Program analysis method, device, electronic device and storage medium

Abstract

The present disclosure provides a program analysis method, including: in response to a program analysis instruction, obtaining a first bytecode file to be analyzed, wherein the first bytecode file is obtained by compiling a target program; performing enhancement processing on the first bytecode file to obtain a second bytecode file; using a class loader to load the second bytecode file into a virtual machine so that the virtual machine runs the target program; calling a listener to asynchronously collect running information of the target program; and generating call chain information based on the collected running information when the target program is completed. In addition, the present disclosure also provides a program analysis device, an electronic device, a readable storage medium, and a computer program product.

Description

Technical Field

[0001] The present disclosure relates to the technical field of program analysis and the financial field, and more specifically, to a program analysis method, a program analysis device, an electronic device, a readable storage medium, and a computer program product. Background Art

[0002] At present, some commercial program products in enterprise-level applications, such as databases and middleware, have a significant impact on the production and operation activities of enterprises. In-depth understanding of the operating principles of these program products is of great significance to operation and maintenance, application architecture and application optimization.

[0003] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following problems in the related art: when some applications report errors, it is difficult for the company's operation and maintenance personnel to effectively handle the problems that arise, and the timeliness of solving the problems is poor. Summary of the invention

[0004] In view of this, the present disclosure provides a program analysis method, a program analysis device, an electronic device, a readable storage medium, and a computer program product.

[0005] One aspect of the present disclosure provides a program analysis method, comprising: in response to a program analysis instruction, obtaining a first bytecode file to be analyzed, wherein the first bytecode file is obtained by compiling a target program; performing enhancement processing on the first bytecode file to obtain a second bytecode file; using a class loader to load the second bytecode file into a virtual machine so that the virtual machine runs the target program; calling a listener to asynchronously collect running information of the target program; and generating call chain information based on the collected running information when the target program is completed.

[0006] According to an embodiment of the present disclosure, the above-mentioned first bytecode file includes multiple first-class packages; wherein, the above-mentioned enhancement processing of the above-mentioned first bytecode file includes: based on preset configuration information, screening at least one target class package from the multiple first-class packages of the above-mentioned first bytecode file; for each of the above-mentioned target class package, determining at least one enhancement point of the above-mentioned target class package; and for each of the above-mentioned enhancement point, adding an enhancement section code corresponding to the above-mentioned enhancement point at the above-mentioned enhancement point.

[0007] According to an embodiment of the present disclosure, the above-mentioned preset configuration information is configured with a target identifier of a class package that needs to be enhanced; wherein, based on the preset configuration information, at least one target class package is screened from multiple first class packages of the above-mentioned first bytecode file, including: selecting at least one first class package with the above-mentioned target identifier from multiple first class packages of the above-mentioned first bytecode file as the above-mentioned target class package.

[0008] According to an embodiment of the present disclosure, the above-mentioned enhancement points at least include a constructor, a static function, an initialization block and a preset method.

[0009] According to an embodiment of the present disclosure, the above-mentioned second bytecode file includes at least one second class package; wherein, the above-mentioned use of a class loader to load the above-mentioned second bytecode file into the virtual machine includes: for each of the above-mentioned second class packages, when the above-mentioned second class package has a corresponding preset class loader, using the above-mentioned class loader to call the above-mentioned preset class loader, so that the above-mentioned preset class loader loads the above-mentioned second class package into the above-mentioned virtual machine.

[0010] According to an embodiment of the present disclosure, the above-mentioned calling listener to asynchronously collect the running information of the above-mentioned target program includes: calling the above-mentioned listener to asynchronously collect the running information of each of the above-mentioned second-category packages of the above-mentioned target program, wherein the above-mentioned running information at least includes the start running time and the end running time and the thread information of running the above-mentioned second-category package; and storing the running information of the above-mentioned second-category package in an in-memory database.

[0011] According to an embodiment of the present disclosure, when the target program is completed, the call chain information is generated based on the collected operation information, including: when the target program is completed, the call chain information is generated based on the operation information of at least one of the second-category packages stored in the memory database.

[0012] According to an embodiment of the present disclosure, the above method further includes:

[0013] In response to a preset operation of the user, the preset parameters are added to the startup command of the target program to initiate the program analysis instruction.

[0014] Another aspect of the present disclosure provides a program analysis device, including: an acquisition module, used to respond to a program analysis instruction to acquire a first bytecode file to be analyzed, wherein the first bytecode file is obtained by compiling a target program; a first processing module, used to perform enhancement processing on the first bytecode file to obtain a second bytecode file; a loading module, used to use a class loader to load the second bytecode file into a virtual machine so that the virtual machine runs the target program; a collection module, used to call a listener to asynchronously collect running information of the target program; and a generation module, used to generate call chain information based on the collected running information when the target program is completed.

[0015] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more instructions, wherein when the one or more instructions are executed by the one or more processors, the one or more processors implement the method as described above.

[0016] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0017] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and when the instructions are executed, are used to implement the method as described above.

[0018] According to an embodiment of the present disclosure, for a first bytecode file compiled by a target program, before running the first bytecode file, the first bytecode file can be enhanced to obtain an enhanced second bytecode file; the second bytecode file can be loaded into a virtual machine through a class loader for running; during the running process, the running information of the target program can be collected to generate call chain information. Through the above technical means, the call chain information of each class of the program can be obtained without intrusive processing of the source code of the program, so at least partially overcomes the technical problem of poor timeliness in solving problems existing in the related art due to the difficulty of operation and maintenance personnel in effectively handling problems in some application programs, thereby effectively improving the efficiency and comprehensiveness of program debugging. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0020] Figure 1 An exemplary system architecture that can be used for the application analysis method according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 2 The flowchart of the program analysis method according to the embodiment of the present disclosure is schematically shown.

[0022] Figure 3 The flowchart of the program analysis method implemented by using CallTree according to an embodiment of the present disclosure is schematically shown.

[0023] Figure 4 The block diagram schematically shows a program analysis device according to an embodiment of the present disclosure.

[0024] Figure 5 A block diagram of an electronic device suitable for implementing a program analysis method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0027] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0028] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0029] In related technologies, since programs often undergo a lot of black-box complex configurations, it is difficult to create a configuration consistent with the production environment in the debugging environment; in addition, the widespread use of dynamic proxy and asynchronous technologies has further increased the difficulty of debugging and tracking programs. All of this makes the program a black box for users, who cannot view or modify the source code of the program. Therefore, once the program reports an error or lacks a function, the only option is to wait for the creator of the program to solve the problem, which makes the timeliness of solving the problem poor.

[0030] In view of this, the embodiments of the present disclosure are based on bytecode technology, which can enhance some codes of the program non-invasively, collect call data during operation, and then calculate the complete code operation link through background analysis. Through the code operation link, operation and maintenance personnel can deeply understand the operation process of the program, which helps to solve problems that arise when the program is running.

[0031] Specifically, the embodiments of the present disclosure provide a program analysis method, a program analysis device, an electronic device, a readable storage medium, and a computer program product. The method includes, in response to a program analysis instruction, obtaining a first bytecode file to be analyzed, wherein the first bytecode file is obtained by compiling a target program; performing enhancement processing on the first bytecode file to obtain a second bytecode file; using a class loader to load the second bytecode file into a virtual machine so that the virtual machine runs the target program; calling a listener to asynchronously collect the running information of the target program; and generating call chain information based on the collected running information when the target program is completed.

[0032] It should be noted that the program analysis method and device determined in the embodiments of the present disclosure can be used in the field of program analysis technology or the financial field; they can also be used in any field other than the field of program analysis technology and the financial field. The application field of the program analysis method and device determined in the embodiments of the present disclosure is not limited.

[0033] In the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0034] Figure 1 The exemplary system architecture of the application analysis method according to the embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0035] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0036] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various application products can be installed on terminal devices 101, 102, 103, including but not limited to shopping applications, web browser applications, search applications, instant messaging tools, email clients and / or social platform software, etc.

[0037] The terminal devices 101 , 102 , and 103 may be various electronic devices with display screens, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0038] The server 105 may be a server that provides various services, such as a background server that provides analysis services for programs running in the terminal devices 101, 102, and 103. The background server may collect and analyze program running information and feed back the analysis results to the terminal device.

[0039] It should be noted that the program analysis method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the program analysis device provided in the embodiment of the present disclosure can generally be arranged in the server 105. The program analysis method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105. Accordingly, the program analysis device provided in the embodiment of the present disclosure can also be arranged in a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105. Alternatively, the program analysis method provided in the embodiment of the present disclosure can also be executed by the terminal device 101, 102, or 103, or can also be executed by other terminal devices different from the terminal device 101, 102, or 103. Accordingly, the program analysis device provided in the embodiment of the present disclosure can also be arranged in the terminal device 101, 102, or 103, or can be arranged in other terminal devices different from the terminal device 101, 102, or 103.

[0040] For example, the program may be originally installed on any one of the terminal devices 101, 102, or 103 (for example, terminal device 101, but not limited to this), and the terminal device 101 may locally execute the program analysis method provided by the embodiment of the present disclosure; or, the terminal device 101 may send a program analysis instruction to other terminal devices, servers, or server clusters, and the other terminal devices, servers, or server clusters that receive the instruction execute the program analysis method provided by the embodiment of the present disclosure to analyze the program on the terminal device 101.

[0041] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0042] Figure 2 The flowchart of the program analysis method according to the embodiment of the present disclosure is schematically shown.

[0043] like Figure 2 As shown, the method includes operations S201 to S205.

[0044] In operation S201, in response to a program analysis instruction, a first bytecode file to be analyzed is obtained, wherein the first bytecode file is obtained by compiling a target program.

[0045] In operation S202, enhancement processing is performed on the first bytecode file to obtain a second bytecode file.

[0046] In operation S203, the second bytecode file is loaded into the virtual machine using a class loader, so that the virtual machine runs the target program.

[0047] In operation S204, the listener is called to asynchronously collect the running information of the target program.

[0048] In operation S205 , when the target program is executed, call chain information is generated based on the collected execution information.

[0049] According to an embodiment of the present disclosure, the target program may be a program that does not use any open source protocol. After the target program is released, the user can only obtain the binary version of the computer program permitted by the program publisher, that is, the first bytecode file.

[0050] According to an embodiment of the present disclosure, the enhanced processing of the first bytecode file may be implemented based on bytecode technology, or may be implemented using source code analysis tools such as CallTree, which is not limited here.

[0051] According to an embodiment of the present disclosure, performing enhancement processing on the first bytecode file may include adding a collection function to each class of the first bytecode file.

[0052] According to an embodiment of the present disclosure, the specific content of the running information can be set according to the specific application scenario, for example, it may include basic information of the task, the time when the task starts and ends, thread information for executing the task, etc., which is not limited here.

[0053] According to an embodiment of the present disclosure, after generating the call chain information, the user can obtain the link information of a specified time period from the front-end page by querying by thread or by class method name.

[0054] According to an embodiment of the present disclosure, for a first bytecode file compiled by a target program, before running the first bytecode file, the first bytecode file can be enhanced to obtain an enhanced second bytecode file; the second bytecode file can be loaded into a virtual machine through a class loader for running; during the running process, the running information of the target program can be collected to generate call chain information. Through the above technical means, the call chain information of each class of the program can be obtained without intrusive processing of the source code of the program, so at least partially overcomes the technical problem of poor timeliness in solving problems existing in the related art due to the difficulty of operation and maintenance personnel in effectively handling problems in some application programs, thereby effectively improving the efficiency and comprehensiveness of program debugging.

[0055] Reference below Figure 3 , combined with specific embodiments Figure 2 The method shown is further explained.

[0056] Figure 3 The flowchart of the program analysis method implemented by using CallTree according to an embodiment of the present disclosure is schematically shown.

[0057] like Figure 3 As shown, the method includes operations S301 to S307.

[0058] It should be noted that, unless it is explicitly stated that there is a sequence of execution between different operations shown in the flowchart in the embodiments of the present disclosure, or there is a sequence of execution between different operations in technical implementation, otherwise, the execution order of multiple operations may not be prioritized, and multiple operations may also be executed simultaneously.

[0059] In operation S301 , in response to a preset operation of a user, a preset parameter is added to a start command of a target program.

[0060] In operation S302, a first bytecode file obtained by compiling the target program is obtained.

[0061] In operation S303, the first bytecode file is enhanced to obtain a second bytecode file.

[0062] In operation S304, each class package of the second bytecode file is loaded into the virtual machine using a class loader.

[0063] In operation S305, the listener is called to asynchronously collect the running information of the class package.

[0064] In operation S306, it is determined whether the target program has been completed. If it is determined that the target program has not been completed, the process returns to operation S305; if it is determined that the target program has been completed, operation S307 is executed.

[0065] In operation S307 , call chain information is generated based on the collected execution information.

[0066] According to an embodiment of the present disclosure, the preset operation may include, for example, a click operation for initiating a program analysis instruction for a target program.

[0067] According to an embodiment of the present disclosure, the preset parameters may include parameters for specifying loading of the CallTree program, such as a “-javaagent” parameter.

[0068] According to an embodiment of the present disclosure, after adding preset parameters to the startup command of the target program, the JVM may execute the CallTree program to enhance the first bytecode file before loading the first bytecode file of the target program.

[0069] According to an embodiment of the present disclosure, when the CallTree program is not needed, only the startup command of the target program needs to be modified. By deleting the preset parameters in the startup command, the function of the CallTree program can be completely removed, effectively avoiding affecting the normal operation of the target program.

[0070] According to an embodiment of the present disclosure, a first bytecode file may include multiple first-category packages.

[0071] According to an embodiment of the present disclosure, performing enhancement processing on the first bytecode file may specifically include: based on preset configuration information, screening at least one target class package from multiple first class packages of the first bytecode file; for each target class package, determining at least one enhancement point of the target class package; and for each enhancement point, adding an enhancement section code corresponding to the enhancement point at the enhancement point.

[0072] According to an embodiment of the present disclosure, the preset configuration information may include the user's configuration information for CallTree. The user may define the class packages that need to be enhanced and the class packages that are ignored for enhancement in multiple first-class packages by specifying the package name prefix of the class package in CallTree. For example, basic class packages or frameworks such as JDK and Spring framework may be used as class packages that are ignored for enhancement. After configuration, CallTree may only enhance the first-class packages that need to be enhanced.

[0073] According to an embodiment of the present disclosure, the preset configuration information may be configured with a target identifier of the class package to be enhanced. When screening multiple first class packages of the first bytecode file, at least one first class package with the target identifier may be selected from the multiple first class packages as the target class package.

[0074] According to an embodiment of the present disclosure, the location and number of enhancement points in the target class package may be set according to a specific application scenario, and may include, for example, a constructor, a static function, an initialization block, a common function, and a preset method.

[0075] According to an embodiment of the present disclosure, the preset method may include a method set by a user, such as a getter and a setter.

[0076] According to an embodiment of the present disclosure, different enhancement points may be configured to use different enhancement slice codes to collect information of different dimensions.

[0077] According to an embodiment of the present disclosure, a custom class loader in CallTree can be used to load each class package of the second bytecode file. Before loading, the class loader can be used to query whether the class package has a corresponding preset class loader. If the class package has a corresponding preset class loader, the class loader can be used to call the corresponding preset class loader to use the preset class loader to load the class package, so that the path of the class package processed by CallTree is consistent with the original path, effectively avoiding the problem of JVM giving an error message of "ClassNotFoundError" due to inconsistent paths during the process of JVM running the target program.

[0078] According to an embodiment of the present disclosure, after completing the loading of the class package, CallTree can start the backend service, including registering a listener to asynchronously collect the running information of the target program, initializing a memory database to store the collected running information, and providing a page to query and display the call chain information.

[0079] According to an embodiment of the present disclosure, during the running process of the target program, a listener may be called to asynchronously collect the running information of each class package of the target program, and store the running information of the class package in a memory database.

[0080] According to an embodiment of the present disclosure, when a class package starts running, a CallItem structure can be generated, and the CallItem structure can contain information such as start time, end time, thread ID, parent thread ID, sequence number, method name, class name, thread name, etc., as shown in Table 1; after a CallItem structure is generated, the start time can be recorded, and it can be added to the context of the current thread through a push operation to collect other running information; after the class execution is completed, the end time can be recorded in the CallItem, and it can be popped from the context of the current thread; when the CallItem is popped, a CallItem completion event can be triggered, and the event can be listened to and processed by the listener.

[0081] Table 1

[0082]

[0083] According to an embodiment of the present disclosure, the listener may serialize and store the collected CallItem information into a memory database.

[0084] According to an embodiment of the present disclosure, when the target program is completed, call chain information may be generated based on the running information of at least one class package stored in the memory database.

[0085] According to an embodiment of the present disclosure, after obtaining the call chain information, the link information of the specified time period can be displayed through the front-end page, or the running information of the thread or the call information of the class package can be obtained by querying by thread or by class package name.

[0086] Figure 4 The block diagram schematically shows a program analysis device according to an embodiment of the present disclosure.

[0087] like Figure 4 As shown, the program analysis device 400 includes an acquisition module 410 , a first processing module 420 , a loading module 430 , a collection module 440 and a generation module 450 .

[0088] The acquisition module 410 is used to acquire a first bytecode file to be analyzed in response to a program analysis instruction, wherein the first bytecode file is obtained by compiling a target program.

[0089] The first processing module 420 is used to perform enhancement processing on the first bytecode file to obtain a second bytecode file.

[0090] The loading module 430 is used to use the class loader to load the second bytecode file into the virtual machine so that the virtual machine runs the target program.

[0091] The collection module 440 is used to call the listener to asynchronously collect the running information of the target program.

[0092] The generation module 450 is used to generate call chain information based on the collected operation information when the target program is completed.

[0093] According to an embodiment of the present disclosure, for a first bytecode file compiled by a target program, before running the first bytecode file, the first bytecode file can be enhanced to obtain an enhanced second bytecode file; the second bytecode file can be loaded into a virtual machine through a class loader for running; during the running process, the running information of the target program can be collected to generate call chain information. Through the above technical means, the call chain information of each class of the program can be obtained without intrusive processing of the source code of the program, so at least partially overcomes the technical problem of poor timeliness in solving problems existing in the related art due to the difficulty of operation and maintenance personnel in effectively handling problems in some application programs, thereby effectively improving the efficiency and comprehensiveness of program debugging.

[0094] According to an embodiment of the present disclosure, the first bytecode file includes a plurality of first-category packages.

[0095] According to an embodiment of the present disclosure, the first processing module 420 includes a first processing unit, a second processing unit, and a third processing unit.

[0096] The first processing unit is used to filter and obtain at least one target class package from multiple first class packages of the first bytecode file based on preset configuration information.

[0097] The second processing unit is configured to determine, for each target class package, at least one enhancement point of the target class package.

[0098] The third processing unit is used to add an enhanced section code corresponding to each enhancement point at the enhancement point.

[0099] According to an embodiment of the present disclosure, the preset configuration information is configured with a target identifier of a class package that needs to be enhanced.

[0100] According to an embodiment of the present disclosure, the first processing unit is further configured to select at least one first-class package having a target identifier from a plurality of first-class packages of the first bytecode file as a target-class package.

[0101] According to an embodiment of the present disclosure, an enhancement point includes at least a constructor, a static function, an initialization block, and a preset method.

[0102] According to an embodiment of the present disclosure, the second bytecode file includes at least one second-category package.

[0103] According to an embodiment of the present disclosure, the loading module 430 is also used to use the class loader to call the preset class loader for each second class package when the second class package has a corresponding preset class loader, so that the preset class loader loads the second class package into the virtual machine.

[0104] According to an embodiment of the present disclosure, the collecting module 440 includes a first collecting unit and a second collecting unit.

[0105] The first collecting unit is used to call the listener to asynchronously collect the running information of each second-category package of the target program, wherein the running information at least includes the start running time and the end running time and the thread information of the running second-category package.

[0106] The second collecting unit is used to store the running information of the second type of packages in the memory database.

[0107] According to an embodiment of the present disclosure, the generation module 450 is also used to generate call chain information based on the running information of at least one second-category package stored in the memory database when the target program is completed.

[0108] According to an embodiment of the present disclosure, the device 400 further includes a second processing module.

[0109] The second processing module is used to add the preset parameters to the start command of the target program in response to the preset operation of the user to initiate the program analysis instruction.

[0110] According to the modules and units of the embodiments of the present disclosure, any multiple or at least part of the functions of any multiple thereof can be implemented in one module. According to the modules and units of the embodiments of the present disclosure, any one or more can be split into multiple modules for implementation. According to the modules and units of the embodiments of the present disclosure, any one or more can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware of any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, according to the modules and units of the embodiments of the present disclosure, one or more can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0111] For example, any multiple of the acquisition module 410, the first processing module 420, the loading module 430, the collection module 440 and the generation module 450 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the first processing module 420, the loading module 430, the collection module 440 and the generation module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by a suitable combination of any of them. Alternatively, at least one of the acquisition module 410 , the first processing module 420 , the loading module 430 , the collection module 440 and the generation module 450 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0112] It should be noted that the program analysis device part in the embodiment of the present disclosure corresponds to the program analysis method part in the embodiment of the present disclosure. The description of the program analysis device part specifically refers to the program analysis method part, which will not be repeated here.

[0113] Figure 5 A block diagram of an electronic device suitable for implementing a program analysis method according to an embodiment of the present disclosure is schematically shown. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0114] like Figure 5 As shown, the computer electronic device 500 according to the embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 to the random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0115] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0116] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0117] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0118] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0119] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0120] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or the RAM 503 described above and / or one or more memories other than the ROM 502 and the RAM 503 .

[0121] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method provided by the embodiment of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the program analysis method provided by the embodiment of the present disclosure.

[0122] When the computer program is executed by the processor 501, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0123] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0124] According to an embodiment of the present disclosure, JAVA can be used to write a program code for executing a computer program provided by an embodiment of the present disclosure. The program code can be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0125] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments and / or claims of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0126] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A program analysis method, comprising: In response to the program analysis instruction, obtaining a first bytecode file to be analyzed, wherein the first bytecode file is obtained by compiling a target program; Performing enhancement processing on the first bytecode file to obtain a second bytecode file; Using a class loader to load the second bytecode file into a virtual machine, so that the virtual machine runs the target program; Calling a listener to asynchronously collect the running information of the target program; and When the target program is completed, generating call chain information based on the collected operation information; Wherein, the first bytecode file includes a plurality of first-category packages; The step of performing enhancement processing on the first bytecode file includes: Based on the preset configuration information, at least one target class package is obtained by screening out from the plurality of first class packages of the first bytecode file; For each of the target class packages, determining at least one enhancement point of the target class package; and For each of the enhancement points, adding an enhancement section code corresponding to the enhancement point at the enhancement point; The preset configuration information is configured with a target identifier of a class package that needs to be enhanced; The step of selecting at least one target class package from a plurality of first class packages of the first bytecode file based on preset configuration information includes: Selecting at least one first-category package having the target identifier from a plurality of first-category packages of the first bytecode file as the target-category package; The enhancement points include at least a constructor, a static function, an initialization block and a preset method.

2. The method according to claim 1, wherein: The second bytecode file includes at least one second-category package; The step of using a class loader to load the second bytecode file into a virtual machine includes: For each of the second class packages, when the second class package has a corresponding preset class loader, the class loader is used to call the preset class loader, so that the preset class loader loads the second class package into the virtual machine.

3. The method according to claim 2, wherein: The calling listener asynchronously collects the running information of the target program, including: Calling the listener to asynchronously collect the running information of each second-class package of the target program, wherein the running information at least includes the start running time and the end running time and the thread information of running the second-class package; and The running information of the second type of packages is stored in the memory database.

4. The method according to claim 3, wherein: When the target program is completed, generating call chain information based on the collected running information includes: When the target program is completed, the call chain information is generated based on the running information of at least one second-category package stored in the memory database.

5. The method according to claim 1, further comprising: In response to a preset operation of the user, a preset parameter is added to a start command of the target program to initiate the program analysis instruction.

6. A program analysis device, comprising: An acquisition module, configured to acquire a first bytecode file to be analyzed in response to a program analysis instruction, wherein the first bytecode file is obtained by compiling a target program; A first processing module, used for performing enhancement processing on the first bytecode file to obtain a second bytecode file; A loading module, used for loading the second bytecode file into a virtual machine using a class loader, so that the virtual machine runs the target program; A collection module, used for calling a listener to asynchronously collect the running information of the target program; and A generation module, used for generating call chain information based on the collected operation information when the target program is completed; Wherein, the first bytecode file includes a plurality of first-category packages; Wherein, the first processing module includes: A first processing unit, configured to filter and obtain at least one target class package from a plurality of first class packages of the first bytecode file based on preset configuration information; A second processing unit is configured to determine, for each of the target class packages, at least one enhancement point of the target class package; and A third processing unit is configured to add, for each enhancement point, an enhancement section code corresponding to the enhancement point at the enhancement point; The preset configuration information is configured with a target identifier of a class package that needs to be enhanced; The first processing unit is further configured to select at least one first-category package having the target identifier from a plurality of first-category packages of the first bytecode file as the target-category package; The enhancement points include at least a constructor, a static function, an initialization block and a preset method.

7. An electronic device comprising: one or more processors; a memory for storing one or more instructions, Wherein, when the one or more instructions are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, wherein when the executable instructions are executed by a processor, the processor is enabled to implement the method according to any one of claims 1 to 5.

9. A computer program product, comprising computer executable instructions, wherein the computer executable instructions are used to implement the method according to any one of claims 1 to 5 when executed.

Images