Method for analyzing dynamic execution of Linux kernel

Abstract

The invention discloses a method for tracking and analyzing functions and statements involved in the dynamic executing process of a kernel of an Linux operating system. According to the invention, the method comprises the following steps of: expanding open source programs strace, KFT, tags and gcov, so that these programs are enabled to track each executable file on the original basis; meanwhile, filtering system call information and other information of a corresponding tracked executable file in the executing process; storing these information into a new established database; and finally displaying relevant information on a webpage and then linking and displaying a call tree, wherein linking each kernel function in the call tree to a file for defining the kernel function; and the display content comprises coverage of the functions in the file and executing frequency of each statement.

Description

technical field [0001] The invention relates to a method for analyzing system security in the operation of a computer operating system. To be exact, the present invention is a tracking and analysis method for the functions and statements involved in the dynamic execution process of the kernel of the Linux operating system in compliance with the POSIX standard. Background technique [0002] As a representative of open source software, Linux is more and more widely used, but there is still a big lack of security analysis and security level verification of Linux. Compared with a series of unfavorable factors such as the cost of the Windows operating system due to business, the possible existence of "backdoors" due to undisclosed code, and more and more viruses, the Linux operating system has the advantages of free, open code, etc., which gradually become popular. More companies and individuals accept it. Along with wider applications, Linux may have more applications in secur...

AI Technical Summary

Problems solved by technology

[0003] The existing open source software strace can trace the system calls used by executable files, but it can only trace certain executable files, and the trace results of multiple executable files cannot be well distinguished. In addition, there are also There is a lot of additional information besides system calls; the existing open source software KFT can track the kernel information between the set entry function and exit function, and the kd function of KFT converts the result into the form of call tree, but KFT every This time can only be traced according to the setting of this time, and the generated multiple call trees cannot be compared by themselves; after compiling the kernel, a tags file will be generated in the kernel directory, which contains the name of the kernel function, defines and declares the kernel function The kernel file, and some other information; the existing open source program gcov can track the coverage of the execution of the kernel file

Images