Process identification and monitoring method, device and equipment based on software and hardware cooperation, and medium

Abstract

The present application relates to the technical field of process monitoring in program dynamic analysis, and provides a software and hardware cooperative process identification and monitoring method, device, equipment and medium, which comprises the following steps: adding extended instructions adaptive to process creation, process covering and process exit in the execution functions of process creation, process covering and process exit; modifying the execution mechanism of the CPU according to the extended instructions, adding an extended register for process identification and monitoring in the CPU, and adding the analysis and execution functions of the extended instructions, so that the CPU analyzes and executes the extended instructions, and stores process record information in the buffer area allocated by the operating system in advance for interaction; when the operating system executes the instruction of storing the process record information of the buffer area into the special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism. The present application improves the transparency of the analysis system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of process monitoring in program dynamic analysis, and particularly relates to a process identification and monitoring method, device, equipment and medium based on software and hardware cooperation. BACKGROUND

[0002] Process identification and monitoring is a basic method in program dynamic analysis, which is implemented by installing an agent tool in the system or building a virtual machine.

[0003] The method for identifying and monitoring processes based on an agent tool has great limitations, because the agent tool usually exists in the form of a process or a driver, and the driver is compatible with the system, and the agent tool usually needs to use the debugging or tracing interface provided by the operating system to implement the process identification and monitoring, which needs to change the integrity of the process and is easily detected and counteracted.

[0004] In the method for identifying and monitoring processes in a virtual CPU in a virtualized analysis environment, due to the diversity of system running states and the complexity of the operating system kernel, it is difficult to determine the timing of the correlation analysis of the kernel data structure through the virtual CPU, and in order to ensure the timeliness of data acquisition, the query needs to be performed at each instruction execution, which seriously affects the system running efficiency. SUMMARY

[0005] In view of the problems in the prior art, the present application provides a process identification and monitoring method, device, equipment and medium based on software and hardware cooperation.

[0006] The present application provides a process identification and monitoring method based on software and hardware cooperation, comprising:

[0007] determining execution functions of process creation, process coverage and process exit in an operating system;

[0008] adding an extended instruction for adapting process creation, process coverage, process exit and monitoring target process calibration in each of the execution functions;

[0009] modifying the execution mechanism of the CPU according to the extended instruction, so that the CPU parses and executes the extended instruction, obtains key data of process record information in the operating system kernel, and stores the key data of the process record information in a buffer area pre-configured in the operating system for process identification and monitoring, and performs buffer area interaction;

[0010] When the operating system executes an instruction for storing process record information in the buffer area into a special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism.

[0011] The application provides a process identification and monitoring method based on software and hardware cooperation, wherein the extension instruction is added in each execution function, including process creation, process covering, process exiting and monitoring target process marking, and the extension instruction includes:

[0012] When the process creation function completes the copying of the existing process data structure content and the control flow jumps to any position before the newly created process, the extension instruction code of process record adding and monitoring target process marking is added;

[0013] When the process covering function completes the filling of the process data structure content and the control flow jumps to any position before the new process, the extension instruction code of process record updating and monitoring target process marking is added;

[0014] The extension instruction code of deleting the process record is added at any position of the process exiting function.

[0015] The application provides a process identification and monitoring method based on software and hardware cooperation, wherein the extension instruction code includes: the value of a special register is pushed to a stack; the address of the process data structure content is stored in the special register; the address content, the value of an existing register and an immediate number are written into the special register; the value of the special register is read out and written into the memory or the existing register; the value of the existing register is popped from the stack.

[0016] The application provides a process identification and monitoring method based on software and hardware cooperation, wherein the execution mechanism of the CPU is modified according to the extension instruction, including:

[0017] The execution code of the buffer of the operating system is constructed;

[0018] The execution code of the extension instruction of the process creation, process covering, process exiting and monitoring target process marking is constructed;

[0019] The execution code of the instruction of transferring the buffer information and the register information is constructed.

[0020] The application provides a process identification and monitoring method based on software and hardware cooperation, wherein the execution code of the extension instruction of the process creation, process covering, process exiting and monitoring target process marking is constructed, including:

[0021] If the extension instruction of the process creation function is executed, the value of the register is taken as the pointer of the current process data structure address, the process record of the data structure in the operating system kernel is read based on the pointer, and the process record is recorded in the buffer area pre-configured for the process identification and monitoring;

[0022] If the extended instruction of process covering function is executed, the value of the register is taken out, the corresponding data structure is found from the process record list of the operating system, the process record is read from the operating system kernel based on the data structure address pointer, and the original entry content of the process record in the cache area preconfigured for process identification and monitoring is updated;

[0023] If the extended instruction of process exit function is executed, the value of the register is taken out, and the corresponding process record is deleted from the cache area preconfigured for process identification and monitoring based on the data structure pointer of the process to be exited.

[0024] If the extended instruction of monitoring target process marking is executed, the value of the register is taken out, and the monitoring mark in the found process record is set to 1 in the process list.

[0025] According to the process identification and monitoring method provided by the application, the CPU executes various types of transfer buffer information and register information instructions, and completes the instruction operation, which includes:

[0026] The function address and parameter type information in the register are read and placed in the process monitoring table of the CPU;

[0027] The data length in the buffer is written into the register;

[0028] The data in the buffer is copied to the address space pointed by the register.

[0029] According to the process identification and monitoring method provided by the application, the method further includes:

[0030] According to the input of the user, the target process information expected to be monitored is obtained;

[0031] According to the target process information, the extended instructions of process creation, process covering, process exit and monitoring target process marking are respectively added to each of the execution functions.

[0032] The application also provides a process identification and monitoring device cooperating with software and hardware, which includes:

[0033] The determining module is used for determining the execution functions of process creation, process covering and process exit in the operating system;

[0034] The first modifying module is used for respectively adding the extended instructions of process creation, process covering, process exit and monitoring target process marking to each of the execution functions;

[0035] The second modification module is configured to modify the execution mechanism of the CPU according to the extended instruction, so that the CPU parses and executes the extended instruction, obtains preset key data of process record information in the operating system kernel, and stores the preset key data of the process record information into a buffer configured for process identification and monitoring in the operating system, and performs buffer interaction.

[0036] The processing module is configured to enable the CPU to complete various operations of transferring buffer information and register information based on the extended execution mechanism when the operating system executes the instruction of storing the process record information in the buffer into the special register of the CPU.

[0037] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the process identification and monitoring method in the above-mentioned any one of the software and hardware cooperation when executing the program.

[0038] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by the processor to implement the process identification and monitoring method in the above-mentioned any one of the software and hardware cooperation.

[0039] The application further provides a computer program product, which includes a computer program, and the computer program is executed by the processor to implement the process identification and monitoring method in the above-mentioned any one of the software and hardware cooperation.

[0040] The application provides a process identification and monitoring method, device, equipment and medium in software and hardware cooperation, which adds an extended instruction for adapting process creation, process covering, process exit and monitoring target process calibration in the kernel respectively, modifies the execution mechanism of the CPU according to the extended instruction, so that the CPU parses and executes the extended instruction, obtains key data of process record information in the operating system kernel, and stores the key data into the buffer of the operating system, and performs buffer interaction, when the operating system executes the instruction of storing the process record information in the buffer into the special register of the CPU, enables the CPU to execute instructions of transferring buffer information and register information, completes the instruction operation, realizes that the CPU compares the record in the buffer and monitors all instructions executed by the process when the process is executed, completes the process identification and monitoring in the software and hardware combination, does not need to use the debugging interface of the operating system, and improves the transparency of the analysis system. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0042] Figure 1 It is the flowchart of the process identification and monitoring method of the software and hardware cooperation provided by the present application.

[0043] Figure 2 It is the implementation block of the operating system provided by the present application.

[0044] Figure 3 It is the implementation block of the CPU hardware provided by the present application.

[0045] Figure 4 It is the interface principle diagram of the operating system and the CPU hardware provided by the present application.

[0046] Figure 5 It is the logic flowchart of the process identification and monitoring process of the software and hardware cooperation provided by the present application.

[0047] Figure 6 It is the structure schematic diagram of the process identification and monitoring device of the software and hardware cooperation provided by the present application.

[0048] Figure 7 It is the structure schematic diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the present application more clear, the following will combine the drawings in the present application to clearly and completely describe the technical solutions in the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the protection scope of the present application.

[0050] Figure 1 It shows the flowchart of the process identification and monitoring method of the software and hardware cooperation provided by the present application, referring to Figure 1 The method comprises the following steps:

[0051] Step 11, determining the execution function of process creation, process covering and process exit in the operating system.

[0052] Step 12, respectively adding the extension instruction of adapting process creation, process covering, process exit and monitoring target process calibration in each execution function.

[0053] Step 13, according to the extension instruction, the execution mechanism of the CPU is modified to make the CPU parse the execution extension instruction, obtain the key data of the process record information in the operating system kernel, and store the key data of the process record information into the buffer area preconfigured in the operating system for process identification and monitoring, and perform buffer area interaction.

[0054] Step 14, when the operating system executes the instruction of storing the process record information of the buffer area into the special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism.

[0055] For steps 11-14, it should be noted that the present application extends the CPU instruction set, cooperates the operating system kernel with the CPU hardware, and realizes the process identification and process monitoring method. The present application is applicable to the case where the kernel source code is available, or the kernel binary code can be modified to add extension instructions.

[0056] In the present application, new instructions are added to the CPU instruction set. For a process, the life cycle of the process can be divided into states such as creation, overlay, exit, etc. Therefore, the present application needs to extend three process state instructions. For the implementation of the creation, overlay, and exit states, the execution functions of process creation, process overlay, and process exit in the operating system are used. At this time, the extension instructions suitable for process creation, process overlay, process exit, and monitoring target process marking are added to the execution functions of process creation, process overlay, and process exit, respectively. When the process is executed by the execution function, the extension instruction is triggered to achieve process state identification and monitoring.

[0057] Furthermore, the extension instructions suitable for process creation, process overlay, process exit, and monitoring target process marking are added to each execution function, including:

[0058] When the process creation function completes the copying of the existing process data structure content, and before the control flow jumps to any position before the newly created process, the extension instruction code for process record addition and monitoring target process marking is added;

[0059] After the process overlay function completes the filling of the process data structure content, and before the control flow jumps to any position before the new process, the extension instruction code for process record update and monitoring target process marking is added;

[0060] At any position of the process exit function, the extension instruction code is added.

[0061] Taking the kernel code of Linux operating system as an example, in order to realize introspection of process execution status, extended instructions need to be added in the positions of process copy (fork() system call), process cover (exec() system call), process exit (exit() system call) function and monitoring target process marking function. The specific adding position and method are as follows:

[0062] The fork() call of operating system includes the following processes: creating a new task_struct (data structure), copying the task_struct part content of the existing process, and jumping the control flow to the newly created process. The present application adds the extended instruction code of process record adding and monitoring target process marking at any position before the control flow jumps to the new process after the fork() function of operating system completes the process task_struct content copying. The monitoring target process marking is to compare the process name in task_sturct according to the process name predefined by the user, if the comparison is consistent, the R6 register is pushed to the stack and the R6 register is set as the address of task_struct; if the comparison is inconsistent, the value of R6 register is pushed to the stack and the value of R6 register is set as 0. The extended instruction code includes six instructions, the first instruction pushes the value of special register R5 to the stack, the second instruction stores the address of task_struct data structure into special register R5, the third instruction is ProcessFork instruction with special register R5 as the operand, the fourth instruction is TargetProcess instruction with R6 register as the operand, the fifth is to pop the value of R5 register from the stack, and the sixth is to pop the value of R6 register from the stack.

[0063] The exec() call of the operating system includes the following procedure: filling the task_struct obtained from the process created by the fork() function according to various information of the new process, and transferring the control flow to the new process for execution. Therefore, the present application adds the extended instruction code of process record updating and target process calibration in the code before the exec() function completes the filling of the task_struct and the control flow is transferred to the new process. The target process determination is based on the process name predefined by the user, and the process name in the task_struct is compared. If the comparison is consistent, the R6 register is pushed to the stack, and the R6 register is set to the address of the task_struct. If the comparison is inconsistent, the value of the R6 register is pushed to the stack, and the value of the R6 register is set to 0. The extended instruction code includes six instructions. The first instruction pushes the value of the special register R5 to the stack, the second instruction stores the address of the task_struct data structure into the special register R5, the third instruction is the ProcessExec instruction with the special register R5 as the operand, the fourth instruction is the TargetProcess instruction with the R6 register as the operand, the fifth instruction is to pop the value of the R5 register from the stack, and the sixth instruction is to pop the value of the R6 register.

[0064] The exit() call of the operating system has no exit mechanism after entering, that is, the current process will necessarily clean up various resources, exit, and destroy various data structures as long as the exit() function is executed. Therefore, four instructions can be added at any position of the exit() function: the first instruction pushes the value of the R5 register to the stack, the second instruction stores the address of the task_struct data structure into the R5 register, the third instruction is the ProcessExit R5, and the fourth instruction pops the value of the R5 register from the stack.

[0065] It should be further noted that the execution instructions for the interaction of the buffer information between the operating system and the CPU hardware also need to be configured in the extended instruction set, so as to enable the CPU to execute various types of buffer information transfer instructions and complete the instruction operation when the operating system executes the instruction of storing the process record information of the buffer into the special register of the CPU. Table 1 below is the instruction definition table.

[0066] Table 1 is the instruction definition table

[0067]

[0068] In the present application, after the extended instruction set of the operating system is built, the CPU hardware needs to be able to parse and execute these instructions accordingly, for which the execution mechanism of the CPU needs to be modified, which can be set by code files and configuration parameters. The main modification of the CPU hardware needs to be in the code execution part, which needs to modify the following parts: first, add the record array of the system process, second, process the ProcessFork, ProcessExec, and ProcessExit instructions, and finally add the interception of the process API and the data acquisition buffer, and the processing method is:

[0069] For example, build the execution code of the buffer of the operating system; build the execution code of the extended instruction adapted to process creation, process overlay, and process exit; build the execution code of the instruction adapted to pass buffer information.

[0070] The execution code of the extended instruction adapted to process creation, process overlay, process exit, and monitoring target process calibration includes:

[0071] If the extended instruction of the process creation function is executed, the value of the register is taken out as the pointer of the current process data structure address, the process record of the data structure in the operating system kernel is read based on the pointer, and recorded in the cache area pre-configured for process identification and monitoring;

[0072] If the extended instruction of the process overlay function is executed, the value of the register is taken out to find the corresponding data structure from the process record list of the operating system, and the process record is read from the operating system kernel based on the data structure address pointer, and the original entry content of the process record in the cache area pre-configured for process identification and monitoring is updated;

[0073] If the extended instruction of the process exit function is executed, the value of the register is taken out, and based on the data structure pointer of the current process to be exited, the corresponding process record is deleted from the cache area pre-configured for process identification and monitoring.

[0074] If the extended instruction of the monitoring target process calibration is executed, the value of the register is taken out, and the corresponding process record is found in the process list, and the monitoring mark in the found process record is set to 1.

[0075] For the instructions that make the CPU execute various types of buffer information and register information, the instruction operation is completed, including:

[0076] Read the function address and parameter type information from the register and put it into the process monitoring buffer of the CPU;

[0077] Put the instruction record information of the process execution into the process monitoring buffer of the CPU;

[0078] Write the data length in the buffer into the register;

[0079] Copy the data in the buffer into the address space pointed by the register.

[0080] The implementation of the above execution code is specifically: if a ProcessFork instruction is encountered, the value of R5 is taken as a pointer to the address of the task_struct of the current process, various information of the task_struct in the virtual memory is read based on the pointer, including the process executable file name, the process executable file loading address, the process loaded dynamic library module and the like, and recorded into the process record in the buffer area preconfigured for process identification and monitoring.

[0081] If a ProcessExec instruction is encountered, the value of R5 is taken, the corresponding task_struct is found in the process record list of the operating system, the process executable file name, the process executable file loading address, the process loaded dynamic library module and the like are read based on the task_struct address pointer again, and the original entry content of the process record in the buffer area preconfigured for process identification and monitoring is updated.

[0082] If a ProcessExit instruction is encountered, the value of the R5 register is taken, and the task_struct pointer of the process to be exited currently is considered, the corresponding process record is found in the buffer area preconfigured for process identification and monitoring, and the record is deleted.

[0083] If a TargetProcess is encountered, the process record in the buffer area is found, and the task_struct address therein is compared, if the same, the process is marked as a monitoring target.

[0084] If a SetBuffer instruction is encountered, the buffer area is stored into the special register of the CPU.

[0085] If a CheckMonitorBuffer is encountered, the data length in the buffer area is written into the R5 register.

[0086] If a ReadMonitorBuffer instruction is encountered, the data in the buffer area is copied into the address space pointed by R5.

[0087] When the target process to be monitored is executed, the CPU extracts all instructions, registers, memory addresses accessed by the instructions and memory address contents of the process execution, and stores them in the process monitoring buffer area.

[0088] In the present application, in view of the process identification and monitoring method of the software and hardware cooperation of the present application, the above method is explained and described below with specific example diagrams.

[0089] Referring to Figure 2 The implementation block diagram of the operating system is shown. It can be seen that according to the process identification and process monitoring, the process information of the monitoring target process of interest can be determined, and then according to the pre-configured target process information, the expansion instructions of process creation, process coverage, process exit and monitoring target process calibration are added in each execution function respectively. These expansion instructions will interact with software and hardware, so that the CPU hardware can realize the process monitoring function according to the instructions. At the same time, in order to store the process state and the instructions executed by the process, a special process record buffer area and a special process monitoring buffer area are configured.

[0090] Referring to Figure 3 The implementation block diagram of the CPU hardware is shown. It can be seen that the interactive data control hardware for the interaction of the cache area information and the expansion instruction set is configured in the CPU hardware. The instructions are executed according to the instruction pipeline (fetch, decode, execute, memory access and write back). The CPU hardware performs process identification and monitoring on the instruction pipeline, obtains process record information, and configures physical memory (pre-configured registers) for storage.

[0091] Referring to Figure 4 It is the interface principle diagram of the operating system and the CPU hardware.

[0092] Referring to Figure 5 It is the logic flow diagram of the process identification and monitoring process of software and hardware cooperation.

[0093] 1. Determine the key system call codes of process creation, process coverage and process exit in the operating system. Go to step 2.

[0094] 2. Look up the manual of the existing CPU, find the existing instructions and expansion instruction coding rules given therein, design the expansion instructions according to the expansion instruction coding rules, and clearly define the contents of the operand records corresponding to the expansion instructions. The operand is usually a register, and the number is 1 or 2. Go to step 3.

[0095] 3. In the case of limited expansion instruction coding given in the existing CPU instruction manual, the defined instruction coding in the manual can be collected and sorted. Without repeating the existing instruction set, new instruction coding is defined with the same coding length limit. Go to step 4.

[0096] 4. In the implementation code of the fork() system call in the operating system kernel, the process record structure is filled in the position. After this position, before the completion of the system call, the monitoring target process judgment and the ProcessFork and TargetProcess expansion instructions are added, and the registers or immediate numbers in the operands are used to pass the pointer of the process record in the kernel. Go to step 5.

[0097] 5. In the implementation code of the exec() system call in the operating system kernel, the location where the process record structure is filled in is added with the monitoring target process judgment and ProcessExec, TargetProcess extension instructions before the system call is completed, and the pointer to the process record in the kernel is passed using the registers or immediate numbers in the operands. Step 6 is entered.

[0098] 6. For the exit() system call, the ProcessExit extension instruction is added before the code execution is completed, and the pointer to the process record in the kernel is passed using the registers or immediate numbers in the operands. Step 7 is entered.

[0099] 7. The operating system code is modified to add hardware parameter information. Step 8 is entered.

[0100] 8. The CPU hardware is modified to enable it to parse and execute the extension instructions added by the operating system during operation. Step 9 is entered.

[0101] 9. The host is started, and the operating system applies a block of physical memory as a buffer during the operating system boot. Step 10 is entered.

[0102] 10. The operating system executes the SetBuffer instruction, and the CPU records the address passed in by the R5 register as the data read-write address. Step 11 is entered.

[0103] 11. When the CPU executes the instruction, if the instruction is CheckMonitorBuffer, the CPU writes the data length in the buffer to the R5 register. Step 12 is entered.

[0104] 12. When the CPU executes the instruction, if the instruction is ReadMonitorBuffer, the CPU copies the data in the buffer to the address space pointed to by R5. Step 13 is entered.

[0105] 13. When the CPU executes the instruction, if the instruction is ProcessFork / ProcessExec, the task_strcut address is taken out from the register R5, and part of the key data in task_struct such as the physical page table address, process name, and module record pointer is read, and a new process record is added in the CPU process record buffer according to the CPU preset mechanism. Step 14 is entered.

[0106] 14、CPU executes the instruction, if the instruction is TargetProcess, the task_strcut address is taken out from the register R6, and the monitoring flag position of the corresponding record in the process record buffer is set to 1 according to the mechanism preset by the CPU. Step 15 is entered.

[0107] 15、CPU executes the instruction, if the instruction is ProcessExit, the task_strcut address is taken out from the register R5, and the record in the process record buffer preset by the CPU is deleted. Step 15 is entered.

[0108] 16、CPU compares the process monitoring flag bit, if yes, the instruction code, register value, accessed memory address and accessed memory value of all instructions are filled into the buffer set by SetBuffer. Step 17 is entered. If no, step 17 is also entered.

[0109] 17、CPU continues to execute the code. Step 11 is entered.

[0110] The process identification and monitoring method provided by the application cooperates software and hardware, adds the expansion instruction of process creation, process covering, process exit and monitoring target process calibration in each execution function respectively, modifies the execution mechanism of the CPU according to the expansion instruction, so that the CPU parses and executes the expansion instruction, obtains the preset key data of the process record information in the operating system kernel, stores the preset key data into the buffer of the operating system, and interacts with the buffer. When the operating system executes the instruction of storing the process record information of the buffer into the special register of the CPU, the CPU executes the instruction of transferring the buffer information and the register information, completes the instruction operation, realizes that the CPU compares the record in the buffer and monitors all instructions of the process execution when the process is executed, completes the process identification and monitoring of software and hardware combination, does not need to use the debugging interface of the operating system, and improves the transparency of the analysis system.

[0111] The process identification and monitoring device provided by the application is described below. The process identification and monitoring device described below can be correspondingly referred to the process identification and monitoring method described above.

[0112] Figure 6 The structure schematic diagram of the process identification and monitoring device provided by the application is shown, referring to Figure 6 The device comprises a determination module 61, a first modification module 62, a second modification module 63 and a processing module 64, wherein:

[0113] The determination module is used for determining the execution function of the process creation, process covering and process exit in the operating system.

[0114] The first modification module is used for adding the extension instruction of adapting process creation, process covering, process exiting and monitoring target process calibration into each execution function respectively.

[0115] The second modification module is used for modifying the execution mechanism of the CPU according to the extension instruction, so that the CPU parses and executes the extension instruction, obtains the key data of the process record information in the operating system kernel, and stores the key data of the process record information into the buffer area preconfigured for process identification and monitoring in the operating system, and performs buffer area interaction.

[0116] The processing module is used for enabling the CPU to complete various transfer buffer area information and register information operations based on the extended execution mechanism when the operating system executes the instruction of storing the process record information of the buffer area into the special register of the CPU.

[0117] Since the device of the embodiment of the present application has the same principle as the above-mentioned embodiment method, more detailed explanation will not be repeated here.

[0118] It should be noted that the related function modules in the embodiment of the present application can be realized by a hardware processor.

[0119] The process identification and monitoring device provided by the present application is realized by adding the extension instruction of adapting process creation, process covering, process exiting and monitoring target process calibration into each execution function respectively, modifying the execution mechanism of the CPU according to the extension instruction, enabling the CPU to parse and execute the extension instruction, obtaining the preset key data of the process record information in the operating system kernel, storing the preset key data into the buffer area of the operating system, and performing buffer area interaction, enabling the CPU to execute various transfer buffer area information and register information instructions when the operating system executes the instruction of storing the process record information of the buffer area into the special register of the CPU, completing the instruction operation, realizing that the CPU compares the record in the buffer area and monitors all instructions of the process execution when the process is executed, completing the process identification and monitoring of the combination of software and hardware, without using the debugging interface of the operating system, and improving the transparency of the analysis system.

[0120] Figure 7 An example of an entity structure schematic diagram of an electronic device is shown in FIG. 1. Figure 7As shown, the electronic device can include a processor 71, a communications interface 72, a memory 73, and a communications bus 74, wherein the processor 71, the communications interface 72, and the memory 73 communicate with each other through the communications bus 74. The processor 71 can invoke the logical instructions in the memory 73 to perform the process identification and monitoring method of software and hardware cooperation, which includes determining the execution functions of process creation, process coverage, and process exit in the operating system; adding an extension instruction for adapting process creation, process coverage, process exit, and monitoring target process calibration in each of the execution functions; modifying the execution mechanism of the CPU according to the extension instruction, so that the CPU parses the execution of the extension instruction, obtains the key data of process record information in the operating system kernel, and stores the key data of the process record information in the buffer area in the operating system preconfigured for process identification and monitoring, and performs buffer area interaction; when the operating system executes the instruction of storing the process record information of the buffer area into the special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism.

[0121] In addition, the logical instructions in the memory 73 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0122] In another aspect, the present application also provides a computer program product, which comprises a computer program stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to perform the process identification and monitoring method provided by the software and hardware cooperation of the above-mentioned methods, and the method comprises the following steps: determining execution functions of process creation, process covering and process exit in an operating system; adding an extension instruction for adapting process creation, process covering, process exit and monitoring target process calibration in each execution function; modifying an execution mechanism of a CPU according to the extension instruction, so that the CPU parses and executes the extension instruction, obtains key data of process record information in an operating system kernel, and stores the key data of the process record information in a buffer area pre-configured for process identification and monitoring in the operating system, and performs buffer area interaction; when the operating system executes an instruction for storing process record information in the buffer area into a special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism.

[0123] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program can be executed by a processor to implement the process identification and monitoring method provided by the software and hardware cooperation of the above-mentioned methods, and the method comprises the following steps: determining execution functions of process creation, process covering and process exit in an operating system; adding an extension instruction for adapting process creation, process covering, process exit and monitoring target process calibration in each execution function; modifying an execution mechanism of a CPU according to the extension instruction, so that the CPU parses and executes the extension instruction, obtains key data of process record information in an operating system kernel, and stores the key data of the process record information in a buffer area pre-configured for process identification and monitoring in the operating system, and performs buffer area interaction; when the operating system executes an instruction for storing process record information in the buffer area into a special register of the CPU, the CPU completes various transfer buffer area information and register information operations based on the extended execution mechanism.

[0124] The apparatus embodiments described above are only schematic, wherein the units illustrated as separate components can or can not be physically separate, and the components illustrated as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0125] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0126] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for process identification and monitoring through software and hardware collaboration, characterized in that, include: Determine the execution functions for process creation, process overwriting, and process exit in the operating system; Add extended instructions for adapting process creation, process overwriting, process exit, and monitoring target process marking to each of the aforementioned execution functions; According to the extended instructions, the CPU's execution mechanism is modified so that the CPU parses and executes the extended instructions to obtain key data of process record information in the operating system kernel, stores the key data of process record information in a buffer pre-configured in the operating system for process identification and monitoring, and performs buffer interaction. When the operating system executes the instruction to store the process record information in the buffer into the CPU's dedicated register, the CPU performs various operations to transfer buffer information and register information based on the extended execution mechanism. The extended instructions include: pushing the value of a special-purpose register onto the stack; storing the address of the process data structure content into a special-purpose register; writing the address content, the values ​​of other registers, and immediate values ​​into a special-purpose register; reading the value of a special-purpose register and writing it into memory or other registers; and popping the value of a register from the stack.

2. The method for process identification and monitoring of hardware and software collaboration according to claim 1, characterized in that, The addition of extended instructions for adapting process creation, process overwriting, and process exit to each of the execution functions includes: After the process creation function completes copying the contents of the existing process data structure and the control flow jumps to any position before the new process is created, add extended instruction code for adding process records and monitoring the target process. After the process overriding function has finished filling the process data structure, and the control flow jumps to any position before the new process, add extended instruction code for process record updating and monitoring target process marking; Add extended instruction code to delete the process record at any point in the process exit function.

3. The method for process identification and monitoring of hardware and software collaboration according to claim 1, characterized in that, The modification of the CPU's execution mechanism according to the extended instructions includes: Construct the executable code that connects to the operating system's buffer; Construct execution code for extended instructions that adapt to process creation, process overriding, process exit, and monitoring of target process marking; Build executable code that adapts to various instructions that pass buffer and register information.

4. The method for process identification and monitoring of hardware and software collaboration according to claim 3, characterized in that, The execution code for constructing the extended instructions for adapting process creation, process overriding, process exit, and monitoring the target process includes: If the extended instructions of the process creation function are executed, the value of the register is retrieved as a pointer to the address of the current process data structure. Based on the pointer, the process record in the data structure of the operating system kernel is read and recorded in the cache pre-configured for process identification and monitoring. If the extended instructions of the process overriding function are executed, the value of the register is retrieved, the corresponding data structure is found in the process record list of the operating system, the process record is reread from the operating system kernel based on the address pointer of the data structure, and the original entries in the cache pre-configured for process identification and monitoring are updated. If the extended instructions of the process exit function are executed, the value of the register is retrieved, and the corresponding process record is deleted from the cache pre-configured for process identification and monitoring based on the data structure pointer of the process to be exited. If the extended instruction specified by the target process is executed, the value of the register is retrieved, the corresponding process record is searched in the process list, and the monitoring flag in the found process record is set to 1.

5. The method for process identification and monitoring of hardware and software collaboration according to claim 4, characterized in that, The aforementioned mechanism enables the CPU to perform various operations involving the transfer of buffer and register information based on the extended execution mechanism, including: The function address and parameter type information are read from the register and placed into the CPU's monitoring buffer for the process. The instructions executed by the process are recorded and placed in the CPU's monitoring buffer for the process. Write the length of the data in the buffer into the register; Copy the data in the buffer to the address space pointed to by the register.

6. The method for process identification and monitoring of hardware and software collaboration according to claim 4, characterized in that, The method further includes: Based on user input, obtain information about the target processes to be monitored; Based on the target process information, extended instructions for adapting process creation, process overwriting, process exit, and monitoring target process marking are added to each of the execution functions.

7. A hardware and software collaborative process identification and monitoring device, characterized in that, include: The determination module is used to determine the execution functions for process creation, process overwriting, and process exit in the operating system; The first modification module is used to add extended instructions for adapting process creation, process overwriting, process exit, and monitoring target process marking to each of the execution functions respectively; The second modification module is used to modify the CPU's execution mechanism according to the extended instructions, so that the CPU parses and executes the extended instructions to obtain preset key data of process record information in the operating system kernel, stores the preset key data of process record information in a buffer pre-configured for process identification and monitoring in the operating system, and performs buffer interaction. The processing module is used to enable the CPU to perform various operations of transferring buffer information and register information based on the extended execution mechanism when the operating system executes the instruction to store the process record information in the buffer into the CPU's dedicated register. The extended instructions include: pushing the value of a special-purpose register onto the stack; storing the address of the process data structure content into a special-purpose register; writing the address content, the values ​​of other registers, and immediate values ​​into a special-purpose register; reading the value of a special-purpose register and writing it into memory or other registers; and popping the value of a register from the stack.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the hardware-software collaborative process identification and monitoring method as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the hardware-software collaborative process identification and monitoring method as described in any one of claims 1-6.

Images