Construction method and device of control flow diagram

Abstract

The invention discloses a construction method and device of a control flow diagram, and the method comprises the steps: for any basic block in a basic block sequence corresponding to a target application program, under the condition that a first basic block pointed by the basic block can be determined based on the last N instructions of the basic block, sending an edge set of the control flow diagram corresponding to the target application program, adding a directed edge pointing to the first basic block from the basic block, otherwise, adding the basic block into the special block set; and for any special block in the special block set, according to the directed edge added into the edge set, determining a target directed path taking the special block as a termination node, by executing all basic blocks belonging to the target directed path in sequence, determining a second basic block pointed by the special block, and adding a directed edge pointing to the second basic block from the special block to the edge set.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of computer technology, and more particularly, to a method and device for constructing a control flow graph. Background Art

[0002] In the process of static analysis of a target application, it is usually necessary to construct a control flow graph (CFG) corresponding to the target application. In the process of constructing the CFG for the target application, the basic blocks in the basic block sequence obtained by converting the target application can be directly added to the point set of the CFG as nodes.

[0003] For the edge set of the CFG corresponding to the target application, it is usually difficult to strike a balance between the completeness of the directed edges and the time cost. For example, although the traditional pattern recognition method does not need to execute basic blocks, it is difficult to completely discover all the directed edges contained in the CFG. The traditional global symbolic execution method can completely discover all the directed edges contained in the CFG, but it needs to completely execute the entire basic block sequence corresponding to the target application, which is very time-consuming. Summary of the invention

[0004] The object of the present invention is to provide a method and device for constructing a control flow graph.

[0005] In a first aspect, a method for constructing a control flow graph is provided, the method comprising: for any basic block in a basic block sequence corresponding to a target application, when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, adding a directed edge from the basic block to the first basic block to the edge set of the control flow graph corresponding to the target application, otherwise adding the basic block to a special block set; for any special block in the special block set, determining a target directed path with the special block as a termination node based on the directed edges added to the edge set, determining the second basic block pointed to by the special block by sequentially executing the basic blocks belonging to the target directed path, and adding a directed edge from the special block to the second basic block to the edge set.

[0006] In a second aspect, a control flow graph construction device is provided, the device comprising: a regular block processing unit, configured to, for any basic block in the basic block sequence corresponding to the target application, add a directed edge from the basic block to the first basic block to the edge set of the control flow graph corresponding to the target application when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, otherwise the basic block is added to a special block set; a special block processing unit, configured to, for any special block in the special block set, determine a target directed path with the special block as the termination node based on the directed edges added to the edge set, determine the second basic block pointed to by the special block by sequentially executing all the basic blocks belonging to the target directed path, and add a directed edge from the special block to the second basic block to the edge set.

[0007] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computing device, the computing device executes the method described in the first aspect.

[0008] In the technical solution provided by the embodiments of this specification, in the process of constructing the CFG for the target application, some regular blocks in the basic block sequence can quickly discover and construct directed edges with the regular blocks as the starting nodes through their own structures; for special blocks other than regular blocks in the basic block sequence, directed edges with the special blocks as the starting nodes can be discovered and constructed by executing a relatively small number of basic blocks, which is conducive to more rapid and complete construction of the CFG corresponding to the target application. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0010] Figure 1 A flowchart of a method for constructing a control flow graph provided in an embodiment of this specification;

[0011] Figure 2 A schematic diagram of decoding the bytecode of a smart contract is provided for example;

[0012] Figure 3 A schematic diagram of a decoding result obtained by decoding a target application program provided as an example;

[0013] Figure 4A schematic diagram of multiple basic blocks and their connection relationships in CFG provided as an example;

[0014] Figure 5 A schematic diagram of determining a target directional path for a special block provided in an embodiment of this specification;

[0015] Figure 6 A schematic diagram of the structure of a control flow graph construction device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0017] By constructing a control flow graph (CFG) corresponding to the application and then performing static analysis on the application based on CFG, it is helpful to optimize the design of the application and improve the program running efficiency, and to quickly locate the problem during the debugging of the application. In addition, by performing security-related analysis techniques such as data flow analysis and taint analysis on CFG, potential security vulnerabilities in the program code can be detected and discovered, thereby improving the security of the application.

[0018] Take the smart contract deployed in the blockchain system as an example. Smart contracts can be automatically executed through the corresponding virtual machine in the blockchain system, thereby ensuring that untrusted entities can collaborate with each other to implement related transactions through smart contracts. Like other applications, smart contracts may also have vulnerabilities that can be maliciously exploited by intruders. Given that smart contracts that cannot be maliciously tampered with and have high economic value usually manage variable digital assets, they often attract a large number of intruders to exploit the vulnerabilities in smart contracts to seek illegal economic benefits and even threaten the security of the blockchain system. Therefore, before deploying smart contracts to the blockchain system, it is extremely important to detect and discover potential security vulnerabilities in smart contracts by building the CFG corresponding to the smart contract and then based on the CFG corresponding to the smart contract.

[0019] The embodiments of this specification at least provide a method and device for constructing a control flow graph. For any basic block in the basic block sequence corresponding to the target application, when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, a directed edge pointing from the basic block to the first basic block is added to the edge set of the control flow graph corresponding to the target application, otherwise the basic block is added to the special block set; for any special block in the special block set, a target directed path with the special block as the termination node is determined based on the directed edges added to the edge set, the second basic block pointed to by the special block is determined by sequentially executing the basic blocks belonging to the target directed path, and a directed edge pointing from the special block to the second basic block is added to the edge set.

[0020] In this way, in the process of constructing CFG for the target application, some regular blocks in the basic block sequence can quickly discover and construct directed edges with regular blocks as starting nodes through their own structures; for special blocks other than regular blocks in the basic block sequence, directed edges with special blocks as starting nodes can be discovered and constructed by executing a relatively small number of basic blocks; this is conducive to building the CFG corresponding to the target application more quickly and completely.

[0021] Figure 1 This is a flow chart of a method for constructing a control flow graph provided in an embodiment of this specification. The method can be executed by any device, platform, equipment or equipment cluster with computing / processing capabilities.

[0022] See also Figure 1 As shown, the method may include but is not limited to part or all of the following steps S101 to S113.

[0023] Step S101, obtaining a basic block sequence corresponding to a target application.

[0024] The program code corresponding to the target application can be decoded based on the selected instruction set to obtain the instruction sequence corresponding to the target application, and then the instruction sequence is divided into basic block sequences according to various transfer instructions in the instruction sequence. The aforementioned instruction set can be, for example, the instruction set used by the execution environment for executing the target application.

[0025] The target application may include, but is not limited to, a smart contract to be deployed to the blockchain system, for example, various computer programs that can be independently run on a terminal or server, program components that can be called by relevant requesting parties, etc. Correspondingly, the execution environment described herein may include, for example, a virtual machine or physical machine for directly executing the target application.

[0026] Take smart contracts as an example. In a blockchain system, various possible virtual machines can be used to execute smart contracts, such as stack-based virtual machines or register-based virtual machines. Among them, stack-based virtual machines may include but are not limited to Ethereum Virtual Machine (hereinafter referred to as EVM), and register-based virtual machines may include but are not limited to IELE virtual machines. Correspondingly, the bytecode corresponding to the smart contract can be decoded according to the instruction set used by the virtual machine used to execute the smart contract to obtain the corresponding decoding result.

[0027] Take the virtual machine that executes smart contracts, including EVM, as an example. The bytecode corresponding to the smart contract is usually in hexadecimal, and a single instruction in the instruction set used by EVM can usually correspond to a two-digit hexadecimal number in the bytecode. Therefore, two hexadecimal numbers can be read from the bytecode in sequence as identification units, and the read identification units can be converted into corresponding instructions according to the encoding comparison table of the instruction set used by EVM; it should be noted that because the instruction set used by EVM may define multiple types of push instructions, after the two-digit hexadecimal number is converted into a certain type of push instruction, it is also necessary to read the corresponding length of the string from the bytecode backwards in sequence according to the push instruction type, and then obtain the specific push instruction based on the read string.

[0028] For example, refer to Figure 2 As shown. For the bytecode of the exemplary smart contract, the two-digit hexadecimal number 60 is first read out according to the encoding comparison table of the instruction set used by the EVM. It is known that the encoding 60 corresponds to the push instruction type PUSH1. PUSH1 represents pushing a value of 1 byte into the stack. Therefore, the two-digit hexadecimal number 80 can be read after the two-digit hexadecimal number read, thereby converting the 4-digit hexadecimal number "6080" in the bytecode into the push instruction PUSH 80. Through similar operations, the 4-digit hexadecimal number "6040" in the bytecode can be converted into the push instruction PUSH 40, the 2-digit hexadecimal number "52" can be converted into the instruction MSTORE, and the 4-digit hexadecimal number "6004" can be converted into the push instruction PUSH 04. Convert the two-digit hexadecimal number "36" into the instruction CALLDATASIZE, convert the two-digit hexadecimal number "10" into the instruction LT, convert the 6-digit hexadecimal number into the push instruction PUSH 01b7, and convert the two-digit hexadecimal number 57 into the instruction JUMPI, and finally obtain the decoding result containing the instruction sequence.

[0029] In the bytecode of a smart contract, the bytecode at the end is usually the static data segment and the metadata segment. Metadata refers to the compilation-related information generated by the compiler when compiling a smart contract, such as but not limited to the compiler version. The specific form of the metadata segment is related to different compiler versions and is generally deployed at the end of the smart contract. Therefore, the metadata segment can be determined and removed based on the compiler version, such as removing Figure 3 The metadata segment "a1656.....0029" in the decoding result is shown. The static data segment refers to the data part between the instruction sequence and the metadata segment. Usually, the invalid instruction FE can be used as the starting position of the static data segment, and the subsequent data content starting from the invalid instruction FE can be directly removed from the decoding result to obtain the instruction sequence corresponding to the smart contract. It should be noted that under different compiler versions, the invalid instruction FE may represent different meanings. For example, it may be used as a dividing line between different function contents under the same smart contract. Therefore, it is necessary to pay attention to whether the content after the invalid instruction is an instruction in the instruction set used by the EVM. Only when the content after the instruction FE is not an instruction in the instruction set used by the EVM, it will be used as the starting position of the static data segment.

[0030] After obtaining the instruction sequence corresponding to the target application, for example, after obtaining the instruction sequence corresponding to the smart contract through the aforementioned example, the obtained instruction sequence can be divided into basic blocks to obtain the corresponding basic block sequence.

[0031] Continuing with the previous example, for the instruction set used by EVM, the transfer instructions belonging to the instruction set mainly include JUMP, JUMPI, REVERT, RETURN and INVALID, so these transfer instructions can be used as the end mark of the basic block, and the next instruction after the transfer instruction in the instruction sequence can be used as the start mark of another basic block, so as to divide the instruction sequence into multiple basic blocks arranged in sequence, that is, divide the instruction sequence into a basic block sequence.

[0032] It should be noted that different instructions in the instruction sequence corresponding to the target application have different logical addresses, where the logical address can be calculated based on the order of the corresponding instruction in the instruction sequence and the length of a single instruction in the instruction sequence. The logical address of the first instruction in a basic block can usually be directly used as the address information of the basic block. For example, please refer to Figure 4As shown, the logical address 0ca6 of the first instruction in basic block 142 can be directly used as the address information of basic block 142, the logical address 0c95 of the first instruction in basic block 143 can be directly used as the address information of basic block 143, the logical address 0cf9 of the first instruction in basic block 149 can be directly used as the address information of basic block 149, and the logical address 0484 of the first instruction in basic block 78 can be directly used as the address information of basic block 78.

[0033] After obtaining the basic block sequence corresponding to the target application, step S103 may be executed to determine, for any basic block in the basic block sequence, whether the last N instructions in the basic block can be used to determine the first basic block pointed to by the basic block.

[0034] When the last N instructions of a basic block meet certain predetermined formats, one or more other basic blocks pointed to by the basic block can be quickly determined directly based on the last N instructions of the basic block without executing the basic block. In other words, by detecting whether the last N instructions of the basic block meet certain predetermined formats, it can be determined whether the last N instructions of the basic block can be used to determine the one or more first basic blocks pointed to by the basic block.

[0035] Continuing with the previous example, let's take the instruction set used by EVM as an example. When the last two instructions of a basic block are a push instruction and a conditional transfer instruction, or a push instruction and an unconditional transfer instruction, the first basic block pointed to by the basic block can be quickly determined directly based on the last two instructions of the basic block without executing the basic block.

[0036] If the last N instructions in a basic block can be used to determine the first basic block pointed to by the basic block, then the following steps S105 and S107 may be sequentially executed on the basic block; otherwise, the following step S109 may be directly executed on the basic block.

[0037] Step S105: Determine the first basic block pointed to by the basic block according to the last N instructions in the basic block.

[0038] Continuing with the previous example, let’s take the instruction set used by EVM as an example.

[0039] When the last two instructions in a basic block are a push instruction and a conditional jump instruction, the next basic block after the basic block in the basic block sequence and the basic block corresponding to the address information in the push instruction can be determined as the first basic block pointed to by the basic block. Figure 4As shown, the last two instructions in the basic block 142 are the push instruction "PUSH 0cc1" and the conditional transfer instruction "JUMPI" respectively. The value 0cc1 pushed into the stack by the push instruction "PUSH 0cc1" is actually the address information of one of the basic blocks pointed to by the basic block 142. Therefore, in the basic block sequence corresponding to the target application, the next basic block 143 located after the basic block 142 and the basic block corresponding to the address information 0cc1 in the push instruction "PUSH 0cc1" can be determined as the first basic block pointed to by the basic block 142.

[0040] When the last two instructions in the basic block are a push instruction and an unconditional transfer instruction, the basic block corresponding to the address information in the push instruction is determined as the first basic block pointed to by the basic block. Figure 4 As shown, the last two instructions in basic block 143 are the push instruction "PUSH 0cf9" and the unconditional transfer instruction "JUMP" respectively. The value 0cf9 pushed into the stack by the push instruction "PUSH 0cf9" is actually the address information of the basic block pointed to by basic block 143. Therefore, the basic block corresponding to the address information 0cf9 can be determined as the first basic block pointed to by basic block 143.

[0041] Step S107, adding a directed edge from the basic block to the first basic block to the edge set of the control flow graph corresponding to the target application. In other words, here, adding a directed edge with the basic block as the starting node and the first basic block as the ending node to the edge set of the control flow graph corresponding to the target application.

[0042] Continuing with the example in step S105 above, refer to Figure 4 As shown. The directed edge E1 from basic block 142 to basic block 143 can be added to the edge set of the control flow graph corresponding to the target application, and the directed edge E2 from basic block 143 to basic block 149 can be added to the edge set of the control flow graph corresponding to the target application. In addition, for example, Figure 3 The directed edges E3, E4, E5, E6, etc. shown in are added to the edge set of the control flow graph corresponding to the target application.

[0043] Looking back at the previous text, if the last N instructions in a basic block cannot be used to directly determine the first basic block pointed to by the basic block, the following step S109 can be performed on the basic block to add the basic block as a special block to the special block set.

[0044] For a special block, the address information of other basic blocks pointed to by the special block can be obtained by executing the special block, that is, by sequentially executing multiple instructions included in the special block. However, for some special blocks, the data required for the execution of the special block may need to be provided by other basic blocks, that is, the special block may not be executed independently, but can only be correctly executed when other basic blocks that provide the data used by the special block are also correctly executed.

[0045] For example, refer to Figure 4 As shown. For basic block 149 as a special block, the first instruction JUMPDEST in basic block 149 only serves as the starting mark of the basic block. It has no actual operation content and does not need to use stack elements. The second instruction SWAP1 in basic block 149 indicates swapping the positions of the first stack element and the second stack element in the stack, and the instruction JUMPDEST before SWAP1 does not push new stack elements into the stack, so the two stack elements used by SWAP1 need to be provided by other basic blocks. The third instruction JUMP in basic block 149 needs to pop the first stack element in the stack and use the value of the first stack element in the stack as the address information of the basic block pointed to; wherein, the stack element that JUMP needs to pop is one of the two elements after the positions are swapped by SWAP1. Based on the above, it is not difficult to find that when the basic block 149 starts to be executed, the basic block 149 actually needs to use the two stack elements provided by other basic blocks, and the basic block 149 cannot be executed correctly independently.

[0046] The following steps S111 and S113 can be used to ensure that each special block can be correctly executed, thereby obtaining the second basic block pointed to by each special block, and then adding a directed edge from the special block to the corresponding second basic block to the edge set.

[0047] Specifically, in step S111, for any special block in the special block set, a target directed path with the special block as a terminal node is determined according to the directed edges added to the edge set.

[0048] In a possible implementation, for any special block, a depth-first search method can be used to recursively search the directed edges that have been added to the edge set to obtain a directed path with the special block as the end node, wherein the termination condition of the recursive search is that there is no directed edge in the edge set with the start node of the directed path as the end node. For example, please refer to Figure 4As shown, for the basic block 149 as a special block, a directed edge such as E2 with the basic block 149 as the termination node may be searched from the edge set; then the starting node "basic block 143" of E2 is taken as the search target, and a directed edge such as E1 with the basic block 143 as the termination node may be searched from the edge set; similarly, the starting node "basic block 142" of E1 is taken as the search target, and a directed edge such as E5 with the basic block 142 as the termination node may be searched; similarly, the starting node "basic block X2" of the edge E5 is taken as the search target, and a directed edge such as E8 with the basic block X2 as the termination node may be searched; for the starting node "basic block X1" of the directed edge E8, since there are no other directed edges with "basic block X1" as the termination node in the edge set of the control flow graph, the termination condition of the recursive search is met, and the search can be stopped to obtain a directed path containing the directed edges E8, E5, E1 and E2 in sequence for the basic block 149 as a special block.

[0049] Alternatively, it is also possible to obtain, for any special block, a directed edge with the special block as the termination node based on the directed edges that have been added to the edge set in other ways. For example, it is also possible to determine, for any special block, a directed path with the first basic block in the basic block sequence as the starting node and the special block as the termination node based on the directed edge set.

[0050] Correspondingly, after determining the directed path corresponding to any special block through various methods of the above examples, the directed path corresponding to the special block can be directly determined as the target directed path corresponding to the special block. In this case, although the target directed path corresponding to the special block can be determined relatively quickly, the determined target directed path may be relatively long, and other basic blocks that provide the stack elements used by the special block may be located at a relatively backward position in the directed path, that is, whether the basic blocks that are relatively forward in the target directed path are correctly executed may not have any impact on whether the special block can be correctly executed, resulting in the subsequent step S113, when determining the one or more second basic blocks pointed to by the special block by sequentially executing all the basic blocks belonging to the target directed path, it is necessary to execute some basic blocks that will not affect the special block, which brings unnecessary computing overhead, and has a negative impact on the efficiency of building the control flow graph.

[0051] In order to save computational overhead, refer to Figure 5 , the following steps S1111 and S1113 can be used to determine, for any special block in the special block set, a target directed path with the special block as the termination node according to the directed edges added to the edge set.

[0052] Step S1111 , determining a target depth lower limit that a stack used by a special block needs to meet when starting to execute the special block.

[0053] In a more specific example, the sum of the number of stack elements corresponding to each of the multiple instructions included in the special block can be determined, and the result of the operation can be used as the target depth lower limit that the stack used by the special block needs to meet. In this example, when executing any instruction belonging to the special block, the execution of the instruction may push new stack elements into the stack used, and the new stack elements are used by other instructions after the instruction, that is, some of the stack elements used in the process of executing the block may be provided by the basic block itself. Therefore, the determined target depth lower limit may be greater than the number of stack elements that the special block needs to use and are provided by other basic blocks. Although it can save computing overhead to a certain extent, it may still cause the subsequent target directed path to be determined, and there are some basic blocks that do not need to be executed, resulting in additional computing overhead.

[0054] In a more specific example, the number of popped elements and the number of pushed elements corresponding to each of the multiple instructions included in the special block can be determined first; then, for any i-th instruction among the multiple instructions, the candidate depth lower limit that the stack used by the special block needs to meet when the special block starts to be executed is determined based on the number of popped elements corresponding to the i-th instruction and the number of popped elements and the number of pushed elements corresponding to each of the first i-1 instructions among the multiple instructions; and then, the target depth lower limit is determined based on the candidate depth lower limits corresponding to each of the multiple instructions. In this example, the target depth lower limit that the stack used by a special block needs to meet can be equal to the actual number of stack elements that the special block needs to use and provided by other basic blocks when the special block starts to be executed. In the subsequent process, when the target directed path corresponding to the special block is determined based on the target depth lower limit, all basic blocks in the target directed path except the special block are basic blocks that can be used to support the correct execution of the special block, which can help to better save computing overhead.

[0055] Exemplarily, the number of stack elements that need to be popped from the stack used by any special block during the execution of any i-th item in any special block, i.e., the number of popped elements, is recorded as b i , the number of stack elements that need to be pushed into the stack used by the special block is recorded as a i, the total number of instructions included in the special block is recorded as m. When the first opcode in the special block starts to be executed, there must be enough stack elements in the stack to be popped, that is, the number of stack elements y in the stack used or the depth y of the stack used must be greater than or equal to b1, so b1 is the candidate depth lower limit corresponding to the first instruction; when the second opcode is executed, the number of stack elements in the stack used has changed to y-b1+a1, and similarly it needs to satisfy y-b1+a1 greater than or equal to b2, where b2+b1-a1 is the candidate depth lower limit corresponding to the second instruction; when the third opcode is executed, the number of stack elements in the stack used has changed to y-b1+a1-b2+a1, and similarly it needs to satisfy y-b1+a1-b2+a2 greater than or equal to b3, where b1-a1+b2-a2+b3 is the candidate depth lower limit corresponding to the third instruction. By analogy, the candidate depth lower limit can be determined for the i-th instruction. Then, the maximum value among the candidate depth lower limits corresponding to the multiple instructions included in the special block can be determined as the target depth lower limit, that is, the value of the target depth lower limit D can be

[0056] Step S1113, based on the target depth lower limit and the directed edges that have been added to the edge set, determine the target directed path with the special block as the termination node, wherein the cumulative depth increment of the stack used by the special block that causes the depth change by successfully executing all basic blocks in the target directed path except the special block in sequence is not less than the target depth lower limit.

[0057] In a possible implementation, a directed path with a special block as the termination node can be determined based on the directed edges added to the edge set. The specific process of determining a special block as the termination node can be referred to the detailed description above, which will not be repeated here.

[0058] After obtaining the directed path corresponding to a particular block, the corresponding target path can be determined by the following example method A or B.

[0059] Mode A, along the reverse direction of the directed path, performs the first recursive operation on the basic blocks in the directed path except the special blocks in sequence. The first recursive operation includes part or all of the following steps A1 to A7:

[0060] Step A1, for the current basic block corresponding to the first recursive operation, according to the number of stack elements popped and the number of stack elements pushed corresponding to the multiple instructions included in the current basic block, calculate the current depth increment of the stack used by the special block caused by the successful execution of the current basic block. Referring to the above, the number of stack elements that need to be popped from the stack used by the special block during the execution of any i-th instruction in any special block, i.e., the number of stack elements popped, is recorded as bi , the number of stack elements that need to be pushed into the stack used by the special block is recorded as a i , and the total amount of instructions included in the special block is recorded as m; then, the current depth increment corresponding to a basic block is

[0061] Please continue to refer to Figure 4 As shown, the directed path including directed edges E8, E5, E1 and E2 is taken as an example. In method A, the first recursive operation will be performed on basic block 143 first. Since the number of popped elements and the number of pushed elements corresponding to the first instruction PUSH 2cec in basic block 143 are 0 and 1 respectively, the number of popped elements and the number of pushed elements corresponding to the second instruction SWAP1 are both 2, the number of popped elements and the number of pushed elements corresponding to the third instruction POP are 1 and 0 respectively, the number of popped elements and the number of pushed elements corresponding to the fourth instruction PUSH 0cf9 are 0 and 1 respectively, and the number of popped elements and the number of pushed elements corresponding to the fifth instruction JUMP are 1 and 0 respectively, it can be calculated that the depth increment corresponding to basic block 143 is 0.

[0062] Based on a similar calculation method, refer to Figure 4 The basic blocks 142 and 149 in the example each contain multiple instructions: if the first recursive operation is performed on the basic block 142, the corresponding depth increment C can be calculated as 1 through step A1; if the first recursive operation is performed on the basic block 149, the corresponding depth increment C can be calculated as -1 through step A1.

[0063] Step A3, summing the current depth increment and the depth increments corresponding to each basic block between the current basic block and the special block in the directed path to obtain a cumulative depth increment.

[0064] Please continue to refer to Figure 4 As shown, a directed path including directed edges E8, E5, E1 and E2 is taken as an example. If the current basic block is basic block 143, since the current depth increment corresponding to basic block 143 is 0, and there is no other basic block between basic block 143 and 149 as a special block, the cumulative depth increment can be calculated to be 0; if the current basic block is basic block 142, the cumulative depth increment can be calculated to be 1; if the current basic block is basic block X2, the cumulative depth increment can be calculated to be 3.

[0065] When the cumulative depth increment is less than the target depth lower limit, it means that when executing the basic blocks in the directed path corresponding to the special block in sequence starting from the current basic block, the special block may still not be executed correctly. In this case, it is necessary to continue to execute the first operation on another basic block in the directed path that is located before the current basic block and points to the current basic block.

[0066] Please refer to Figure 4 As shown, when the basic block 149 starts to be executed, the target depth lower limit D that the stack used by the basic block 149 needs to meet is 2, that is, 2 of the data used by the basic block 149 need to be provided by each basic block located before the basic block 149 in the directed path containing the directed edges E8, E5, E1 and E2. The successful execution of the basic block 143 does not change the number of stack elements. Even if the basic block 143 is successfully executed, the number of stack elements may still be less than 2, and it is necessary to continue to perform the first recursive operation on the basic block 142 located before the basic block 143 in the directed path. In the process of performing the first recursive operation on the basic block 142, the determined cumulative depth increment is still less than the target depth lower limit 2, and it is necessary to continue to perform the first recursive operation on the basic block X2.

[0067] In the process of performing the first recursive operation on the basic block X2, assuming that the depth increment corresponding to the basic block X2 is 2, the cumulative depth increment D determined for the basic block X2 in step A3 is 3, which is greater than the target depth lower limit 2. In other words, as long as the basic block X2, the basic block 142 and the basic block 143 are correctly executed, the basic block 149 can be correctly executed.

[0068] Step A5: When the accumulated depth increment is not less than the target depth lower limit, determine whether the target depth lower limit that the stack used by the current basic block needs to meet when starting to execute the current basic block is 0. If so, execute step A7.

[0069] As can be understood from the foregoing, if the lower limit of the target depth that the stack used by the current basic block needs to meet is not 0, it means that the data used by the current basic block may be provided by other basic blocks located before the current basic block in the directed path. In this case, it is necessary to continue to perform the first recursive operation on other basic blocks located before the current basic block in the directed path. For example, assuming that the lower limit of the target depth corresponding to basic block X2 is not 0, it is necessary to continue to perform the first recursive operation on basic block X1.

[0070] Correspondingly, if the lower limit of the depth of the stack used by the current basic block is 0, it means that the current basic block does not need to use the data provided by other basic blocks located before the current basic block in the directed path, and the current basic block can be independently and correctly executed, that is, all subsequent basic blocks starting from the current basic block can be correctly executed in sequence. In this case, the following step A7 can be executed to determine the target directed path with the current basic block as the starting node from the directed path.

[0071] Please continue to refer to Figure 4As shown, taking the directed path including directed edges E8, E5, E1 and E2 as an example, assuming that when the basic block X2 is started to be executed, the target depth lower limit D that the stack used by the basic block X2 needs to meet is 0, then the target directed path including directed edges E5, E1 and E2 can be determined from the directed path including directed edges E8, E5, E1 and E2.

[0072] Method B, first determine the candidate basic block from the directed path, where the lower limit of the target depth that the stack used by the candidate basic block needs to meet when the candidate basic block starts to be executed is 0; for example, please refer to Figure 4 As shown, taking a directed path including directed edges E8, E5, E1 and E2 as an example, the candidate basic blocks with a target depth lower limit of 0 determined from the directed path may include basic block X1, basic block X2 and basic block 142. Next, when the number of candidate basic blocks is greater than 1, the second recursive operation is performed on the candidate basic blocks in the directed path in sequence along the reverse direction of the directed path.

[0073] The aforementioned second recursive operation may include the following steps B1 and B3.

[0074] Step B1, for the current candidate basic block corresponding to the second recursive operation, determine the accumulated depth increment resulting from the successful execution of the current candidate basic block and all basic blocks between the current candidate basic block and the special block, which causes the depth change of the stack used by the special block.

[0075] Please continue to refer to Figure 4 As shown, a directed path including directed edges E8, E5, E1 and E2 is taken as an example. Referring to the calculation method of the depth increment and the cumulative depth increment provided above, if the current candidate basic block is basic block 142, the corresponding cumulative depth increment can be calculated to be 1; if the current candidate basic block is basic block X2, the corresponding cumulative depth increment can be calculated to be 3.

[0076] When the accumulated increment calculated in step B1 does not reach the target depth lower limit corresponding to the special block, the second recursive operation may be continued to be performed on the previous candidate basic block located before the current candidate basic block in the directed path.

[0077] Correspondingly, in step B3, when the accumulated depth increment reaches the target depth lower limit, a target directed path with the current basic block as the starting node can be determined from the directed paths.

[0078] In method B, when the number of candidate basic blocks determined from a directed path is 1, a target directed path with the candidate basic block as a starting node and the special block as an ending node can be directly determined from the directed path.

[0079] After determining the corresponding target directional path for any special block, the following step S113 may be performed on the special block.

[0080] Specifically, in step S113, by executing all basic blocks belonging to the target directed path, the second basic block pointed to by the special block is determined, and a directed edge from the special block to the second basic block is added to the edge set.

[0081] Please continue to refer to Figure 4 As shown, taking the directed path including directed edges E8, E5, E1 and E2 as an example, the target directed path including directed edges E5, E1 and E2 can be determined from the directed path. Since the target depth lower limit corresponding to the starting node "basic block X2" in the target directed path is 0, it is possible to directly start from basic block X2 and sequentially execute basic blocks X2, basic block 142, basic block 143 and basic block 149 in the target directed path, and obtain the stack element popped from the stack by the jump instruction JUMP in basic block 149. The value of the stack element is the address information of the second basic block pointed to by basic block 149. For example, when the value of the stack element is 0484, basic block 78 with address information of 0484 can be determined as the second basic block pointed to by basic block 149, thereby adding the directed edge from basic block 149 to basic block 78 to the edge set.

[0082] It should be specially noted that, in order to accurately describe the technical solutions provided in the embodiments of this specification, the address information of any basic block, the multiple instructions specifically included in any basic block, the value of the target depth lower limit D corresponding to any basic block, and the value of the depth increment C provided in the foregoing text are not the actual values ​​in the actual technical scenario but serve only as examples.

[0083] Based on the same concept as the above method embodiment, this specification embodiment also provides a control flow graph construction device 600. Figure 6 As shown, the device 600 includes: a regular block processing unit 601, configured to, for any basic block in the basic block sequence corresponding to the target application, add a directed edge from the basic block to the first basic block to the edge set of the control flow graph corresponding to the target application when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, otherwise the basic block is added to the special block set; a special block processing unit 603, configured to, for any special block in the special block set, determine a target directed path with the special block as the termination node according to the directed edges added to the edge set, determine the second basic block pointed to by the special block by sequentially executing the basic blocks belonging to the target directed path, and add a directed edge from the special block to the second basic block to the edge set.

[0084] A computer-readable storage medium is also provided in an embodiment of the present specification, on which a computer program / instruction is stored. When the computer program / instruction is executed in a computer, the computer is caused to execute the method steps performed by the computing device or data storage system in the aforementioned embodiments.

[0085] A computing device is also provided in an embodiment of the present specification, including a memory and a processor, wherein the memory stores a computer program / instructions, and when the processor executes the computer program / instructions, the method steps performed by the computing device or the data storage system in the aforementioned embodiments are implemented.

[0086] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0087] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0088] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0089] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0090] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0091] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0093] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0094] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0095] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0096] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0097] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0099] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of mutual contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0100] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A method for constructing a control flow graph, the method comprising: For any basic block in the basic block sequence corresponding to the target application, when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, a directed edge from the basic block to the first basic block is added to the edge set of the control flow graph corresponding to the target application; otherwise, the basic block is added to the special block set; For any special block in the special block set, a target directed path with the special block as the termination node is determined based on the directed edges that have been added to the edge set, and the second basic block pointed to by the special block is determined by sequentially executing the basic blocks belonging to the target directed path, and a directed edge from the special block to the second basic block is added to the edge set.

2. The method according to claim 1, further comprising: determining an instruction set used by an execution environment for executing the target application; According to the instruction set, decoding the program code corresponding to the target application program to obtain an instruction sequence; The instruction sequence is divided into a basic block sequence.

3. The method of claim 2, wherein the execution environment comprises a stack-based virtual machine; And / or, the target application includes a smart contract.

4. The method according to claim 1, further comprising: When the last two instructions of the basic block are a push instruction and a conditional transfer instruction, the next basic block of the basic block and the basic block corresponding to the address information in the push instruction are both determined as the first basic block pointed to by the basic block.

5. The method according to claim 1, further comprising: When the last two instructions in the basic block are a push instruction and an unconditional transfer instruction, the basic block corresponding to the address information in the push instruction is determined as the first basic block pointed to by the basic block.

6. The method according to claim 1, wherein determining a target directed path with the special block as a terminal node based on the directed edges added to the edge set comprises: Determine a target lower depth limit that a stack used by the special block needs to meet when starting to execute the special block; According to the target depth lower limit and the directed edges that have been added to the edge set, a target directed path with the special block as the termination node is determined, wherein all basic blocks in the target directed path except the special block make the cumulative depth increment of the stack used by the special block not less than the target depth lower limit.

7. The method according to claim 6, wherein determining a target lower limit of the depth of the stack used by the special block that needs to be met when starting to execute the special block comprises: Determine the number of popped elements and the number of pushed elements corresponding to each of the plurality of instructions included in the special block; For any i-th instruction among the plurality of instructions, determine, according to the number of popped elements corresponding to the i-th instruction, and the number of popped elements and the number of pushed elements corresponding to each of the first i-1 instructions among the plurality of instructions, a candidate lower limit of the depth that the stack used by the special block needs to satisfy when starting to execute the special block; A target depth lower limit is determined according to the candidate depth lower limits corresponding to each of the plurality of instructions.

8. The method according to claim 6, wherein determining a target directed path with the special block as a termination node based on the target depth lower limit and the directed edges added to the edge set comprises: Determine, based on the directed edges added to the edge set, a directed path with the special block as a terminal node; Along the reverse direction of the directed path, a first recursive operation is sequentially performed on the basic blocks in the directed path except the special block, wherein the first recursive operation includes: For a current basic block corresponding to the first recursive operation, calculating a current depth increment resulting from a depth change of a stack used by the special block caused by successfully executing the current basic block according to the number of popped elements and the number of pushed elements corresponding to each of the multiple instructions included in the current basic block; Sum the current depth increment and the depth increments corresponding to each basic block between the current basic block and the special block in the directed path to obtain a cumulative depth increment; When the accumulated depth increment is not less than the target depth lower limit, determining whether the target depth lower limit that the stack used by the current basic block needs to satisfy when starting to execute the current basic block is 0; If yes, a target directed path with the current basic block as a starting node is determined from the directed paths.

9. The method according to claim 6, wherein determining the target directed path with the special block as the terminal node according to the target depth lower limit and the directed edges added to the edge set comprises: Determine, based on the directed edges added to the edge set, a directed path with the special block as a terminal node; Determine all candidate basic blocks located in the directed path, wherein when starting to execute the candidate basic blocks, the lower limit of the target depth that the stack used by the candidate basic blocks needs to meet is 0; When the number of determined candidate basic blocks is greater than 1, a second recursive operation is sequentially performed on the candidate basic blocks located in the directed path in the reverse direction of the directed path, wherein the second recursive operation includes: For the current candidate basic block corresponding to the second recursive operation, determine a cumulative depth increment resulting from a depth change of a stack used by the special block caused by successfully executing the current candidate basic block and all basic blocks between the current candidate basic block and the special block; When the accumulated depth increment reaches the target depth lower limit corresponding to the special block, a target directed path with the current candidate basic block as a starting node is determined from the directed paths.

10. A control flow graph construction device, the device comprising: a conventional block processing unit configured to, for any basic block in the basic block sequence corresponding to the target application, add a directed edge from the basic block to the first basic block to the edge set of the control flow graph corresponding to the target application when the first basic block pointed to by the basic block can be determined based on the last N instructions of the basic block, otherwise add the basic block to the special block set; The special block processing unit is configured to determine, for any special block in the special block set, a target directed path with the special block as the termination node according to the directed edges that have been added to the edge set, determine the second basic block pointed to by the special block by sequentially executing all basic blocks belonging to the target directed path, and add a directed edge from the special block to the second basic block to the edge set.

11. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computing device, the computing device executes the method according to any one of claims 1 to 9.

Images