Memory monitoring system, memory access time sequence recording method and memory checking and modifying method
Through the design of the memory monitoring system, the CPU access address and data is recorded using the FPGA control module, which solves the problem of difficult monitoring of memory read and write operations of embedded devices, realizes memory access timing recording and user data modification, and supports dynamic debugging and analysis of devices .
Patent Information
- Application Number
- CN202411306041.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-19
- Publication Date
- 2025-01-07
AI Technical Summary
Existing embedded devices are difficult to monitor and analyze memory read and write operations when hiding file systems and preventing users from debugging, resulting in difficulty in analyzing hidden backdoors and potential vulnerabilities of devices.
Design a memory monitoring system, including a memory base, FPGA control module, main memory module, backup memory module and USB interface module, record CPU memory access address and data through FPGA control module, realize memory access timing recording, and support user reading and modify memory data.
It realizes monitoring and timing recording of device memory read and write operations, supports firmware loading process analysis, and provides support for dynamic debugging and analysis of devices, assists embedded device analysts to record memory access timing, and supports users to read and modify memory data. .
Smart Images
Figure CN119271492A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of memory monitoring, and in particular to a memory monitoring system, a memory access timing recording method, and a memory checking and modifying method. Background Art
[0002] Currently, more and more embedded devices, such as routers and modems, use a combination of firmware encryption, trusted chip protection, and restricted shell tool sets to hide the file system and prevent user debugging. However, this brings great difficulties to the analysis of hidden backdoors and potential vulnerabilities of the devices. Summary of the invention
[0003] The technical problem to be solved by the present invention is: to provide a memory monitoring system, a memory access timing recording method and a memory viewing and modification method, which can monitor the memory read and write operations of the device and record the timing relationship to support firmware loading process analysis, and at the same time can actively read and write the memory of the device, and combined with memory patch technology, can provide support for dynamic debugging and analysis of the device.
[0004] In order to solve the above technical problems, the first technical solution adopted by the present invention is:
[0005] A memory monitoring system comprises a memory base, a memory signal interface, an FPGA control module, a main memory module, a standby memory module and a USB interface module, wherein the FPGA control module is electrically connected to the memory signal interface, the main memory module, the standby memory module and the USB interface module respectively, the USB interface module is electrically connected to an external analysis device, the memory base is used to be plugged into the memory signal interface of the device to be analyzed, the main memory module is used for normal reading and writing of the device to be analyzed, and the standby memory module is used for users to read memory data;
[0006] The FPGA control module includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data.
[0007] The second technical solution adopted by the present invention is:
[0008] A memory access timing recording method, applied to the above-mentioned memory monitoring system, comprises the following steps:
[0009] S1. Receive a CPU memory access signal of a device to be analyzed, and obtain a CPU memory access address according to the CPU memory access signal;
[0010] S2, writing the CPU memory access address into a storage unit in the address memory module whose address is the memory access sequence number;
[0011] S3, analyzing the CPU memory access signal of the device to be analyzed, and determining the type of the CPU memory access signal;
[0012] S4, if the type of the CPU memory access signal is a read signal type, the read-write flag position is set to zero, and step S7 is executed; if the type of the CPU memory access signal is a write signal type, the read-write flag position is set to one, and step S5 is executed;
[0013] S5, parsing the byte data to be written into the data memory module in the CPU memory access signal, and splicing the byte data with a first preset byte data into double-byte write data;
[0014] S6, writing the double-byte write data into a storage unit whose address is the access sequence number in the data memory module, and executing step S9;
[0015] S7, receiving and parsing the memory data returned to the device to be analyzed in the main memory module, and splicing the memory data with a second preset byte data into double-byte read data;
[0016] S8, writing the double-byte read data into a storage unit in the data memory module whose address is the memory access sequence number;
[0017] S9, adding one to the current memory access sequence number as the target memory access sequence number, and determining whether the target memory access sequence number is less than a preset maximum number of memory access times;
[0018] S10, if yes, execute step S1; otherwise, execute step S11;
[0019] S11, set the memory access timing record enable flag to zero and exit.
[0020] The third technical solution adopted by the present invention is:
[0021] A memory viewing and modification method is applied to the above-mentioned memory monitoring system, including putting the memory address and memory data of the write operation of the CPU memory access signal of the device to be analyzed into the write operation queue, and putting the read and write memory operations of the user memory access signal of the external analysis device into the read operation queue and the write operation queue respectively, specifically including the following steps:
[0022] The write operation sorting steps of the CPU memory access signal are as follows:
[0023] S101, setting the instruction count value of the write operation to zero;
[0024] S102, receiving and parsing a CPU memory access signal of a device to be analyzed, and determining a type of the CPU memory access signal;
[0025] S103, if the type of the CPU memory access signal is a read signal type, execute step S102; if the type of the CPU memory access signal is a write signal type, execute step S104;
[0026] S104, acquiring a memory address and memory data of a write operation according to the CPU memory access signal;
[0027] S105, writing the memory address and memory data of the write operation into a write operation buffer module;
[0028] S106, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation;
[0029] User memory access signal sorting operation steps:
[0030] S201, setting the instruction count value of the read operation to zero;
[0031] S202, receiving and analyzing a user memory access signal from an external analysis device;
[0032] S203, acquiring a memory address of a write operation and a memory address of a read operation according to the user memory access signal;
[0033] S204, determining the type of the user memory access signal;
[0034] S205, if the type of the user memory access signal is a read signal type, execute step S209; if the type of the user memory access signal is a write signal type, execute step S206;
[0035] S206, acquiring memory data of a write operation according to the user memory access signal;
[0036] S207, writing the memory address and memory data of the write operation into a write operation buffer module;
[0037] S208, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation, and executing step S202;
[0038] S209, writing the memory address of the read operation into a read operation buffer module;
[0039] S210, adding one to the instruction count value of the current read operation as the instruction count value of the target read operation, and executing step S202.
[0040] The beneficial effects of the present invention are:
[0041] This solution sets a memory base, a memory signal interface, an FPGA control module, a main memory module, a backup memory module and a USB interface module. The CPU memory access signal of the device to be analyzed is transmitted to the FPGA control module via the memory base and the memory signal interface, and is transmitted to the main memory module and the backup memory module after being processed by the FPGA control module. The main memory module and the backup memory module receive the CPU memory access signal and generate an output signal (i.e., output the memory data to be read by the device to be analyzed). The output signal is also sent back to the device to be analyzed via the FPGA control module. The FPGA control module includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data, so that the memory access timing of the device to be analyzed can be obtained. The memory monitoring system designed in this solution is equivalent to a memory chip for the device to be analyzed, and does not change the signal processing logic of the original system. For embedded device analysts, it can assist in recording the memory read and write timing of the device to be analyzed, and support users to read and modify memory data. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 is a connection block diagram of the memory monitoring system of the present invention;
[0043] Figure 2 A flow chart of the steps of the memory access timing recording method of the present invention;
[0044] Figure 3 A flowchart of the steps of the memory viewing method of the present invention;
[0045] Description of labels:
[0046] 1. Memory base; 2. Memory signal interface; 3. FPGA control module; 4. Main memory module; 5. Backup memory module; 6. USB interface module; 7. Device to be analyzed; 8. External analysis device. DETAILED DESCRIPTION
[0047] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.
[0048] Please refer to Figure 1 , the first technical solution adopted by the present invention is:
[0049] A memory monitoring system comprises a memory base, a memory signal interface, an FPGA control module, a main memory module, a standby memory module and a USB interface module, wherein the FPGA control module is electrically connected to the memory signal interface, the main memory module, the standby memory module and the USB interface module respectively, the USB interface module is electrically connected to an external analysis device, the memory base is used to be plugged into the memory signal interface of the device to be analyzed, the main memory module is used for normal reading and writing of the device to be analyzed, and the standby memory module is used for users to read memory data;
[0050] The FPGA control module includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data.
[0051] From the above description, it can be seen that the beneficial effects of the present invention are:
[0052] This solution sets a memory base, a memory signal interface, an FPGA control module, a main memory module, a backup memory module and a USB interface module. The CPU memory access signal of the device to be analyzed is transmitted to the FPGA control module via the memory base and the memory signal interface, and is transmitted to the main memory module and the backup memory module after being processed by the FPGA control module. The main memory module and the backup memory module receive the CPU memory access signal and generate an output signal (i.e., output the memory data to be read by the device to be analyzed). The output signal is also sent back to the device to be analyzed via the FPGA control module. The FPGA control module includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data, so that the memory access timing of the device to be analyzed can be obtained. The memory monitoring system designed in this solution is equivalent to a memory chip for the device to be analyzed, and does not change the signal processing logic of the original system. For embedded device analysts, it can assist in recording the memory read and write timing of the device to be analyzed, and support users to read and modify memory data.
[0053] Furthermore, the FPGA control module also includes a write operation buffer module, and the write operation buffer module is electrically connected to the main memory module and the backup memory module respectively.
[0054] As can be seen from the above description, the write operation buffer module is used to synchronize data with the main memory module, and the address and data to be written are first placed in the write operation buffer queue and are written when the standby memory module is idle.
[0055] Furthermore, the FPGA control module also includes a read operation buffer module, and the read operation buffer module is electrically connected to the main memory module and the backup memory module respectively.
[0056] From the above description, it can be seen that by setting up a read operation buffer module, when the user needs to read a certain range of memory data, the corresponding read operation is placed in the read operation buffer queue, and the corresponding data is read when the standby memory module is idle. The read data and the corresponding address can be stored in the storage area used by the memory access timing recording function (ie, the address memory module and the data memory module).
[0057] Please refer to Figure 2 , the second technical solution adopted by the present invention is:
[0058] A memory access timing recording method, applied to the above-mentioned memory monitoring system, comprises the following steps:
[0059] S1. Receive a CPU memory access signal of a device to be analyzed, and obtain a CPU memory access address according to the CPU memory access signal;
[0060] S2, writing the CPU memory access address into a storage unit in the address memory module whose address is the memory access sequence number;
[0061] S3, analyzing the CPU memory access signal of the device to be analyzed, and determining the type of the CPU memory access signal;
[0062] S4, if the type of the CPU memory access signal is a read signal type, the read-write flag position is set to zero, and step S7 is executed; if the type of the CPU memory access signal is a write signal type, the read-write flag position is set to one, and step S5 is executed;
[0063] S5, parsing the byte data to be written into the data memory module in the CPU memory access signal, and splicing the byte data with a first preset byte data into double-byte write data;
[0064] S6, writing the double-byte write data into a storage unit whose address is the access sequence number in the data memory module, and executing step S9;
[0065] S7, receiving and parsing the memory data returned to the device to be analyzed in the main memory module, and splicing the memory data with a second preset byte data into double-byte read data;
[0066] S8, writing the double-byte read data into a storage unit in the data memory module whose address is the memory access sequence number;
[0067] S9, adding one to the current memory access sequence number as the target memory access sequence number, and determining whether the target memory access sequence number is less than a preset maximum number of memory access times;
[0068] S10, if yes, execute step S1; otherwise, execute step S11;
[0069] S11, set the memory access timing record enable flag to zero and exit.
[0070] Please refer to Figure 3 , the third technical solution adopted by the present invention is:
[0071] A memory viewing and modification method is applied to the above-mentioned memory monitoring system, including putting the memory address and memory data of the write operation of the CPU memory access signal of the device to be analyzed into the write operation queue, and putting the read and write memory operations of the user memory access signal of the external analysis device into the read operation queue and the write operation queue respectively, specifically including the following steps:
[0072] The write operation sorting steps of the CPU memory access signal are as follows:
[0073] S101, setting the instruction count value of the write operation to zero;
[0074] S102, receiving and parsing a CPU memory access signal of a device to be analyzed, and determining a type of the CPU memory access signal;
[0075] S103, if the type of the CPU memory access signal is a read signal type, execute step S102; if the type of the CPU memory access signal is a write signal type, execute step S104;
[0076] S104, acquiring a memory address and memory data of a write operation according to the CPU memory access signal;
[0077] S105, writing the memory address and memory data of the write operation into a write operation buffer module;
[0078] S106, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation;
[0079] User memory access signal sorting operation steps:
[0080] S201, setting the instruction count value of the read operation to zero;
[0081] S202, receiving and analyzing a user memory access signal from an external analysis device;
[0082] S203, acquiring a memory address of a write operation and a memory address of a read operation according to the user memory access signal;
[0083] S204, determining the type of the user memory access signal;
[0084] S205, if the type of the user memory access signal is a read signal type, execute step S209; if the type of the user memory access signal is a write signal type, execute step S206;
[0085] S206, acquiring memory data of a write operation according to the user memory access signal;
[0086] S207, writing the memory address and memory data of the write operation into a write operation buffer module;
[0087] S208, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation, and executing step S202;
[0088] S209, writing the memory address of the read operation into a read operation buffer module;
[0089] S210, adding one to the instruction count value of the current read operation as the instruction count value of the target read operation, and executing step S202.
[0090] Furthermore, the method further includes performing a read and write operation on the spare memory module, which specifically includes the following steps:
[0091] S301, setting the memory access sequence numbers in the memory access sequence number units in the address memory module and the data memory module to zero;
[0092] S302, determining whether the instruction count value of the target write operation is zero;
[0093] S303, if the instruction count value of the target write operation is zero, execute step S306; otherwise, execute step S304;
[0094] S304, taking out the memory address and memory data of the write operation from the write operation buffer module;
[0095] S305, writing the memory address of the write operation into the memory address unit in the standby memory module, and executing step S302;
[0096] S306, determining whether the instruction count value of the target read operation is zero;
[0097] S307, if the instruction count value of the target read operation is zero, execute step S314; otherwise, execute step S308;
[0098] S308, taking out the memory address of the read operation from the read operation buffer module;
[0099] S309, reading the memory data pointed to by the memory address of the read operation in the memory address unit in the standby memory module;
[0100] S310, writing the memory address of the read operation and the memory data pointed to by the memory address of the read operation into the memory access sequence number units in the address memory module and the data memory module respectively;
[0101] S311, adding one to the memory access sequence number in the memory access sequence number unit in the address memory module and the data memory module as the target memory access sequence number;
[0102] S312, determining whether the instruction count value of the target write operation is zero;
[0103] S313, if the instruction count value of the target write operation is not zero, execute step S302, otherwise execute step S306;
[0104] S314, setting the memory view and modify enable flag to zero.
[0105] Furthermore, the method further comprises the following steps:
[0106] S315, determining whether the memory view and modify enable flag is one;
[0107] S316, if the memory view and modify enable flag is one, execute step S301; otherwise, execute step S317;
[0108] S317, determining whether the primary and standby memory swap flag is one;
[0109] S318, if the primary and standby memory swap flag is one, execute step S319, otherwise execute step S320;
[0110] S319, swapping the main memory module and the backup memory module, and setting the main and backup memory swap flag to zero;
[0111] S320. Execute step S315.
[0112] From the above description, it can be seen that after the backup memory module is read, the user can use the host access interface provided by the USB interface module to electrically connect the analysis machine to the USB interface module, and use the software installed on the analysis machine to read the corresponding data from the address memory module and the data memory module; after the write operation of the backup memory module is completed and the roles of the main memory module and the backup memory module are exchanged, the user's memory rewrite of the device to be analyzed takes effect immediately.
[0113] Please refer to Figure 1 , Embodiment 1 of the present invention is:
[0114] A memory monitoring system comprises a memory base 1, a memory signal interface 2, an FPGA control module 3, a main memory module 4, a standby memory module 5 and a USB interface module 6, wherein the FPGA control module 3 is electrically connected to the memory signal interface 2, the main memory module 4, the standby memory module 5 and the USB interface module 6 respectively, the USB interface module 6 is electrically connected to an external analysis device 8, the memory base 1 is used to be plugged into the memory signal interface 2 of the device to be analyzed, the main memory module 4 is used for normal reading and writing of the device to be analyzed 7, and the standby memory module 5 is used for reading memory data for a user;
[0115] The FPGA control module 3 includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data.
[0116] When using the system, the memory chip on the circuit board of the device to be analyzed 7 needs to be removed and replaced with the memory base 1, and then the memory signal interface 2 is inserted into the memory base 1, so as to transmit the memory read and write signals to the FPGA control module 3.
[0117] The frequency of the CPU memory access signal of the device to be analyzed 7 is very high. For example, the memory access signal for DDR3 / DDR4 is above GHz. If a logic analyzer or other equipment is used, it is extremely difficult and costly to record and analyze the memory access timing from the signal perspective. However, if an FPGA control module 3 is added between the device to be analyzed 7 and the memory chip, and the FPGA control module 3 acts as the agent for the memory access process and only records the memory access address and read and write data, the memory access timing analysis can be efficiently implemented.
[0118] The main memory module and the backup memory module use DDR3 / DDR4 general purpose chips on the market, and the connection circuit between the FPGA control module 3 and such chips can use the reference circuit of Xilinx fgpa;
[0119] The DDR3 chips can be used in the following models: Samsung K4B4G1646E-BYMA, Hynix H5TQ4G83CFR-RDC;
[0120] The following DDR4 chips can be used: Hynix H5AN8G8NAFR-VKC, Samsung K4AAG165WA-BCWE; the choice of chip model is ultimately to match the device to be analyzed. In principle, the reading and writing speed cannot be slower than the memory chip replaced by the memory base 1 on the device to be analyzed.
[0121] When the device to be analyzed 7 uses a DDR3 chip, the FPGA control module 3 can use a xilinx artix 7 series chip (such as xc7A200T-2FBG484I);
[0122] When the device to be analyzed 7 uses a DDR4 chip, the FPGA control module 3 can use a Xilinx ultrascale series chip (such as XCVU9P-1FLGB2104I).
[0123] The FPGA control module 3 further includes a write operation buffer module, which is electrically connected to the main memory module 4 and the backup memory module 5 respectively.
[0124] The FPGA control module 3 further includes a read operation buffer module, which is electrically connected to the main memory module 4 and the backup memory module 5 respectively.
[0125] Please refer to Figure 2 , Embodiment 2 of the present invention is:
[0126] A memory access timing recording method, applied to the memory monitoring system in the first embodiment, comprises the following steps:
[0127] S1, receiving a CPU memory access signal of the device to be analyzed 7, and obtaining a CPU memory access address according to the CPU memory access signal;
[0128] S2, write the CPU memory access address into the storage unit whose address is the memory access sequence number in the address memory module; for example, the receiving device 7 to be analyzed wants to access 1 byte stored at the address 0xffff0033 in the memory, assuming that the memory access sequence number is 1 at this time, then we write the value 0xffff0033 into the storage area with the address 1 in the address memory module, and its memory bit width is 32 bits;
[0129] S3, analyzing the CPU memory access signal of the device to be analyzed 7, and determining the type of the CPU memory access signal;
[0130] S4, if the type of the CPU memory access signal is a read signal type, the read-write flag position is set to zero, and step S7 is executed; if the type of the CPU memory access signal is a write signal type, the read-write flag position is set to one, and step S5 is executed;
[0131] S5, parsing the byte data to be written into the data memory module in the CPU memory access signal, and splicing the byte data with a first preset byte data into double-byte write data;
[0132] S6, write the double-byte write data into the storage unit whose address is the access sequence number in the data memory module, and execute step S9; assuming that the access sequence number is 1 and the data to be written is 0x66, we write 0x0166 to the storage area whose address is 1 in the data memory module, and the hexadecimal 01 indicates that the CPU performs a write operation;
[0133] S7, receiving and parsing the memory data returned to the device to be analyzed 7 from the main memory module 4, and splicing the memory data with a second preset byte data into double-byte read data;
[0134] S8, write the double-byte read data into the storage unit whose address is the access sequence number in the data memory module; assuming that the access sequence number is 1 and the read data is 0x88, we write 0x0066 to the storage area whose address is 1 in the data memory module, and hexadecimal 00 indicates that the CPU performs a read operation;
[0135] S9, adding one to the current memory access sequence number as the target memory access sequence number, and determining whether the target memory access sequence number is less than a preset maximum memory access number; in this embodiment, the maximum memory access number is 4294967295;
[0136] S10, if yes, execute step S1; otherwise, execute step S11;
[0137] S11, set the memory access timing record enable flag to zero and exit.
[0138] In this embodiment, the memory access sequence number starts from 0 and has a total of 32 bits.
[0139] After the memory access timing record is completed, that is, when the memory access timing record enable flag is zero, the user can safely read the data in the address memory module and the data memory module through the FPGA control logic (the user is in exclusive mode at this time, and there will be no other read and write operations except the record read instructions issued by the user).
[0140] Please refer to Figure 3 , Embodiment 3 of the present invention is:
[0141] A memory viewing and modification method is applied to the memory monitoring system in the first embodiment, including placing the memory address and memory data of the write operation of the CPU memory access signal of the device to be analyzed 7 into the write operation queue, and placing the read and write memory operations of the user memory access signal of the external analysis device into the read operation queue and the write operation queue respectively, specifically including the following steps:
[0142] The write operation sorting steps of the CPU memory access signal are as follows:
[0143] S101, setting the instruction count value of the write operation to zero;
[0144] S102, receiving and parsing the CPU memory access signal of the device to be analyzed 7, and determining the type of the CPU memory access signal;
[0145] S103, if the type of the CPU memory access signal is a read signal type, execute step S102; if the type of the CPU memory access signal is a write signal type, execute step S104;
[0146] S104, acquiring a memory address and memory data of a write operation according to the CPU memory access signal;
[0147] S105, writing the memory address and memory data of the write operation into a write operation buffer module;
[0148] S106, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation;
[0149] User memory access signal sorting operation steps:
[0150] S201, setting the instruction count value of the read operation to zero;
[0151] S202, receiving and analyzing a user memory access signal from an external analysis device;
[0152] S203, acquiring a memory address of a write operation and a memory address of a read operation according to the user memory access signal;
[0153] S204, determining the type of the user memory access signal;
[0154] S205, if the type of the user memory access signal is a read signal type, execute step S209; if the type of the user memory access signal is a write signal type, execute step S206;
[0155] S206, acquiring memory data of a write operation according to the user memory access signal;
[0156] S207, writing the memory address and memory data of the write operation into a write operation buffer module;
[0157] S208, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation, and executing step S202;
[0158] S209, writing the memory address of the read operation into a read operation buffer module;
[0159] S210, adding one to the instruction count value of the current read operation as the instruction count value of the target read operation, and executing step S202.
[0160] The method further includes performing a read and write operation on the standby memory module 5, specifically including the following steps:
[0161] S301, setting the memory access sequence numbers in the memory access sequence number units in the address memory module and the data memory module to zero;
[0162] S302, determining whether the instruction count value of the target write operation is zero;
[0163] S303, if the instruction count value of the target write operation is zero, execute step S306; otherwise, execute step S304;
[0164] S304, taking out the memory address and memory data of the write operation from the write operation buffer module;
[0165] S305, write the memory address of the write operation into the memory address unit in the spare memory module 5, and execute step S302;
[0166] S306, determining whether the instruction count value of the target read operation is zero;
[0167] S307, if the instruction count value of the target read operation is zero, execute step S314; otherwise, execute step S308;
[0168] S308, taking out the memory address of the read operation from the read operation buffer module;
[0169] S309, reading the memory data pointed to by the memory address of the read operation in the memory address unit in the standby memory module 5;
[0170] S310, writing the memory address of the read operation and the memory data pointed to by the memory address of the read operation into the memory access sequence number units in the address memory module and the data memory module respectively;
[0171] S311, adding one to the memory access sequence number in the memory access sequence number unit in the address memory module and the data memory module as the target memory access sequence number;
[0172] S312, determining whether the instruction count value of the target write operation is zero;
[0173] S313, if the instruction count value of the target write operation is not zero, execute step S302, otherwise execute step S306;
[0174] S314, setting the memory view and modify enable flag to zero.
[0175] The following steps are also included:
[0176] S315, determining whether the memory view and modify enable flag is one;
[0177] S316, if the memory view and modify enable flag is one, execute step S301; otherwise, execute step S317;
[0178] S317, determining whether the primary and standby memory swap flag is one;
[0179] S318, if the primary and standby memory swap flag is one, execute step S319, otherwise execute step S320;
[0180] S319, swap the main memory module 4 and the backup memory module 5, and set the main and backup memory swap flag to zero;
[0181] S320. Execute step S315.
[0182] In summary, the present invention provides a memory monitoring system, a memory access timing recording method, and a memory viewing and modification method. By setting a memory base, a memory signal interface, an FPGA control module, a main memory module, a backup memory module, and a USB interface module, the CPU memory access signal of the device to be analyzed is transmitted to the FPGA control module via the memory base and the memory signal interface, and after being processed by the FPGA control module, it is transmitted to the main memory module and the backup memory module. The main memory module and the backup memory module receive the CPU memory access signal and generate an output signal (i.e., output the memory data to be read by the device to be analyzed). The output signal is also sent back to the device to be analyzed via the FPGA control module; the FPGA control module includes an address Memory module and data memory module, the address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data, so as to obtain the memory access timing of the device to be analyzed; the memory monitoring system designed in this scheme is equivalent to a memory chip for the device to be analyzed, and does not change the signal processing logic of the original system. For embedded device analysts, it can assist in recording the memory read and write timing of the device to be analyzed, and support users to read and modify memory data; it can monitor the memory read and write operations of the device and record the timing relationship to support the firmware loading process analysis, and can actively read and write the memory of the device. Combined with memory patch technology, it can provide support for dynamic debugging and analysis of the device.
[0183] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A memory monitoring system, characterized in that: It includes a memory base, a memory signal interface, an FPGA control module, a main memory module, a standby memory module and a USB interface module, wherein the FPGA control module is electrically connected to the memory signal interface, the main memory module, the standby memory module and the USB interface module respectively, the USB interface module is electrically connected to an external analysis device, the memory base is used to plug into the memory signal interface of the device to be analyzed, the main memory module is used for normal reading and writing of the device to be analyzed, and the standby memory module is used for users to read memory data; The FPGA control module includes an address memory module and a data memory module. The address memory module is used to record the CPU memory access address, and the data memory module is used to record the CPU memory access data.
2. The memory monitoring system according to claim 1, characterized in that: The FPGA control module also includes a write operation buffer module, and the write operation buffer module is electrically connected to the main memory module and the backup memory module respectively.
3. The memory monitoring system according to claim 1, characterized in that: The FPGA control module also includes a read operation buffer module, and the read operation buffer module is electrically connected to the main memory module and the backup memory module respectively.
4. A memory access timing recording method, applied to the memory monitoring system according to any one of claims 1 to 3, characterized in that: The following steps are involved: S1. Receive a CPU memory access signal of a device to be analyzed, and obtain a CPU memory access address according to the CPU memory access signal; S2, writing the CPU memory access address into a storage unit in the address memory module whose address is the memory access sequence number; S3, analyzing the CPU memory access signal of the device to be analyzed, and determining the type of the CPU memory access signal; S4, if the type of the CPU memory access signal is a read signal type, the read-write flag position is set to zero, and step S7 is executed; if the type of the CPU memory access signal is a write signal type, the read-write flag position is set to one, and step S5 is executed; S5, parsing the byte data to be written into the data memory module in the CPU memory access signal, and splicing the byte data with a first preset byte data into double-byte write data; S6, writing the double-byte write data into a storage unit whose address is the access sequence number in the data memory module, and executing step S9; S7, receiving and parsing the memory data returned to the device to be analyzed in the main memory module, and splicing the memory data with a second preset byte data into double-byte read data; S8, writing the double-byte read data into a storage unit in the data memory module whose address is the memory access sequence number; S9, adding one to the current memory access sequence number as the target memory access sequence number, and determining whether the target memory access sequence number is less than a preset maximum number of memory access times; S10: If yes, execute step S1; Otherwise, execute step S11; S11, set the memory access timing record enable flag to zero and exit.
5. A memory viewing and modification method, applied to the memory monitoring system according to any one of claims 1 to 3, characterized in that: The method includes placing the memory address and memory data of the write operation of the CPU memory access signal of the device to be analyzed into the write operation queue, and placing the read and write memory operations of the user memory access signal of the external analysis device into the read operation queue and the write operation queue respectively, specifically including the following steps: The write operation sorting steps of the CPU memory access signal are as follows: S101, setting the instruction count value of the write operation to zero; S102, receiving and parsing a CPU memory access signal of a device to be analyzed, and determining a type of the CPU memory access signal; S103, if the type of the CPU memory access signal is a read signal type, execute step S102; if the type of the CPU memory access signal is a write signal type, execute step S104; S104, acquiring a memory address and memory data of a write operation according to the CPU memory access signal; S105, writing the memory address and memory data of the write operation into a write operation buffer module; S106, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation; User memory access signal sorting operation steps: S201, setting the instruction count value of the read operation to zero; S202, receiving and analyzing a user memory access signal from an external analysis device; S203, acquiring a memory address of a write operation and a memory address of a read operation according to the user memory access signal; S204, determining the type of the user memory access signal; S205, if the type of the user memory access signal is a read signal type, execute step S209; if the type of the user memory access signal is a write signal type, execute step S206; S206, acquiring memory data of a write operation according to the user memory access signal; S207, writing the memory address and memory data of the write operation into a write operation buffer module; S208, adding one to the instruction count value of the current write operation as the instruction count value of the target write operation, and executing step S202; S209, writing the memory address of the read operation into a read operation buffer module; S210, adding one to the instruction count value of the current read operation as the instruction count value of the target read operation, and executing step S202.
6. The memory viewing and modifying method according to claim 5, characterized in that: The method also includes performing read and write operations on the spare memory module, specifically including the following steps: S301, setting the memory access sequence numbers in the memory access sequence number units in the address memory module and the data memory module to zero; S302, determining whether the instruction count value of the target write operation is zero; S303, if the instruction count value of the target write operation is zero, execute step S306; otherwise, execute step S304; S304, taking out the memory address and memory data of the write operation from the write operation buffer module; S305, writing the memory address of the write operation into the memory address unit in the standby memory module, and executing step S302; S306, determining whether the instruction count value of the target read operation is zero; S307, if the instruction count value of the target read operation is zero, execute step S314; otherwise, execute step S308; S308, taking out the memory address of the read operation from the read operation buffer module; S309, reading the memory data pointed to by the memory address of the read operation in the memory address unit in the standby memory module; S310, writing the memory address of the read operation and the memory data pointed to by the memory address of the read operation into the memory access sequence number units in the address memory module and the data memory module respectively; S311, adding one to the memory access sequence number in the memory access sequence number unit in the address memory module and the data memory module as the target memory access sequence number; S312, determining whether the instruction count value of the target write operation is zero; S313, if the instruction count value of the target write operation is not zero, execute step S302, otherwise execute step S306; S314, setting the memory view and modify enable flag to zero.
7. The memory viewing and modifying method according to claim 6, characterized in that: The following steps are also included: S315, determining whether the memory view and modify enable flag is one; S316, if the memory view and modify enable flag is one, execute step S301; otherwise, execute step S317; S317, determining whether the primary and standby memory swap flag is one; S318, if the primary and standby memory swap flag is one, execute step S319, otherwise execute step S320; S319, swapping the main memory module and the backup memory module, and setting the main and backup memory swap flag to zero; S320. Execute step S315.