Stack repair method and device, electronic equipment and computer readable storage medium

Abstract

The application provides a stack repair method and device, electronic equipment and a computer readable storage medium. The method comprises: in the case of stack backtracking failure, obtaining function information of a first target function; wherein the first target function is a function to which the first target stack frame belongs, and the first target stack frame comprises a stack frame at the backtracking failure position; according to the function information, finding a stack consumption value of the first target function from a preset resource consumption table; and according to the stack consumption value, determining an actual return address and an actual ebp value of the first target stack frame. The application can repair the stack, so that stack backtracking can be correctly performed.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a stack repair method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] Stack backtracking is a common technique that prints out the function call stack, which is very helpful for analyzing function calls, debugging system anomalies, and even detecting abnormal attacks. However, in practical applications, the pointer register values ​​in the stack frames may be modified, for example, if stack pointer optimization is enabled during compilation. If this happens, stack backtracking will fail, requiring stack repair to obtain the correct return addresses of the stack frames needed for the backtracking process. Summary of the Invention

[0003] The purpose of this application is to provide a stack repair method, apparatus, electronic device, and computer-readable storage medium for stack repair.

[0004] This application provides a stack repair method, including: in the event of stack backtracking failure, obtaining function information of a first target function; wherein, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point of backtracking failure; finding the stack consumption value of the first target function from a preset resource consumption table according to the function information; and determining the actual return address of the first target stack frame according to the stack consumption value.

[0005] In the above implementation, after obtaining the function information of the function that may be abnormal (i.e. the first target function) in the case of stack backtracking failure, the stack consumption value of the first target function is found by looking up the preset resource consumption table. Based on the growth rules of the function stack, the actual return address of the first target stack frame can be estimated by using the stack consumption value, thereby repairing the stack and enabling correct stack backtracking.

[0006] Furthermore, the stack consumption value of the first objective function includes a first consumption value; the first consumption value is the stack consumption value generated when the first objective function calls the next level function;

[0007] Determining the actual return address of the first target stack frame based on the stack consumption value includes: determining the actual return address of the first target stack frame based on the first consumption value and the value of ebp (extended base pointer register) of the next level function.

[0008] Further, determining the actual return address of the first target stack frame based on the first consumption value and the ebp value of the next-level function includes: determining the ebp value in the first target stack frame when the first target function calls the next-level function based on the ebp value of the next-level function; and determining the actual return address of the first target stack frame based on the ebp value in the first target stack frame when the first target function calls the next-level function and the first consumption value.

[0009] Further, determining the actual return address of the first target stack frame based on the value of ebp in the first target stack frame when the first target function calls the next-level function, and the first consumption value, includes: calculating the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next-level function to obtain a second target address; obtaining the content within the second target address; the content within the second target address is the actual return address of the first target stack frame.

[0010] It is understandable that the stack frame generation mechanism can deduce the stack top pointer position of the first target function's stack frame based on the ebp value of the next-level function. The first consumption value is the stack consumption value generated when the first target function calls the next-level function. Therefore, adding this first consumption value to the stack top pointer position yields the actual return address. Thus, based on this method, the actual return address and actual ebp value of the first target stack frame can be determined quickly and accurately, enabling stack repair and allowing for correct stack backtracking.

[0011] Furthermore, the stack consumption value of the first target function also includes a second consumption value; the second consumption value is the stack consumption value of the first target function executing the push ebp instruction; the method further includes: determining the actual ebp value of the first target stack frame based on the ebp value of the next layer function, the first consumption value and the second consumption value.

[0012] Understandably, analysis of a large amount of disassembled code revealed that the stack frame's ebp is pushed before modification. Therefore, for an exception function, the actual size of the stack generated upwards after calling the next-level function should be the difference between the first and second consumption values. Based on the stack frame generation mechanism, the stack top pointer position of the first target function's stack frame can be estimated from the ebp value of the next-level function. Thus, based on the stack top pointer position and the actual size of the stack generated upwards, the actual ebp value of the first target stack frame can be estimated. Therefore, based on the above method, the actual return address and actual ebp value of the first target stack frame can be quickly and accurately determined, enabling stack repair and correct stack backtracking.

[0013] Further, determining the actual ebp value of the first target stack frame based on the ebp value of the next-level function, the first consumption value, and the second consumption value includes: determining the ebp value in the first target stack frame when the first target function calls the next-level function based on the ebp value of the next-level function; determining the stack growth value after the first target function calls the next-level function based on the first consumption value and the second consumption value; and determining the actual ebp value of the first target stack frame based on the ebp value in the first target stack frame when the first target function calls the next-level function and the stack growth value after the first target function calls the next-level function.

[0014] Further, determining the actual ebp value of the first target stack frame based on the ebp value in the first target stack frame when the first target function calls the next-level function, and the value of the stack growth after the first target function calls the next-level function, includes: calculating the sum of the ebp value in the first target stack frame when the first target function calls the next-level function and the value of the stack growth after the first target function calls the next-level function to obtain a first target address; obtaining the content within the first target address; the content within the first target address is the actual ebp value of the first target stack frame.

[0015] As analyzed above, based on the above implementation method, the actual ebp value of the first target stack frame can be determined quickly and accurately, the stack can be repaired, and stack backtracking can be performed correctly.

[0016] Furthermore, the method also includes: re-performing stack backtracking based on the actual return address of the first target stack frame.

[0017] Furthermore, the method also includes: if stack backtracking fails, obtaining the ebp value of the second target stack frame; the second target stack frame is a stack frame whose ebp value is not incorrect; according to the ebp value of the second target stack frame and the preset stack backtracking traversal formula, traversing all stack backtracking paths in sequence until stack backtracking is successful.

[0018] It is understandable that in some cases, the above implementation method may fail to repair (for example, the first and second consumption values ​​of the first objective function are not recorded in the preset resource consumption table). In this case, by traversing all stack backtracking paths, the stack backtracking path that makes the stack backtracking successful can be found (at this time, each ebp and return address constituting the stack backtracking path is considered correct). Thus, the recovery of abnormal ebp and return addresses can be achieved at least partially, and the stack can be repaired to a certain extent.

[0019] Further, the stack backtracking traversal formula includes: ebp(n+1) = [ebp(n)], ret(n+1) = [ebp(n) + m], ebp(j) = ebp(j) + m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at the nth level, and ebp(n) is the value of the stack frame at the nth level. +1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j)=ebp(j)+m represents adding m to the original value of ebp(j) during traversal to get the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

[0020] In the above implementation, based on the above formula, stack backtracking can be performed when only the second target stack frame is obtained as the ebp value, and the ebp value can be updated during the traversal process, thereby effectively realizing the traversal process.

[0021] Furthermore, the value of the new round of ebp(j) satisfies the following conditions: the value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

[0022] Based on the above restrictions, on the one hand, we can avoid unlimited updates to ebp, and on the other hand, we can ensure that the updated ebp value conforms to the stack generation rules, thus guaranteeing the correctness of the scheme execution.

[0023] Furthermore, the method includes: determining that the stack backtracking was successful when the return address of the highest-level stack frame in the function call chain belongs to the third target function.

[0024] Furthermore, the stack consumption value of the first objective function includes a third consumption value; the third consumption value is the memory value consumed by the stack frame of the first objective function.

[0025] Determining the actual return address of the first target stack frame based on the stack consumption value includes: determining the actual RSP value of the first target stack frame based on the third consumption value and the RSP (reextended stack pointer) value of the next level function called by the first target function; and determining the actual return address of the first target stack frame based on the actual RSP value of the first target stack frame.

[0026] It is understandable that for a 64-bit system, during stack backtracking, the OS (operating system) scans the executable file's memory mapping to find a RUNTIME_FUNCTION structure whose range includes the current instruction address. Based on the RUNTIME_FUNCTION structure, the operating system knows how to unpack the stack, i.e., it knows the stack memory consumption of the function stack frame (i.e., the memory value consumed by the stack frame). If the RUNTIME_FUNCTION structure cannot be retrieved during the backtracking process, the backtracking will fail. Therefore, in the above method of this application embodiment, by pre-configuring the correct stack consumption values ​​of each function in the resource consumption table, when stack backtracking fails, the actual RSP value of the first target stack frame can be determined by looking up the third consumption value of the first target function in the preset resource consumption table, thereby determining the actual return address of the first target stack frame and realizing stack repair.

[0027] Further, determining the actual RSP value of the first target stack frame based on the third consumption value and the RSP value of the next-level function called by the first target function includes: calculating the sum of the third consumption value and the RSP value of the next-level function called by the first target function to obtain the actual RSP value of the first target stack frame.

[0028] This application embodiment also provides a stack backtracking method, the method comprising: in the case of stack backtracking failure, obtaining the extended base address pointer register ebp value of a second target stack frame; the second target stack frame is a stack frame whose ebp value is not erroneous; according to the ebp value of the second target stack frame and a preset stack backtracking traversal formula, sequentially traversing all stack backtracking paths until stack backtracking is successful.

[0029] In the above implementation, by traversing all stack backtracking paths, the stack backtracking path that makes the stack backtracking successful can be found (at this time, each ebp and return address constituting the stack backtracking path is considered correct), thereby at least partially realizing the retrieval of the ebp and return address of the exception, and to a certain extent realizing the repair of the stack.

[0030] Further, the stack backtracking traversal formula includes: ebp(n+1) = [ebp(n)], ret(n+1) = [ebp(n) + m], ebp(j) = ebp(j) + m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at the nth level, and ebp(n) is the value of the stack frame at the nth level. +1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j)=ebp(j)+m represents adding m to the original value of ebp(j) during traversal to get the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

[0031] Furthermore, the value of the new round of ebp(j) satisfies the following conditions: the value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

[0032] Furthermore, the method includes: determining that the stack backtracking was successful when the return address of the highest-level stack frame in the function call chain belongs to the third target function.

[0033] This application embodiment also provides a stack repair device, including: a first acquisition module, used to acquire function information of a first target function when stack backtracking fails; wherein, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point of backtracking failure; a search module, used to search for the stack consumption value of the first target function from a preset resource consumption table according to the function information; and a correction module, used to determine the actual return address of the first target stack frame according to the stack consumption value.

[0034] This application embodiment also provides a stack backtracking device, including: a second acquisition module, used to acquire the extended base pointer register (ebp) value of a second target stack frame when stack backtracking fails; the second target stack frame is a stack frame whose ebp value is not erroneous; and a traversal module, used to traverse all stack backtracking paths sequentially according to the ebp value of the second target stack frame and a preset stack backtracking traversal formula until stack backtracking is successful.

[0035] This application also provides an electronic device, including a processor and a memory; the processor is used to execute a program stored in the memory to implement any of the above-mentioned stack repair methods or stack backtracking methods.

[0036] This application also provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement any of the above-mentioned stack repair methods or stack backtracking methods. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart illustrating a stack repair method provided in an embodiment of this application;

[0039] Figure 2 A flowchart illustrating a stack backtracking method provided in an embodiment of this application;

[0040] Figure 3 This is a schematic diagram of the structure of a stack repair device provided in an embodiment of this application;

[0041] Figure 4 This is a schematic diagram of the structure of a stack backtracking device provided in an embodiment of this application;

[0042] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0044] To achieve stack repair and enable correct stack backtracking, thus meeting the needs of business operations such as analyzing function calls, debugging system anomalies, and detecting abnormal attacks, the following stack repair methods are provided in the embodiments of this application.

[0045] See also Figure 1 As shown, Figure 1 This is a flowchart illustrating a stack repair method provided in an embodiment of this application, including:

[0046] S101: In the event of stack backtracking failure, obtain the function information of the first target function.

[0047] In the embodiments of this application, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point where backtracking failed.

[0048] In this embodiment of the application, when performing stack backtracking, at least the following two methods can be used to determine whether the stack backtracking has failed:

[0049] Method 1: Determine whether the function to which the return address of the highest-level stack frame in the function call chain belongs when the stack backtracking is complete is a specific third-target function. If it is a specific third-target function, then the stack backtracking is successful; otherwise, the stack backtracking has indeed failed.

[0050] As we can understand it, a function call chain refers to the chain of functions that we hope to trace back to during this stack backtrace. For example, if function A calls function B, function B calls function C, and function C calls function D, then functions A, B, C, and D constitute a function call chain. During stack backtrace, the backtrace will start from the stack frame of function D and proceed backwards (because the stack grows upwards in the memory address space (i.e., it expands continuously towards lower addresses), so stack backtrace will proceed downwards on the stack) until it reaches the stack frame of function A.

[0051] Under normal circumstances, when stack backtracking succeeds, the function to which the return address of the highest-level stack frame in the function call chain belongs is a specific function (i.e., the third target function). This function is determined by the system architecture and process bit width. For example, for an x86 architecture system with a 32-bit process, the third target function should be ntdll! RtlInitializeExceptionChain or ntdll! RtlUserThreadStart (ntdll is the module name, while RtlInitializeExceptionChain and RtlUserThreadStart are the function names). Therefore, when the function to which the return address of the highest-level stack frame in the function call chain belongs is not the third target function, it can be determined that stack backtracking has failed.

[0052] It can also be understood that the highest level in a function call chain refers to the level of the starting function in the function call chain. Taking the function call chain consisting of functions A, B, C, and D mentioned earlier as an example, the level of function A is the highest level in the function call chain, while the level of function D is the lowest level in the function call chain.

[0053] Method 2: Determine whether the return address obtained from each level of stack backtracking is the address of a function within a specific module. If not, the stack backtracking is considered to have failed.

[0054] It is understandable that the so-called specific module refers to the module in the function call chain where the function is located during stack backtracking.

[0055] It is understood that, in the embodiments of this application, after the stack backtracking is completed, it can be determined whether the stack backtracking has failed based on method one or method two, and after it is determined that the stack backtracking has failed, the first target function can be determined based on the stack frame whose return address is not the function address in a specific module (i.e., the first target stack frame).

[0056] Alternatively, in this embodiment, method two can be used for judgment during stack backtracking. Once it is determined that a return address does not belong to a function address within a specific module, stack backtracking is stopped, and the stack frame whose return address is not a function address within a specific module is then processed according to the embodiments of this application. Figure 1 The solution involves repairing the stack frame by obtaining its actual return address and ebp value, and then continuing the stack backtracking process based on these values. This process is repeated until the stack backtracking is complete.

[0057] In the embodiments of this application, the obtained function information may be the identification information of the first target function, such as the function name, but this is not a limitation.

[0058] S102: Find the stack consumption value of the first target function from the preset resource consumption table according to the function information.

[0059] In this embodiment, the resource consumption table can be pre-recorded during the compilation of each function or during the process of collecting a whitelist library of instruction sequences (this library is typically collected in attack detection techniques, and the collection process calls each function). The resource consumption table can record function information (e.g., function name) and stack consumption value, so that the stack consumption value of the first target function can be obtained by looking up the table based on the function information of the first target function.

[0060] S103: Determine the actual return address of the first target stack frame based on the stack consumption value of the first target function.

[0061] In some embodiments of this application, the stack consumption value of the first target function may include a first consumption value. The first consumption value is the stack consumption value generated when the first target function calls the next level function.

[0062] At this point, step S103 may be to determine the actual return address of the first target stack frame based on the first consumption value and the expanded ebp value of the next-level function called by the first target function.

[0063] It is understood that, in this embodiment of the application, the ebp value of the next-level function called by the first target function can be obtained. Specifically, the ebp value used when backtracking to the first target stack frame during the stack backtracking process can be found, and this value is the ebp value of the next-level function called by the first target function.

[0064] Optionally, in this embodiment, the value of ebp in the first target stack frame when the first target function calls the next-level function can be determined based on the ebp value of the next-level function, and the actual return address of the first target stack frame can be determined together with the value of ebp in the first target stack frame when the first target function calls the next-level function and the first consumption value.

[0065] For example, the sum of the ebp value and the first consumption value in the first target stack frame when the first target function calls the next level function can be calculated to obtain the second target address. Then, the content within the second target address can be retrieved. The content within the second target address is the actual return location of the first target stack frame.

[0066] It is understandable that the specific method for determining the value of ebp in the first target stack frame when the first target function calls the next-level function based on the ebp value of the next-level function is determined by the system architecture and process bit width. For example, for an x86 architecture system with a 32-bit process, the ebp value of the next-level function can be increased by 8 to obtain the value of ebp in the first target stack frame when the first target function calls the next-level function.

[0067] In some optional embodiments of this application, the stack consumption value of the first target function may further include a second consumption value. The second consumption value is the stack consumption value of the first target function executing the push ebp instruction.

[0068] It can be understood that the push ebp instruction refers to the instruction that performs the push ebp operation, which is the operation of pushing the function's stack pointer onto the stack.

[0069] It can also be understood that in the embodiments of this application, the first consumption value and the second consumption value refer to the amount of space consumed by the stack, which is essentially the amount of storage space occupied.

[0070] In this optional implementation, the actual ebp value of the first target stack frame can be determined based on the ebp value, the second consumption value, and the first consumption value of the next-level function.

[0071] Optionally, the value of ebp in the first target stack frame when the first target function calls the next-level function can be determined based on the ebp value of the next-level function, and the value of stack growth after the first target function calls the next-level function can be determined based on the first consumption value and the second consumption value.

[0072] Subsequently, based on the value of ebp in the first target stack frame when the first target function calls the next level function, and the value of the stack growing upward after the first target function calls the next level function, the actual ebp value of the first target stack frame is determined.

[0073] For example, the first target address can be obtained by calculating the value of ebp in the first target stack frame when the first target function calls the next level function, and the sum of the stack growth after the first target function calls the next level function. Then, the content within the first target address is retrieved. The content within the first target address is the actual ebp value of the first target stack frame.

[0074] It is understood that, based on the above embodiments, after obtaining the function information of the function that may be abnormal (i.e., the first target function) in the case of stack backtracking failure, the first resource consumption value generated by the first target function when calling the next level function and the second resource consumption value of executing the push ebp instruction are found through the preset resource consumption table. Thus, the actual return address and actual ebp value of the first target stack frame can be estimated based on the first and second resource consumption values, thereby repairing the stack and enabling correct stack backtracking.

[0075] See below. Figure 2 As shown, Figure 2 This is a flowchart illustrating a stack backtracking method provided in an embodiment of this application, including:

[0076] S201: In the event of a stack backtracking failure, obtain the value of the extended base pointer register ebp of the second target stack frame.

[0077] This is understandable; how to determine whether stack backtracking has failed can be found in the previous text, and will not be repeated here.

[0078] In this embodiment, the second target stack frame is a stack frame whose ebp value is not incorrect. In this embodiment, a stack frame that is backtracked before the first target stack frame during the stack backtracking process can be taken as the second target stack frame to ensure that the erroneous first target stack frame can be included during the traversal.

[0079] S202: Based on the ebp value of the second target stack frame and the preset stack backtracking traversal formula, traverse all stack backtracking paths in sequence until the stack backtracking is successful.

[0080] It is understood that in this embodiment, the stack backtracking formula includes two parts: the stack backtracking formula and the ebp value update formula. The stack backtracking formula is determined by the system architecture and process bit width used.

[0081] For example, for systems with x86 architecture and 32-bit processes, the stack backtracking formula is ebp(n+1) = [ebp(n)], ret(n+1) = [ebp(n) + 4], where ebp(n) is the ebp value of the stack frame at level n, ebp(n+1) is the ebp value of the stack frame at level (n+1), and ret(n+1) is the return address of the stack frame at level (n+1). The square brackets in the formula indicate that the content within the address inside the square brackets is taken, and n takes values ​​from 0 to k2, where k2 is the second largest level in the function call chain of the stack backtracking. For example, for the function call chain consisting of functions A, B, C, and D mentioned above, function A is at level 3, function D is at level 0, and k2 equals 2. This formula means that the calculation starts from n equal to 0 and iterates to obtain ebp(k2+1) = [ebp(k2)], ret(k2+1) = [ebp(k2) + 4].

[0082] In this embodiment, the stack backtracking formula can be ebp(n+1)=[ebp(n)], ret(n+1)=[ebp(n)+m], where m is a constant, and its specific value is determined according to the system architecture and process bit width used. For example, in the above example, the system m value is 4 for x86 architecture and 32-bit process.

[0083] In this embodiment, when using the stack backtracking formula for stack repair, since the second target stack frame may not be the stack frame corresponding to the lowest level function in the function call chain, the value of n does not need to start from 0. When using the stack backtracking formula for stack repair, n can be k1 to k2 sequentially, where k1 is the level number of the second target stack frame in the function call chain.

[0084] In this embodiment of the application, the formula for updating the ebp value can be ebp(j) = ebp(j) + m. ebp(j) = ebp(j) + m means that during traversal, the original value of ebp(j) is added to m to obtain the value of ebp(j) in the new round, where ebp(j) is the ebp that needs to be updated in this round of traversal, and k1≤j≤k2.

[0085] It is understood that the stack has a size limit. Therefore, in this embodiment, ebp(j) cannot grow indefinitely. In this embodiment, the value of ebp(j) in the new round should meet the following conditions: the value of ebp(j) in the new round is less than the stack bottom address (StackBase) and greater than the minimum address of the stack (StackLimit), and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of ebp(j) in the new round.

[0086] It can also be understood that, in the embodiments of this application, after each round of traversal, it can be determined whether the function to which the return address of the highest level stack frame in the function call chain obtained in this round of traversal belongs is the third target function. If so, it is determined that the stack backtracking of this round of traversal is successful; otherwise, it is determined that the stack backtracking of this round of traversal fails.

[0087] It's also understandable that the stack backtracking formula described above is used multiple times during each traversal. In this case, it's not necessarily necessary to update the ebp value every time the formula is used. Specifically, since ebp(n+1) = [ebp(n)], meaning the ebp value of the previous level is derived from the ebp value of the next level, a change in the ebp value of the next level will also change the ebp value of the previous level. Backtracking from the ebp value of level k1 to the ebp value of level k2+1 constitutes a stack backtracking path. Therefore, changing the ebp value at any level in the stack backtracking path results in a new stack backtracking path. Thus, during each traversal, it's sufficient that the combination of updated ebp values ​​differs from the combination of changed ebp values ​​in the already traversed stack backtracking path. However, it's important to note that for stack frames with correct ebp values, their ebp values ​​are not updated.

[0088] For example, updates can begin from the lower-level ebp value and proceed to the higher-level ebp value. Taking the function call chain consisting of functions A, B, C, and D as an example, assuming a backtracking exception occurs at function C (i.e., the stack frame corresponding to function C is the first target stack frame), then the stack frame corresponding to function D is the second target stack frame, and k1 is 0. Assuming an x86 architecture and a 32-bit process system, the traversal process is as follows:

[0089] Calculate ebp(1) = [ebp(0)], ret(1) = [ebp(0) + 4], continue calculating ebp(2) = [ebp(1)], ret(2) = [ebp(2) + 4], continue calculating ebp(3) = [ebp(2)], ret(3) = [ebp(2) + 4], and determine if ret(3) is (ntdll!RtlInitializeExceptionChain, ntdll!RtlUserThreadStart). If not, add 4 to ebp(0) and re-execute the above process until the ebp(0) stack backtracks successfully or ebp(0) can no longer be added.

[0090] If the stack backtracking still fails, ebp(0) returns to its initial value. Calculate ebp(1) = [ebp(0)], ret(1) = [ebp(0) + 4]. After adding 4 to ebp(1), continue calculating ebp(2) = [ebp(1)], ret(2) = [ebp(2) + 4], and continue calculating ebp(3) = [ebp(2)], ret(3) = [ebp(2) + 4]. Check if ret(3) is (ntdll!RtlInitializeExceptionChain, ntdll!RtlUserThreadStart). If not, add 4 to ebp(0) and re-execute the above process until the stack backtracking of ebp(0) succeeds or ebp(0) can no longer be added.

[0091] If the stack backtracking still fails, ebp(0) returns to its initial value. Calculate ebp(1) = [ebp(0)], ret(1) = [ebp(0) + 4]. Add 8 to ebp(1) and continue calculating ebp(2) = [ebp(1)], ret(2) = [ebp(2) + 4]. Continue calculating ebp(3) = [ebp(2)], ret(3) = [ebp(2) + 4]. Check if ret(3) is (ntdll!RtlInitializeExceptionChain, ntdll!RtlUserThreadStart). If not, add 4 to ebp(0) and re-execute the above process until the stack backtracking of ebp(0) succeeds or ebp(0) can no longer be added.

[0092] Repeat the above process until a path is found that allows the stack to backtrack successfully.

[0093] In the embodiments of this application, the above Figure 2 By traversing all stack backtracking paths, the stack backtracking path that makes the stack backtracking successful can be found (at this time, the ebp and return address that constitute the stack backtracking path are considered to be correct). Thus, the ebp and return address of the exception can be retrieved at least partially, and the stack can be repaired to a certain extent.

[0094] It is understandable that the stack repair method and the stack backtracking method described above can be used in combination. Specifically, one can first use... Figure 1 Repair using the stack repair method shown, based on Figure 1 After the stack repair method is used, the stack backtracking is performed again based on the actual return address and actual ebp value of the first target stack frame. If the stack backtracking still fails at this time (for example, the second consumption value and the first consumption value of the first target function are not recorded in the preset resource consumption table), then the following can be used: Figure 2The stack backtracking method shown is used to repair the system again, thereby further improving the reliability and feasibility of the repair.

[0095] Understandably, for a 64-bit system, during stack backtracking, the OS scans the executable file's memory mapping to find a `RUNTIME_FUNCTION` structure whose range includes the current instruction address. Based on the `RUNTIME_FUNCTION` structure, the OS knows how to unroll the stack, i.e., it knows the stack memory consumption of the function stack frame (i.e., the memory value consumed by the stack frame). If the `RUNTIME_FUNCTION` structure cannot be found during the backtracking process, the backtracking will fail.

[0096] Therefore, in some optional embodiments of this application, the stack consumption value of the first target function may include a third consumption value. The third consumption value is the memory value consumed by the stack frame of the first target function.

[0097] Subsequently, for step S103, the actual RSP value of the first target stack frame can be determined based on the third consumption value and the RSP value of the next-level function called by the first target function. Then, the actual return address of the first target stack frame is determined based on the actual RSP value of the first target stack frame.

[0098] Specifically, the actual RSP value of the first target stack frame can be obtained by summing the third consumption value and the RSP value of the next-level function called by the first target function.

[0099] Then, the actual return address of the first target stack frame is obtained according to the formula Ret = [Rsp - 8].

[0100] It can be understood that Ret refers to the actual return address of the first target stack frame, and Rsp is the actual RSP value of the first target stack frame. The formula Ret = [Rsp - 8] represents the content within the address obtained after taking Rsp - 8, which is the actual return address of the first target stack frame.

[0101] Based on the same inventive concept, this application also provides two stack repair devices, 300 and 400. Please refer to... Figure 3 and Figure 4 As shown, Figure 3 It shows the use of Figure 1 The stack repair device 300 of the method shown, Figure 4 It shows the use of Figure 2The method illustrated includes a stack backtracking device 400. It should be understood that the specific functions of devices 300 and 400 are described above; to avoid repetition, detailed descriptions are omitted here. Devices 300 and 400 include at least one software functional module that can be stored in memory or embedded in the operating system of devices 300 and 400 in the form of software or firmware. Specifically:

[0102] See Figure 3 As shown, device 300 may include:

[0103] The first acquisition module 301 is used to acquire function information of the first target function when the stack backtracking fails; wherein, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point of backtracking failure;

[0104] The lookup module 302 is used to look up the stack consumption value of the first target function from a preset resource consumption table based on the function information;

[0105] The correction module 303 is used to determine the actual return address and the actual extended base pointer register (ebp) value of the first target stack frame based on the stack consumption value.

[0106] In an optional embodiment of this application, the stack consumption value of the first target function includes a first consumption value; the first consumption value is the stack consumption value generated when the first target function calls the next-level function. The correction module 303 is specifically used to: determine the actual return address of the first target stack frame based on the first consumption value and the value of the extended base pointer register ebp of the next-level function.

[0107] In the above optional embodiments, the correction module 303 is specifically used to: determine the value of ebp in the first target stack frame when the first target function calls the next-level function based on the value of ebp in the next-level function; and determine the actual return address of the first target stack frame based on the value of ebp in the first target stack frame when the first target function calls the next-level function and the first consumption value.

[0108] In the above optional implementation, the correction module 303 is specifically used to: calculate the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, to obtain the second target address; obtain the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

[0109] In the above optional implementation, the stack consumption value of the first target function further includes a second consumption value; the second consumption value is the stack consumption value of the first target function executing the push ebp instruction. The correction module 303 is further configured to: determine the actual ebp value of the first target stack frame based on the ebp value of the next-level function, the first consumption value, and the second consumption value.

[0110] In the above optional embodiments, the correction module 303 is specifically used for:

[0111] The value of ebp in the first target stack frame when the first target function calls the next-level function is determined based on the value of ebp in the next-level function.

[0112] The stack growth value after the first target function calls the next level function is determined based on the first consumption value and the second consumption value;

[0113] The actual ebp value of the first target stack frame is determined based on the ebp value in the first target stack frame when the first target function calls the next-level function, and the value of the stack growth after the first target function calls the next-level function.

[0114] In the above optional embodiments, the correction module 303 is specifically used for:

[0115] The first target address is obtained by calculating the value of ebp in the first target stack frame when the first target function calls the next layer function, and the sum of the value of the stack growing upward after the first target function calls the next layer function.

[0116] Obtain the content within the first target address; the content within the first target address is the actual ebp value of the first target stack frame.

[0117] In this embodiment of the application, the correction module 303 is specifically used to: calculate the sum of the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next layer function, to obtain the second target address; obtain the content in the second target address; the content in the second target address is the actual return address of the first target stack frame.

[0118] In this embodiment of the application, the device 300 may further include a backtracking control module, which is used to re-perform stack backtracking based on the actual return address of the first target stack frame.

[0119] In this embodiment, the first acquisition module 301 can also be used to acquire the ebp value of a second target stack frame in the event of a stack backtracking failure; the second target stack frame is a stack frame whose ebp value is not incorrect. The backtracking control module is further used to traverse all stack backtracking paths sequentially according to the ebp value of the second target stack frame and a preset stack backtracking traversal formula until the stack backtracking is successful.

[0120] In this embodiment, the stack backtracking formula includes: ebp(n+1) = [ebp(n)], ret(n+1) = [ebp(n) + m], ebp(j) = ebp(j) + m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, and ebp(n) is the ebp value of the stack frame at the nth level. (n+1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j) = ebp(j) + m represents adding m to the original value of ebp(j) during traversal to get the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

[0121] In this embodiment of the application, the value of the new round of ebp(j) satisfies the following conditions: the value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

[0122] In this embodiment of the application, the backtracking control module is further used to determine that the stack backtracking is successful when the function to which the return address of the highest level stack frame in the function call chain belongs is the third target function.

[0123] In another optional embodiment of this application, the stack consumption value of the first target function includes a third consumption value; the third consumption value is the memory value consumed by the stack frame of the first target function.

[0124] The correction module 303 is specifically used to: determine the actual RSP value of the first target stack frame based on the third consumption value and the RSP value of the stack top pointer register of the next level function called by the first target function; and determine the actual return address of the first target stack frame based on the actual RSP value of the first target stack frame.

[0125] In one example of the above optional implementation, the correction module 303 is specifically used to: calculate the sum of the third consumption value and the RSP value of the next-level function called by the first target function to obtain the actual RSP value of the first target stack frame.

[0126] See Figure 4 As shown, the stack backtracking device 400 may include:

[0127] The second acquisition module 401 is used to acquire the extended base pointer register ebp value of the second target stack frame in the event of stack backtracking failure; the second target stack frame is a stack frame whose ebp value is not erroneous.

[0128] The traversal module 402 is used to traverse all stack backtracking paths sequentially according to the ebp value of the second target stack frame and the preset stack backtracking traversal formula until the stack backtracking is successful.

[0129] In this embodiment, the stack backtracking formula includes: ebp(n+1) = [ebp(n)], ret(n+1) = [ebp(n) + m], ebp(j) = ebp(j) + m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, and ebp(n) is the ebp value of the stack frame at the nth level. (n+1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j) = ebp(j) + m represents adding m to the original value of ebp(j) during traversal to get the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

[0130] In this embodiment of the application, the value of the new round of ebp(j) satisfies the following conditions: the value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

[0131] In this embodiment of the application, the traversal module 402 is specifically used to: determine that the stack backtracking is successful when the function to which the return address of the highest level stack frame in the function call chain belongs is the third target function.

[0132] It should be understood that, for the sake of brevity, some of the content described in the method embodiments will not be repeated in the device embodiments.

[0133] Based on the same inventive concept, this application also provides an electronic device, see [link to relevant documentation]. Figure 5 As shown, it includes a processor 501 and a memory 502. Wherein:

[0134] The processor 501 is used to execute one or more programs stored in the memory 502 to implement the stack repair method or stack backtracking method described in the above embodiments.

[0135] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0136] For example, the processor 501 and the memory 502 may be connected via a communication bus. As another example, the electronic device may also include components such as a display, mouse, and keyboard.

[0137] In this embodiment, the processor 501 can be a central processing unit, a microprocessor, a microcontroller, etc., but this is not a limitation. The memory 502 can be a random access memory, a read-only memory, a programmable read-only memory, an erasable read-only memory, an electrically erasable read-only memory, etc., but this is not a limitation.

[0138] In the embodiments of this application, the electronic device can be, but is not limited to, physical devices such as desktop computers, laptops, smartphones, smart wearable devices, and in-vehicle devices, or virtual devices such as virtual machines. Furthermore, the electronic device is not necessarily a single device; it can be a combination of multiple devices, such as a server cluster, etc.

[0139] This embodiment also provides a computer-readable storage medium, such as a floppy disk, optical disk, hard disk, flash memory, USB flash drive, SD (Secure Digital Memory Card), MMC (Multimedia Card), etc., in which one or more programs implementing the above steps are stored. These one or more programs can be executed by one or more processors to implement the stack repair method or stack backtracking method of the above embodiments. Further details will not be elaborated here.

[0140] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0141] In the various embodiments of this application, the functional modules can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0142] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0143] In this article, "multiple" refers to two or more.

[0144] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A stack repair method, characterized in that, include: In the event of a stack backtracking failure, obtain the function information of the first target function; wherein, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point of backtracking failure; The stack consumption value of the first target function is retrieved from the preset resource consumption table based on the function information. The actual return address of the first target stack frame is determined based on the stack consumption value; The method further includes: re-performing stack backtracking based on the actual return address of the first target stack frame; The method further includes: if stack backtracking fails, obtaining the ebp value of the second target stack frame; the second target stack frame is a stack frame whose ebp value is not incorrect; according to the ebp value of the second target stack frame and the preset stack backtracking traversal formula, traversing all stack backtracking paths in sequence until stack backtracking is successful. The stack backtracking traversal formula includes: ebp(n+1)=[ebp(n)], ret(n+1)=[ebp(n)+m], ebp(j)=ebp(j)+m; Wherein, n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at level n, ebp(n+1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j) = ebp(j) + m represents adding m to the original value of ebp(j) during traversal to obtain the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, and k1≤j≤k2.

2. The stack repair method as described in claim 1, characterized in that, The stack consumption value of the first target function includes a first consumption value; the first consumption value is the stack consumption value generated when the first target function calls the next level function; Determining the actual return address of the first target stack frame based on the stack consumption value includes: The actual return address of the first target stack frame is determined based on the first consumption value and the value of the extended base pointer register ebp of the next-level function.

3. The stack repair method as described in claim 2, characterized in that, Determining the actual return address of the first target stack frame based on the first consumption value and the ebp value of the next-level function includes: The value of ebp in the first target stack frame when the first target function calls the next-level function is determined based on the value of ebp in the next-level function. The actual return address of the first target stack frame is determined based on the value of ebp in the first target stack frame when the first target function calls the next level function, and the first consumption value.

4. The stack repair method as described in claim 3, characterized in that, The actual return address of the first target stack frame is determined based on the value of ebp in the first target stack frame when the first target function calls the next-level function, and the first consumption value, including: The second target address is obtained by summing the value of ebp in the first target stack frame and the first consumption value when the first target function calls the next level function; Obtain the content within the second target address; the content within the second target address is the actual return address of the first target stack frame.

5. The stack repair method as described in claim 2, characterized in that, The stack consumption value of the first target function also includes a second consumption value; the second consumption value is the stack consumption value of the first target function executing the push ebp instruction; The method further includes: The actual ebp value of the first target stack frame is determined based on the ebp value of the next layer function, the first consumption value, and the second consumption value.

6. The stack repair method as described in claim 5, characterized in that, Based on the ebp value of the next-level function, the first consumption value, and the second consumption value, the actual ebp value of the first target stack frame is determined, including: The value of ebp in the first target stack frame when the first target function calls the next-level function is determined based on the value of ebp in the next-level function. The stack growth value after the first target function calls the next level function is determined based on the first consumption value and the second consumption value; The actual ebp value of the first target stack frame is determined based on the ebp value in the first target stack frame when the first target function calls the next-level function, and the value of the stack growth after the first target function calls the next-level function.

7. The stack repair method as described in claim 6, characterized in that, Based on the value of ebp in the first target stack frame when the first target function calls the next-level function, and the value of stack growth after the first target function calls the next-level function, the actual ebp value of the first target stack frame is determined, including: The first target address is obtained by calculating the value of ebp in the first target stack frame when the first target function calls the next layer function, and the sum of the value of the stack growing upward after the first target function calls the next layer function. Obtain the content within the first target address; the content within the first target address is the actual ebp value of the first target stack frame.

8. The stack repair method as described in claim 1, characterized in that, The value of ebp(j) in the new round satisfies the following condition: The value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

9. The stack repair method as described in claim 1, characterized in that, The method includes: The stack backtracking is considered successful when the return address of the highest-level stack frame in the function call chain belongs to the third target function.

10. The stack repair method as described in claim 1, characterized in that, The stack consumption value of the first objective function includes a third consumption value; the third consumption value is the memory value consumed by the stack frame of the first objective function. Determining the actual return address of the first target stack frame based on the stack consumption value includes: The actual RSP value of the first target stack frame is determined based on the third consumption value and the RSP value of the stack pointer register of the next level function called by the first target function. The actual return address of the first target stack frame is determined based on the actual RSP value of the first target stack frame.

11. The stack repair method as described in claim 10, characterized in that, The actual RSP value of the first target stack frame is determined based on the third consumption value and the RSP value of the next-level function called by the first target function, including: The sum of the third consumption value and the RSP value of the next-level function called by the first target function is calculated to obtain the actual RSP value of the first target stack frame.

12. A stack backtracking method, characterized in that, The method includes: If stack backtracking fails, obtain the extended base pointer register (ebp) value of the second target stack frame; the second target stack frame is a stack frame whose ebp value is not incorrect. Based on the ebp value of the second target stack frame and the preset stack backtracking traversal formula, all stack backtracking paths are traversed sequentially until the stack backtracking is successful. The stack backtracking traversal formula includes: ebp(n+1)=[ebp(n)], ret(n+1)=[ebp(n)+m], ebp(j)=ebp(j)+m; Wherein, n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at level n, ebp(n+1) is the ebp value of the stack frame at level n+1, ret(n+1) is the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j) = ebp(j) + m represents adding m to the original value of ebp(j) during traversal to obtain the value of ebp(j) in the new round, ebp(j) is the ebp that needs to be updated in this round of traversal, and k1≤j≤k2.

13. The stack backtracking method as described in claim 12, characterized in that, The value of ebp(j) in the new round satisfies the following condition: The value of the new round of ebp(j) is less than the stack bottom address and greater than the minimum address of the stack, and the value of ebp(j+1) obtained based on the new round of ebp(j) is greater than the value of the new round of ebp(j).

14. The stack backtracking method as described in any one of claims 12-13, characterized in that, The method includes: The stack backtracking is considered successful when the return address of the highest-level stack frame in the function call chain belongs to the third target function.

15. A stack repair device, characterized in that, include: The first acquisition module is used to acquire function information of the first target function when the stack backtracking fails; wherein, the first target function is the function to which the first target stack frame belongs, and the first target stack frame includes the stack frame at the point of backtracking failure; The lookup module is used to find the stack consumption value of the first target function from a preset resource consumption table based on the function information; The correction module is used to determine the actual return address of the first target stack frame based on the stack consumption value; The backtracking control module is used to re-perform stack backtracking based on the actual return address of the first target stack frame; The first acquisition module is also used to acquire the ebp value of the second target stack frame in the event of stack backtracking failure; the second target stack frame is a stack frame whose ebp value is not incorrect; the backtracking control module is also used to traverse all stack backtracking paths in sequence according to the ebp value of the second target stack frame and the preset stack backtracking traversal formula until the stack backtracking is successful. The stack backtracking formula includes: ebp(n+1)=[ebp(n)], ret(n+1)=[ebp(n)+m], ebp(j)=ebp(j)+m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at level n, and ebp(n+1) is the value of the stack frame at level n. ) represents the ebp value of the stack frame at level n+1, ret(n+1) represents the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j)=ebp(j)+m represents adding m to the original value of ebp(j) during traversal to get the new value of ebp(j), ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

16. A stack backtracking device, characterized in that, include: The second acquisition module is used to acquire the extended base pointer register ebp value of the second target stack frame in the event of stack backtracking failure. The second target stack frame is a stack frame whose ebp value is not incorrect; The traversal module is used to traverse all stack backtracking paths sequentially according to the ebp value of the second target stack frame and the preset stack backtracking traversal formula until the stack backtracking is successful. The stack backtracking formula includes: ebp(n+1)=[ebp(n)], ret(n+1)=[ebp(n)+m], ebp(j)=ebp(j)+m; where n takes values ​​from k1 to k2, k1 is the level of the second target stack frame in the function call chain, k2 is the second largest level in the function call chain, ebp(n) is the ebp value of the stack frame at level n, and ebp(n+1) is the value of the stack frame at level n. ) represents the ebp value of the stack frame at level n+1, ret(n+1) represents the return address of the stack frame at level n+1, m is a preset constant, the square brackets in the formula represent taking the content of the address inside the square brackets, ebp(j)=ebp(j)+m represents adding m to the original value of ebp(j) during traversal to get the new value of ebp(j), ebp(j) is the ebp that needs to be updated in this round of traversal, k1≤j≤k2.

17. An electronic device, characterized in that, include: Processor and memory; The processor is used to execute the program stored in the memory to implement the stack repair method as described in any one of claims 1 to 11, or the stack backtracking method as described in any one of claims 12 to 14.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the stack repair method as described in any one of claims 1 to 11, or the stack backtracking method as described in any one of claims 12 to 14.

Images