Data consistency analysis method, device, equipment, storage medium and product

Abstract

The application provides a data consistency analysis method and device, equipment, a storage medium and product, and belongs to the software technical field. The method comprises the following steps: obtaining a kernel file of an operating system and memory image data, the memory image data being generated based on the content in the kernel file; determining a first piece of information in the kernel file and a second piece of information in the memory image data, the first piece of information being used for storing key information of the kernel file, and the second piece of information being used for storing key information of the memory image data; filtering first relationship data from the first piece of information and second relationship data from the second piece of information, the first relationship data and the second relationship data being different manifestations of the same relationship data of the operating system; and performing consistency analysis on the kernel file and the memory image data based on the filtered first piece of information and the filtered second piece of information. The application can improve the accuracy of data analysis.

Description

Technical Field

[0001] This application relates to the field of software technology, and in particular to a data consistency analysis method, apparatus, device, storage medium, and product. Background Technology

[0002] With the continuous development of emerging industries, a large number of users are using products based on the underlying Linux operating system; for example, mobile phones, in-vehicle terminals, wearable devices, and network devices based on the Linux operating system. However, during the operation of these devices, their Linux operating systems may be abnormally reset. After the Linux operating system is abnormally reset, a memory image (dump data) will be generated, and the dump data is generated based on the contents of the kernel file (vmlinux). Therefore, by performing consistency analysis on the dump data and vmlinux, the data integrity in the dump data can be analyzed, thereby identifying whether there is data pollution and data jump. Summary of the Invention

[0003] This application provides a data consistency analysis method, apparatus, device, storage medium, and product, which can improve the accuracy of data analysis. The technical solution is as follows:

[0004] On the one hand, a data consistency analysis method is provided, the method comprising:

[0005] Obtain the operating system kernel file and memory image data, wherein the memory image data is generated based on the contents of the kernel file;

[0006] The first segment of information in the kernel file and the second segment of information in the memory image data are determined. The first segment of information is used to store key information of the kernel file, and the second segment of information is used to store key information of the memory image data.

[0007] Filter first relation data from the first information segment and filter second relation data from the second information segment, wherein the first relation data and the second relation data are different representations of the same relation data in the operating system;

[0008] Based on the filtered first segment of information and the filtered second segment of information, a consistency analysis is performed on the kernel file and the memory image data.

[0009] On the other hand, a data consistency analysis apparatus is provided, the apparatus comprising:

[0010] The acquisition module is used to acquire the kernel file and memory image data of the operating system, wherein the memory image data is generated based on the contents of the kernel file;

[0011] The determining module is used to determine the first segment of information in the kernel file and the second segment of information in the memory image data. The first segment of information is used to store key information of the kernel file, and the second segment of information is used to store key information of the memory image data.

[0012] The filtering module is used to filter first relation data from the first segment of information and filter second relation data from the second segment of information, wherein the first relation data and the second relation data are different representations of the same relation data in the operating system;

[0013] The analysis module is used to perform consistency analysis on the kernel file and the memory image data based on the filtered first segment of information and the filtered second segment of information.

[0014] On the other hand, a terminal is provided, the terminal including one or more processors and one or more memories, the one or more memories storing at least one piece of program code, the at least one piece of program code being loaded and executed by the one or more processors to implement the data consistency analysis method described above.

[0015] On the other hand, a computer-readable storage medium is provided, wherein at least one piece of program code is stored in the storage medium, the at least one piece of program code being loaded and executed by a processor to implement the data consistency analysis method described above.

[0016] On the other hand, a computer program product is provided, which stores at least one piece of program code for execution by a processor to implement the data consistency analysis method described above.

[0017] Because memory image data from different manufacturers uses different data formats, and the operating system modifies data in the kernel file during runtime to ensure data randomness (meaning the content of the memory image data is also altered), and because there is no standardized processing method for the data content in memory image data in related technologies, consistency analysis between memory image data and kernel files cannot be achieved. However, in this embodiment, by determining the first segment of information in the kernel file and the second segment of information in the memory image data (which stores key information), consistency analysis between the kernel file and memory image data can be performed. However, inconsistencies may exist between the first and second segments. Therefore, by filtering the relationship data between the first and second segments, inconsistencies in the kernel file caused by the operating system during operation can be filtered out. This allows for consistency analysis based on the filtered first and second segments. Thus, this application solves the problem of the inability to perform consistency analysis between memory image data and kernel files in related technologies, providing an accurate solution for consistency analysis of memory image data and kernel files, thereby improving the accuracy of data analysis. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a data consistency analysis method in an exemplary embodiment of this application is shown;

[0019] Figure 2 This illustration shows a schematic diagram illustrating the data volume of the memory image data and the kernel file in an exemplary embodiment of this application;

[0020] Figure 3 A flowchart illustrating a data consistency analysis method in an exemplary embodiment of this application is shown;

[0021] Figure 4 A schematic diagram illustrating a data consistency analysis method according to an exemplary embodiment of this application is shown;

[0022] Figure 5 This illustration shows a schematic diagram illustrating the data volume of the first and second segments of information in an exemplary embodiment of this application.

[0023] Figure 6 This illustration shows a schematic diagram of the comparison results of a source data function-level feature extraction comparison scheme as illustrated in an exemplary embodiment of this application;

[0024] Figure 7 This illustration shows a schematic diagram of detecting an abnormal reset of the operating system, as shown in an exemplary embodiment of this application.

[0025] Figure 8 A flowchart illustrating a data consistency analysis method in an exemplary embodiment of this application is shown;

[0026] Figure 9 A schematic diagram illustrating a data consistency analysis method according to an exemplary embodiment of this application is shown;

[0027] Figure 10 This invention provides a schematic diagram illustrating instruction conversion information in an exemplary embodiment of this application.

[0028] Figure 11 A schematic diagram illustrating an instruction filter filtering instruction is shown in an exemplary embodiment of this application;

[0029] Figure 12 This illustration shows a schematic diagram of the comparison results of a binary feature comparison scheme for source data, as illustrated in an exemplary embodiment of this application.

[0030] Figure 13 A block diagram of a data consistency analysis apparatus illustrated in an exemplary embodiment of this application is shown;

[0031] Figure 14 A block diagram of a terminal illustrated in an exemplary embodiment of this application is shown. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0033] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0034] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the kernel files and memory image data involved in this application were obtained with full authorization.

[0035] Please refer to Figure 1 This document illustrates a flowchart of a data consistency analysis method according to an exemplary embodiment of this application. The method can be executed by a terminal, and includes:

[0036] Step 101: Obtain the operating system kernel file and memory image data. The memory image data is generated based on the contents of the kernel file.

[0037] The memory image data can be either dump data or minidump data. A minidump can be a subset of the dump data, and it is more configurable than the dump data. Minidump data is only a few megabytes in size, much smaller than the dump data, while a complete dump file is a memory-sized image. The operating system can be Linux or another operating system; in this embodiment, Linux is used as an example. Correspondingly, the kernel file can be vmlinux. In some embodiments, the terminal only obtains the operating system's kernel file and memory image data when the terminal's operating system experiences an abnormal reset. By performing consistency analysis on these two datasets, the integrity of the data in the dump data can be analyzed, thereby identifying whether data corruption or data jumps exist.

[0038] In some embodiments, when the terminal's operating system experiences an abnormal reset, the terminal will also form a data set based on the terminal's product characteristics. This data set includes information for analyzing the cause of the abnormal operating system reset, so that the terminal can analyze the cause of the abnormal operating system reset based on this data set.

[0039] Step 102: Determine the first segment of information in the kernel file and the second segment of information in the memory image data. The first segment of information is used to store key information in the kernel file, and the second segment of information is used to store key information in the memory image data.

[0040] The first information segment includes at least one of a first constant (rodata) segment, a first text segment, and a first dynamic string (dynstr) segment; the first rodata segment stores constant data in the kernel file; the first text segment stores the machine code of the compiled program in the kernel file; and the first dynstr segment stores the dynamic string of the kernel file. Similarly, the second information segment includes a second rodata segment, a second text segment, and a second dynstr segment; the second rodata segment stores constant data in the memory image data; the second text segment stores the machine code of the compiled program in the memory image data; and the second dynstr segment stores the dynamic string of the memory image data.

[0041] Since the memory image data and kernel files can reach 100,000 records, directly performing consistency analysis on the kernel files would render the analysis ineffective. Furthermore, when the memory image data contains data corruption or jumps, it becomes even more difficult to obtain valid consistency analysis results through manual comparison. For example, see... Figure 2 , Figure 2 The left side shows the memory image data, which is 1303832 bytes in size. Figure 2 The right side is the kernel file, which is also 1303832 bytes in size. The memory image data stores a large amount of difference data, which refers to the data that is different between the memory image data and the kernel file.

[0042] In this embodiment, by determining the first segment of information in the kernel file and the second segment of information in the memory image data, the data volume of the first segment of information is less than the data volume of the kernel file, and the data volume of the second segment of information is less than the data volume of the memory image data; therefore, by comparing the segment information to perform consistency analysis on the kernel file and the memory image data, the amount of data analyzed can be reduced, thereby improving the analysis efficiency.

[0043] Step 103: Filter the first relation data from the first information segment and filter the second relation data from the second information segment. The first relation data and the second relation data are different representations of the same relation data in the operating system.

[0044] The first relational data can be read-only data of the first function address, read-only data of the first instruction, or other first read-only data, where other first read-only data refers to read-only data that is neither a function address nor an instruction; the second relational data can be read-only data of the second function address, read-only data of the second instruction, or other second read-only data, where other second read-only data refers to read-only data that is neither a function address nor an instruction.

[0045] In some embodiments, the first relational data is read-only data of the first function address, and the second relational data is read-only data of the second function address. The first and second function addresses are function addresses modified by the operating system during operation. The terminal then filters the first function address from the first information segment and filters the second function address from the second information segment. By using the function address filtering method to perform consistency analysis on kernel files and memory image data, accurate data comparison can be achieved, and the location of the corresponding function address in case of anomalies can be detected.

[0046] In some embodiments, the first relational data is a first other read-only data, and the second relational data is a second other read-only data; then the terminal filters the first other read-only data from the first information segment and filters the second other read-only data from the second information segment. By performing consistency analysis on kernel files and content image data using read-only data filtering, accurate data comparison can be achieved.

[0047] In other embodiments, the first relational data is read-only data of a first instruction, and the second relational data is read-only data of a second instruction. The first and second instructions are instructions converted by the operating system during operation. The terminal then filters the first instruction from the first information segment and filters the second instruction from the second information segment. By performing consistency analysis on kernel files and memory image data using the instruction filtering method, rapid data comparison can be achieved.

[0048] Step 104: Based on the filtered first segment of information and the filtered second segment of information, perform consistency analysis on the kernel file and memory image data.

[0049] In some embodiments, if the filtered first segment of information and the filtered second segment of information are the same, the terminal determines that the consistency analysis results of the kernel file and the memory image data are consistent; if the filtered first segment of information and the filtered second segment of information are different, the terminal determines that the consistency analysis results of the kernel file and the memory image data are inconsistent.

[0050] Because memory image data from different manufacturers uses different data formats, and the operating system changes the data in the kernel file during runtime to ensure data randomness, meaning the content of the memory image data will also be changed; furthermore, there is no standardized processing method for the data content in the memory image data in related technologies; therefore, it is impossible to perform consistency analysis on the memory image data and the kernel file in related technologies.

[0051] In this embodiment, by determining the first segment of information in the kernel file and the second segment of information in the memory image data, and since the segment information stores some key information, consistency analysis of the kernel file and memory image data can be performed using the segment information. However, inconsistent relationship data may exist between the first and second segments of information. Therefore, by filtering the relationship data between the first and second segments of information, inconsistent relationship data between the memory image data and the kernel file caused by the operating system during operation can be filtered out. This allows for consistency analysis based on the filtered first and second segments of information. Thus, this application solves the problem of the inability to perform consistency analysis of memory image data and kernel files in related technologies, providing an accurate solution for consistency analysis of memory image data and kernel files, thereby improving the accuracy of data analysis.

[0052] Please refer to Figure 3 The document illustrates a flowchart of a data consistency analysis method according to an exemplary embodiment of this application. The method includes:

[0053] Step 301: The terminal obtains the operating system's kernel file and memory image data. The memory image data is generated based on the contents of the kernel file.

[0054] In some embodiments, this step is the same as step 101, and will not be described again here.

[0055] Step 302: The terminal determines the version identifier of the kernel file and the version identifier of the memory image data.

[0056] The version identifier can be a version number; in some embodiments, the terminal searches for "version" in the kernel file to obtain the kernel file's version identifier; it searches for "version" in the memory image data to obtain the memory image data's version identifier; then it determines whether the kernel file's version identifier and the memory image data's version identifier are consistent; if the kernel file's version identifier and the memory image data's version identifier are the same, step 303 is executed, thereby achieving effective data consistency analysis; if the kernel file's version identifier and the memory image data's version identifier are different, the process ends. For example, see... Figure 4 If the memory image data is dump data and the kernel file is vmlinux, then the terminal determines whether the dump data and vmlinux versions are consistent. If the dump data and vmlinux versions are consistent, then proceed to step 303.

[0057] In some embodiments, if the version identifier of the kernel file and the version identifier of the memory image data are different, the terminal obtains the kernel file and memory image data with the same version identifier, and then executes step 303 to determine the first segment of information and the second segment of information in the kernel file and memory image data respectively.

[0058] Step 303: If the version identifier of the kernel file and the version identifier of the memory image data are consistent, the terminal determines the first segment of information in the kernel file and the second segment of information corresponding to the memory image data.

[0059] The first segment of information stores key information about the kernel file, and the second segment of information stores key information about the memory image data. In some embodiments, the steps for the terminal to determine the first segment of information in the kernel file and the second segment of information in the memory image data are the same as step 102, and will not be repeated here. For example, the memory image data is dump data; see [link to relevant documentation] for more details. Figure 4The terminal extracts the second segment of information from the dump data, denoted as D1; ​​if the kernel file is vmlinux, the terminal extracts the first segment of information from vmlinux, denoted as V1.

[0060] Step 304: The terminal determines the first file corresponding to the first segment of information and the second file corresponding to the second segment of information. The first file is used to store the feature set corresponding to the first segment of information, and the second file is used to store the feature set corresponding to the second segment of information. The data volume of the first file is less than the data volume of the first segment of information, and the data volume of the second file is less than the data volume of the second segment of information.

[0061] The first file and the second file have the same format, and either file can be in any format; for example, both the first and second files can be in JSON format. In this embodiment, the format of the first and second files is not specifically limited; only JSON format is used as an example. The feature set corresponding to the first segment of information includes the data address, the data content corresponding to the data address, and the data length of the data content. The feature set corresponding to the second segment of information includes the data address, the data content corresponding to the data address, and the data length of the data content. The data size of both the first and second segments is 10MB+, while the data size of both the first and second files is approximately 100KB. Therefore, this step can reduce the data size, thereby improving the efficiency of subsequent data consistency analysis. For example, see... Figure 5 The second information segment has a data size of 16991KB, while the second file obtained based on the second information segment has a data size of 424KB; the first information segment has a data size of 94178KB, while the first file obtained based on the first information segment has a data size of 101KB; it can be seen that the method of this application can reduce the comparison data to 1% of the original data, which greatly improves the efficiency of comparing the original data.

[0062] It should be noted that the data address in the first segment of information is the address used to store data; the data address in the second segment of information is also the address used to store data.

[0063] In some embodiments, step 304 can be implemented by the following steps (1)-(5):

[0064] (1) The terminal determines the kernel address space layout randomization KASLR feature of the kernel log included in the memory image data, and determines the first offset corresponding to the KASLR feature.

[0065] The terminal retrieves the kernel log from the memory image data and determines the KASLR signature of the kernel log. The terminal pre-stores a mapping between KASLR signatures and offsets; in this step, the terminal determines the first offset corresponding to the given KASLR signature from the stored mapping. For example, see [link to example]. Figure 4 The terminal determines the KASLR feature in the kernel log and determines the first offset corresponding to the KASLR feature.

[0066] (2) Based on the first offset, the terminal removes the segment information corresponding to the KASLR feature from the second segment information to obtain the third segment information, which includes the data address of the memory image data.

[0067] The terminal converts the KASLR features into segment information. Based on the first offset, it determines the position of the segment information corresponding to the KASLR features within the second segment information. Based on the length of the segment information corresponding to the KASLR features, it removes segment information of that length from that position to obtain the third segment information. For example, see [link to example]. Figure 4 Based on the first offset, the terminal removes the segment information corresponding to the KASLR feature from D1 to obtain the third segment information D2.

[0068] (3) The terminal removes the segment information that is not in the address range of the memory image data from the first segment information to obtain the fourth segment information, which includes the data address of the kernel file.

[0069] The memory image data is a subset of the kernel file; that is, the kernel file includes a complete address range, while the memory image data includes a portion of that complete address range. In this step, the terminal removes segment information that is not within the address range of the memory image data from the first segment, so that the resulting fourth segment and the third segment are two segments including the same address range, thus enabling subsequent comparison. For example, see [link to example]. Figure 4 In the vmlinux segment information, segment information that is not within the address range of the dump is filtered out and denoted as V2.

[0070] (4) The terminal determines the first file based on the feature set corresponding to the fourth segment of information. The first file includes the data address included in the fourth segment of information, the data content corresponding to the data address, and the data length of the data content.

[0071] The fourth segment of information includes multiple data addresses. For any one of these addresses, the terminal retrieves the corresponding data content from the kernel file and determines its length. After determining the data content and length for each address, the terminal generates a feature set corresponding to the fourth segment of information using the data address, data content, and data length. The terminal then saves the content of this feature set in a preset format to a file, resulting in the first file. The preset format can be JSON. For example, see [link to example]. Figure 4 The terminal exports the feature set corresponding to V2 based on V2. The feature set includes data address, data content and data length. The feature set corresponding to V2 is stored in a file in JSON format and denoted as V3.

[0072] (5) The terminal determines the same data address of the third segment of information and the fourth segment of information, obtains the data content and data length of the data content corresponding to the same data address from the memory image data, and stores the same data address, the data content and data length of the data content to the second file.

[0073] The terminal iterates through the data addresses in the third segment of information. For the currently iterated data address, it checks if the data address exists in the fourth segment of information. If the data address exists in the fourth segment, it is considered the same data address. The terminal then retrieves the data content corresponding to this same data address from the memory image data, determines the data length of this data content, and stores the same data address, its corresponding data content, and the data length of the data content into a file in a preset format, resulting in the second file. The preset format can be JSON. For example, see [link to example]. Figure 4 Iterate through the data addresses in D2 and search for matching data addresses in V3. If a matching data address is found in V3, synchronize the data address, the corresponding data content, and the data length from the memory image data. Store the synchronized information in JSON format in the second file, denoted as D3.

[0074] In some embodiments, the process of the terminal generating the first file and the second file through the above steps (1)-(5) is obtained by analyzing the first segment information and the second segment information through function-level data analysis, which can improve the accuracy of the determined first file and the second file, and thus improve the accuracy of subsequent data comparison.

[0075] In some embodiments, see Figure 4After the terminal identifies the first file and the second file, it can directly traverse and compare the data in the first and second files to perform consistency analysis on the kernel file and memory image data. For example, if the data in the first file and the data in the second file are the same, the terminal determines that the consistency analysis result of the kernel file and the memory image data is consistent; if the data in the first file and the data in the second file are different, the terminal determines that the consistency analysis result of the kernel file and the memory image data is inconsistent.

[0076] In some embodiments, if the data in the first file and the data in the second file are different, the terminal can also output different data to locate the inconsistency, which facilitates subsequent data consistency analysis and identifies whether there is data pollution and data jump in the memory image data.

[0077] In some embodiments, after the terminal identifies the first file and the second file, it can further filter the first file and the second file using a function filter to filter out functions that change during the operation of the operating system, thereby further improving the accuracy of the comparison.

[0078] Step 305: The terminal filters the first data address and the second data address in the first file and the second file respectively. The first data address and the second data address are mutually convertible addresses.

[0079] The terminal uses a function address filter to filter the data conversion addresses in the first and second files; that is, it uses a function address filter to filter the first data address in the first file and the second data address in the second file. For example, see [link to example]. Figure 4 The terminal performs function address filtering. In some embodiments, the terminal restores the data addresses in the first and second files based on the KASLR characteristics, and then filters out differences in data address conversion between the first and second files using a function address filter.

[0080] In some embodiments, the terminal stores an address filtering table, which includes two addresses that are mutually converted addresses. In this step, for any data address in the first file, the terminal determines whether the address filtering table contains the data address. If the address filtering table contains the data address, the data address can be referred to as the first data address. The terminal then determines the conversion address corresponding to the first data address from the address filtering table and determines whether the conversion address is in the second file. If the conversion address is in the second file, the conversion address can be referred to as the second data address. Through the above steps, the first data address and the second data address can be found, and then a filtering operation can be performed.

[0081] In this embodiment, filtering the data conversion addresses in the first and second files using the function address filtering method can solve the problem of inconsistency in data comparison where there are random linear addresses in the segment information; the validity of the segment information is analyzed by finding the first offset of the KASLR feature.

[0082] Step 306: The terminal filters the preset values ​​in the first file and the second file respectively. The preset values ​​are filled into the first file and the second file based on the operating system's description information.

[0083] The preset value can be 0 or 1, etc. In this embodiment, the preset value of 0 is used as an example. The first and second information segments contain the operating system's description information, which can be the number of CPU cores, etc. The operating system's description information does not change when the operating system is running, and it is filled into the first and second information segments during runtime; therefore, the first and second files obtained based on the first and second information segments include the preset value corresponding to the description information. Accordingly, this step can be: the terminal filters the 0 values ​​in the first and second files respectively using a 0 value filter. This 0 value is added to the first and second files based on the operating system's description information. For example, see [link to example]. Figure 4 The terminal performs zero-value filtering.

[0084] In this embodiment of the application, the terminal uses a zero-value filter to filter zero values ​​in the first and second files, which can solve the problem of some constants in the segment information that were modified after being initialized to zero, such as the "ro_after_init" feature value.

[0085] Step 307: The terminal filters the data used to record the data size in the first file and the second file respectively.

[0086] The first and second information segments contain data length information. During operating system runtime, memory modifies the data size information in the segment information area. Therefore, the first and second files obtained based on the first and second information segments contain data for recording data sizes. Correspondingly, this step can be: the terminal uses a size feature filter to filter the real-time data recording size in the first and second files, respectively. For example, see [link to example]. Figure 4 The terminal performs filtering using the size function.

[0087] In this embodiment of the application, the terminal uses a size feature filter to filter real-time data recording the size in the first file and the second file respectively, which can solve the problem that there are some constants in the segment information that are initialized to non-zero and then modified, and these constants describe some length information.

[0088] In some embodiments, steps 305-307 may be performed as a single step, i.e., filtering the first and second files using a single function filter; or two steps, i.e., filtering the first and second files using two function filters; or all three steps, i.e., filtering the first and second files using three function filters, thereby performing data filtering through multiple data filters. Furthermore, the execution order of these three steps is not specifically limited; for example, they may be executed in the order of steps 305-306-307, steps 305-307-306, steps 306-307-305, and so on.

[0089] Step 308: The terminal performs a consistency analysis on the kernel file and memory image data based on the filtered first file and the filtered second file.

[0090] In some embodiments, if the filtered first file and the filtered second file are the same, the terminal determines that the consistency analysis results of the kernel file and the memory image data are consistent; if the filtered first file and the filtered second file are different, the terminal determines that the consistency analysis results of the kernel file and the memory image data are inconsistent.

[0091] In some embodiments, when the terminal filters the data conversion between the first file and the second file through a function address filter, the terminal outputs a first comparison result of the first file and the second file through the function address filter. The first comparison result includes a first correct result or a first incorrect result. The first correct result indicates that the kernel file and the memory image data are consistent. The first incorrect result indicates that there is inconsistent data between the kernel file and the memory image data, and the first incorrect result includes inconsistent data addresses. At this time, the terminal can also determine the inconsistent data content based on the inconsistent data addresses, thereby locating the error location and facilitating the staff to solve the problem.

[0092] In some embodiments, when the terminal filters the zero values ​​in the first file and the second file using a zero-value filter, the terminal outputs a second comparison result of the first file and the second file using the zero-value filter. The second comparison result includes a second correct result or a second incorrect result. The second correct result indicates that the kernel file and the memory image data are consistent. The second incorrect result indicates that there is inconsistent data between the kernel file and the memory image data, and the second incorrect result includes the location of the inconsistent zero value. At this time, the terminal can also determine the inconsistent data content based on the location of the inconsistent zero value, thereby locating the error location and facilitating the staff to solve the problem.

[0093] In some embodiments, when the terminal filters real-time data recording the size in the first file and the second file respectively using a size feature filter, the terminal outputs a third comparison result of the first file and the second file. This third comparison result includes either a third correct result or a third incorrect result. A third correct result indicates that the kernel file and the memory image data are consistent; a third incorrect result indicates that there is inconsistent data between the kernel file and the memory image data, and includes the location of the inconsistent size. In this case, the terminal can also determine the inconsistent data content based on the location of the inconsistent size, thereby locating the error and facilitating problem-solving by staff. For example, see [link to example]. Figure 4 The terminal outputs the comparison results of the filtered segment information, which is the comparison file between the kernel file and the memory image data.

[0094] In some embodiments, the terminal directly outputs the comparison result of the first segment of information and the second segment of information through a function address filter, a 0-value filter, and a size feature filter. This comparison result represents the data consistency result between the kernel file and the memory image data. The comparison result also includes the function locations corresponding to data inconsistencies; therefore, this embodiment of the application can achieve efficient data extraction. Furthermore, the comparison result of the first segment of information and the second segment of information also includes the number of identical function-level features, the number of different function-level features, and the number of filtered function features. For example, the terminal outputs the comparison result of the first segment of information and the second segment of information through a function address filter, a 0-value filter, and a size feature filter as follows: Figure 6 As shown.

[0095] In some embodiments, steps 301-308 perform data consistency analysis by comparing source data function-level features. Furthermore, in the event of an abnormal reset of the terminal's operating system, the terminal can directly perform data consistency analysis by comparing source data function-level features. Alternatively, in the event of an abnormal reset of the terminal's operating system, the terminal can first perform analysis using other anomaly analysis methods before performing data consistency analysis by comparing source data function-level features.

[0096] For example, see Figure 7 In the event of an abnormal reset of the terminal's operating system, the terminal first analyzes the situation using other anomaly analysis methods before performing data consistency analysis through source data function-level feature extraction and comparison. Other anomaly analysis methods include startup print anomaly analysis and abnormal system log feature and register analysis. Startup print anomaly analysis includes code-level startup anomaly analysis, customizable filters for data filtering, and scalable filters for data filtering. Abnormal system log feature and register analysis includes abnormal register analysis, critical log analysis, and abnormal log instruction analysis. Based on the above analysis, it can be seen that the source data function-level feature extraction and comparison in this embodiment includes function-level data analysis, multiple data filters for data filtering, and efficient data extraction.

[0097] The source data function-level feature extraction and comparison scheme provided in this application is applicable to the comparison of segment information with large differences in source data. Therefore, before using the source data function-level feature extraction and comparison scheme provided in this application, the degree of difference between the first segment information and the second segment information can be estimated. This degree of difference is used to represent the size of the difference between the first segment information and the second segment information. Only when the degree of difference is greater than a preset degree will the terminal use the source data function-level feature extraction and comparison scheme provided in this application to perform consistency analysis on the data, thereby achieving fast and accurate data comparison.

[0098] In this embodiment of the application, by performing data consistency analysis on the memory image data, developers can easily analyze whether there is data pollution and jumps in the memory image data, solve the consistency comparison problem of 100,000-level difference data, reduce the manpower input for large-scale data log consistency analysis, quickly analyze and draw conclusions on data consistency comparison, and facilitate the subsequent problem location and the development of other verification work.

[0099] Because memory image data from different manufacturers uses different data formats, and the operating system changes the data in the kernel file during runtime to ensure data randomness, meaning the content of the memory image data will also be changed; furthermore, there is no standardized processing method for the data content in the memory image data in related technologies; therefore, it is impossible to perform consistency analysis on the memory image data and the kernel file in related technologies.

[0100] In this embodiment, by determining the first segment of information of the kernel file and the second segment of information of the memory image data, and since the segment information stores some key information, consistency analysis of the kernel file and memory image data can be performed with the help of the segment information. Furthermore, the terminal can also determine the first file corresponding to the first segment information and the second file corresponding to the second segment information. The data volume of the first file and the data volume of the second file are smaller than the data volume of the first segment information and the data volume of the second segment information, respectively, thereby reducing the amount of data to be compared and improving the efficiency of data comparison.

[0101] In addition, the terminal uses function address filters, 0-value filters, and size feature filters to filter out functions in the memory image data that are inconsistent with the kernel file due to the operating system's operation during runtime. This directly outputs the comparison results of the first and second information segments, which represent the data consistency results between the kernel file and the memory image data. Thus, through function-level data analysis capabilities, multiple data filtering, and efficient data extraction methods, accurate data comparison is achieved, and the location of functions corresponding to data inconsistencies can also be discovered.

[0102] Please refer to Figure 8 The document illustrates a flowchart of a data consistency analysis method according to an exemplary embodiment of this application. The method includes:

[0103] Step 801: The terminal obtains the operating system's kernel file and memory image data. The memory image data is generated based on the contents of the kernel file.

[0104] In some embodiments, this step is the same as step 101, and will not be described again here.

[0105] Step 802: The terminal determines the version identifier of the kernel file and the version identifier of the memory image data.

[0106] In some embodiments, this step is the same as step 302, and will not be described again here.

[0107] For example, see Figure 9If the memory image data is dump data and the kernel file is vmlinux, then the terminal determines whether the dump data and vmlinux versions are consistent. If the dump data and vmlinux versions are consistent, then proceed to step 803.

[0108] Step 803: If the version identifier of the kernel file and the version identifier of the memory image data are consistent, the terminal determines the first segment of information in the kernel file and the second segment of information in the memory image data.

[0109] The first segment stores key information about the kernel file, and the second segment stores key information about the memory image data. In some embodiments, this step is the same as step 303, and will not be described again here.

[0110] For example, see continue. Figure 9 The terminal dumps segment information from the data in advance, denoted as D1, and extracts segment information from vmlinux, denoted as V1.

[0111] Step 804: The terminal determines the second offset of the second segment of information within the first segment of information, and aligns the first segment of information and the second segment of information based on the second offset.

[0112] The second segment of information is a subset of the first segment of information. The terminal compares the second segment of information with the first segment of information, determines the second offset of the second segment of information in the first segment of information, and then aligns the first segment of information with the second offset.

[0113] Step 805: The terminal determines the fifth and sixth segments of information corresponding to the same data address from the first and second segments of information after alignment.

[0114] For example, see continue. Figure 9 The terminal finds the second offset of the second segment of information within the first segment of information, and copies out the vmlinx segment information V2 and the dump segment information D2 after aligning with the second offset.

[0115] Step 806: The terminal compares the contents of the fifth and sixth information segments one by one based on the preset granularity.

[0116] The byte length corresponding to the preset granularity can be set and changed as needed; and the terminal can also provide a configuration interface to configure the preset granularity. The terminal obtains the preset granularity configured in the configuration interface. The terminal first compares the contents included in the fifth and sixth segments of information one by one based on the preset granularity. If the byte lengths corresponding to the preset granularity are the same, the comparison continues; if the byte lengths corresponding to the preset granularity are different, it is determined that the comparison result is a mismatch, and then step 807 is executed.

[0117] In this embodiment, a coarse-grained screening comparison is performed first. Only when a mismatch is found is a fine-grained screening comparison performed. This allows for layered comparison through both coarse and fine granularity, improving comparison efficiency. For example, the preset granularity is 8KB. See also... Figure 9 The terminal compares data in 8KB lengths, and only performs fine-grained screening and comparison when a mismatch is found.

[0118] In some embodiments, the terminal may perform only coarse-grained screening comparison, or only fine-grained screening comparison; or it may perform both coarse-grained and fine-grained screening comparison. Figure 9 The example given is that the terminal performs both coarse-grained and fine-grained screening and comparison.

[0119] Step 807: If the comparison result is a mismatch, the terminal determines the instruction translation information between the kernel file and the memory image data. The instruction translation information is used to represent the translation relationship between the instructions in the kernel file and the instructions in the memory image data.

[0120] Instruction translation information can be instruction translation rules; for example, see [link to relevant documentation]. Figure 10 The instruction conversion information can be the conversion rules for converting LDAR instructions to LDAPR instructions during the operation of the operating system; for example, the instruction conversion information can be the conversion rules for NOP instructions during the operation of the operating system; for example, the instruction conversion information can be the conversion rules for LDAR32 instructions during the operation of the operating system.

[0121] Step 808: Based on the instruction conversion information, the terminal filters the first instruction and the second instruction from the fifth segment of information and the sixth segment of information respectively. The first instruction and the second instruction satisfy the conversion relationship represented by the instruction conversion information.

[0122] For any set of instructions in the fifth and sixth segments of information, the set of instructions includes one instruction in the fifth segment and one instruction in the sixth segment; if the set of instructions satisfies the conversion relationship represented by the instruction conversion information, the two instructions included in the set of instructions can be referred to as the first instruction and the second instruction. The terminal filters the first instruction from the fifth segment of information and filters the second instruction from the sixth segment of information through the instruction filter.

[0123] In some embodiments, for any set of instructions, if the set of instructions satisfies the conversion relationship represented by the instruction conversion information, the terminal considers the set of instructions to be consistent; if the set of instructions does not satisfy the conversion relationship represented by the instruction conversion information, the terminal records the set of instructions and increments the error data count. For example, see... Figure 11The instruction in the fifth segment is 1X001000110(1)(1)(1)(1)1(1)(1)(1)(1)RnRt, with the instruction format LDAR; the instruction in the sixth segment is 1X111000101(1)(1)(1)(1)10000RnRt, with the instruction format LDAPR. Since the 00 in the instruction LDAR is the same as the 11 in the instruction LDAPR, the 10 in the instruction LDAR is the same as the 01 in the instruction LDAPR, and the (1)(1)(1)(1) in the instruction LDAR is the same as the 0000 in the instruction LDAPR, the terminal determines that the comparison results of the fifth and sixth segments are consistent, and thus determines that the consistency analysis results of the kernel file and the memory image data are consistent.

[0124] In some embodiments, instructions are binary data; therefore, the method provided in this application is a source data binary feature comparison scheme. This scheme is suitable for scenarios requiring rapid comparison, such as rapid comparison of text segments and partial rodata segments in segment information, and features characteristics such as short execution time and high efficiency. Furthermore, this scheme has binary data analysis capabilities, includes instruction filters, and features coarse-grained hierarchical layering. For example, see [link to previous section]. Figure 7 The terminal compares data using a source data binary feature comparison scheme; this source data binary feature comparison scheme includes steps such as binary data analysis, instruction filtering, and coarse-grained stratification.

[0125] In this application embodiment, an innovative method for instruction filtering is proposed to solve the instruction differences between storage time and runtime in the next-generation processor architecture (armv8), and to perform filtering analysis based on instruction conversion information.

[0126] Step 809: The terminal performs a consistency analysis on the kernel file and memory image data based on the filtered fifth and sixth segments of information.

[0127] In some embodiments, if the filtered fifth segment information and the filtered sixth segment information are the same, the terminal determines that the consistency analysis results of the kernel file and the memory image data are consistent; if the filtered fifth segment information and the filtered sixth segment information are different, the terminal determines that the consistency analysis results of the kernel file and the memory image data are inconsistent.

[0128] In some embodiments, the terminal filters the first instruction in the fifth segment of information and the second instruction in the sixth segment of information using an instruction filter, and outputs a comparison result. The comparison result includes a fourth correct result or a fourth incorrect result. The fourth correct result indicates that the kernel file and memory image data are consistent; the fourth incorrect result indicates that there is inconsistent data between the kernel file and memory image data, and the fourth incorrect result includes inconsistent instructions. In this case, the terminal can also locate the error location based on the inconsistent instructions, making it easier for staff to solve problems. The consistency analysis result of the kernel file and memory image data determined by the terminal is as follows: Figure 12 As shown.

[0129] Because memory image data from different manufacturers uses different data formats, and the operating system changes the data in the kernel file during runtime to ensure data randomness, meaning the content of the memory image data will also be changed; furthermore, there is no standardized processing method for the data content in the memory image data in related technologies; therefore, it is impossible to perform consistency analysis on the memory image data and the kernel file in related technologies.

[0130] In this embodiment, by determining the first segment of information in the kernel file and the second segment of information in the memory image data, and since the segment information stores some key information, consistency analysis of the kernel file and memory image data can be performed using the segment information. However, because the second segment is a subset of the first segment, the terminal aligns the first and second segments and copies out the fifth and sixth segments with the same address range, enabling effective comparison. Furthermore, the terminal first performs a coarse-grained screening comparison; only when a mismatch is found does it perform a fine-grained screening comparison. This coarse- and fine-grained hierarchical comparison improves comparison efficiency.

[0131] Please refer to Figure 13 This application illustrates a block diagram of a data consistency analysis apparatus according to an exemplary embodiment of the present application, the apparatus comprising:

[0132] The acquisition module 1301 is used to acquire the kernel file and memory image data of the operating system. The memory image data is generated based on the contents of the kernel file.

[0133] The determination module 1302 is used to determine the first segment of information in the kernel file and the second segment of information in the memory image data. The first segment of information is used to store key information of the kernel file, and the second segment of information is used to store key information of the memory image data.

[0134] The filtering module 1303 is used to filter first relation data from the first segment of information and filter second relation data from the second segment of information. The first relation data and the second relation data are different representations of the same relation data in the operating system.

[0135] Analysis module 1304 is used to perform consistency analysis on kernel files and memory image data based on the filtered first segment of information and the filtered second segment of information.

[0136] In some embodiments, the filtering module 1303 is used to determine a first file corresponding to a first segment of information and a second file corresponding to a second segment of information. The first file is used to store a feature set corresponding to the first segment of information, and the second file is used to store a feature set corresponding to the second segment of information. The data volume of the first file is less than the data volume of the first segment of information, and the data volume of the second file is less than the data volume of the second segment of information. The first relation data and the second relation data are filtered from the first file and the second file, respectively.

[0137] In some embodiments, the filtering module 1303 is used to filter a first data address from a first file and a second data address from a second file, wherein the first data address and the second data address are mutually convertible addresses; to filter preset values ​​from the first file and the second file, wherein the preset values ​​are filled into the first file and the second file based on the operating system's description information; and to filter data used to record data size from the first file and the second file.

[0138] In some embodiments, the filtering module 1303 is configured to: determine the KASLR (Kernel Address Space Layout Randomization) feature of the kernel log included in the memory image data; determine the first offset corresponding to the KASLR feature; based on the first offset, remove the segment information corresponding to the KASLR feature from the second segment information to obtain the third segment information, which includes the data address of the memory image data; remove segment information not within the address range of the memory image data from the first segment information to obtain the fourth segment information, which includes the data address of the kernel file; based on the feature set corresponding to the fourth segment information, determine the first file, which includes the data address included in the fourth segment information, the data content corresponding to the data address, and the data length of the data content; determine the same data address between the third and fourth segments information; obtain the data content corresponding to the same data address and the data length of the data content from the memory image data; and store the same data address, the data content corresponding to the same data address, and the data length of the data content in the second file.

[0139] In some embodiments, the filtering module 1303 is configured to determine a second offset of the second segment of information within the first segment of information, align the first segment of information and the second segment of information based on the second offset, determine a fifth segment of information and a sixth segment of information corresponding to the same data address from the aligned first segment of information and the aligned second segment of information, and filter first relation data from the fifth segment of information and filter second relation data from the sixth segment of information.

[0140] In some embodiments, the filtering module 1303 is used to determine instruction conversion information between the kernel file and the memory image data. The instruction conversion information is used to represent the conversion relationship between the instructions in the kernel file and the instructions in the memory image data. Based on the instruction conversion information, the first instruction is filtered from the fifth segment of information and the second instruction is filtered from the sixth segment of information. The first instruction and the second instruction are those that satisfy the conversion relationship represented by the instruction conversion information.

[0141] In some embodiments, the filtering module 1303 is used to compare the contents included in the fifth segment of information and the sixth segment of information one by one based on a preset granularity; if the comparison result is a mismatch, the first relationship data is filtered from the fifth segment of information and the second relationship data is filtered from the sixth segment of information.

[0142] In some embodiments, the determining module 1302 is used to determine the version identifier of the kernel file and the version identifier of the memory image data; if the version identifier of the kernel file and the version identifier of the memory image data are consistent, it determines the first segment of information in the kernel file and the second segment of information in the memory image data.

[0143] Because memory image data from different manufacturers uses different data formats, and the operating system changes the data in the kernel file during runtime to ensure data randomness, meaning the content of the memory image data will also be changed; furthermore, there is no standardized processing method for the data content in the memory image data in related technologies; therefore, it is impossible to perform consistency analysis on the memory image data and the kernel file in related technologies.

[0144] In this embodiment, by determining the first segment of information in the kernel file and the second segment of information in the memory image data, and since the segment information stores some key information, consistency analysis of the kernel file and memory image data can be performed using the segment information. However, inconsistent relationship data may exist between the first and second segments of information. Therefore, by filtering the relationship data between the first and second segments of information, inconsistent relationship data between the memory image data and the kernel file caused by the operating system during operation can be filtered out. This allows for consistency analysis based on the filtered first and second segments of information. Thus, this application solves the problem of the inability to perform consistency analysis of memory image data and kernel files in related technologies, providing an accurate solution for consistency analysis of memory image data and kernel files, thereby improving the accuracy of data analysis.

[0145] It should be noted that the data consistency analysis device provided in the above embodiments is only illustrated by the division of the above functional modules when performing data compression. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the terminal can be divided into different functional modules to complete all or part of the functions described above. In addition, the data consistency analysis device and the data consistency analysis method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0146] Please refer to Figure 14 The diagram illustrates a block diagram of a terminal 1400 according to an exemplary embodiment of this application. The terminal 1400 in this application may include one or more components such as a processor 1410, a memory 1420, and a display screen 1430.

[0147] Processor 1410 may include one or more processing cores. Processor 1410 connects to various parts within terminal 1400 using various interfaces and lines, and performs various functions and processes data of terminal 1400 by running or executing instructions, programs, code sets, or instruction sets stored in memory 1420, and by calling data stored in memory 1420. Optionally, processor 1410 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 1410 may integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), Neural-network Processing Unit (NPU), and modem. Specifically, the CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required to be displayed on display screen 1430; the NPU is used to implement Artificial Intelligence (AI) functions; and the modem is used to handle wireless communication. It is understandable that the aforementioned modem may not be integrated into the processor 1410, but may be implemented as a separate chip.

[0148] The memory 1420 may include random access memory (RAM) or read-only memory. Optionally, the memory 1420 may include a non-transitory computer-readable storage medium. The memory 1420 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 1420 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the various method embodiments described below, etc.; the data storage area may store data created based on the use of the terminal 1400 (such as audio data, phone book, etc.).

[0149] Display screen 1430 is a display component used to display a user interface. Optionally, the display screen 1430 is a touch-enabled display screen, through which users can use their fingers, styluses, or any suitable object to perform touch operations on the display screen 1430.

[0150] The display screen 1430 is typically located on the front panel of the terminal 1400. The display screen 1430 can be designed as a full-screen, curved screen, irregularly shaped screen, dual-sided screen, or foldable screen. The display screen 1430 can also be designed as a combination of a full-screen and a curved screen, or a combination of an irregularly shaped screen and a curved screen, etc., but this embodiment does not limit it in this way.

[0151] In addition, those skilled in the art will understand that the structure of the terminal 1400 shown in the above figures does not constitute a limitation on the terminal 1400. The terminal 1400 may include more or fewer components than shown, or combine certain components, or have different component arrangements. For example, the terminal 1400 may also include audio acquisition devices, speakers, radio frequency circuits, input units, sensors, audio circuits, a Wireless Fidelity (Wi-Fi) module, a power supply, a Bluetooth module, and other components, which will not be described in detail here.

[0152] This application also provides a computer-readable medium storing at least one piece of program code, which is loaded and executed by the processor to implement the data consistency analysis method shown in the above embodiments.

[0153] This application also provides a computer program product that stores at least one piece of program code, which is loaded and executed by the processor to implement the data consistency analysis method shown in the above embodiments.

[0154] In some embodiments, the computer program product involved in the present application can be deployed and executed on a terminal, or executed on multiple terminals located in one location, or executed on multiple terminals distributed in multiple locations and interconnected through a communication network. Multiple terminals distributed in multiple locations and interconnected through a communication network can form a blockchain system.

[0155] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0156] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data consistency analysis method, characterized in that, The method includes: Obtain the operating system kernel file and memory image data, wherein the memory image data is generated based on the contents of the kernel file; The first segment of information in the kernel file and the second segment of information in the memory image data are determined. The first segment of information is used to store key information of the kernel file, and the second segment of information is used to store key information of the memory image data. Filter first relational data from the first information segment and filter second relational data from the second information segment. The first relational data and the second relational data are different manifestations of the same relational data in the operating system. The first relational data is read-only data of a first function address, read-only data of a first instruction, or read-only data of a first non-function address and non-instruction. The second relational data is read-only data of a second function address, read-only data of a second instruction, or read-only data of a second non-function address and non-instruction. Based on the filtered first segment of information and the filtered second segment of information, a consistency analysis is performed on the kernel file and the memory image data to obtain a consistency analysis result, which is either consistent or inconsistent. The steps of filtering first relation data from the first segment of information and filtering second relation data from the second segment of information include: Determine a first file corresponding to the first segment of information and a second file corresponding to the second segment of information. The first file is used to store the feature set corresponding to the first segment of information, and the second file is used to store the feature set corresponding to the second segment of information. The data size of the first file is smaller than the data size of the first segment of information, and the data size of the second file is smaller than the data size of the second segment of information. Filter the first relation data and the second relation data from the first file and the second file respectively.

2. The method according to claim 1, characterized in that, The steps of filtering first relation data from the first segment of information and filtering second relation data from the second segment of information include: Filter a first data address from the first file and filter a second data address from the second file, wherein the first data address and the second data address are mutually convertible addresses; Filter preset values ​​from the first file and the second file, the preset values ​​being filled into the first file and the second file based on the description information of the operating system; Filter the data used to record data size from the first file and the second file.

3. The method according to claim 1, characterized in that, The step of determining the first file corresponding to the first segment of information and the second file corresponding to the second segment of information includes: Determine the kernel address space layout randomization (KASLR) feature of the kernel log included in the memory image data, and determine the first offset corresponding to the KASLR feature; Based on the first offset, the segment information corresponding to the KASLR feature is removed from the second segment information to obtain the third segment information, which includes the data address of the memory image data; Remove segment information that is not within the address range of the memory image data from the first segment information to obtain the fourth segment information, which includes the data address of the kernel file; Based on the feature set corresponding to the fourth segment of information, the first file is determined, and the first file includes the data address included in the fourth segment of information, the data content corresponding to the data address, and the data length of the data content. Determine the same data address between the third segment of information and the fourth segment of information, obtain the data content corresponding to the same data address and the data length of the data content from the memory image data, and store the same data address, the data content corresponding to the same data address, and the data length of the data content in the second file.

4. The method according to claim 1, characterized in that, The steps of filtering first relation data from the first segment of information and filtering second relation data from the second segment of information include: Determine the second offset of the second segment of information within the first segment of information, and align the first segment of information and the second segment of information based on the second offset; Determine the fifth and sixth segments of information corresponding to the same data address from the first and second segments of information after alignment; Filter the first relationship data from the fifth information segment and filter the second relationship data from the sixth information segment.

5. The method according to claim 4, characterized in that, The step of filtering the first relationship data from the fifth segment of information and filtering the second relationship data from the sixth segment of information includes: Determine instruction translation information between the kernel file and the memory image data, wherein the instruction translation information is used to represent the translation relationship between instructions in the kernel file and instructions in the memory image data; Based on the instruction conversion information, a first instruction is filtered from the fifth segment of information and a second instruction is filtered from the sixth segment of information, wherein the first instruction and the second instruction satisfy the conversion relationship represented by the instruction conversion information.

6. The method according to claim 4 or 5, characterized in that, The step of filtering the first relationship data from the fifth segment of information and filtering the second relationship data from the sixth segment of information includes: Based on a preset granularity, the contents included in the fifth and sixth information segments are compared one by one. If a mismatch is found in the comparison results, the first relationship data is filtered from the fifth information segment and the second relationship data is filtered from the sixth information segment.

7. The method according to claim 1, characterized in that, Determining the first segment of information in the kernel file and the second segment of information in the memory image data includes: Determine the version identifier of the kernel file and the version identifier of the memory image data; If the version identifier of the kernel file and the version identifier of the memory image data are consistent, the first segment of information in the kernel file and the second segment of information in the memory image data are determined.

8. A data consistency analysis device, characterized in that, The device includes: The acquisition module is used to acquire the kernel file and memory image data of the operating system, wherein the memory image data is generated based on the contents of the kernel file; The determining module is used to determine the first segment of information in the kernel file and the second segment of information in the memory image data. The first segment of information is used to store key information of the kernel file, and the second segment of information is used to store key information of the memory image data. The filtering module is used to filter first relational data from the first segment of information and filter second relational data from the second segment of information. The first relational data and the second relational data are different manifestations of the same relational data in the operating system. The first relational data is read-only data of a first function address, read-only data of a first instruction, or read-only data of a first non-function address and non-instruction. The second relational data is read-only data of a second function address, read-only data of a second instruction, or read-only data of a second non-function address and non-instruction. The analysis module is used to perform consistency analysis on the kernel file and the memory image data based on the filtered first segment of information and the filtered second segment of information, and obtain a consistency analysis result, wherein the consistency analysis result is consistent or inconsistent. The filtering module is used to determine a first file corresponding to the first segment of information and a second file corresponding to the second segment of information. The first file is used to store the feature set corresponding to the first segment of information, and the second file is used to store the feature set corresponding to the second segment of information. The data volume of the first file is less than the data volume of the first segment of information, and the data volume of the second file is less than the data volume of the second segment of information. The first relation data and the second relation data are filtered from the first file and the second file, respectively.

9. The apparatus according to claim 8, characterized in that, The filtering module is used to filter a first data address from the first file and a second data address from the second file, wherein the first data address and the second data address are mutually converted addresses; and to filter preset values ​​from the first file and the second file, wherein the preset values ​​are filled into the first file and the second file based on the description information of the operating system. Filter the data used to record data size from the first file and the second file.

10. The apparatus according to claim 8, characterized in that, The filtering module is configured to: determine the KASLR (Kernel Address Space Layout Randomization) feature of the kernel log included in the memory image data; determine the first offset corresponding to the KASLR feature; based on the first offset, remove the segment information corresponding to the KASLR feature from the second segment information to obtain a third segment information, the third segment information including the data address of the memory image data; remove segment information not within the address range of the memory image data from the first segment information to obtain a fourth segment information, the fourth segment information including the data address of the kernel file; based on the feature set corresponding to the fourth segment information, determine the first file, the first file including the data address included in the fourth segment information, the data content corresponding to the data address, and the data length of the data content; determine the same data address between the third segment information and the fourth segment information; obtain the data content corresponding to the same data address and the data length of the data content from the memory image data; and store the same data address, the data content corresponding to the same data address, and the data length of the data content in the second file.

11. The apparatus according to claim 8, characterized in that, The filtering module is used to determine the second offset of the second segment of information in the first segment of information, and to align the first segment of information and the second segment of information based on the second offset. Determine the fifth and sixth segments of information corresponding to the same data address from the first and second segments of information after alignment; Filter the first relationship data from the fifth information segment and filter the second relationship data from the sixth information segment.

12. The apparatus according to claim 11, characterized in that, The filtering module is used to determine instruction conversion information between the kernel file and the memory image data. The instruction conversion information is used to represent the conversion relationship between the instructions in the kernel file and the instructions in the memory image data. Based on the instruction conversion information, a first instruction is filtered from the fifth segment of information and a second instruction is filtered from the sixth segment of information. The first instruction and the second instruction satisfy the conversion relationship represented by the instruction conversion information.

13. The apparatus according to claim 11 or 12, characterized in that, The filtering module is used to compare the contents included in the fifth segment of information and the sixth segment of information one by one based on a preset granularity; if a mismatch occurs, the first relationship data is filtered from the fifth segment of information and the second relationship data is filtered from the sixth segment of information.

14. The apparatus according to claim 8, characterized in that, The determining module is used to determine the version identifier of the kernel file and the version identifier of the memory image data; if the version identifier of the kernel file and the version identifier of the memory image data are consistent, it determines the first segment of information in the kernel file and the second segment of information in the memory image data.

15. A terminal, characterized in that, The terminal includes one or more processors and one or more memories, wherein at least one piece of program code is stored in the one or more memories, and the at least one piece of program code is loaded and executed by the one or more processors to implement the data consistency analysis method as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the data consistency analysis method as described in any one of claims 1 to 7.

17. A computer program product, characterized in that, The computer program product stores at least one piece of program code, which is executed by a processor to implement the data consistency analysis method as described in any one of claims 1 to 7.

Images