A detection method, device and computer-readable storage medium for single-step debugging

Abstract

The embodiment of the present invention discloses a detection method, device and medium for single-step debugging. The self-modifying machine code is pre-stored in the self-modifying area of ​​the memory; in the full-speed debugging mode, the original machine code of the application program is executed first, and The data at the specified address will be cached in the preset cache; in the single-step debugging mode, first call the self-modifying machine code to replace the original machine code with the modified machine code, and the data at the specified address will not be cached at this time into the cache memory. Obtain the clock cycle consumed by loading the data at the specified address; if the clock cycle is greater than the preset threshold, it means that the data corresponding to the specified address has not been cached in the cache, and the detection result of the single-step debugging of the application program can be output at this time . According to the difference between full-speed debugging and single-step debugging on the data corresponding to the specified address, it can be accurately identified whether the application program has been executed single-step debugging.

Description

technical field [0001] The invention relates to the technical field of debugging and detection, in particular to a single-step debugging detection method, device and computer-readable storage medium. Background technique [0002] Single-step debugging refers to a debugging method that is usually used in order to find program defects (bugs) in program development. It tracks the process of program execution step by step, and finds the cause of errors according to the values ​​of variables. [0003] However, in the current scenario of protecting personal / company software, there is a problem of being maliciously cracked through single-step debugging. If this problem is not resolved, personal / company paid software may be used for free, or even malicious codes may be inserted. Risk of socially spreading malware. [0004] Conventional anti-debugging methods implement debugging detection based on the official Windows application programming interface (Application Programming Interf...

AI Technical Summary

Problems solved by technology

[0003] However, in the current scenario of protecting personal / company software, there is a problem of being maliciously cracked through single-step debugging. If this problem is not resolved, personal / company paid software may be used for free, or even malicious codes may be inserted. Risk of society-wide spread of malware

[0004] Conventional anti-debugging methods implement debugging detection based on the official Windows application programming interface (Application Programming Interface, API), but this method cannot detect single-step debugging

Images