the database, such as the find command, use sorting tools such as sort for the multiple results found For sorting, the results of multiple executions of the find command are consistent.
  • generating at least two test construction commands according to different environment variables in the code construction commands includes: tracking the code construction process and monitoring the code construction commands during the code construction process; when the code construction commands are obtained, the code is paused Execution of the build command; generating at least two test build commands according to different environment variables in the code build command.
  • track the entire process of project construction monitor the code construction commands in the process of project construction; pause the execution of the current code construction commands; construct two test construction commands, and the two test construction commands set different environment variables ( For example, user name, system time and other factors that may cause unreproducible build); execute two newly built test build commands in sequence; compare the output of the two test build commands, if the output is inconsistent, the current code build command is determined to be unavailable Reproduce the code build command of the build.
  • environment variables For example, user name, system time and other factors that may cause unreproducible build
  • monitor not limited to ptrace
  • the construction process of the project detect non-reproducible construction environment variables in the project; find the adjustment rules corresponding to the environment variables according to the database; adjust the environment variables according to the adjustment rules Get the new code build command; replace the original code build command with the new code build command; execute the new code build command.
  • the present disclosure prepares adjustment rules in advance for environmental variables that cause non-reproducible construction, and stores the adjustment rules in the database; after obtaining the new adjustment rules, the new adjustment rules are added to the database, and the database is updated in real time.
  • the present disclosure can reuse the existing analysis and non-reproducible construction results, without modifying the project source code, during the project construction process, automatically locate and repair the environment variables that cause the non-reproducible construction, and ensure that the binary is built multiple times Consistent, so as to facilitate the completion of the code binary equivalent audit.
  • monitoring the construction process of the project detecting non-reproducible construction reasons caused by timestamps in the project: for example, the tar tool generates a compressed package (when the tar command generates a compressed package file, it will be based on the current time of the system A timestamp is generated in the file header.
  • the compressed package file generated by the same tar command executed twice will be inconsistent with the binary because the timestamp in the file header is different); according to the timestamp query the database to find the adjustment rule corresponding to the timestamp, such as tar command to generate compressed file, the monitoring module builds a new tar command, and sets the system time for executing the tar command to a fixed time, then the compressed file generated by repeatedly executing the same tar command can keep the binary consistency; according to the adjustment rules After the timestamp is adjusted, the adjusted code construction command is obtained, and the adjusted code construction command is executed on the code.
  • monitor the construction process of the project detect non-reproducible construction reasons caused by random numbers in the project: for example, when the cpio file is generated, the inode of the file packaged in the cpio is a random number; according to the random number Query the database to find the adjustment rules corresponding to the random number, such as generating the inode random problem of the packaged file in cpio (build an independent file system, such as ext4, etc., copy the packaged files to this independent file system in order, Make the packaged file have a fixed inode value, and then generate the cpio file in this independent file system, so that the cpio file generated during multiple builds keeps the binary consistency); adjust the code construction command according to the adjustment rules, and after the code is adjusted The code build command.
  • the adjustment rules such as generating the inode random problem of the packaged file in cpio
  • monitor the construction process of the project detect the unreproducible construction caused by the order of the file list in the project: such as the find search command, the order of multiple results found is not fixed; the order is broken according to the file list
  • Search the database to find the adjustment rules corresponding to the order of the file list (such as the find command, use sorting tools such as sort to sort the multiple results found, then the search results of multiple executions of the find command are consistent); adjust the code construction according to the adjustment rules Command; execute the adjusted code construction command on the code.
  • start project construction ; monitor project construction; monitor code construction commands in the process of project construction; suspend the execution of current code construction commands; construct two test construction commands (set different environment variables to make two The use of different system time, user name and other factors for the secondary command may cause non-reproducible build); execute the first test build command; execute the second test build command; compare the execution results of the two test build commands, if the binary is inconsistent , It locates the reason for an unreproducible build; resumes the execution of the suspended command; detects the build process, if the build is not completed, jumps to the code build command step in the monitoring project build process; otherwise ends the process.
  • FIG. 2 is a schematic structural diagram of a code construction device provided by the present disclosure.
  • the device is configured in a computer device. See FIG. 2.
  • the device includes: a generating module 21 configured to construct according to the code Different environment variables in the command generate at least two test build commands; the adjustment module 22 is configured to execute the at least two test build commands on the code respectively, and if the execution results are inconsistent, adjust according to the environment variables in the code build command The code construction command; the execution module 23 is configured to execute the adjusted code construction command on the code.
  • the code construction device provided in the present disclosure is used to implement the code construction method of the present disclosure.
  • the implementation principle and technical effect of the code construction device provided in the present disclosure are similar to the code construction method of the present disclosure, and will not be repeated here.
  • the adjustment module 22 may be configured to: query a database according to the code construction command to obtain a first adjustment rule corresponding to the code construction command; adjust the code construction according to the first adjustment rule Various environment variables in the command.
  • the adjustment module 22 may be configured to query a database according to the environmental variables in the code construction command to obtain a second adjustment rule corresponding to the environmental variable; The environment variables.
  • the adjustment module 22 may be configured to: if the environment variable in the code construction command is a time stamp, set the system time corresponding to the code construction command to a fixed time.
  • the adjustment module 22 may be configured to: if the environment variable in the code construction command is a random number, construct a target file system; replace the file system corresponding to the code construction command with the target file system , So that the files to be archived have fixed node information.
  • the adjustment module 22 may be configured to: if the environment variable in the code construction command is in a file list order, use a sorting tool to sort at least one execution result corresponding to the code construction command.
  • the adjustment module 22 may be configured to track the code construction process and monitor the code construction commands in the code construction process; when the code construction commands are obtained, the execution of the code construction commands is suspended; according to the code Different environment variables in the build command generate at least two test build commands.
  • a code construction device includes: a generation module configured to generate at least two test construction commands according to different environment variables in the code construction command; an adjustment module configured to execute the at least two test constructions on the code respectively Command, if the execution results are inconsistent, adjust the code construction command according to the environment variables in the code construction command; the execution module is configured to execute the adjusted code construction command on the code, which can reuse the existing analysis. Reproduce the results of the build without the need for the user to manually modify the project source code, and automatically discover, repair or avoid the factors that cause non-reproducible builds during the project construction process, and achieve the binary consistency of the multiple build results, thereby improving the effectiveness of the code audit efficient.
  • FIG. 3 is a schematic structural diagram of a device provided by the present disclosure.
  • the device provided by the present disclosure includes one or more processors 51 and a storage device 52; There may be one or more processors 51.
  • one processor 51 is taken as an example; the storage device 52 is used to store one or more programs; the one or more programs are used by the one or more processors 51 executes, so that the one or more processors 51 implement any method described herein.
  • the device further includes: a communication device 53, an input device 54 and an output device 55.
  • the processor 51, the storage device 52, the communication device 53, the input device 54 and the output device 55 in the device may be connected by a bus or other means.
  • a bus the connection by a bus is taken as an example.
  • the input device 54 may be configured to receive input digital or character information, and generate key signal input related to user settings and function control of the device.
  • the output device 55 may include a display device such as a display screen.
  • the communication device 53 may include a receiver and a transmitter.
  • the communication device 53 is configured to perform information transceiving and communication under the control of the processor 51.
  • Information includes but is not limited to uplink authorization information.
  • the storage device 52 can be configured to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the code construction method described in FIG. 1 of the present disclosure (for example, in the code construction device The generation module 21, the adjustment module 22 and the execution module 23).
  • the storage device 52 may include a program storage area and a data storage area.
  • the program storage area may store an operating system and an application program required by at least one function; the data storage area may store data created according to the use of the device, and the like.
  • the storage device 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
  • the storage device 52 may further include a memory remotely provided with respect to the processor 51, and these remote memories may be connected to the device through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the present disclosure also provides a storage medium that stores a computer program, and when the computer program is executed by a processor, it implements any code construction method described in the present disclosure.
  • the computer storage medium of the present disclosure may adopt any combination of one or more computer-readable media.
  • the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples of computer-readable storage media (non-exhaustive list) include: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (Read Only Memory, ROM), Erasable Programmable Read Only Memory (EPROM), flash memory, optical fiber, portable CD-ROM, optical storage device, magnetic storage device, or any suitable combination of the above .
  • the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program may be used by or in combination with an instruction execution system, apparatus, or device.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and computer-readable program code is carried therein. This propagated data signal can take many forms, including but not limited to: electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the computer-readable signal medium may also be any computer-readable medium other than the computer-readable storage medium.
  • the computer-readable medium may send, propagate or transmit the program for use by or in combination with the instruction execution system, apparatus, or device .
  • the program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.
  • suitable medium including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.
  • the computer program code used to perform the operations of the present disclosure can be written in one or more programming languages or a combination thereof.
  • the programming languages include object-oriented programming languages—such as Java, Smalltalk, C++, and also conventional Procedural programming language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computer, partly on the user's computer, executed as an independent software package, partly on the user's computer and partly executed on a remote computer, or entirely executed on the remote computer or server.
  • the remote computer can be connected to the user's computer through any kind of network including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to Connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • user equipment encompasses any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser, or a vehicle-mounted mobile station.
  • the various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic or any combination thereof.
  • some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, although the present disclosure is not limited thereto.
  • the embodiments of the present disclosure may be implemented by executing computer program instructions by a data processor of a mobile device, for example, in a processor entity, or by hardware, or by a combination of software and hardware.
  • Computer program instructions can be assembly instructions, instruction set architecture (Instruction Set Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or written in any combination of one or more programming languages Source code or object code.
  • the block diagram of any logic flow in the drawings of the present disclosure may represent program steps, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program steps and logic circuits, modules, and functions.
  • the computer program can be stored on the memory.
  • the memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as but not limited to read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), optical Memory devices and systems (Digital Video Disc (DVD) or Compact Disk (CD)), etc.
  • Computer-readable media may include non-transitory storage media.
  • the data processor can be any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microprocessors, digital signal processors (Digital Signal Processing, DSP), application specific integrated circuits (ASICs) ), programmable logic devices (Field-Programmable Gate Array, FGPA), and processors based on multi-core processor architecture.
  • DSP Digital Signal Processing
  • ASICs application specific integrated circuits
  • FGPA programmable logic devices

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种代码构建方法、装置、设备和存储介质。该方法包括：根据代码构建命令中的不同环境变量生成至少两个测试构建命令（S110）；对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令（S120）；对所述代码执行调整后的代码构建命令（S130）。

Description

代码构建方法、装置、设备和存储介质
相关申请的交叉引用
本申请要求2020年6月15日提交给中国专利局的第202010543411.0号专利申请的优先权，其全部内容通过引用合并于此。
技术领域
本公开涉及但不限于计算机领域。
背景技术
现在出于对安全的考量，对代码的审计要求越来越严格，越来越广泛，代码二进制等效审计也成为了一项重要指标。
现在业界应对代码二进制等效审计的通用方法有两种方式：被动分析和主动防御。
被动分析：对多次代码构建结果进行对比，分析说明差异是由于时间戳、随机数、文件顺序等不影响程序逻辑的因素造成，间接证明待审计的代码二进制等效。
主动防御：事先分析工程源码，找出可能影响代码二进制等效的因素：时间戳、随机数、文件顺序、字符集等，在不影响程序逻辑的前提下将其修改为常量进行修复或规避，使得多次构建结果二进制一致，从而保证审计的代码二进制等效。
发明内容
第一方面，本公开提供一种代码构建方法，包括：根据代码构建命令中的不同环境变量生成至少两个测试构建命令；对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；对所述代码执行调整后的代码构建命令。
第二方面，本公开提供一种代码构建装置，包括：生成模块，配置为根据代码构建命令中的不同环境变量生成至少两个测试构建 命令；调整模块，配置为对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；执行模块，配置为对所述代码执行调整后的代码构建命令。
第三方面，本公开提供了一种设备，包括：一个或多个处理器；存储装置，配置为存储一个或多个程序；当所述一个或多个程序被所述一个或多个处理器执行时，使得所述一个或多个处理器实现如本文所描述的任一方法。
第四方面，本公开提供了一种存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现本文所描述的任意一种方法。
附图说明
图1是本公开提供的一种代码构建方法的流程示意图；
图2为本公开提供的一种代码构建装置的结构示意图；
图3为本公开提供的一种设备的结构示意图。
具体实施方式
为使本公开的目的、技术方案和优点更加清楚明白，下文中将结合附图对本公开的实施方式进行详细说明。需要说明的是，在不冲突的情况下，本公开中的实施方式及实施方式中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
现在出于对安全的考量，对代码的审计要求越来越严格，越来越广泛，代码二进制等效审计也成为了一项重要指标。
现在业界应对代码二进制等效审计的通用方法有两种方式：被动分析和主动防御。
被动分析：对多次代码构建结果进行对比，分析说明差异是由 于时间戳、随机数、文件顺序等不影响程序逻辑的因素造成，间接证明待审计的代码二进制等效。这种遇到差异再被动分析的方式存在如下劣势：一、及时性差，如果发现差异再分析，往往达不到用户的时间要求，不能及时给用户提供差异分析报告；二、可复用性差，由于分析结果可重复利用率低，更换工程后，可能又要耗时、耗力的重复大量的分析工作；三、分析效率低，在构建过程中，差异是会传递的，构建开始过程中的微小差异，会造成最终结果的大差异，被动分析时，需要逆向追溯，层层分析，找到造成构建结果差异的根本原因，分析过程费时、费力，效率比较低。
主动防御：事先分析工程源码，找出可能影响代码二进制等效的因素：时间戳、随机数、文件顺序、字符集等，在不影响程序逻辑的前提下将其修改为常量进行修复或规避，使得多次构建结果二进制一致，从而保证审计的代码二进制等效。此方法的劣势：一、可复用性差，分析修改工程源码的工作不可复用，更换工程后，又得重复繁琐的工程分析和修改工作；二、分析效率低，需要人工去分析工程，工作量大，且有可能遗漏。
图1为本公开提供的一种代码构建方法的流程示意图，该方法可以适用于应对代码二进制审计的情况，该方法可以由代码构建装置执行，该代码构建装置可以由软件和/或硬件实现，并集成在设备上。所述设备可以为计算机设备。
如图1所示，本公开提供的代码构建方法，包括步骤S110、S120和S130。
在步骤S110，根据代码构建命令中的不同环境变量生成至少两个测试构建命令。
其中，所述环境变量包括：用户名、系统时间、时间戳、随机数、文件顺序以及字符集中的至少一种。
其中，所述环境变量为代码构建命令中包含的变量，例如可以是，若代码构建命令为生成压缩包文件命令，则环境变量为时间戳。
其中，所述不同环境变量可以为不同类型的环境变量，也可以为同一类型的环境变量对应的不同数值，例如可以是，不同环境变量 可以为时间戳A和时间戳B，也可以为时间戳A和用户名C，本公开对此不进行限制。
在一个实施方式中，跟踪工程构建过程，工程构建过程指的是将代码进行二进制转换的过程，监控工程构建过程中的代码构建命令，暂停代码构建命令的执行，根据不同的环境变量生成至少两个测试构建命令，例如可以是，跟踪工程构建过程，工程构建过程指的是将代码进行二进制转换的过程，监控工程构建过程中的代码构建命令，暂停代码构建命令的执行，若环境变量为系统时间A和系统时间B，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令；也可以为，若环境变量为系统时间A和用户名C，则根据系统时间A生成一个测试构建命令，根据用户名C生成一个测试构建命令；也可以为，若环境变量为时间戳Q、随机数M和用户名C，则根据时间戳Q生成一个测试构建命令，根据随机数M生成一个测试构建命令，根据用户名C生成一个测试构建命令；或者可以为，若环境变量为系统时间A、系统时间B和系统时间P，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令，根据系统时间P生成一个测试构建命令。
在步骤S120，对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令。
其中，对代码分别执行所述至少两个测试构建命令，例如可以是，若环境变量为系统时间A和系统时间B，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令，对代码执行根据系统时间A生成的测试构建命令，对代码执行根据系统时间B生成的测试构建命令；若环境变量为系统时间A、系统时间B和系统时间P，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令，根据系统时间P生成一个测试构建命令，对代码执行根据系统时间A生成的测试构建命令，对代码执行根据系统时间B生成的测试构建命令，对代码执行根据系统时间P生成的测试构建命令；也可以为，若环境变量为时间戳Q、 随机数M和用户名C，则根据时间戳Q生成一个测试构建命令，根据随机数M生成一个测试构建命令，根据用户名C生成一个测试构建命令，对代码执行根据时间戳Q生成的测试构建命令，对代码执行根据随机数M生成的测试构建命令，对代码执行根据用户名C生成的测试构建命令。
在一个实施方式中，若执行结果不一致，则根据代码构建命令中的环境变量调整所述代码构建命令，例如可以是，若环境变量为系统时间A和系统时间B，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令，对代码执行根据系统时间A生成的测试构建命令，对代码执行根据系统时间B生成的测试构建命令，若对代码执行根据系统时间A生成的测试构建命令的执行结果为X，对代码执行根据系统时间B生成的测试构建命令的执行结果为Y，因为执行结果X和执行结果Y不同，执行结果不一致，则根据系统时间调整代码构建命令；若环境变量为系统时间A、系统时间B和系统时间P，则根据系统时间A生成一个测试构建命令，根据系统时间B生成一个测试构建命令，根据系统时间P生成一个测试构建命令，对代码执行根据系统时间A生成的测试构建命令，对代码执行根据系统时间B生成的测试构建命令，对代码执行根据系统时间P生成的测试构建命令，对代码执行根据系统时间A生成的测试构建命令的执行结果为X，对代码执行根据系统时间B生成的测试构建命令的执行结果为Y，对代码执行根据系统时间P生成的测试构建命令的执行结果为Z，因为执行结果X、执行结果Y和执行结果Z不同，执行结果不一致，则根据系统时间调整代码构建命令；也可以为，若环境变量为时间戳Q、随机数M和用户名C，则根据时间戳Q生成一个测试构建命令，根据随机数M生成一个测试构建命令，根据用户名C生成一个测试构建命令，对代码执行根据时间戳Q生成的测试构建命令，对代码执行根据随机数M生成的测试构建命令，对代码执行根据用户名C生成的测试构建命令，对代码执行根据时间戳Q生成的测试构建命令的执行结果为X，对代码执行根据随机数M生成的测试构建命令的执行结果为X，对代码执行根 据用户名C生成的测试构建命令的执行结果为Y，因为执行结果X和执行结果Y不同，执行结果不一致，则根据时间戳、随机数和用户名调整代码构建命令。
在步骤S130，对所述代码执行调整后的代码构建命令。
在一个实施方式中，对代码执行调整后的代码构建命令，例如可以是，若环境变量为时间戳，则将代码构建命令的系统时间调整为固定值，对代码执行将系统时间调整为固定值的代码构建命令；若环境变量为文件列表顺序，则将代码构建命令调整为在得到执行结果后，使用排序工具对执行结果进行排序，对代码执行调整后的代码构建命令。
本公开提供的一种代码构建方法，通过根据代码构建命令中的不同环境变量生成至少两个测试构建命令；对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；对所述代码执行调整后的代码构建命令，能够使得多次代码构建结果一致，自动实现可复现代码构建。
在上述实施方式的基础上，提出了上述实施方式的变型实施方式，在此需要说明的是，为了使描述简要，在变型实施方式中仅描述与上述实施方式的不同之处。
在一个实施方式中，根据所述代码构建命令中的环境变量调整所述代码构建命令，包括：根据所述代码构建命令查询数据库，得到与所述代码构建命令对应的第一调整规则；根据所述第一调整规则调整所述代码构建命令中的各个环境变量。
其中，预先建立关于代码构建命令和调整规则的对应关系的数据库，例如可以是，所述数据库中存储有代码构建命令W和代码构建命令W中的全部环境变量的调整规则；代码构建命令G和代码构建命令G中的全部环境变量的调整规则；代码构建命令K和代码构建命令K中的全部环境变量的调整规则。
其中，所述第一调整规则可以包括代码构建命令中的全部环境变量的调整规则，例如可以是，若代码构建命令中包括环境变量D和环境变量E，则第一调整规则包括环境变量D的调整规则和环境 变量E的调整规则。
在一个实施方式中，根据代码构建命令查询数据库，得到与所述代码构建命令对应的第一调整规则；根据所述第一调整规则调整所述代码构建命令中的各个环境变量，例如可以是，根据代码构建命令W查询数据库，得到代码构建命令W中的全部环境变量的调整规则，若代码构建命令W中的全部环境变量为环境变量D和环境变量E，则得到环境变量D的调整规则和环境变量E的调整规则，根据环境变量D的调整规则调整代码构建命令W中的环境变量D和根据环境变量E的调整规则调整代码构建命令W中的环境变量E。
在一个实施方式中，根据所述第一调整规则调整所述代码构建命令中的各个环境变量，包括：若所述代码构建命令中包括时间戳，则将所述代码构建命令对应的系统时间设置为固定时间；若所述代码构建命令中包括随机数，则构建目标文件系统，将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息；若所述代码构建命令中包括文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
其中，所述代码构建命令中可以包括时间戳(环境变量)、随机数(环境变量)和文件列表顺序(环境变量)中的至少一种环境变量。
在一个实施方式中，若所述代码构建命令中包括时间戳，则将所述代码构建命令对应的系统时间设置为固定时间；若所述代码构建命令中包括随机数，则构建目标文件系统，将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息；若所述代码构建命令中包括文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序，例如可以是，若代码构建命令中只包括时间戳，则只需将所述代码构建命令对应的系统时间设置为固定时间；若代码构建命令中包括时间戳和随机数，则需要将所述代码构建命令对应的系统时间设置为固定时间，并且构建目标文件系统，将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息；若代码构建命令中包括 时间戳、随机数和文件列表顺序，则需要将所述代码构建命令对应的系统时间设置为固定时间，构建目标文件系统，将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息，并且将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
在一个实施方式中，根据所述代码构建命令中的环境变量调整所述代码构建命令，包括：根据所述至少两个测试构建命令对应的环境变量查询数据库，得到与所述环境变量对应的第二调整规则；根据所述第二调整规则调整所述环境变量。
其中，预先建立关于环境变量和调整规则的对应关系的数据库，例如可以是，所述数据库包括环境变量D和环境变量D的调整规则，环境变量R和环境变量R的调整规则，环境变量H和环境变量H的调整规则。
其中，所述第二调整规则可以包括测试构建命令对应的环境变量的调整规则。
在一个实施方式中，预先根据测试构建命令确定出导致执行结果不一致的环境变量，所述环境变量可以为一种也可以为多种，例如可以是，根据测试构建命令确定出导致执行结果不一致的环境变量为环境变量D，则查询数据库，得到环境变量D的调整规则，根据环境变量D的调整规则调整环境变量D。
需要说明的是，代码构建命令中可能包括多个环境变量，导致执行结果不一致的环境变量可以为一个也可以为多个，例如可以是，代码构建命令中包括环境变量Q、环境变量D和环境变量R，导致执行结果不一致的环境变量为环境变量Q；也可以为，代码构建命令中包括环境变量Q和环境变量D，导致执行结果不一致的环境变量为环境变量Q和环境变量D；若导致执行结果不一致的环境变量为环境变量Q和环境变量D，则根据环境变量Q查询数据库得到环境变量Q的调整规则，根据环境变量D查询数据库得到环境变量D的调整规则。
在一个具体的例子中，若代码构建命令中包括环境变量Q、环 境变量D和环境变量R，则根据代码构建命令中环境变量Q1生成测试构建命令N1，根据代码构建命令中环境变量Q2生成测试构建命令N2，根据代码构建命令中环境变量D1生成测试构建命令V1，根据代码构建命令中环境变量D2生成测试构建命令V2，根据代码构建命令中环境变量R1生成测试构建命令U1，根据代码构建命令中环境变量R2生成测试构建命令U2，若测试构建命令N1的执行结果和测试构建命令N2的执行结果一致，测试构建命令V1和测试构建命令V2的执行结果不一致，测试构建命令U1和测试构建命令U2的执行结果一致，则根据环境变量D查询数据库，得到环境变量D的调整规则，根据环境变量D的调整规则调整环境变量D。
在一个实施方式中，根据所述第二调整规则调整所述环境变量，包括：若所述代码构建命令中的环境变量为时间戳，则将所述代码构建命令对应的系统时间设置为固定时间。
其中，所述固定时间可以为系统设定，也可以为人为设定，本公开对此不进行限制。
在一个实施方式中，若所述代码构建命令中的环境变量为时间戳，则将所述代码构建命令对应的系统时间设置为固定时间，例如可以是，探测到工程中因为时间戳引起的不可复现构建原因：比如tar工具生成压缩包(tar命令生成压缩包文件时，会根据系统当前时间在文件头中生成时间戳。则同样的tar命令执行两次生成的压缩包文件，会因为文件头中的时间戳不同而二进制不一致)；根据查询数据库找到对应的调整规则，如tar生成压缩包文件的命令，监控模块构建新的tar命令，将执行tar命令的系统时间设置为一个固定时间，则多次执行相同tar命令生成的压缩包文件能够保持二进制一致。
在一个实施方式中，根据所述第二调整规则调整所述环境变量，包括：若所述代码构建命令中的环境变量为随机数，则构建目标文件系统；将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息。
在一个实施方式中，若所述代码构建命令中的环境变量为随机数，则构建目标文件系统；将所述代码构建命令对应的文件系统替换 为目标文件系统，以使待归档文件具备固定的节点信息，例如可以是，探测到工程中因为随机数引起的不可复现构建原因：比如生成cpio文件时，被打包到cpio中的文件的inode为随机数；根据查询数据库找到对应的调整规则，如生成cpio中被打包文件的inode随机问题(构建独立的文件系统，如ext4等，将被打包文件按顺序拷贝到这个独立的的文件系统中，使得被打包的文件拥有固定的inode值，然后在这个独立的文件系统中生成cpio文件，这样多次构建时生成的cpio文件保持二进制一致)。
在一个实施方式中，根据所述第二调整规则调整所述环境变量，包括：若所述代码构建命令中的环境变量为文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
在一个实施方式中，若所述代码构建命令中的环境变量为文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序，例如可以是，探测到工程中因为文件列表顺序引起的不可复现构建：比如find查找命令，查找到的多个结果的顺序不固定；通过查找数据库找到对应的调整方法，例如find命令，对找到的多个结果使用sort等排序工具进行排序，则多次执行find命令的查找的结果一致。
在一个实施方式中，根据代码构建命令中的不同环境变量生成至少两个测试构建命令包括：跟踪代码构建过程，并监控代码构建过程中的代码构建命令；当获取到代码构建命令时，暂停代码构建命令的执行；根据所述代码构建命令中的不同环境变量生成至少两个测试构建命令。
在一个具体的例子中，跟踪工程构建整个过程；监控工程构建过程中的代码构建命令；暂停当前代码构建命令的执行；构建两条的测试构建命令，两条测试构建命令设置不同的环境变量(比如用户名、系统时间等可能造成不可复现构建的因素)；依次执行新构建的两条测试构建命令；对比两个测试构建命令的输出，如果输出不一致，则将当前代码构建命令确定为不可复现构建的代码构建命令。
在另一个具体的例子中，监控(不限于ptrace)工程的构建过程； 探测到工程中的不可复现构建的环境变量；根据数据库找到环境变量对应的调整规则；根据调整规则对环境变量进行调整得到新的代码构建命令；用新的代码构建命令替换原代码构建命令；执行新的代码构建命令。
本公开预先为造成不可复现构建的环境变量准备调整规则，将调整规则存储至数据库；在获取新的调整规则后，将新的调整规则，添加到数据库中，对数据库进行实时更新。
本公开可复用已有的分析不可复现构建的成果，在不修改工程源码的情况下，在工程构建过程中，自动定位、修复造成不可复现构建的环境变量，保证多次构建的二进制一致，从而方便的完成代码二进制等效审计。
在另一个具体的例子中，监控工程的构建过程；探测到工程中因为时间戳引起的不可复现构建原因：比如tar工具生成压缩包(tar命令生成压缩包文件时，会根据系统当前时间在文件头中生成时间戳。则同样的tar命令执行两次生成的压缩包文件，会因为文件头中的时间戳不同而二进制不一致)；根据时间戳查询数据库找到与时间戳对应的调整规则，如tar生成压缩包文件的命令，监控模块构建新的tar命令，将执行tar命令的系统时间设置为一个固定时间，则多次执行相同tar命令生成的压缩包文件能够保持二进制一致；根据调整规则对时间戳进行调整后得到调整后的代码构建命令，对代码执行调整后的代码构建命令。
在另一个具体的例子中，监控工程的构建过程；探测到工程中因为随机数引起的不可复现构建原因：比如生成cpio文件时，被打包到cpio中的文件的inode为随机数；根据随机数查询数据库找到与随机数对应的调整规则，如生成cpio中被打包文件的inode随机问题(构建独立的文件系统，如ext4等，将被打包文件按顺序拷贝到这个独立的的文件系统中，使得被打包的文件拥有固定的inode值，然后在这个独立的文件系统中生成cpio文件，这样多次构建时生成的cpio文件保持二进制一致)；根据调整规则调整代码构建命令，对代码执行调整后的代码构建命令。
在另一个具体的例子中，监控工程的构建过程；探测到工程中因为文件列表顺序引起的不可复现构建：比如find查找命令，查找到的多个结果的顺序不固定；根据文件列表破顺序查找数据库找到与文件列表顺序对应的调整规则，(如find命令，对找到的多个结果使用sort等排序工具进行排序，则多次执行find命令的查找的结果一致)；根据调整规则调整代码构建命令；对代码执行调整后的代码构建命令。
在另一个具体的例子中，启动工程构建；监控工程构建；监控工程构建过程中的代码构建命令；暂停当前代码构建命令的执行；构建两条的测试构建命令(设置不同的环境变量，使两次命令使用不同的系统时间、用户名等可能造成不可复现构建的因素)；执行第一条测试构建命令；执行第二条测试构建命令；对比两条测试构建命令的执行结果，如果二进制不一致，则定位到一个不可复现构建的原因；恢复暂停命令的执行；探测构建过程，若构建未完成，跳转执行监控工程构建过程中的代码构建命令步骤；否则结束流程。
在另一个具体的例子中，建立存储有会造成多次构建二进制不一致的环境变量和环境变量的调整规则的数据库；启动工程构建；监控工程构建；探测到造成不可复现的环境变量；根据数据库，获取探测到的不可复现的环境变量的调整规则；根据调整规则调整环境变量，得到调整后的代码构建命令。执行调整后的代码构建命令，探测构建过程，若构建未完成，则跳转执行监控工程构建过程中的代码构建命令步骤；否则结束流程。
本公开提供了一种代码构建装置，图2为本公开提供的一种代码构建装置的结构示意图，该装置配置于计算机设备，参见图2，该装置包括：生成模块21，配置为根据代码构建命令中的不同环境变量生成至少两个测试构建命令；调整模块22，配置为对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；执行模块23，配置为对所述代码执行调整后的代码构建命令。
本公开提供的代码构建装置用于实现本公开的代码构建方法， 本公开提供的代码构建装置实现原理和技术效果与本公开的代码构建方法类似，此处不再赘述。
在上述实施方式的基础上，提出了上述实施方式的变型实施方式，在此需要说明的是，为了使描述简要，在变型实施方式中仅描述与上述实施方式的不同之处。
在一个实施方式中，所述调整模块22可配置为：根据所述代码构建命令查询数据库，得到与所述代码构建命令对应的第一调整规则；根据所述第一调整规则调整所述代码构建命令中的各个环境变量。
在一个实施方式中，所述调整模块22可配置为：根据所述代码构建命令中的环境变量查询数据库，得到与所述环境变量对应的第二调整规则；根据所述第二调整规则调整所述环境变量。
在一个实施方式中，所述调整模块22可配置为：若所述代码构建命令中的环境变量为时间戳，则将所述代码构建命令对应的系统时间设置为固定时间。
在一个实施方式中，所述调整模块22可配置为：若所述代码构建命令中的环境变量为随机数，则构建目标文件系统；将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息。
在一个实施方式中，所述调整模块22可配置为：若所述代码构建命令中的环境变量为文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
在一个实施方式中，所述调整模块22可配置为：跟踪代码构建过程，并监控代码构建过程中的代码构建命令；当获取到代码构建命令时，暂停代码构建命令的执行；根据所述代码构建命令中的不同环境变量生成至少两个测试构建命令。
本公开提供的一种代码构建装置，包括：生成模块，配置为根据代码构建命令中的不同环境变量生成至少两个测试构建命令；调整模块，配置为对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；执行模块，配置为对所述代码执行调整后的代码构建命令，能 复用已有的分析不可复现构建的成果，不需要用户手工修改工程源码，在工程构建过程中自动发现、并且修复或规避造成不可复现构建的因素，实现多次构建结果的二进制一致，从而提升代码有效性审计的效率。
本公开提供了一种设备，图3为本公开提供的一种设备的结构示意图，如图3所示，本公开提供的设备，包括一个或多个处理器51和存储装置52；该设备中的处理器51可以是一个或多个，图3中以一个处理器51为例；存储装置52用于存储一个或多个程序；所述一个或多个程序被所述一个或多个处理器51执行，使得所述一个或多个处理器51实现本文所述任一方法。
所述设备还包括：通信装置53、输入装置54和输出装置55。
所述设备中的处理器51、存储装置52、通信装置53、输入装置54和输出装置55可以通过总线或其他方式连接，图3中以通过总线连接为例。
输入装置54可配置为接收输入的数字或字符信息，以及产生与设备的用户设置以及功能控制有关的按键信号输入。输出装置55可包括显示屏等显示设备。
通信装置53可以包括接收器和发送器。通信装置53设置为根据处理器51的控制进行信息收发通信。信息包括但不限于上行授权信息。
存储装置52作为一种计算机可读存储介质，可设置为存储软件程序、计算机可执行程序以及模块，如本公开图1所述代码构建方法对应的程序指令/模块(例如，代码构建装置中的生成模块21、调整模块22和执行模块23)。存储装置52可包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据设备的使用所创建的数据等。此外，存储装置52可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储装置52可进一步包括相对于处理器51 远程设置的存储器，这些远程存储器可以通过网络连接至设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
本公开还提供一种存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现本公开所述的任一代码构建方法。
本公开的计算机存储介质，可以采用一个或多个计算机可读的介质的任意组合。计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质。计算机可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机存取存储器(Random Access Memory，RAM)、只读存储器(Read Only Memory，ROM)、可擦式可编程只读存储器(Erasable Programmable Read Only Memory，EPROM)、闪存、光纤、便携式CD-ROM、光存储器件、磁存储器件、或者上述的任意合适的组合。计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
计算机可读的信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了计算机可读的程序代码。这种传播的数据信号可以采用多种形式，包括但不限于：电磁信号、光信号或上述的任意合适的组合。计算机可读的信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
计算机可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：无线、电线、光缆、无线电频率(Radio Frequency，RF)等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言或其组合来编写用于执行本公 开操作的计算机程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、Smalltalk、C++，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络——包括局域网(LAN)或广域网(WAN)——连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。
以上所述，仅为本公开的示例性实施方式而已，并非用于限定本公开的保护范围。
本领域内的技术人员应明白，术语用户设备涵盖任何适合类型的无线用户设备，例如移动电话、便携数据处理装置、便携网络浏览器或车载移动台。
一般来说，本公开的多种实施方式可以在硬件或专用电路、软件、逻辑或其任何组合中实现。例如，一些方面可以被实现在硬件中，而其它方面可以被实现在可以被控制器、微处理器或其它计算装置执行的固件或软件中，尽管本公开不限于此。
本公开的实施方式可以通过移动装置的数据处理器执行计算机程序指令来实现，例如在处理器实体中，或者通过硬件，或者通过软件和硬件的组合。计算机程序指令可以是汇编指令、指令集架构(Instruction Set Architecture，ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码。
本公开附图中的任何逻辑流程的框图可以表示程序步骤，或者可以表示相互连接的逻辑电路、模块和功能，或者可以表示程序步骤与逻辑电路、模块和功能的组合。计算机程序可以存储在存储器上。存储器可以具有任何适合于本地技术环境的类型并且可以使用任何适合的数据存储技术实现，例如但不限于只读存储器(Read-Only  Memory，ROM)、随机访问存储器(Random Access Memory，RAM)、光存储器装置和系统(数码多功能光碟(Digital Video Disc，DVD)或光盘(Compact Disk，CD))等。计算机可读介质可以包括非瞬时性存储介质。数据处理器可以是任何适合于本地技术环境的类型，例如但不限于通用计算机、专用计算机、微处理器、数字信号处理器(Digital Signal Processing，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑器件(Field-Programmable Gate Array，FGPA)以及基于多核处理器架构的处理器。
通过示范性和非限制性的示例，上文已提供了对本公开的示范实施方式的详细描述。但结合附图和权利要求来考虑，对以上实施方式的多种修改和调整对本领域技术人员来说是显而易见的，但不偏离本公开的范围。因此，本公开的恰当范围将根据权利要求确定。

Claims (11)

  1. 一种代码构建方法，包括：
    根据代码构建命令中的不同环境变量生成至少两个测试构建命令；
    对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；
    对所述代码执行调整后的代码构建命令。
  2. 根据权利要求1所述的方法，其中，根据所述代码构建命令中的环境变量调整所述代码构建命令，包括：
    根据所述代码构建命令查询数据库，得到与所述代码构建命令对应的第一调整规则；
    根据所述第一调整规则调整所述代码构建命令中的各个环境变量。
  3. 根据权利要求2所述的方法，其中，根据所述第一调整规则调整所述代码构建命令中的各个环境变量，包括：
    若所述代码构建命令中包括时间戳，则将所述代码构建命令对应的系统时间设置为固定时间；
    若所述代码构建命令中包括随机数，则构建目标文件系统，将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息；
    若所述代码构建命令中包括文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
  4. 根据权利要求1所述的方法，其中，根据所述代码构建命令中的环境变量调整所述代码构建命令，包括：
    根据所述至少两个测试构建命令对应的环境变量查询数据库，得到与所述环境变量对应的第二调整规则；
    根据所述第二调整规则调整所述环境变量。
  5. 根据权利要求4所述的方法，其中，根据所述第二调整规则调整所述环境变量，包括：
    若所述代码构建命令中的环境变量为时间戳，则将所述代码构建命令对应的系统时间设置为固定时间。
  6. 根据权利要求4所述的方法，其中，根据所述第二调整规则调整所述环境变量，包括：
    若所述代码构建命令中的环境变量为随机数，则构建目标文件系统；
    将所述代码构建命令对应的文件系统替换为目标文件系统，以使待归档文件具备固定的节点信息。
  7. 根据权利要求4所述的方法，其中，根据所述第二调整规则调整所述环境变量，包括：
    若所述代码构建命令中的环境变量为文件列表顺序，则将所述代码构建命令对应的至少一个执行结果使用排序工具进行排序。
  8. 根据权利要求1所述的方法，其中，根据代码构建命令中的不同环境变量生成至少两个测试构建命令包括：
    跟踪代码构建过程，并监控代码构建过程中的代码构建命令；
    当获取到代码构建命令时，暂停代码构建命令的执行；
    根据所述代码构建命令中的不同环境变量生成至少两个测试构建命令。
  9. 一种代码构建装置，包括：
    生成模块，配置为根据代码构建命令中的不同环境变量生成至少两个测试构建命令；
    调整模块，配置为对代码分别执行所述至少两个测试构建命令，若执行结果不一致，则根据所述代码构建命令中的环境变量调整所述代码构建命令；
    执行模块，配置为对所述代码执行调整后的代码构建命令。
  10. 一种设备，包括：
    一个或多个处理器；
    存储装置，配置为存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行时，使得所述一个或多个处理器实现如权利要求1-8任一所述的方法。
  11. 一种存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-8任一项所述的方法。
PCT/CN2021/099361 2020-06-15 2021-06-10 代码构建方法、装置、设备和存储介质 WO2021254243A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022554637A JP7433464B2 (ja) 2020-06-15 2021-06-10 コード構築方法、装置、デバイスおよび記憶媒体
EP21826277.2A EP4167076A4 (en) 2020-06-15 2021-06-10 CODE CONSTRUCTION METHOD AND APPARATUS, DEVICE AND STORAGE MEDIUM
US18/010,014 US20230251952A1 (en) 2020-06-15 2021-06-10 Code construction method and device, apparatus, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010543411.0A CN112799649B (zh) 2020-06-15 2020-06-15 代码构建方法、装置、设备和存储介质
CN202010543411.0 2020-06-15

Publications (1)

Publication Number Publication Date
WO2021254243A1 true WO2021254243A1 (zh) 2021-12-23

Family

ID=75806489

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/099361 WO2021254243A1 (zh) 2020-06-15 2021-06-10 代码构建方法、装置、设备和存储介质

Country Status (5)

Country Link
US (1) US20230251952A1 (zh)
EP (1) EP4167076A4 (zh)
JP (1) JP7433464B2 (zh)
CN (1) CN112799649B (zh)
WO (1) WO2021254243A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112799649B (zh) * 2020-06-15 2023-09-12 中兴通讯股份有限公司 代码构建方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470620A (zh) * 2007-12-29 2009-07-01 珠海金山软件股份有限公司 Pe文件源代码一致性的判定方法及装置
US20100293533A1 (en) * 2009-05-15 2010-11-18 Henrique Andrade Incrementally constructing executable code for component-based applications
CN108052344A (zh) * 2017-12-11 2018-05-18 北京奇虎科技有限公司 一种内核差异检测方法及装置
CN110941424A (zh) * 2019-11-28 2020-03-31 Oppo广东移动通信有限公司 编译参数优化方法、装置及电子设备
CN112799649A (zh) * 2020-06-15 2021-05-14 中兴通讯股份有限公司 代码构建方法、装置、设备和存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7404110B1 (en) * 2004-12-01 2008-07-22 Advanced Micro Devices, Inc. Method and system for self-assembling instruction opcodes for a custom random functional test of a microprocessor
JP5052472B2 (ja) 2008-09-30 2012-10-17 株式会社野村総合研究所 プログラムの設定情報切替システム及び切替方法
US8819652B2 (en) * 2010-07-30 2014-08-26 General Electric Company System and method for parametric system evaluation
WO2012057170A1 (ja) * 2010-10-27 2012-05-03 株式会社日立製作所 ソースコード変換方法およびソースコード変換プログラム
CN104375875B (zh) * 2013-08-15 2017-08-25 国际商业机器公司 用于应用程序的编译优化的方法以及编译器
JP6561212B2 (ja) 2016-09-01 2019-08-14 株式会社日立製作所 問合せ対応システム及び方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101470620A (zh) * 2007-12-29 2009-07-01 珠海金山软件股份有限公司 Pe文件源代码一致性的判定方法及装置
US20100293533A1 (en) * 2009-05-15 2010-11-18 Henrique Andrade Incrementally constructing executable code for component-based applications
CN108052344A (zh) * 2017-12-11 2018-05-18 北京奇虎科技有限公司 一种内核差异检测方法及装置
CN110941424A (zh) * 2019-11-28 2020-03-31 Oppo广东移动通信有限公司 编译参数优化方法、装置及电子设备
CN112799649A (zh) * 2020-06-15 2021-05-14 中兴通讯股份有限公司 代码构建方法、装置、设备和存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4167076A4 *

Also Published As

Publication number Publication date
CN112799649A (zh) 2021-05-14
US20230251952A1 (en) 2023-08-10
CN112799649B (zh) 2023-09-12
EP4167076A4 (en) 2023-11-22
EP4167076A1 (en) 2023-04-19
JP2023517614A (ja) 2023-04-26
JP7433464B2 (ja) 2024-02-19

Similar Documents

Publication Publication Date Title
CN107908541B (zh) 接口测试方法、装置、计算机设备及存储介质
Li et al. ATOM: Automatic maintenance of GUI test scripts for evolving mobile applications
US9547579B1 (en) Method and apparatus for automatically detecting defects
US20080126867A1 (en) Method and system for selective regression testing
US20090199096A1 (en) Automated gui test recording/playback
CN105022691A (zh) 一种基于uml图的高度自动化软件测试方法
US7913233B2 (en) Performance analyzer
US10824549B1 (en) System and method for regression testing of an application programming interface
US9928055B1 (en) Validating development software by comparing results from processing historic data sets
CN108459951B (zh) 测试方法和装置
CN111026645A (zh) 用户界面自动化测试方法、装置、存储介质及电子设备
CN111444052B (zh) 一种产测方法及其系统和装置
US20140298107A1 (en) Dynamic Near Real-Time Diagnostic Data Capture
WO2021254243A1 (zh) 代码构建方法、装置、设备和存储介质
CN105468511A (zh) 网页脚本错误定位方法及装置
CN110830500B (zh) 网络攻击追踪方法、装置、电子设备及可读存储介质
CN115104336A (zh) 跟踪和公开用于生成分析的数据
CN113591079B (zh) 获取异常应用安装包的方法、装置及电子设备
CN111625448B (zh) 协议包生成方法、装置、设备及存储介质
WO2017167015A1 (zh) 服务器设备安全管理方法、装置及计算机存储介质
CN111309986A (zh) 大数据采集与共享系统
CN113886221B (zh) 测试脚本生成方法、装置、存储介质及电子设备
CN113849817B (zh) 一种JavaScript原型链污染漏洞的检测方法及装置
CN109710487A (zh) 一种监控方法和装置
CN115407981A (zh) 一种基于中间件适配的前端数据mock方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21826277

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022554637

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021826277

Country of ref document: EP

Effective date: 20230111

NENP Non-entry into the national phase

Ref country code: DE