Dynamic and non-invasive application process function call monitoring method in virtual machine manager

Abstract

The invention provides a dynamic and non-intrusive application process function calling monitoring method in a virtual machine manager. The method includes a function calling trigger insertion algorithm and construction of a trigger code. When monitoring is needed, a function calling trigger code is inserted from the starting position of an entry address of a function of a monitored application according to a position selected by the function calling trigger insertion algorithm; when the monitoring of the function of the application is not needed, the function code can be restored; and dynamism and non-intrusive property are realized. The method is advantageous in that a 7-byte or 9-byte position can be searched at an entry of any monitored function, and one of a 7-byte function calling trigger code and a 9-byte function calling trigger code is selected for insertion at the position according to the condition of the original code of the position.

Description

technical field [0001] The invention relates to a dynamic and non-invasive application process function call monitoring method in a virtual machine manager, which can monitor any function call in any user process. The monitoring behavior can be set dynamically. Only when the manager needs it, a function call trigger is inserted in the called function of the monitored application. After the function call trigger is inserted, once the function to be monitored is called, the function The call trigger triggers an exception and traps the hypervisor; while the function in the application does not need to be monitored, the code of this function remains as it is. Therefore, the monitoring method is dynamic and non-invasive, and belongs to the field of computer application technology. Background technique [0002] Some of the existing monitoring methods use to modify the registered function pointer table, so that when the function is called, it can jump to the monitoring function fo...

AI Technical Summary

Problems solved by technology

[0002] Some of the existing monitoring methods use to modify the registered function pointer table, so that when the function is called, it can jump to the monitoring function for monitoring. In this way, functions that are not registered cannot be monitored; some monitoring methods use Insert monitoring code at the function call. This method is difficult to implement dynamic configuration. It is not non-invasive to modify and compile the application program.