Tracking Method, Comparison Method, Device and Computing Device for Program Running Trajectory

Abstract

The present invention discloses a method and a comparison method for tracking the program running trajectory, a device and a computing device, which relate to the field of computers. The method for tracking the program running trajectory of the present invention includes: obtaining all conditional jump instructions in the code segment to be tracked in the program. Then, for each conditional jump instruction, modifying the conditional jump instruction into a software interrupt instruction to call a hook function, where the hook function includes obtaining the exception address where the exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to a conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into a software interrupt instruction again. Finally, running the program, and based on the obtained exception addresses and the values of the flag registers by the hook function, obtaining the addresses where each conditional jump instruction is located and the values of the flag registers when each conditional jump instruction is executed. The method for tracking the program running trajectory of the present invention can not only ensure the validity of data, but also improve the tracking efficiency.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method for tracking a program running trajectory, a comparison method, a device and a computing device. Background Art

[0002] During the development of computer program code, sometimes due to exceptions or parameter errors, the program may enter an incorrect branch, resulting in a running crash or data error. At this time, if the developer has all the source code of the program running, the problem can be located by reading the source code combined with debugging. However, if the developer does not have the complete project source code, for example, calls a link library that implements a certain function from a closed-source system, or calls a file (mainly a driver file) that belongs to a specific category implemented by a specific development group or manufacturer, then the error that occurs can only be traced in a reverse manner, and once the amount of code in the project is large, tracing the source of the error will become a very troublesome and time-consuming problem.

[0003] Therefore, the present invention provides a method for tracking a program running trajectory to solve the above technical problems. Summary of the Invention

[0004] Therefore, the present invention provides a method for tracking a program running trajectory, a comparison method, a device and a computing device, in an attempt to solve or at least alleviate the problems existing above.

[0005] According to one aspect of the present invention, there is provided a method for tracking a program running trajectory, including: obtaining all conditional jump instructions in a code segment to be tracked in the program; for each conditional jump instruction, modifying the conditional jump instruction into a software interrupt instruction to call a hook function, where the hook function includes obtaining the exception address where an exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to a conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into a software interrupt instruction again; running the program, and based on the obtained exception addresses and the values of the flag registers by the hook function, obtaining the addresses where each conditional jump instruction is located and the values of the flag registers when each conditional jump instruction is executed.

[0006] Optionally, in the method for tracking a program running trajectory according to the present invention, obtaining all conditional jump instructions in a code segment to be tracked in the program includes: using a disassembly engine to obtain all conditional jump instructions in the code segment to be tracked.

[0007] Optionally, in the method for tracing the program running track according to the present invention, obtaining the addresses where each conditional jump instruction is located and the values of the flag register when each jump instruction is executed includes: normalizing the exception addresses obtained based on the hook function at each software interrupt instruction, and determining the address after normalization as the address where the conditional jump instruction corresponding to the software interrupt instruction is located; determining the value of the flag register obtained based on the hook function at each software interrupt instruction as the value of the flag register when the conditional jump instruction corresponding to the software interrupt instruction is executed.

[0008] Optionally, in the method for tracing the program running track according to the present invention, the code segment to be traced is the code segment of a linked library linked in the program.

[0009] Optionally, in the method for tracing the program running track according to the present invention, normalizing the exception addresses obtained based on the hook function at each software interrupt instruction includes: subtracting the base address of the linked library from the exception addresses obtained based on the hook function at each software interrupt instruction, and using the obtained difference as the address after normalization.

[0010] Optionally, in the method for tracing the program running track according to the present invention, obtaining the exception address where an exception occurs includes: obtaining the eip value when the exception occurs, and using the eip value as the exception address.

[0011] According to another aspect of the present invention, there is provided a method for comparing program running tracks, including: using the above method for tracing the program running track to obtain the first addresses where each conditional jump instruction in the code segment to be traced in the program is located and the first values of the flag register when each conditional jump instruction is executed when the program runs on the first operating system; using the above method for tracing the program running track to obtain the second addresses where each conditional jump instruction in the code segment to be traced in the program is located and the second values of the flag register when each conditional jump instruction is executed when the program runs on the second operating system; based on each first address and each second address, comparing the first values of the flag register and the second values of the flag register when each conditional jump instruction is executed; when the first address is the same as the second address, and the first value of the flag register corresponding to the first address is different from the second value of the flag register corresponding to the second address, determining that the position of the first address is the position where the program running track has a difference.

[0012] According to another aspect of the present invention, there is provided a tracking device for a program running trace, comprising: a first acquisition module adapted to acquire all conditional jump instructions in a code segment to be traced in the program; an instruction modification module adapted to, for each conditional jump instruction, modify the conditional jump instruction into a software interrupt instruction to call a hook function, the hook function including acquiring an exception address where an exception occurs and a value of a flag register when the exception occurs, restoring the software interrupt instruction to a conditional jump instruction and executing the next instruction, and again modifying the conditional jump instruction into a software interrupt instruction; a program running module adapted to run the program and, based on the exception addresses and the values of the flag registers obtained by the hook function, acquire the addresses where the conditional jump instructions are located and the values of the flag registers when the conditional jump instructions are executed.

[0013] According to another aspect of the present invention, there is provided a comparison device for a program running trace, comprising: a second acquisition module adapted to, by using the above-mentioned tracking method for a program running trace, acquire the first addresses where the conditional jump instructions in a code segment to be traced in the program are located and the values of the first flag registers when the conditional jump instructions are executed when the program runs on a first operating system, and further adapted to, by using the above-mentioned tracking method for a program running trace, acquire the second addresses where the conditional jump instructions in a code segment to be traced in the program are located and the values of the second flag registers when the conditional jump instructions are executed when the program runs on a second operating system; a comparison module adapted to, based on the first addresses and the second addresses, compare the values of the first flag registers and the values of the second flag registers when the conditional jump instructions are executed; a determination module adapted to, when the first address is the same as the second address and the value of the first flag register corresponding to the first address is different from the value of the second flag register corresponding to the second address, determine that the position of the first address is the position where the program running trace has a difference.

[0014] According to another aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing any one of the above methods.

[0015] According to another aspect of the present invention, there is provided a readable storage medium storing program instructions, which, when read and executed by a computing device, cause the computing device to execute any one of the above methods.

[0016] According to the method for tracing the program running trajectory of the present invention, only the running trajectory of the conditional jump instructions in the code segment to be traced in the program is traced. Instructions such as calculations, comparisons, and data transfer instructions in the program are all executed sequentially in order and will not generate unexpected path branches. Instructions such as unconditional jump instructions, function call instructions, and function return instructions have fixed target addresses and will not generate unexpected path branches either. Therefore, the method of tracing the program running trajectory by recording the running trajectory of conditional jump instructions in the present invention can not only ensure the validity of data but also improve the tracing efficiency.

[0017] Moreover, the present invention performs normalization processing when obtaining the addresses where each conditional jump instruction is located. In this way, the addresses where the conditional jump instructions with the same offset in the code segment to be traced are located on different operating systems can be the same. In this way, only by comparing the flag register values corresponding to the same address, the positions where the running trajectories of the code segment to be traced are different when running on different operating systems can be quickly located, which is convenient and fast. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalent aspects are intended to fall within the scope of the claimed subject matter. The above and other objects, features, and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the drawings. Throughout the present disclosure, the same reference numerals generally refer to the same components or elements.

[0019] Figure 1 FIG. shows a schematic diagram of executing each instruction when running a program according to an embodiment of the present invention;

[0020] Figure 2 FIG. shows a block diagram of the structure of a computing device 200 according to an embodiment of the present invention;

[0021] Figure 3 FIG. shows a flowchart of a method 300 for tracing the program running trajectory according to an embodiment of the present invention;

[0022] Figure 4 FIG. shows a schematic diagram of the composition structure of a conditional jump instruction according to an embodiment of the present invention;

[0023] Figure 5 FIG. shows a schematic diagram of modifying a conditional jump instruction in the code segment to be traced into a software interrupt instruction according to an embodiment of the present invention;

[0024] Figure 6 FIG. shows a schematic diagram of the logic executed after calling a hook function when executing a software interrupt instruction according to an embodiment of the present invention;

[0025] Figure 7 Shows a schematic diagram of a linked library loaded by a program according to an embodiment of the present invention;

[0026] Figure 8 Shows a schematic diagram of a section of running code intercepted from the linked library ad220ui.dll according to an embodiment of the present invention;

[0027] Figure 9 Shows a schematic diagram of a section of running code intercepted from a linked library according to another embodiment of the present invention;

[0028] Figure 10 Shows a flowchart of a method 1000 for comparing program running trajectories according to an embodiment of the present invention;

[0029] Figure 11 Shows a structural diagram of a tracking device 1100 for program running trajectories according to an embodiment of the present invention;

[0030] Figure 12 Shows a structural diagram of a comparison device 1200 for program running trajectories according to an embodiment of the present invention. Detailed implementation manners

[0031] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0032] Currently, the main computer software ecosystem is concentrated in the Windows operating system. When you want to use these Windows software on other operating systems, you can achieve it through the wine migration technology. Wine simulates the relevant behaviors by simulating the Windows API. However, in wine, most of the Windows source programs and the linked libraries they call as inputs do not have source code available for reference. Therefore, in order to ensure the correctness of program operation to the greatest extent, it is generally required that its running trajectory under the current operating system be consistent with that under Windows. If the running trajectories are inconsistent, it is usually because the implementation of a certain API in wine is different from that in Windows. In this case, it is necessary to find the branch point where the program has differences, and reverse means can be used to search for it.

[0033] Take the example that the same application can run normally on Windows but cannot run through the Wine compatibility layer on Linux. Specifically, the assembly debugging tool can be used to start reverse troubleshooting from the last obvious differences such as crashes or no window output, set breakpoints to observe whether the program passes through this position, and finally obtain the position where the first difference appears. Obviously, this debugging method takes a lot of time and is inefficient when the code volume is large. Based on this, the present invention provides a method for tracking the program running trajectory.

[0034] Among them, when the computer runs a program, it will execute each instruction in sequence. Therefore, after executing an ordinary instruction of the calculation type, the computer will surely execute the next instruction of this instruction. That is to say, when the computer executes instructions such as calculation, comparison, and data transmission in any environment, no unexpected path branches will be generated (such as Figure 1 the left figure in), so executing instructions in sequence will not cause the program to have inconsistent running paths on different operating systems. For unconditional jump instructions jmp, function call instructions call, and function return instructions ret, etc., since their target addresses are fixed, they will not cause path differences either. For conditional jump instructions, when the jump condition (i.e., the condition code) is satisfied, it jumps to the specified position, and when the jump condition is not satisfied, it executes the next instruction in sequence (such as Figure 1 the right figure in), obviously, when executing the same jump statement on different operating systems, it may enter different branches due to different condition codes, thus resulting in inconsistent running paths of the program. Therefore, conditional jump instructions are the root cause instructions for the inconsistent running paths of the program on different operating systems.

[0035] Based on this, the method for tracking the program running trajectory provided by the present invention only tracks the running paths of conditional jump instructions in the program. Among them, as pointed out above, the paths of conditional jump instructions in a program generally have two branches. When the jump condition is satisfied, it jumps to the target offset address, and when the jump condition is not satisfied, it executes the next instruction after the conditional jump instruction. And whether the condition is satisfied is usually judged based on the value of the flag register (that is, the eflags value. Eflags is a flag register in the x86 architecture, which is used to record the result flags of operations such as comparison and summation, and is usually used as the judgment basis for conditional jumps). For example, for the je and jz instructions, they judge whether to jump according to the ZF flag bit in the eflags register. That is to say, a conditional jump instruction determines the address of the next instruction to be executed according to the current eflags value. In other words, the running path of a conditional jump instruction is determined by the current eflags value. Therefore, the present invention adopts the method of recording the addresses of each conditional jump instruction in the program and the eflags value when each conditional jump instruction is executed to track the running paths of conditional jump instructions in the program. The method for tracking the program running trajectory of the present invention can not only ensure the validity of data, but also improve the tracking efficiency.

[0036] Figure 2 FIG. shows a block diagram of the physical components (i.e., hardware) of a computing device 200. In a basic configuration, the computing device 200 includes at least one processing unit 202 and a system memory 204. According to one aspect, depending on the configuration and type of the computing device, the processing unit 202 may be implemented as a processor. The system memory 204 includes, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. According to one aspect, the system memory 204 includes an operating system 205 and program modules 206. The program modules 206 include a tracking device 1100 for program running trajectories and a comparison device 1200 for program running trajectories. The tracking device 1100 for program running trajectories is configured to execute the method 300 for tracking the program running trajectory of the present invention, and the comparison device 1200 for program running trajectories is configured to execute the method 1000 for comparing the program running trajectories of the present invention.

[0037] According to one aspect, the operating system 205 is suitable for controlling the operation of the computing device 200, for example. In addition, the examples are practiced in conjunction with a graphics library, other operating systems, or any other application programs, and are not limited to any specific application or system. In Figure 2The basic configuration is shown by those components within dashed line 208. According to one aspect, computing device 200 has additional features or functionality. For example, according to one aspect, computing device 200 includes additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or magnetic tapes. Such additional storage is Figure 2 shown by removable storage device 209 and non-removable storage device 210 in

[0038] As stated above, according to one aspect, program modules are stored in system memory 204. According to one aspect, the program modules may include one or more application programs, and the present invention does not limit the type of application programs. For example, the application programs may include: email and contact applications, word processing applications, spreadsheet applications, database applications, slide show applications, painting or computer-aided applications, web browser applications, etc.

[0039] According to one aspect, the examples may be practiced in a circuit including discrete electronic components, a packaged or integrated electronic chip containing logic gates, a circuit utilizing a microprocessor, or on a single chip containing electronic components or a microprocessor. For example, the examples may be practiced via a system-on-a-chip (SOC) in which each or many of the components shown in Figure 2 are integrated on a single integrated circuit. According to one aspect, such an SOC device may include one or more processing units, graphics units, communication units, system virtualization units, and various application functions, all of which are integrated (or "burned") onto a chip substrate as a single integrated circuit. When operating via an SOC, the functions described herein may be operated via dedicated logic integrated with other components of computing device 200 on a single integrated circuit (chip). Embodiments of the present invention may also be practiced using other technologies capable of performing logical operations (such as AND, OR, and NOT), including but not limited to mechanical, optical, fluidic, and quantum technologies. Additionally, embodiments of the present invention may be practiced within a general-purpose computer or in any other circuit or system.

[0040] According to one aspect, computing device 200 may also have one or more input devices 212, such as a keyboard, mouse, pen, voice input device, touch input device, etc. It may also include output devices 214, such as a display, speaker, printer, etc. The foregoing devices are examples and other devices may also be used. Computing device 200 may include one or more communication connections 216 that allow communication with other computing devices 218. Examples of suitable communication connections 216 include but are not limited to: RF transmitter, receiver, and / or transceiver circuits; universal serial bus (USB), parallel, and / or serial ports.

[0041] As used herein, the term computer-readable medium includes computer storage media. Computer storage media can include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (e.g., computer-readable instructions, data structures, or program modules). System memory 204, removable storage 209, and non-removable storage 210 are all examples of computer storage media (i.e., memory storage). Computer storage media can include random access memory (RAM), read only memory (ROM), electrically erasable read only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other article of manufacture that can be used to store information and that can be accessed by a computing device 200. According to one aspect, any such computer storage media can be part of a computing device 200. Computer storage media does not include carrier waves or other propagated data signals.

[0042] According to one aspect, a communication medium is implemented with computer-readable instructions, data structures, program modules, or other data in a modulated data signal (e.g., a carrier wave or other transmission mechanism) and includes any information delivery medium. According to one aspect, the term "modulated data signal" describes a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal. By way of example and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0043] Figure 3 A flowchart of a tracing method 300 of a program execution trace according to an embodiment of the present invention is shown. The method 300 is adapted to be executed in a computing device (e.g., Figure 2 the computing device 200 shown). As Figure 3 shown, the method 300 begins at 310.

[0044] In 310, all conditional jump instructions in the code segment to be traced in the program are obtained. Here, it should be noted first that the program in this embodiment refers to an executable program. Therefore, the code segment to be traced refers to a code segment composed of binary machine code. Specifically, in some embodiments, the code segment to be traced can be the code segment of a linked library linked in the program. For example, when a developer suspects that there is a problem with a certain dynamic link library linked in the program, the code segment of this dynamic link library can be used as the code segment to be traced. Of course, if the developer also has doubts about another dynamic library linked in the program, this dynamic link library can also be used as a code segment to be traced. That is to say, the code segment to be traced is the code segment that the user is interested in. In specific embodiments, it can be set by the user according to actual needs. By first screening the executable file to lock some potentially problematic dynamic link libraries or address ranges and then using them as the code segments to be traced, the tracing range can be narrowed and the amount of data to be processed can be reduced.

[0045] According to an embodiment of the present invention, an anti-disassembly engine can be used to obtain all conditional jump instructions in the code segment to be traced. Specifically, scan the address range of the code segment to be traced (the address range of any code segment in the program is fixed), and find the positions of all conditional jump instructions therein through the anti-disassembly engine.

[0046] Here, a description of the conditional jump instruction is given. The conditional jump instruction consists of two parts, namely, a conditional jump instruction code (7X) indicating the judgment type and an offset address (addr), such as Figure 4 . Among them, in the 32-bit x86 architecture, the conditional jump instruction codes include 0x70 - 0x7f. That is to say, in the 32-bit x86 architecture, the conditional jump instruction is an instruction with 0x70 - 0x7f as the instruction code. Therefore, in the 32-bit x86 architecture, obtaining the conditional jump instructions in the code segment to be traced is to obtain the instructions with 0x70 - 0x7f as the instruction code in the code segment to be traced through the anti-disassembly engine.

[0047] Taking the example of obtaining the conditional jump instructions in a code segment to be traced in the 32-bit x86 architecture as an example. Among them, the code segment to be traced is the code segment of a dynamic link library linked in the program, and after this dynamic link library is loaded into the program, the address range of its code segment is 0x1000 - 0x2000. Then, first scan the address range of 0x1000 - 0x2000, and then find each instruction with 0x70 - 0x7f as the instruction code through the anti-disassembly engine. The instructions found are the conditional jump instructions in this dynamic link library.

[0048] Subsequently, at 320, for each conditional jump instruction, the conditional jump instruction is modified into a software interrupt instruction to call the hook function. The software interrupt instruction can be 0xCC (i.e., the int 3 instruction), that is, each conditional jump instruction in the code segment to be traced is modified into 0xCC. For example, Figure 5 The left figure shows several instructions in a code segment to be traced. jz ox1050 is a conditional jump instruction, and then jz ox1050 is modified into int 3.

[0049] Obviously, after the conditional jump instruction is modified into the software interrupt instruction int 3, when the program executes to the position where the conditional jump instruction is located, the actually executed instruction is the int 3 instruction, and then it will be captured by the code in the debugger part. According to an embodiment of the present invention, after being captured by the code in the debugger part, a preset hook function is called. That is, when the program executes to the int 3 instruction, the hook function is called.

[0050] The hook function can include obtaining the exception address where the exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to the conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into the software interrupt instruction again. That is to say, after the hook function is called, the exception address where the exception occurs and the value of the flag register when the exception occurs are obtained. Then, the software interrupt instruction is restored to the conditional jump instruction it replaces, and the next instruction is executed downward. Finally, the jump instruction is modified into the software interrupt instruction.

[0051] Among them, eip is a register used to record the current program position. That is to say, the instruction to be currently executed is stored at the eip address. Therefore, according to an embodiment of the present invention, the exception address where the exception occurs can be obtained by obtaining the eip value when the exception occurs. Specifically, the eip value when the exception occurs is obtained, and the obtained eip value is used as the exception address. Here, it should be noted that when the program runs to 0xCC, an exception of Exception_breakpoint(0x80000003) will be triggered. Therefore, the eip value when the exception occurs can be obtained from the parameters passed by the exception. In addition, when an exception is generated by executing 0xCC (i.e., the INT3 instruction), the value of the instruction pointer (eip) will be decreased by one. When eip points to the next byte of 0xCC when 0xCC is just executed, so after decreasing by one, eip points to 0xCC again. That is to say, the eip value when the exception occurs is the address where 0xCC is located. Therefore, the eip value when the exception occurs is the exception address, that is, the eip value is the exception address.

[0052] In addition, as pointed out above, the hook function includes modifying the soft interrupt instruction to the conditional jump instruction it replaces. Therefore, when replacing each conditional jump instruction with a soft interrupt instruction, the replaced conditional jump instructions should also be stored. According to an embodiment of the present invention, when modifying each conditional jump instruction to a soft interrupt instruction, the conditional jump instruction at the modification location can be saved in the global data.

[0053] To better understand the hook function, the following uses the example given above Figure 5 (i.e., modifying jz ox1050 to int 3) to illustrate the logic executed after calling the hook function when the int 3 instruction is executed. Specifically, first, obtain the exception address where the exception occurs and the value of the flag register when the exception occurs, that is, obtain the eip value and eflags value when the exception occurs. Then, restore the original instruction. Specifically, obtain the conditional jump instruction corresponding to this soft interrupt instruction from the global data, and modify the soft interrupt instruction here to the obtained conditional jump instruction, that is, modify int 3 (as shown in 610 in Figure 6 ) to jz ox1050 (as shown in 620 in Figure 6 ). Subsequently, execute one instruction step by step downward, such as 620 and 630 in Figure 6 . Finally, modify the previous conditional jump instruction back to the soft interrupt instruction, that is, modify jz ox1050 (as shown in 630 in Figure 6 ) back to int 3 (as shown in 640 in Figure 6 ).

[0054] Regarding the step of finally modifying the conditional jump instruction back to the soft interrupt instruction when executing the hook function, an explanation is given here. Executing this step is to ensure that when the program runs to this location again, the hook function can still be called by executing the int 3 instruction.

[0055] So far, each conditional jump instruction in the code segment to be traced has been modified to a soft interrupt instruction. Then, enter 330, run the program, and based on the exception addresses and the values of the flag registers obtained by the hook function, obtain the addresses of each conditional jump instruction and the values of the flag registers when each conditional jump instruction is executed.

[0056] Since each conditional jump instruction in the code segment to be traced has been replaced with a soft interrupt instruction, when the program runs, an exception will be triggered each time a soft interrupt instruction is executed, and the hook function will be called to obtain the exception address where the exception occurs and the value of the flag register when the exception occurs. In this way, after the program executes a complete process, the exception addresses where exceptions occur in the code segment to be traced and the values of the flag registers when each exception occurs can be obtained through the hook function.

[0057] Among them, each exception is triggered by executing a software interrupt instruction. In the present invention, each conditional jump instruction in the code segment to be traced is modified into a software interrupt instruction. Therefore, the address of the exception triggered when each software interrupt instruction is executed is the address where the conditional jump instruction replaced by the software interrupt instruction is located, and the value of the flag register when each software interrupt instruction is executed is the value of the flag register when the conditional jump instruction replaced by the software interrupt instruction is executed. Therefore, according to an embodiment of the present invention, the exception address obtained based on the hook function at each software interrupt instruction can be determined as the address where the conditional jump instruction corresponding to the software interrupt instruction is located, and the value of the flag register obtained based on the hook function at each software interrupt instruction can be determined as the value of the flag register when the conditional jump instruction corresponding to the software interrupt instruction is executed.

[0058] In addition, when loading the same code segment (such as the code segment of a dynamic link library) on different operating systems (such as the Windows system and the Linux system), the base address is not necessarily the same. When the base address of the same code segment is different on different operating systems, the addresses where the same instruction in this code segment is located on different operating systems will certainly not be the same. Obviously, in this way, it will be more troublesome to analyze whether the running paths of the same instruction in the same code segment are consistent on different operating systems. Therefore, in order to more conveniently analyze whether the running paths of the same instruction in the same code segment are consistent on different operating systems, normalization processing can be performed when obtaining the addresses where each instruction is located, so that the addresses where the instructions with the same offset in the same code segment are located on different operating systems are the same.

[0059] Therefore, according to another embodiment of the present invention, when obtaining the addresses where each conditional jump instruction is located, the exception addresses obtained based on the hook function at each software interrupt instruction are normalized, and the normalized addresses are determined as the addresses where the conditional jump instructions corresponding to the software interrupt instructions are located. Among them, the normalization process can be to subtract a preset value from the exception address obtained based on the hook function at each software interrupt instruction. In some embodiments, the preset value can be the base address of the code segment to be traced. In this way, normalizing the exception address obtained based on the hook function at each software interrupt instruction is to subtract the base address of the code segment to be traced from the exception address obtained based on the hook function at each software interrupt instruction, and use the obtained difference as the normalized address. Obviously, when the code segment to be traced is a linked library, this step is to subtract the base address of the linked library from the exception address obtained based on the hook function at each software interrupt instruction, and use the obtained difference (i.e., the normalized address) as the address where the conditional jump instruction corresponding to the software interrupt instruction is located. Here, it should be noted that the normalization process of this embodiment can be understood as normalizing the base address of the code segment to be traced to a predetermined value. For example, when the preset value is the base address of the code segment to be traced as described above, it is to normalize the base address of the code segment to be traced to 0.

[0060] Regarding the base address, an example is given here. Such as Figure 7 , which are several linked libraries loaded by a program. Based on Figure 7 , it can be known that the code segment of the linked library ad220ui.dll is based on the section from 900000 to 975000. Therefore, the base address of the linked library ad220ui.dll is 900000.

[0061] In addition, to better understand this step, the following takes the above-mentioned linked library ad220ui.dll as the code segment to be traced, and intercepts a section of running code as an example, such as Figure 8It can be seen that the intercepted code segment above includes the conditional jump instruction jz. Therefore, when tracing the running track of ad220ui.dll based on the above method, the conditional jump instruction jz will be modified to int3. In this way, when running to this point, the hook function will be called to obtain the exception address where the exception occurs. Obviously, when the conditional jump instruction jz is modified to int3, the instruction stored at address 944838 is int3. Therefore, the obtained exception address is 944838. After obtaining the exception address 944838, normalization processing is performed on it - subtracting 944838 from 900000 (it has been pointed out above that the base address of the link library ad220ui.dll is 900000), and the obtained difference 44838 is used as the address where the conditional jump instruction jz is located. Since normalization processing is performed when obtaining the address where the conditional jump instruction is located in this embodiment, even if the base address of the link library ad220ui.dll in other operating systems is not 900000, the finally obtained address where the conditional jump instruction jz is located will still be 44838 (assuming the base address of the link library ad220ui.dll in other operating systems is 800000, then the obtained exception address is 844838. Obviously, after normalization processing - subtracting 800000 from 844838, the obtained difference is still 44838).

[0062] Thus, the addresses where each conditional jump instruction in the code segment to be traced is located and the values of the flag register when each conditional jump instruction is executed are obtained. Among them, in some embodiments, the addresses where each conditional jump instruction in the code segment to be traced is located and the values of the flag register when each conditional jump instruction is executed can be displayed in the form of a list. The following gives an example. As Figure 9 , on the left is a piece of code in a link library that the user is interested in, and on the right is the disassembly corresponding to this code segment, where the base address of this link library has been normalized to 0. From Figure 9 it can be seen that there are two conditional jump instructions in this code segment, which are 91144A and 911466 respectively. Then, after tracing this code segment based on the above method, the output information is as follows:

[0063] eip value: 91144A eflags value: xxxxx

[0064] eip value: 911466 eflags value: xxxxx

[0065] Among them, the eip value is the address where the conditional jump instruction is located, and the eflags value is the value of the flag register when the conditional jump instruction is executed.

[0066] By obtaining the eip value and eflags value of the program when the conditional jump occurs through the above hook method of 0xCC, a large amount of invalid data can be avoided, the running track of the program can be obtained with the least amount of data, and the difficulty of locating problems is reduced.

[0067] Based on the program running track tracking method of the above embodiment, the present invention also proposes a program running track comparison method. As Figure 10 , which shows a flowchart of a program running track comparison method 1000 according to an embodiment of the present invention. The method 1000 is suitable for execution in a computing device (such as Figure 2 the computing device shown), and the method 1000 starts at 1010.

[0068] In 1010, using the program running track tracking method provided in the above embodiment, obtain the first address where each conditional jump instruction in the code segment to be tracked in the program is located and the value of the first flag register when each conditional jump instruction is executed when the program runs in the first operating system. Then, in 1020, using the program running track tracking method provided in the above embodiment, obtain the second address where each conditional jump instruction in the code segment to be tracked in the program is located and the value of the second flag register when each conditional jump instruction is executed when the program runs in the second operating system.

[0069] Among them, the first operating system can be a Linux operating system, and the second operating system can be a Windows operating system. Of course, this is only an example here. The present invention does not limit what specific operating systems the first operating system and the second operating system are. In addition, for the specific details of obtaining the addresses where each conditional jump instruction in the code segment to be tracked is located and the values of the flag registers when each conditional jump instruction is executed on the first operating system and the second operating system, reference can be made to the description of the above embodiment, and details will not be repeated here.

[0070] Subsequently, enter 1030. Based on the obtained first addresses and second addresses, compare the values of the first flag register and the second flag register when each conditional jump instruction is executed. As pointed out in the above embodiments, when obtaining the addresses where each conditional jump instruction is located, the difference between the exception address obtained based on the hook function at each software interrupt instruction and the base address of the code segment to be traced is calculated, and then the obtained difference is used as the address where the conditional jump instruction corresponding to the software interrupt instruction is located. Therefore, for the same conditional jump instruction, the address where it is located obtained on the first operating system is the same as the address where it is located obtained on the second operating system. In this way, when comparing the values of the first flag register and the second flag register when each conditional jump instruction is executed, equal first addresses and second addresses (these two addresses store the same conditional jump instruction) can be obtained first, and then for each pair of equal first addresses and second addresses, compare the value of the first flag register when the conditional jump instruction stored at the first address is executed (i.e., the value of the flag register when this conditional jump instruction is executed on the first operating system) with the value of the second flag register when the conditional jump instruction stored at the second address is executed (i.e., the value of the flag register when this conditional jump instruction is executed on the second operating system).

[0071] Among them, when the first address is the same as the second address, and the value of the first flag register corresponding to the first address is different from the value of the second flag register corresponding to the second address, enter 1040 to determine that the position of the first address is the position where the program execution trajectory has a difference. Specifically, for the same first address and second address, if the value of the first flag register when the conditional jump instruction stored at the first address is executed (i.e., the value of the first flag register corresponding to the first address) is different from the value of the second flag register when the conditional jump instruction stored at the second address is executed (i.e., the value of the second flag register corresponding to the second address), it indicates that the execution trajectory of this conditional jump instruction (i.e., the conditional jump instructions stored at the first address and the second address, where the first address and the second address store the same conditional jump instruction) is different on the first operating system and the second operating system, then determine the position of the first address (or the second address) as the position where the program execution trajectory has a difference. If the value of the first flag register is the same as the value of the second flag register, it is determined that the execution trajectory of this conditional jump instruction is the same on the first operating system and the second operating system.

[0072] To better understand this step, continue with the following example Figure 9Taking the code segment shown as an example, a comparison is made of its running traces on the Windows operating system and the Linux operating system (assuming that this code segment runs on the Linux operating system through the wine migration technology). Among them, when the code segment runs on the Windows operating system, the first address where jnz is located is 91144A, the value of the first flag register when jnz is executed is a1, the first address where jz is located is 911466, and the value of the first flag register when jz is executed is a2; when the code segment runs on the Linux operating system, the second address where jnz is located is 91144A, the value of the second flag register when jnz is executed is b1, the second address where jz is located is 911466, and the value of the second flag register when jz is executed is b2.

[0073] It can be seen that the first address 91144A is the same as the second address 91144A, and the first address 911466 is the same as the second address 911466. Then, a1 is compared with b1, and a2 is compared with b2. If a1 is the same as b1 and a2 is the same as b2, it indicates that the running traces of the two conditional jump instructions jnz and jz on the Windows operating system and the Linux operating system are the same, that is, the running traces of this code segment on the Windows operating system and the Linux operating system are the same. If a1 is different from b1 (that is, the zf value in a1 is different from the zf value in b1), it indicates that there are differences in the running traces of the conditional jump instruction jnz on the Windows operating system and the Linux operating system, and then the code on it is analyzed. Through analysis, it can be known that the value of zf comes from the return value of the function GetJobW, so it is determined that the implementation of this function in wine in Linux must be different from that on Windows, and then the function GetJobW is analyzed. If a2 is different from b2, it indicates that there are differences in the running traces of the conditional jump instruction jz on the Windows operating system and the Linux operating system, and then the code on it is analyzed. The specific analysis process is similar to the analysis process when a1 and b1 are different, and will not be elaborated here.

[0074] The present invention also provides a device for tracking the running trace of a program. Figure 11 The structural block diagram of a device 1100 for tracking the running trace of a program according to an embodiment of the present invention is shown. As Figure 11 shown, the device for tracking the running trace of a program includes a first acquisition module 1110, an instruction modification module 1120, and a program running module 1130.

[0075] The first acquisition module 1110 is adapted to acquire all conditional jump instructions in the code segment to be traced in the program.

[0076] An instruction modification module 1120, which is adapted to modify each conditional jump instruction into a software interrupt instruction to call a hook function for each conditional jump instruction. The hook function includes obtaining the exception address where an exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to a conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into a software interrupt instruction again.

[0077] A program running module 1130, which is adapted to run a program and obtain the address where each conditional jump instruction is located and the value of the flag register when each conditional jump instruction is executed based on each exception address and each value of the flag register obtained by the hook function.

[0078] The tracking device 1100 for the program running track according to the present invention, the specific details of which have been disclosed in detail in the description based on Figures 1 to 9 and will not be elaborated herein.

[0079] The present invention also provides a comparison device for the program running track. Figure 12 FIG. shows a structural block diagram of a comparison device 1200 for the program running track according to an embodiment of the present invention. As Figure 12 shown, the comparison device for the program running track includes a second acquisition module 1210, a comparison module 1220, and a determination module 1230.

[0080] The second acquisition module 1210 is adapted to use the program running track tracking method provided in the above embodiment to obtain the first address where each conditional jump instruction in the code segment to be tracked in the program is located and the value of the first flag register when each conditional jump instruction is executed when the program runs on the first operating system, and is also adapted to use the program running track tracking method provided in the above embodiment to obtain the second address where each conditional jump instruction in the code segment to be tracked in the program is located and the value of the second flag register when each conditional jump instruction is executed when the program runs on the second operating system.

[0081] The comparison module 1220 is adapted to compare the value of the first flag register and the value of the second flag register when each conditional jump instruction is executed based on each first address and each second address.

[0082] The determination module 1230 is adapted to determine that the position of the first address is the position where the program running track has a difference when the first address is the same as the second address and the value of the first flag register corresponding to the first address is different from the value of the second flag register corresponding to the second address.

[0083] The comparison device 1200 for the program running track according to the present invention, the specific details of which have been disclosed in detail in the description based on Figures 1 to 10 and will not be elaborated herein.

[0084] According to the method for tracking the program running track of the present invention, only the running track of the conditional jump instructions in the code segment to be tracked in the program is tracked, avoiding wasting a large amount of time in the process of using assembly debugging tools for single-stepping and tracing. Instructions such as calculation, comparison, and data transfer in the program are executed sequentially in order and will not generate unexpected path branches. Instructions such as unconditional jump instructions, function call instructions, and function return instructions have fixed target addresses and will not generate unexpected path branches either. Therefore, the method of tracking the program running track by recording the running track of conditional jump instructions in the present invention can not only ensure the validity of data but also improve the tracking efficiency.

[0085] Moreover, the present invention performs normalization processing when obtaining the addresses where each conditional jump instruction is located. In this way, the addresses where conditional jump instructions with the same offset in the code segment to be tracked are the same on different operating systems. Thus, by simply comparing the flag register values corresponding to the same address, it is possible to quickly locate the positions where the running tracks are different when the code segment to be tracked runs on different operating systems, which is convenient and fast.

[0086] In addition, in the location of occasional problems, the present invention will have greater advantages. By simply running the program multiple times, the difference points of its running tracks on different operating systems can be obtained, which is more efficient than the traditional single-step follow-up or adding log methods.

[0087] The various technologies described here can be implemented in combination with hardware or software, or a combination of them. Thus, the method and device of the present invention, or certain aspects or parts of the method and device of the present invention, can take the form of program code (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, USB flash drive, floppy disk, CD-ROM, or any other machine-readable storage medium. When the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0088] In the case where the program code is executed on a programmable computer, the computing device generally includes a processor, a processor-readable storage medium (including volatile and non-volatile memories and / or storage elements), at least one input device, and at least one output device. Among them, the memory is configured to store the program code; the processor is configured to execute the method for tracking the program running track or the method for comparing the program running tracks of the present invention according to the instructions in the program code stored in the memory.

[0089] By way of example, and not limitation, a readable medium includes a readable storage medium and a communication medium. A readable storage medium stores information such as computer readable instructions, data structures, program modules or other data. A communication medium generally embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and includes any information delivery medium. Combinations of any of the above are also included within the scope of the readable medium.

[0090] In the specification provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used with examples of the present invention. The structure required to construct such systems will be apparent from the above description. Additionally, the present invention is not directed to any particular programming language. It should be understood that the content of the present invention described herein can be implemented using various programming languages, and the description of a particular language above is for the purpose of disclosing the best mode of the present invention.

[0091] In the specification provided herein, numerous specific details are set forth. However, it can be understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0092] It should be understood that, to streamline this disclosure and assist in understanding one or more of the various inventive aspects, in the foregoing description of the exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, the disclosed method should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0093] Those skilled in the art should understand that the modules, units, or components of the devices in the examples disclosed herein may be arranged in the devices as described in the embodiments, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or further divided into multiple sub-modules.

[0094] Those skilled in the art can understand that the modules in the devices in the embodiments can be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and in addition, they can be divided into multiple sub-modules or sub-units or sub-components. Except that at least some of such features and / or processes or units are mutually exclusive, any combination can be adopted to combine all the features disclosed in this specification (including the accompanying claims, abstract and drawings) and all the processes or units of any method or device so disclosed. Unless otherwise explicitly stated, each feature disclosed in this specification (including the accompanying claims, abstract and drawings) can be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0095] In addition, those skilled in the art can understand that although some of the embodiments described herein include certain features included in other embodiments rather than other features, the combination of features of different embodiments means that it is within the scope of the present invention and forms different embodiments.

[0096] In addition, some of the embodiments herein are described as combinations of methods or method elements that can be implemented by a processor of a computer system or by other devices performing the functions. Therefore, a processor having the necessary instructions for implementing the method or method element forms a device for implementing the method or method element. In addition, the elements described herein in the device embodiments are examples of the following devices: the device is used to implement the functions performed by the elements for the purpose of implementing the present invention.

[0097] As used herein, unless otherwise specified, the use of ordinal numbers "first", "second", "third", etc. to describe ordinary objects only represents different instances of similar objects and does not intend to imply that the objects so described must have a given order in terms of time, space, sorting or in any other way.

[0098] Although the present invention is described in terms of a limited number of embodiments, those skilled in the art in this technical field will understand, based on the above description, that other embodiments can be envisioned within the scope of the present invention thus described. In addition, it should be noted that the language used in this specification is mainly selected for readability and teaching purposes, rather than for the purpose of explaining or limiting the subject matter of the present invention. Therefore, many modifications and changes are obvious to those of ordinary skill in the art without departing from the scope and spirit of the appended claims. For the scope of the present invention, the disclosure of the present invention is illustrative, not restrictive, and the scope of the present invention is defined by the appended claims.

Claims

1. A method for tracing the running track of a program, comprising: Obtaining all conditional jump instructions in the code segment to be traced in the program, where the code segment to be traced is the code segment of a linked library linked in the program; For each conditional jump instruction, modifying the conditional jump instruction into a software interrupt instruction to call a hook function, where the hook function includes obtaining the exception address where an exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to the conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into the software interrupt instruction again; Running the program, and based on the exception addresses and the values of the flag registers obtained by the hook function, obtaining the addresses where each conditional jump instruction is located and the values of the flag registers when each conditional jump instruction is executed, including: performing normalization processing on the exception address obtained by the hook function at each software interrupt instruction, and determining the address where the conditional jump instruction corresponding to the software interrupt instruction is located as the normalized address, and determining the value of the flag register obtained by the hook function at each software interrupt instruction as the value of the flag register when the conditional jump instruction corresponding to the software interrupt instruction is executed; Among them, performing normalization processing on the exception address obtained by the hook function at each software interrupt instruction includes: subtracting the base address of the linked library from the exception address obtained by the hook function at each software interrupt instruction, and using the obtained difference as the normalized address.

2. The method according to claim 1, wherein Obtaining all conditional jump instructions in the code segment to be traced in the program includes: Using a disassembly engine to obtain all conditional jump instructions in the code segment to be traced.

3. The method according to claim 1 or 2, wherein Obtaining the exception address where an exception occurs includes: Obtaining the value of eip when the exception occurs, and using the value of eip as the exception address.

4. A method for comparing the running tracks of a program, comprising: Using the method according to any one of claims 1-3 to obtain the first addresses where each conditional jump instruction in the code segment to be traced in the program is located and the first values of the flag registers when each conditional jump instruction is executed when the program runs on a first operating system; Using the method according to any one of claims 1-3 to obtain the second addresses where each conditional jump instruction in the code segment to be traced in the program is located and the second values of the flag registers when each conditional jump instruction is executed when the program runs on a second operating system; Based on each of the first addresses and each of the second addresses, comparing the first values of the flag registers and the second values of the flag registers when each conditional jump instruction is executed; When the first address is the same as the second address, and the first value of the flag register corresponding to the first address is different from the second value of the flag register corresponding to the second address, determining that the position of the first address is the position where the running track of the program has a difference.

5. A device for tracing the running track of a program, comprising: A first obtaining module, adapted to obtain all conditional jump instructions in the code segment to be traced in the program, where the code segment to be traced is the code segment of a linked library linked in the program; An instruction modification module, adapted to modify each conditional jump instruction into a software interrupt instruction to call a hook function for each conditional jump instruction. The hook function includes obtaining the exception address where an exception occurs and the value of the flag register when the exception occurs, restoring the software interrupt instruction to the conditional jump instruction and executing the next instruction, and modifying the conditional jump instruction into the software interrupt instruction again; A program running module, adapted to run the program, and based on the exception addresses and the values of the flag registers obtained by the hook function, obtain the addresses where each conditional jump instruction is located and the values of the flag registers when each conditional jump instruction is executed, including: performing normalization processing on the exception address obtained by the hook function at each software interrupt instruction, and determining the address where the conditional jump instruction corresponding to the software interrupt instruction is located after the normalization processing, and determining the value of the flag register when the conditional jump instruction corresponding to the software interrupt instruction is executed as the value of the flag register obtained by the hook function at each software interrupt instruction; Wherein, performing normalization processing on the exception address obtained by the hook function at each software interrupt instruction includes: subtracting the base address of the link library from the exception address obtained by the hook function at each software interrupt instruction, and using the obtained difference as the address after the normalization processing.

6. A device for comparing program running traces, comprising: A second acquisition module, adapted to use the method according to any one of claims 1-3 to obtain the first addresses where each conditional jump instruction in the code segment to be traced in the program is located and the values of the first flag registers when each conditional jump instruction is executed when the program runs on a first operating system, and is also adapted to use the method according to any one of claims 1-3 to obtain the second addresses where each conditional jump instruction in the code segment to be traced in the program is located and the values of the second flag registers when each conditional jump instruction is executed when the program runs on a second operating system; A comparison module, adapted to compare the values of the first flag register and the second flag register when each conditional jump instruction is executed based on each of the first addresses and each of the second addresses; A determination module, adapted to determine that the position of the first address is the position where the program running trace has a difference when the first address is the same as the second address and the value of the first flag register corresponding to the first address is different from the value of the second flag register corresponding to the second address.

7. A computing device, comprising: At least one processor; And A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1-4.

8. A readable storage medium storing program instructions, when the program instructions are read and executed by a computing device, causing the computing device to execute the method according to any one of claims 1-4.

Images