Debugging method and debugging equipment

Abstract

The embodiment of the invention discloses a debugging method. The method comprises the following steps: modifying fault handling functional addresses corresponding to page property faults in an interrupt descriptor table (IDT) of a system processor into customized fault handling functional addresses; in case of a designated page property fault in a target program, acquiring field information; saving the field information in a virtual execution buffer area corresponding to the current thread; saving the field information in the buffer area in a stack-pushing manner; judging whether an extended instruction pointer (EIP) of the target program is matched with a preset break-point address of a faulty page; if yes, interacting with a user; if no, copying and constructing the instruction to which the EIP of the target program is directed into the virtual execution buffer area corresponding to the current thread; and popping up the field information from the stack, executing the instruction in the buffer area, and repeatedly judging whether the address is matched with the preset break-point address. The embodiment of the invention further provides corresponding debugging equipment. The method and the equipment provided by the embodiment of the invention have the advantage of higher imperceptibility.

Description

technical field [0001] The invention relates to the technical field of computers, in particular to a debugging method and debugging equipment. Background technique [0002] Debugging technology is widely used in code analysis, reverse engineering, and malicious code analysis. Debugging the software includes the following aspects: one is to set a breakpoint on the execution path of the target program and make it stop during execution; the other is to be able to single-step trace the target program; the third is to be able to provide Rich information about program runtime. [0003] During the research and practice of the prior art, the inventors of the present invention found that the currently more commonly used debugging method is to implement the breakpoint mechanism by modifying the target program code, which is easy to be discovered by the anti-debugging technology and restore the target program, so the existing debugging method is poor in concealment. Contents of the...

AI Technical Summary

Problems solved by technology

[0003] During the research and practice of the prior art, the inventors of the present invention found that the currently more commonly used debugging method is to implement the breakpoint mechanism by modifying the target program code, which is easy to be found by the anti-debugging technology and restore the target program, so the existing debugging methods are less concealed

Images