Function return detection method and apparatus

Abstract

Embodiments of the present specification provide a function return detection method and device. The method comprises: in the binary code of a program to be detected, generating a second code based on a first code of a first function called, the second code comprising a first instruction, a second instruction and all instructions of the first code arranged in a first order, the first instruction being used to call the first instruction of the all instructions, and the second instruction being used to jump to an entrance of a second function responsible for function return detection; and modifying the first instruction to a third instruction in the first code, the third instruction being used to jump to the entrance of the second code. The method can be applied to smart contract detection on a block chain.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of computer technology, and in particular relate to a method and apparatus for detecting function return values. Background Technology

[0002] A program's code (such as binary code) typically includes many functions, some of which have call relationships. The function that contains the call point to a particular function can be called the caller function of that function. In practice, for performance analysis of a program, such as to statistically analyze the execution time of one or more called functions, and / or to avoid privacy leaks, it is generally necessary to perform function return detection. Summary of the Invention

[0003] The purpose of this invention is to provide a function return detection method and apparatus that can reduce the performance overhead caused by implementing function return detection.

[0004] This specification provides a function return detection method, comprising: generating second code in the binary code of a program to be detected based on the first code of a first function that is called, the second code including a first instruction, a second instruction and all instructions of the first code arranged in sequence, the first instruction being used to call the first instruction of all instructions, the second instruction being used to jump to the entry point of the second function responsible for function return detection; modifying the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code.

[0005] A second aspect of this specification provides a function return detection method, comprising: generating second code in the binary code of the program to be detected based on the first code of the first function being called; the second code including a first instruction, a second instruction, a portion of the first code, and a sixth instruction arranged in sequence; the portion of the instructions including the first instruction of the first code; the first instruction being used to call the first instruction; the second instruction being used to jump to the entry point of the second function responsible for function return detection; and the sixth instruction being used to jump to the instruction following the last instruction of the portion of the instructions in the first code; and modifying the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code.

[0006] A third aspect of this specification provides a function return detection method, comprising: in the binary code of the program to be detected, executing an instruction for calling the entry point of the first function in the caller function of the first function to call the first function; wherein, the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes equivalent code of the first instruction, the second instruction and all instructions in the original first code of the first function arranged in sequence; executing the third instruction in the current first code to jump to the entry point of the second code; executing the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; after the equivalent code is executed, executing the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0007] This specification provides a function return detection method in its fourth aspect, comprising: in the binary code of the program to be detected, calling the first function by executing an instruction for calling the entry point of the first function in the caller function of the first function; wherein the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes a first instruction, a second instruction, equivalent code of a portion of the original first code of the first function, and a sixth instruction arranged in sequence, wherein the portion of the instructions includes the first instruction of the original first code; executing the third instruction in the current first code to jump to the entry point of the second code; executing the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; after the equivalent code is executed, executing the sixth instruction in the second code to jump to the instruction following the last instruction of the equivalent code in the current first code, thereby returning to the current first code to continue execution; after the last instruction of the current first code is executed, executing the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0008] This specification provides a function return detection apparatus in a fifth aspect, comprising: a code generation unit configured to generate second code in the binary code of a program to be detected based on first code of a first function being called, the second code including a first instruction, a second instruction, and all instructions of the first code arranged in sequence, the first instruction being used to call the first instruction of all instructions, and the second instruction being used to jump to the entry point of a second function responsible for function return detection; and an instruction modification unit configured to modify the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code.

[0009] This specification provides a function return detection apparatus in a fifth aspect, comprising: a code generation unit configured to generate second code in the binary code of a program to be detected based on first code of a first function being called, the second code including a first instruction, a second instruction, a portion of the first code, and a sixth instruction arranged in sequence, the portion of the first code including the first instruction of the first code, the first instruction being used to call the first instruction, the second instruction being used to jump to the entry point of a second function responsible for function return detection, and the sixth instruction being used to jump to the instruction following the last instruction of the portion of the first code; and an instruction modification unit configured to modify the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code.

[0010] A seventh aspect of this specification provides a function return detection apparatus, comprising: a first calling unit configured to call the first function in the binary code of a program to be detected by executing an instruction for calling the entry point of the first function in a caller function; wherein the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes equivalent code of the first instruction, the second instruction, and all instructions in the original first code of the first function arranged in sequence; a first jump unit configured to execute the third instruction in the current first code to jump to the entry point of the second code; a second calling unit configured to execute the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; and a second jump unit configured to, after the equivalent code is executed, execute the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0011] This specification provides a function return detection device in an eighth aspect, comprising: a first calling unit configured to call the first function in the binary code of the program to be detected by executing an instruction for calling the entry point of the first function in a caller function; wherein the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes a first instruction, a second instruction, equivalent code of a portion of the original first code of the first function, and a sixth instruction arranged in sequence, wherein the portion of the instructions includes the first instruction of the original first code; and a first jump unit configured to execute the third instruction in the current first code to jump to the function. The second code includes an entry point; a second calling unit configured to execute the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; a second jump unit configured to, after the equivalent code is executed, execute the sixth instruction in the second code to jump to the instruction following the last instruction of the equivalent code in the current first code, thereby returning to the current first code to continue execution; and a third jump unit configured to, after the last instruction of the current first code is executed, execute the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0012] The ninth aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in any of the implementations of the first to fourth aspects.

[0013] A tenth aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any of the implementations of the first to fourth aspects.

[0014] The eleventh aspect of this specification provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the method described in any of the implementations of the first to fourth aspects.

[0015] The solution provided by the above embodiments in this specification, by constructing a new code copy (the second code) of the function to be detected (the first function mentioned above) and modifying the original first code of the function to be detected, can ensure that there is no overhead for the undetected function. Moreover, when the function to be detected finishes execution, the function responsible for detecting the function return will naturally gain control, without the need to use the high-overhead exception mechanism, thus having very little performance overhead. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram illustrating one application scenario in which the embodiments of this specification can be applied;

[0018] Figure 2 This is a flowchart of the function return detection method in the embodiments of this specification;

[0019] Figure 3 This is a flowchart of the function return detection method in the embodiments of this specification;

[0020] Figure 4 This is a schematic diagram illustrating one application scenario in which the embodiments of this specification can be applied;

[0021] Figure 5 This is a flowchart of the function return detection method in the embodiments of this specification;

[0022] Figure 6 This is a flowchart of the function return detection method in the embodiments of this specification;

[0023] Figure 7 This is a schematic diagram of the function return detection device in the embodiments of this specification;

[0024] Figure 8 This is a schematic diagram of the function return detection device in the embodiments of this specification;

[0025] Figure 9 This is a schematic diagram of the function return detection device in the embodiments of this specification;

[0026] Figure 10 This is a schematic diagram of the function return detection device in the embodiments of this specification. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0028] As mentioned earlier, a program's code (such as binary code) typically includes many functions, some of which have calling relationships. The function that contains the call point to a particular function can be called the caller function of that function. In practice, for performance analysis of a program, such as to statistically analyze the execution time of one or more called functions, and / or to avoid privacy leaks, it is generally necessary to perform function return detection on the program.

[0029] Current technology typically achieves function return detection by inserting debugging instructions into the program's code. This approach requires triggering debugging-related exceptions, which incurs significant performance overhead.

[0030] In order to reduce the performance overhead caused by implementing function return detection, the embodiments of this specification provide a function return detection method.

[0031] See Figure 1 This is a schematic diagram illustrating one application scenario to which the embodiments of this specification can be applied. Figure 1 The application scenario shown can include the current code of function B (referred to as the first code) in the binary code of the program to be tested, a new copy of function B's code (referred to as the second code), the code of function A, the caller of function B, and the code of function C, which is responsible for detecting function return. The current first code of function B is the code after in-place modification of the original first code of function B. The first instruction of the current first code of function B is the rewritten instruction I3. Instruction I3 is used to jump to the entry point of the second code.

[0032] The second code includes instructions I1 and I2 arranged in sequence, and the equivalent code D1 of all instructions in the original first code of function B. Instruction I1 calls the first instruction of equivalent code D1. Instruction I2 jumps to the entry point of function C. Equivalent code D1 is identical to all instructions in the original first code, or some instructions in equivalent code D1 have different offsets than their corresponding instructions in the original first code. These offsets in some instructions are corrected offsets.

[0033] The code of caller function A includes instructions for calling function B. During the execution of the binary code of the program under test, this can be observed as follows: Figure 1 As indicated by label ①, function B is called by executing the entry instruction for calling function B within the caller function A. Then, it can be done as follows: Figure 1 As indicated by label ②, the execution of instruction I3 in the current first code of function B jumps to the entry point of the second code. If instruction I1 is the first instruction of the second code, executing instruction I3 can specifically jump to instruction I1 within the second code, and then proceed as follows... Figure 1 As shown by label ③, the execution of equivalent code D1 is achieved by calling the first instruction of the execution instruction I1. When the execution reaches the last function return instruction of equivalent code D1, it can be done as follows: Figure 1 As indicated by label ④, the function returns to instruction I2 by executing the function return instruction. Then, it can be done as follows: Figure 1 As indicated by label ⑤, the execution instruction I2 jumps to the entry point of function C, thus executing function C. When the execution reaches the last function return instruction of function C, it can be done as follows: Figure 1 As indicated by label ⑥, the execution of this function return instruction returns to the instruction following the entry point in the caller function A used to call function B, and continues execution.

[0034] By employing the function return detection process described above, function C can naturally gain control without relying on the expensive exception mechanism, thus resulting in minimal performance overhead.

[0035] Below, based on Figure 1 The application scenario shown illustrates the process of modifying the binary code of the program to be tested.

[0036] See Figure 2 This is a flowchart of the function return detection method in the embodiments of this specification. This method can be executed by a device, apparatus, or system with computing and processing capabilities (such as a system with dynamic performance detection capabilities).

[0037] like Figure 2 As shown, firstly, in step S201, in the binary code of the program to be detected, a second code is generated based on the first code of the first function that is called. The second code includes a first instruction, a second instruction, and all instructions of the first code arranged in sequence. The first instruction is used to call the first instruction of all instructions, and the second instruction is used to jump to the entry point of the second function responsible for function return detection.

[0038] The first function is the function to be tested. Below, we will use function B as the first function, function C as the second function, instruction I1 as the first instruction, and instruction I2 as the second instruction as an example for description.

[0039] Specifically, in step S201, in the binary code of the program to be tested, second code can be generated based on the first code of the function B to be tested. Here, the first code can be the original first code of function B, i.e., the original code of function B. The second code can include instructions I1, I2, and all instructions of the first code arranged in sequence. Instruction I1 is used to call the first instruction of this set of instructions. Instruction I2 is used to jump to the entry point of function C, which is responsible for function return detection. Instruction I1 can be a `call` instruction. Instruction I2 can be a `jmp` instruction. In practice, in assembly language, the `call` instruction is a call instruction and involves stack operations. When executing a `call` instruction, the address of the next instruction is generally pushed onto the stack. The `jmp` instruction, on the other hand, is a jump instruction and does not involve stack operations.

[0040] In step S203, the first instruction in the first code is modified to the third instruction, which is used to jump to the entry point of the second code.

[0041] After generating the second code, the first instruction in the first code can be modified to instruction I3 (the third instruction). Instruction I3 is used to jump to the entry point of the second code. Instruction I3 can be a jmp instruction. It should be noted that when instruction I1 is the first instruction of the second code, the entry point of the second code can be the address of instruction I1.

[0042] In one implementation, to help function C know which function it is returning from, an instruction I4 (the fourth instruction) can be added to the second code to push the original entry address of the first code (i.e., the original entry address of function B) onto the stack. Based on this, the second code can also include instruction I4, which is the instruction preceding instruction I1. In this case, the entry point of the second code can be the address of instruction I4.

[0043] In practice, when an instruction in the second code that precedes all the aforementioned instructions (such as instruction I4) involves a push operation, it will cause a change in the stack top. Since access to function call parameters is done through the stack top register, when the stack top changes, the offset needs to be corrected to access the original parameters.

[0044] Therefore, in one implementation, when the instruction preceding all the aforementioned instructions in the second code involves a stack push operation, if any of the aforementioned instructions contains an offset for accessing function call parameters, the offset in that instruction can be corrected in the second code. Specifically, when the aforementioned instructions include instruction I5 (the fifth instruction) for adjusting the value of the stack top register, for any instruction containing an offset relative to the memory address of the stack top register, if the offset exceeds the adjustment value of the stack top register in instruction I5, it can be determined that the offset is an offset for accessing function call parameters.

[0045] In one implementation, when any of the aforementioned instructions employs instruction-relative addressing, the offset in that instruction can be corrected in the second code to ensure that the instruction can be executed correctly in the second code. It should be noted that the offset used in this instruction is related to the instruction's address; since the instruction's location has changed, the offset in this instruction needs to be corrected.

[0046] Figure 2 The corresponding implementation provides a solution that, by constructing a new code copy of the function to be detected and modifying the original first code of the function to be detected, ensures that there is no overhead for the undetected function. Moreover, when the function to be detected finishes execution, the function responsible for detecting the function return will naturally gain control, without the need to use the expensive exception mechanism, thus having very little performance overhead.

[0047] After modifying the binary code of the program to be tested using the code modification process described above, the binary code can be run. Below, in conjunction with... Figure 3 This section describes the function call process during the execution of this binary code.

[0048] See Figure 3 This is a flowchart of the function return detection method in the embodiments of this specification. This method can be executed by a device, apparatus, or system with computing and processing capabilities (such as a system with dynamic performance detection capabilities).

[0049] like Figure 3 As shown, firstly, in step S301, in the binary code of the program to be tested, the first function is called by executing the instruction for calling the entry point of the first function in the caller function of the first function; wherein, the first instruction of the current first code of the first function is the rewritten third instruction, and the second code includes the equivalent code of the first instruction, the second instruction and all instructions in the original first code of the first function arranged in sequence.

[0050] In this context, the instruction in caller function A used to call function B can be classified as a `call` instruction. When this instruction is executed, the address of the next instruction can be pushed onto the stack. This way, when function C, responsible for function return detection, executes the last function return instruction, it can read the address of the next instruction from the stack and return to that instruction in caller function A to continue execution.

[0051] In step S303, the third instruction in the first code of the first function is executed to jump to the entry point of the second code.

[0052] Instruction I3 can be a jmp instruction. Since the jmp instruction does not involve stack operations, there is no need to push the address of the next instruction of instruction I3 onto the stack when executing instruction I3. It should be understood that in subsequent execution, the execution will not return to that next instruction in the current first line of code of function B to continue execution.

[0053] Furthermore, when instruction I1 is the first instruction of the second code, the entry point of the second code can be the address of instruction I1. After executing step S303, step S305 can be executed next. When the second code also includes instruction I4 as described above, instruction I4 is the first instruction of the second code, and the entry point of the second code can be the address of instruction I4. After executing step S303, the original entry address of function B can be pushed onto the stack by executing instruction I4 in the second code, and then step S305 can be executed next.

[0054] In step S305, the first instruction in the second code is executed to call the first instruction of the equivalent code, thereby executing the equivalent code.

[0055] Instruction I1 can be a call instruction. Since call instructions involve stack operations, when executing instruction I1, the address of the next instruction (i.e., instruction I2) can be pushed onto the stack. Thus, when executing the last function return instruction of the equivalent code above, the address of instruction I2 can be read from the stack, allowing execution to return to instruction I2 based on that address and continue execution.

[0056] In step S307, after the above equivalent code is executed, the second instruction in the second code is executed to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0057] Instruction I2 can be a jmp instruction. Since the jmp instruction does not involve stack operations, there is no need to push the address of the next instruction of instruction I2 onto the stack when executing instruction I2. It should be understood that in subsequent execution, execution will not return to that next instruction in the second code.

[0058] In one implementation, when the second code includes instruction I4, to avoid problems with function return, the code of function C may include instructions for obtaining the function entry address from the top of the stack and instructions for popping the top element of the stack, and these two instructions are placed before the function return instruction of the code.

[0059] Based on this, by executing the instruction in function C used to obtain the function entry address from the top of the stack, the original entry address of function B can be read from the stack. By executing the instruction in function C used to pop the top element from the stack, the original entry address of function B can be popped from the stack. Thus, when the function return instruction of function C is executed, the address of the instruction following the instruction in the calling function A that calls the entry point of function B can be read from the stack by executing this function return instruction, and execution can normally return to that next instruction in the calling function A based on that address to continue.

[0060] Through the function call process described above, the function responsible for function return detection will naturally gain control, without needing to use the expensive exception mechanism, thus having very little performance overhead.

[0061] The above combination Figure 2 and Figure 3 Described Figure 1 The method for detecting function return values ​​in the application scenario shown. Figure 1 In the application scenario shown, all instructions of the original first code of the function to be detected need to be copied into the new code copy of the function to be detected, which will increase the amount of binary code of the program to be detected.

[0062] To further reduce the size of the binary code of the program to be detected, this specification also provides another function return detection scheme. In this scheme, only a portion of the instructions of the original first code of the function to be detected needs to be copied into the new code copy of the function to be detected. This portion of instructions includes the first instruction of the original first code. Specifically, this portion of instructions can all be instructions in the original first code that will be overwritten in memory because the original first instruction will be rewritten to the aforementioned third instruction. Below, we will first combine... Figure 4 This section introduces application scenarios suitable for the detection scheme returned by this function.

[0063] See Figure 4 This is a schematic diagram illustrating one application scenario to which the embodiments of this specification can be applied. Figure 4The application scenario shown can include the current code of function B (referred to as the first code) in the binary code of the program to be tested, a new copy of function B's code (referred to as the second code), the code of function A, the caller of function B, and the code of function C, which is responsible for detecting function return. The current first code of function B is the code after in-place modification of the original first code of function B. The first instruction of the current first code of function B is the rewritten instruction I3. Instruction I3 is used to jump to the entry point of the second code.

[0064] The second code includes instructions I1, I2, equivalent code D2 (a portion of the instructions in the original first code of function B), and instruction I6, arranged sequentially. Instruction I1 is used to call the first instruction of equivalent code D2. Instruction I2 is used to jump to the entry point of function C. Instruction I6 is used to jump to the instruction following the last instruction of equivalent code D2 in the current first code of function B (e.g., ...). Figure 4 (See instruction I7 shown). Equivalent code D2 is exactly the same as some of the above instructions, or some instructions in equivalent code D2 have different offsets than the corresponding instructions in the above instructions. The offsets in these instructions are corrected offsets.

[0065] The code of caller function A includes instructions for calling function B. During the execution of the binary code of the program under test, this can be observed as follows: Figure 4 As indicated by label ①, function B is called by executing the entry instruction for calling function B within the caller function A. Then, it can be done as follows: Figure 4 As indicated by label ②, the execution of instruction I3 in the current first code of function B jumps to the entry point of the second code. If instruction I1 is the first instruction of the second code, executing instruction I3 can specifically jump to instruction I1 within the second code, and then proceed as follows... Figure 4 As indicated by label ③, the first instruction of the equivalent code D2 is called by instruction I1, thereby executing the equivalent code D2. After executing the equivalent code D2, it can be executed as follows: Figure 4 As indicated by label ④, execution jumps from instruction I6 to instruction I7 in the current first code of function B to continue execution. When execution reaches the last function return instruction in the current first code of function B, it can be done as follows: Figure 4 As indicated by label ⑤, the function returns to instruction I2 in the second code by executing the function return instruction. Then, it can be done as follows: Figure 4 As indicated by label ⑥, the execution instruction I2 jumps to the entry point of function C, thus executing function C. When the execution reaches the last function return instruction of function C, it can be done as follows: Figure 4As indicated by label ⑦, the execution of this function return instruction returns to the instruction following the entry point in the caller function A used to call function B, and continues execution.

[0066] By employing the function return detection process described above, function C can naturally gain control without relying on the expensive exception mechanism, thus achieving minimal performance overhead. Furthermore, compared to... Figure 1 Compared to the function return detection process in the application scenario shown, this method can reduce the amount of code in the second code, thereby reducing the amount of binary code in the program to be detected.

[0067] Below, based on Figure 4 The application scenario shown illustrates the process of modifying the binary code of the program to be tested.

[0068] See Figure 5 This is a flowchart of the function return detection method in the embodiments of this specification. This method can be executed by a device, apparatus, or system with computing and processing capabilities (such as a system with dynamic performance detection capabilities).

[0069] like Figure 5 As shown, firstly, in step S501, in the binary code of the program to be detected, a second code is generated based on the first code of the first function that is called. The second code includes a first instruction, a second instruction, a portion of the instructions of the first code, and a sixth instruction arranged in sequence. The portion of the instructions includes the first instruction of the first code. The first instruction is used to call the first instruction. The second instruction is used to jump to the entry point of the second function responsible for function return detection. The sixth instruction is used to jump to the instruction following the last instruction of the portion of the instructions in the first code.

[0070] The first function is the function to be tested. Below, we will describe the process using the first function as function B, the second function as function C, the first instruction as instruction I1, the second instruction as instruction I2, and the sixth instruction as instruction I6 as an example.

[0071] Specifically, in step S501, in the binary code of the program to be detected, second code can be generated based on the first code of the function B to be detected. Here, the first code can be the original first code of function B, i.e., the original code of function B. The second code can include instructions I1, I2, a portion of the instructions from the first code, and instruction I6 arranged sequentially. This portion of instructions includes the first instruction of the first code. Instruction I1 is used to call this first instruction. Instruction I2 is used to jump to the entry point of the second function responsible for function return detection. Instruction I6 is used to jump to the instruction following the last instruction of this portion of instructions in the first code. Instruction I1 can be a call instruction. Instructions I2 and I6 can be jmp instructions.

[0072] In one implementation, these instructions can all be instructions in the first code that will be overwritten in memory because the original first instruction is to be rewritten as instruction I3 (the third instruction). Instruction I3 is used to jump to the entry point of the second code. Furthermore, instruction I3 can be a jmp instruction.

[0073] In step S503, the first instruction in the first code is modified to the third instruction, which is used to jump to the entry point of the second code.

[0074] After generating the second code, the first instruction in the first code can be modified to instruction I3. It should be noted that when instruction I1 is the first instruction of the second code, the entry point of the second code can be the address of instruction I1.

[0075] In one implementation, to help function C know which function it is returning from, an instruction I4 (the fourth instruction) can be added to the second code to push the original entry address of the first code (i.e., the original entry address of function B) onto the stack. Based on this, the second code can also include instruction I4, which is the instruction preceding instruction I1. In this case, the entry point of the second code can be the address of instruction I4.

[0076] In practice, when an instruction preceding the aforementioned instructions in the second code (such as instruction I4) involves a push operation, it causes a change in the stack top. Since access to function call parameters is done through the stack top register, when the stack top changes, the offset needs to be corrected to access the original parameters.

[0077] Therefore, in one implementation, when the instruction preceding the aforementioned partial instructions in the second code involves a stack push operation, if the aforementioned partial instructions contain an instruction that includes an offset for accessing function call parameters, the second code can correct that offset in the instruction. Specifically, when the aforementioned partial instructions include instruction I5 (the fifth instruction) for adjusting the value of the stack top register, if the offset of the instruction containing an offset relative to the memory address of the stack top register exceeds the adjustment value of the stack top register in instruction I5, it can be determined that the offset is an offset for accessing function call parameters.

[0078] In addition, for any instruction in the first code other than the aforementioned instructions, if the instruction contains an access offset for a function call parameter, the access offset in the instruction can be corrected in the first code.

[0079] In one implementation, when one of the aforementioned instructions uses instruction relative addressing, the offset in that instruction can be corrected in the second code to ensure that the instruction can be executed normally in the second code.

[0080] Figure 5 The corresponding implementation provides a solution that, by constructing a new code copy of the function to be detected and modifying the original first code of the function to be detected, ensures no overhead for undetected functions. Furthermore, once the function to be detected completes execution, the function responsible for detecting function return will naturally gain control, eliminating the need for expensive exception mechanisms and thus achieving minimal performance overhead. Moreover, compared to... Figure 2 Compared with the solutions provided in the corresponding embodiments, the amount of binary code of the program to be tested can be effectively reduced.

[0081] In Adoption Figure 5 The code modification process described in the corresponding embodiment completes the modification of the binary code of the program to be tested, after which the binary code can be run. Below, in conjunction with... Figure 6 This section describes the function call process during the execution of this binary code.

[0082] See Figure 6 This is a flowchart of the function return detection method in the embodiments of this specification. This method can be executed by a device, apparatus, or system with computing and processing capabilities (such as a system with dynamic performance detection capabilities).

[0083] like Figure 6 As shown, firstly, in step S601, in the binary code of the program to be tested, the first function is called by executing the instruction for calling the entry point of the first function in the caller function of the first function; wherein, the first instruction of the current first code of the first function is the rewritten third instruction, and the second code includes the first instruction, the second instruction, the equivalent code of some instructions in the original first code of the first function, and the sixth instruction arranged in sequence, which includes the first instruction of the original first code.

[0084] In step S603, the third instruction in the first code of the first function is executed to jump to the entry point of the second code.

[0085] In step S605, the first instruction in the second code is executed to call the first instruction of the equivalent code, thereby executing the equivalent code.

[0086] For an explanation of steps S601-S605, please refer to the relevant explanations of steps S301-305 in the previous text, which will not be repeated here.

[0087] In step S607, after the equivalent code is executed, the sixth instruction in the second code is executed to jump to the next instruction in the first code of the first function after the last instruction of the equivalent code, thereby returning to the first code of the first function to continue execution.

[0088] Specifically, after the equivalent code above has been executed, the execution of instruction I6 in the second code can jump to the instruction following the last instruction of the equivalent code in the current first code of function B, thereby returning to the current first code of function B to continue execution.

[0089] In step S609, after the last instruction of the first code in the first function is executed, the second instruction in the second code jumps to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0090] Specifically, the last instruction of the first code in function B is generally a function return instruction. When executing this function return instruction in the first code of function B, the address of instruction I2 can be read from the stack by executing this function return instruction, and then the execution can return to instruction I2 in the second code based on that address. Afterwards, instruction I2 in the second code can be executed to jump to the entry point of function C, which is responsible for function return detection, and thus function C can be executed.

[0091] In one implementation, when the second code includes instruction I4, to avoid problems with function return, the code of function C may include instructions for obtaining the function entry address from the top of the stack and instructions for popping the top element of the stack, and these two instructions are placed before the function return instruction of the code.

[0092] Based on this, by executing the instruction in function C used to obtain the function entry address from the top of the stack, the original entry address of function B can be read from the stack. By executing the instruction in function C used to pop the top element from the stack, the original entry address of function B can be popped from the stack. Thus, when the function return instruction of function C is executed, the address of the instruction following the instruction in the calling function A that calls the entry point of function B can be read from the stack by executing this function return instruction, and execution can normally return to that next instruction in the calling function A based on that address to continue.

[0093] Through the function call process described above, the function responsible for function return detection naturally gains control, eliminating the need for expensive exception mechanisms and thus resulting in minimal performance overhead. Furthermore, with Figure 3 Compared with the solutions provided in the corresponding embodiments, the amount of binary code of the program to be tested can be effectively reduced.

[0094] It should be noted that the function return detection method described above is applicable to the detection of smart contracts on the blockchain. For example, function return detection can be performed on functions within smart contracts.

[0095] Figure 7 This is a schematic diagram of the function return detection device in the embodiments of this specification. This device can be applied to equipment or systems with computing and processing capabilities (such as systems with dynamic performance detection capabilities).

[0096] like Figure 7 As shown, the function return detection device 700 in the embodiments of this specification may include: a code generation unit 701 and an instruction modification unit 702. The code generation unit 701 is configured to generate second code in the binary code of the program to be detected based on the first code of the first function being called. The second code includes a first instruction, a second instruction, and all instructions of the first code arranged in sequence. The first instruction is used to call the first instruction of all instructions, and the second instruction is used to jump to the entry point of the second function responsible for function return detection. The instruction modification unit 702 is configured to modify the first instruction in the first code to a third instruction, and the third instruction is used to jump to the entry point of the second code.

[0097] In some embodiments, the second code further includes a fourth instruction, which is the instruction preceding the first instruction, for pushing the original entry address of the first code onto the stack.

[0098] In some embodiments, the instruction modification unit 702 may also be configured to: when there is an instruction among all the above instructions that contains an access offset for a function call parameter, modify the access offset in the second code.

[0099] In some embodiments, all of the above instructions include a fifth instruction, which is used to adjust the value of the stack top register; and the instruction modification unit 702 may also be configured to: for all of the above instructions containing an offset relative to the memory address of the stack top register, if the offset exceeds the adjustment value of the stack top register in the fifth instruction, then determine that the offset is an access offset for function call parameters.

[0100] In some embodiments, the instruction modification unit 702 may also be configured to: when there is an instruction among all the above instructions that uses instruction relative addressing, correct the offset in the instruction in the second code.

[0101] In some embodiments, the first instruction is a call instruction, and the second and third instructions are jmp instructions.

[0102] Figure 8This is a schematic diagram of the function return detection device in the embodiments of this specification. This device can be applied to equipment or systems with computing and processing capabilities (such as systems with dynamic performance detection capabilities).

[0103] like Figure 8 As shown, the function return detection device 800 in the embodiments of this specification may include: a code generation unit 801 and an instruction modification unit 802. The code generation unit 801 is configured to generate second code in the binary code of the program to be detected based on the first code of the first function being called. The second code includes a first instruction, a second instruction, a portion of the first code's instructions, and a sixth instruction arranged sequentially. The portion of the instructions includes the first instruction of the first code, the first instruction being used to call the first instruction, the second instruction being used to jump to the entry point of the second function responsible for function return detection, and the sixth instruction being used to jump to the instruction following the last instruction of the portion of the instructions in the first code. The instruction modification unit 802 is configured to modify the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code.

[0104] In some embodiments, the second code further includes a fourth instruction, which is the instruction preceding the first instruction, for pushing the original entry address of the first code onto the stack.

[0105] In some embodiments, the instruction modification unit 802 may also be configured to: when there is an instruction in the above-mentioned partial instructions that contains an access offset for a function call parameter, modify the access offset in the instruction in the second code.

[0106] In some embodiments, the aforementioned partial instructions include a fifth instruction, which is used to adjust the value of the stack top register; and the instruction modification unit 802 may also be configured to: for an instruction in the aforementioned partial instructions that includes an offset relative to the memory address of the stack top register, if the offset exceeds the adjustment value of the stack top register in the fifth instruction, then determine that the offset is an offset for accessing function call parameters.

[0107] In some embodiments, the instruction modification unit 802 may also be configured to: for any instruction in the first code other than the aforementioned partial instructions, if the instruction contains an access offset for a function call parameter, then modify the access offset in the instruction in the first code.

[0108] In some embodiments, the instruction modification unit 802 may also be configured to: when there is an instruction in the above-mentioned partial instructions that uses instruction relative addressing, correct the offset in the instruction in the second code.

[0109] In some embodiments, the aforementioned instructions are all instructions in the first code that will be overwritten in memory because the original first instruction is to be rewritten as a third instruction.

[0110] In some embodiments, the first instruction is a call instruction, and the second, third, and sixth instructions are jmp instructions.

[0111] Figure 9 This is a schematic diagram of the function return detection device in the embodiments of this specification. This device can be applied to equipment or systems with computing and processing capabilities (such as systems with dynamic performance detection capabilities).

[0112] like Figure 9 As shown, the function return detection device 900 in the embodiments of this specification may include: a first calling unit 901, a first jump unit 902, a second calling unit 903, and a second jump unit 904. The first calling unit 901 is configured to call the first function in the binary code of the program to be detected by executing an instruction for calling the entry point of the first function in the caller function of the first function; wherein the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes equivalent code of the first instruction, the second instruction, and all instructions in the original first code of the first function arranged in sequence; the first jump unit 902 is configured to execute the third instruction in the current first code to jump to the entry point of the second code; the second calling unit 903 is configured to execute the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; the second jump unit 904 is configured to, after the equivalent code is executed, execute the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0113] In some embodiments, the second code further includes a fourth instruction, which is the instruction preceding the first instruction, for pushing the original entry address of the first code onto the stack; and the above-described apparatus 900 may further include: an address pushing unit (not shown in the figure), configured to execute the fourth instruction in the second code to push the original entry address of the first code onto the stack before the second calling unit 903 executes the first instruction in the second code to call the first instruction of the equivalent code.

[0114] Figure 10 This is a schematic diagram of the function return detection device in the embodiments of this specification. This device can be applied to equipment or systems with computing and processing capabilities (such as systems with dynamic performance detection capabilities).

[0115] like Figure 10As shown, the function return detection device 1000 in the embodiments of this specification may include: a first calling unit 1001, a first jump unit 1002, a second calling unit 1003, a second jump unit 1004, and a third jump unit 1005. The first calling unit 1001 is configured to call the first function in the binary code of the program to be detected by executing an instruction for calling the entry point of the first function in the caller function of the first function; wherein the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes the first instruction, the second instruction, equivalent code of a portion of the original first code of the first function, and a sixth instruction arranged in sequence, the latter including the first instruction of the original first code; the first jump unit 1002 is configured to execute the third instruction in the current first code to jump to the entry point of the second code; the second... Calling unit 1003 is configured to execute the first instruction in the second code to call the first instruction of the equivalent code, thereby executing the equivalent code; the second jump unit 1004 is configured to, after the equivalent code is executed, execute the sixth instruction in the second code to jump to the instruction following the last instruction of the equivalent code in the current first code, thereby returning to the current first code to continue execution; the third jump unit 1005 is configured to, after the last instruction of the current first code is executed, execute the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function.

[0116] In some embodiments, the second code further includes a fourth instruction, which is the instruction preceding the first instruction, for pushing the original entry address of the first code onto the stack; and the above-described apparatus 1000 may further include: an address pushing unit (not shown in the figure), configured to execute the fourth instruction in the second code to push the original entry address of the first code onto the stack before the second calling unit 1003 executes the first instruction in the second code to call the first instruction of the equivalent code.

[0117] exist Figures 7-10 For further explanation of each unit in the corresponding device embodiments, please refer to the relevant descriptions in the previous method embodiments, which will not be repeated here.

[0118] This specification also provides a computer-readable storage medium storing a computer program thereon, wherein when the computer program is executed in a computer, it causes the computer to execute the function return detection method described in the above method embodiments.

[0119] This specification also provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the function return detection method described in the above method embodiments.

[0120] This specification also provides a computer program in its embodiments, wherein when the computer program is executed in a computer, the computer executes the function return detection method described in the above method embodiments.

[0121] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0122] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0123] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0124] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0125] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0126] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0127] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0128] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0129] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0130] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0131] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0132] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0134] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0135] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A function return detection method, comprising: In the binary code of the program to be tested, a second code is generated based on the first code of the first function that is called. The second code includes a first instruction, a second instruction, and all instructions of the first code arranged in sequence. The first instruction is used to call the first instruction of all instructions, and the second instruction is used to jump to the entry point of the second function responsible for function return detection. In the first code, the first instruction is modified to a third instruction, which is used to jump to the entry point of the second code, so that after the second function finishes execution, it returns to the caller function of the first function.

2. The method according to claim 1, wherein, The second code also includes a fourth instruction, which is the instruction preceding the first instruction, and is used to push the original entry address of the first code onto the stack.

3. The method according to claim 2, further comprising: When any of the instructions contains an instruction that includes an access offset for a function call parameter, the access offset in that instruction is corrected in the second code.

4. The method according to claim 3, wherein, The complete set of instructions includes a fifth instruction, which is used to adjust the value of the stack top register; as well as The method further includes: For any instruction containing an offset relative to the memory address of the stack top register, if the offset exceeds the adjustment value of the stack top register in the fifth instruction, then the offset is determined to be an offset for accessing function call parameters.

5. The method according to claim 1, further comprising: When there is an instruction among all the instructions that uses instruction relative addressing, the offset in that instruction is corrected in the second code.

6. The method according to any one of claims 1-5, wherein, The first instruction is a call instruction, and the second and third instructions are jmp instructions.

7. A method for detecting function return values, comprising: In the binary code of the program to be tested, a second code is generated based on the first code of the first function that is called. The second code includes a first instruction, a second instruction, a partial instruction of the first code, and a sixth instruction arranged in sequence. The partial instruction includes the first instruction of the first code. The first instruction is used to call the first instruction. The second instruction is used to jump to the entry point of the second function that is responsible for function return detection. The sixth instruction is used to jump to the instruction following the last instruction of the partial instruction in the first code. In the first code, the first instruction is modified to a third instruction, which is used to jump to the entry point of the second code, so that after the second function finishes execution, it returns to the caller function of the first function.

8. The method according to claim 7, wherein, The second code also includes a fourth instruction, which is the instruction preceding the first instruction, and is used to push the original entry address of the first code onto the stack.

9. The method according to claim 8, further comprising: When a portion of the instructions contains an instruction that includes an access offset for a function call parameter, the access offset in that instruction is corrected in the second code.

10. The method of claim 8, further comprising: For any instruction in the first code other than the aforementioned partial instructions, if the instruction contains an access offset for a function call parameter, then the access offset in the instruction is corrected in the first code.

11. The method according to claim 7, wherein, The aforementioned instructions are all instructions in the first code that will be overwritten in memory because the original first instruction is to be rewritten as the third instruction.

12. A function return detection method, comprising: In the binary code of the program to be tested, second code is generated based on the first code of the first function that is called. The first function is called by executing the entry instruction for calling the first function in the caller function. The first instruction of the first code of the first function is the rewritten third instruction. The second code includes the first instruction, the second instruction and the equivalent code of all instructions in the original first code of the first function arranged in sequence. Execute the third instruction in the current first code to jump to the entry point of the second code; The first instruction in the second code is executed to call the first instruction of the equivalent code, thereby executing the equivalent code; After the equivalent code is executed, the second instruction in the second code jumps to the entry point of the second function responsible for function return detection, thereby executing the second function, and returning to the caller function after the second function is executed.

13. A function return detection method, comprising: In the binary code of the program to be tested, second code is generated based on the first code of the first function to be called. The first function is called by executing the entry instruction for calling the first function in the caller function. The first instruction of the current first code of the first function is a rewritten third instruction. The second code includes the first instruction, the second instruction, the equivalent code of some instructions in the original first code of the first function, and the sixth instruction arranged in sequence. The partial instructions include the first instruction of the original first code. Execute the third instruction in the current first code to jump to the entry point of the second code; The first instruction in the second code is executed to call the first instruction of the equivalent code, thereby executing the equivalent code; After the equivalent code is executed, by executing the sixth instruction in the second code, the execution jumps to the instruction following the last instruction of the equivalent code in the current first code, thereby returning to the current first code to continue execution; After the last instruction of the current first code is executed, the second instruction in the second code jumps to the entry point of the second function responsible for function return detection, thereby executing the second function, and returning to the caller function after the second function is executed.

14. A function return detection device, comprising: The code generation unit is configured to generate second code in the binary code of the program to be detected based on the first code of the first function that is called. The second code includes a first instruction, a second instruction and all instructions of the first code arranged in sequence. The first instruction is used to call the first instruction of all instructions, and the second instruction is used to jump to the entry point of the second function responsible for function return detection. The instruction modification unit is configured to modify the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code, so that after the second function finishes execution, it returns to the caller function of the first function.

15. A function return detection device, comprising: The code generation unit is configured to generate second code in the binary code of the program to be detected based on the first code of the first function that is called. The second code includes a first instruction, a second instruction, a partial instruction of the first code, and a sixth instruction arranged in sequence. The partial instruction includes the first instruction of the first code. The first instruction is used to call the first instruction. The second instruction is used to jump to the entry point of the second function responsible for function return detection. The sixth instruction is used to jump to the instruction following the last instruction of the partial instruction in the first code. The instruction modification unit is configured to modify the first instruction in the first code to a third instruction, the third instruction being used to jump to the entry point of the second code, so that after the second function finishes execution, it returns to the caller function of the first function.

16. A function return detection device, comprising: The first calling unit is configured to generate second code in the binary code of the program to be tested based on the first code of the first function to be called, and to call the first function by executing the entry instruction for calling the first function in the caller function of the first function; wherein, the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes the first instruction, the second instruction and the equivalent code of all instructions in the original first code of the first function arranged in sequence; The first jump unit is configured to execute the third instruction in the current first code to jump to the entry point of the second code; The second calling unit is configured to execute the first instruction in the second code that calls the first instruction of the equivalent code, thereby executing the equivalent code; The second jump unit is configured to, after the equivalent code has been executed, execute the second instruction in the second code to jump to the entry point of the second function responsible for function return detection, thereby executing the second function, and returning to the caller function after the second function has been executed.

17. A function return detection device, comprising: The first calling unit is configured to generate second code in the binary code of the program to be tested based on the first code of the first function to be called, and to call the first function by executing the entry instruction for calling the first function in the caller function of the first function; wherein, the first instruction of the current first code of the first function is a rewritten third instruction, and the second code includes the first instruction, the second instruction, the equivalent code of a portion of the original first code of the first function, and the sixth instruction arranged in sequence, wherein the portion of the instructions includes the first instruction of the original first code; The first jump unit is configured to execute the third instruction in the current first code to jump to the entry point of the second code; The second calling unit is configured to execute the first instruction in the second code that calls the first instruction of the equivalent code, thereby executing the equivalent code; The second jump unit is configured to, after the equivalent code has been executed, execute the sixth instruction in the second code to jump to the instruction following the last instruction of the equivalent code in the current first code, thereby returning to the current first code to continue execution; The third jump unit is configured to execute the second instruction in the second code after the last instruction of the current first code has been executed, jump to the entry point of the second function responsible for function return detection, thereby executing the second function, and returning to the caller function after the second function has been executed.

18. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-13.

19. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-13.

Images