Software verification method and device, electronic equipment and storage medium

Abstract

The invention relates to a software verification method and device, electronic equipment and a storage medium, and the method comprises the steps: determining an initial instrumentation point, a query interface and a stub function according to a to-be-detected error type; based on the initial instrumentation point, the instrumentation function and the query interface, configuring an instrumentation rule; based on an instrumentation rule, performing instrumentation processing on the intermediate representation I < R > corresponding to the to-be-verified code to obtain a target code; and performing verification operation on the target code to obtain a verification result. The instruction corresponding to the error type can be locked, the error verification logic corresponding to the error type can be determined, the code can be automatically instrumented according to the configured instrumentation rule, whether the instruction corresponding to the error type needs instrumentation or not is determined through the query interface in the instrumentation process, the instrumentation process is prevented from being affected by a bottom layer interface, and the instrumentation efficiency is improved. Unnecessary instrumentation operation is remarkably reduced, meanwhile, checking operation in the execution stage is reduced, and verification efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software engineering, and in particular to a software verification method, device, electronic equipment and storage medium. Background Art

[0002] In the software development cycle, formal verification of software is a key link to ensure that the software system meets the specifications and user needs, and its importance is becoming increasingly prominent. With the continuous advancement of technology, the field of formal verification of software is also developing continuously, and symbolic execution is one of the important verification methods. In order to find software errors in the symbolic execution process, it is necessary to insert the verification program before symbolic execution, and then call the insertion code to trigger the error detection function during the symbolic execution process. For example, to detect whether there is a division by zero error in the software, it is necessary to use the solver to determine whether the instruction operand corresponding to the divisor is equal to zero when encountering relevant operation instructions during symbolic execution. If it is solvable, an error is reported. In related instrumentation technologies, manual instrumentation is required, or external tools are relied on to identify the instrumentation points. The instrumentation points that cannot be identified by external tools cannot work. In addition, due to the variety of software error types, even if the same type of software error occurs, different platforms will have different instrumentation points due to the different interfaces provided by the underlying layer, which reduces the reliability of symbolic execution. Summary of the invention

[0003] In order to solve at least one of the technical problems mentioned above, the present disclosure proposes a software verification method, device, electronic device and storage medium.

[0004] In one aspect, the present invention provides a software verification method, comprising:

[0005] According to the error type to be detected, the initial insertion point, query interface and stub function are determined. The initial insertion point indicates the instruction corresponding to the error type. The query interface is used to determine whether the initial insertion point needs to be inserted. The stub function indicates the error verification logic corresponding to the error type.

[0006] Configure the instrumentation rules based on the initial instrumentation point, instrumentation function, and query interface;

[0007] Based on the instrumentation rules, the intermediate representation IR corresponding to the code to be verified is instrumented to obtain the target code;

[0008] Perform verification operation on the target code to obtain verification results.

[0009] In an optional embodiment, performing a verification operation on the target code to obtain a verification result includes:

[0010] Load the stub code corresponding to the stub function;

[0011] Combine the target code and the stub code to obtain the code to be executed;

[0012] Based on the pile function list, the code to be executed is sliced ​​to obtain a slice set, and the pile function list is used to indicate the pile function inserted in the target code;

[0013] Perform symbolic execution on the slice set to obtain verification results.

[0014] In an optional embodiment, a symbolic execution operation is performed on the slice set to obtain a verification result, including:

[0015] Read the target instruction, which is any instruction in the slice set;

[0016] According to the error verification logic indicated by the stub function corresponding to the target instruction, a symbolic execution operation is performed on the target instruction to obtain the symbolic execution result of the target instruction, which belongs to the verification result.

[0017] In an optional embodiment, based on the instrumentation rule, the intermediate representation IR corresponding to the code to be verified is instrumented to obtain the target code, including:

[0018] Read the instruction code in the intermediate representation IR corresponding to the code to be verified;

[0019] Match the instruction code with the instrumentation rules to obtain the matching result;

[0020] When the matching result indicates that the instruction code matches the initial insertion point indicated by the insertion rule, the query interface indicated by the insertion rule is called to perform static analysis on the instruction code to obtain an analysis result, and the analysis result is used to indicate whether there is an abnormality in the instruction code;

[0021] When the analysis result indicates that there is no abnormality in the instruction code, skip the instruction code;

[0022] When the analysis result indicates that the instruction code is abnormal, the instruction code is instrumented to obtain the target code.

[0023] In an optional embodiment, the instrumentation rule further includes an expected result corresponding to the instruction code, and the method further includes:

[0024] When the analysis result is consistent with the expected result, it is determined that there is no abnormality in the instruction code;

[0025] When the analysis result does not match the expected result, it is determined that an abnormality exists in the instruction code.

[0026] In an optional embodiment, based on the initial instrumentation point, the stub function and the query interface, the instrumentation rules are configured, including:

[0027] Determine first rule information according to the initial insertion point, the first rule information including an instruction name, a return value, and an instruction operand list corresponding to the initial insertion point;

[0028] Determine second rule information according to the query interface, the second rule information including an interface name corresponding to the query interface and an expected result;

[0029] Determine the 3rd rule information according to pile function, the 3rd rule information comprises that pile function name, instruction, return value and pile function of pile function correspondence are carried out required parameter;

[0030] The first rule information, the second rule information and the third rule information are integrated to obtain the instrumentation rule.

[0031] In an optional embodiment, after performing a verification operation on the target code and obtaining a verification result, the method further includes:

[0032] When the verification result indicates that there is an error in the code to be verified, an error report is generated.

[0033] In a second aspect, the present invention further provides a software verification device, comprising:

[0034] A determination module is used to determine an initial insertion point, a query interface and a stub function according to the error type to be detected, wherein the initial insertion point indicates an instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates an error verification logic corresponding to the error type;

[0035] The rule configuration module is used to configure the instrumentation rules based on the initial instrumentation point, instrumentation function and query interface;

[0036] The instrumentation module is used to perform instrumentation processing on the intermediate representation IR corresponding to the code to be verified based on the instrumentation rules to obtain the target code;

[0037] The verification module is used to perform verification operations on the target code and obtain verification results.

[0038] In a third aspect, the present invention further provides an electronic device, comprising:

[0039] processor;

[0040] a memory for storing processor-executable instructions;

[0041] The processor is used to execute instructions to implement the above software verification method.

[0042] In a fourth aspect, the present invention further provides a storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the above-mentioned software verification method.

[0043] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

[0044] The implementation of this disclosure has the following beneficial effects:

[0045] According to the error type to be detected, the initial insertion point, query interface and stub function are determined, the initial insertion point indicates the instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates the error verification logic corresponding to the error type; based on the initial insertion point, stub function and query interface, the insertion rules are configured; based on the insertion rules, the intermediate representation IR corresponding to the code to be verified is inserted to obtain the target code; the target code is verified to obtain the verification result.

[0046] The present invention determines the initial insertion point, query interface and stub function according to the error type to be detected, configures the insertion rule based on the initial insertion point, stub function and query interface, and performs insertion processing on the intermediate representation IR corresponding to the code to be verified based on the insertion rule. It can lock the instruction corresponding to the error type, determine the error verification logic corresponding to the error type, and automatically insert the code according to the configured insertion rule. In the insertion process, it determines whether the instruction corresponding to the error type needs to be inserted through the query interface, so that the insertion process is not affected by the underlying interface, and unnecessary insertion operations are significantly reduced. At the same time, the inspection operations in the execution stage are reduced, and the verification efficiency is improved.

[0047] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure, and do not constitute an improper limitation of the present disclosure.

[0049] Figure 1 is a schematic diagram of an implementation environment according to an exemplary embodiment;

[0050] Figure 2 is a flowchart of a software verification method according to an exemplary embodiment;

[0051] Figure 3is a schematic diagram of implementation components of a software verification method according to an exemplary embodiment;

[0052] Figure 4 is a flowchart of a pile plugging device according to an exemplary embodiment;

[0053] Figure 5 is a flow chart showing a slicing method according to an exemplary embodiment;

[0054] Figure 6 is a flowchart of a symbolic execution according to an exemplary embodiment;

[0055] Figure 7 is a schematic diagram of a software verification device according to an exemplary embodiment;

[0056] Figure 8 The invention is a block diagram of an electronic device for software verification according to an exemplary embodiment. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0059] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the drawings, the drawings are not necessarily drawn to scale unless otherwise indicated. The word "exemplary" is used specifically herein to mean "serving as an example, embodiment, or illustrative". Any embodiment described herein as "exemplary" is not necessarily to be construed as being superior or better than other embodiments.

[0060] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0061] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0062] See also Figure 1 , Figure 1 is a schematic diagram of an application environment according to an exemplary embodiment. Figure 1 As shown, the application environment may include a server 01 and a terminal 02 .

[0063] In an optional embodiment, the server 01 can be used for computing in the software verification method. Specifically, the server 01 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0064] In an optional embodiment, the terminal 02 may perform calculation processing in combination with the software verification method of the server 01. Specifically, the terminal 02 may include but is not limited to electronic devices such as smart phones, desktop computers, tablet computers, laptop computers, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart wearable devices, etc. Optionally, the operating system running on the electronic device may include but is not limited to Android system, IOS system, Linux system, Windows system, Unix system, etc.

[0065] For example, the error type to be detected is determined by terminal 02 and transmitted to server 01; the initial insertion point, query interface and stub function are determined by server 01 according to the error type to be detected, the initial insertion point indicates the instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates the error verification logic corresponding to the error type; based on the initial insertion point, stub function and query interface, the insertion rules are configured; based on the insertion rules, the intermediate representation IR corresponding to the code to be verified is inserted to obtain the target code; the target code is verified to obtain the verification result, and the verification result is transmitted to terminal 02.

[0066] In addition, it should be noted that Figure 1 What is shown is only one application environment provided by the present disclosure. In actual application, other application environments may also be included.

[0067] In the embodiments of this specification, the server 01 and the terminal 02 may be directly or indirectly connected via wired or wireless communication, which is not limited in this disclosure.

[0068] Figure 2 is a flowchart of a software verification method according to an exemplary embodiment. Figure 2 As shown, the software verification method includes the following:

[0069] Step S201: Determine the initial insertion point, query interface and stub function according to the error type to be detected. The initial insertion point indicates the instruction corresponding to the error type. The query interface is used to determine whether the initial insertion point needs to be inserted. The stub function indicates the error verification logic corresponding to the error type.

[0070] In the disclosed embodiment, the error type to be detected can be any type error that occurs in the software development process. Take the integer variable overflow error as an example, if the software to be detected has the integer variable overflow error, the corresponding instructions that may have the integer variable overflow error have instructions such as addition instruction, subtraction instruction and multiplication instruction, and the instructions such as addition instruction, subtraction instruction and multiplication instruction need to be used as the initial insertion point of the error type to be detected. The query interface is called when inserting a pile, to determine whether to insert a pile function at a specific initial insertion point, the query interface is provided by the plug-in designed based on static analysis technology (pointer analysis, reachable definition analysis, active variable analysis and range analysis, etc.) according to the error type to be detected, such as to check the overflow error, a corresponding plug-in named "CheckOverflowPlugin" is implemented, and this plug-in provides an interface named "canOverFlow". The creation process of the pile function includes designing error checking logic, and then realizing the corresponding pile function. For example, to detect a 32-bit integer variable overflow failure, you need to implement a stub function named "check_int32overflow". This function will be called by the symbolic execution tool during the symbolic execution phase, and inside the function, error detection is completed based on the parameters passed in by the symbolic execution tool.

[0071] Step S202: configuring the instrumentation rules based on the initial instrumentation point, the instrumentation function and the query interface.

[0072] In an optional embodiment, based on the initial instrumentation point, the stub function and the query interface, the instrumentation rules are configured, including:

[0073] Step S2021: determining first rule information according to the initial insertion point, where the first rule information includes an instruction name, a return value, and an instruction operand list corresponding to the initial insertion point.

[0074] In the embodiment of the present disclosure, taking the instruction in which the initial insertion point may cause an integer variable overflow error as an example, the instruction name corresponding to the initial insertion point is the name of an addition instruction, a subtraction instruction, a multiplication instruction, etc. Correspondingly, the return value and the instruction operand list in the first rule information are the return value and the instruction operand list corresponding to the above instructions, respectively.

[0075] Step S2022: Determine second rule information according to the query interface, where the second rule information includes an interface name corresponding to the query interface and an expected result.

[0076] In the embodiment of the present disclosure, taking the query interface as an example of an interface for querying whether there is a possible integer variable overflow error at the initial insertion point, the interface name corresponding to the query interface can be "canOverFlow", and accordingly, the expected result in the second rule information corresponds to executing the query operation through the above interface.

[0077] Step S2023: Determine the third rule information according to the stub function, the third rule information including the stub function name, instruction, return value corresponding to the stub function, and parameters required for the stub function execution.

[0078] In the disclosed embodiment, taking the pile function as an example of a pile function for detecting whether there is a 32-bit integer variable overflow fault, the function name corresponding to the pile function can be "check_int32overflow", and accordingly, the pile function name, instruction, return value, and the parameters required for the execution of the pile function in the third rule information include the function instructions, return value and instruction operand list corresponding to the above-mentioned pile function, and the instruction operand list includes the pile function name and the parameters required for the execution of the pile function.

[0079] Step S2024: The first rule information, the second rule information and the third rule information are integrated to obtain the instrumentation rule.

[0080] In the disclosed embodiment, the first rule information is integrated into the insertion point matching rule, which consists of the three fields of the instruction name, return value and instruction operand list of the initial insertion point; the second rule information is integrated into the query rule, which consists of the query interface name and the expected result list; the third rule information is integrated into the insertion rule, which includes the three fields of return value, instruction and instruction operand list. The above integrated insertion point matching rule, query rule and insertion rule are determined as the insertion rule.

[0081] Based on the above, it can be known that in the embodiment of the present disclosure, the first rule information is determined according to the initial insertion point, the first rule information includes the instruction name, return value and instruction operand list corresponding to the initial insertion point, the second rule information is determined according to the query interface, the second rule information includes the interface name and expected result corresponding to the query interface, and the third rule information is determined according to the pile function, the third rule information includes the pile function name, instruction, return value and parameters required for the execution of the pile function corresponding to the pile function, and various types of information required for pile insertion can be summarized, and the pile insertion rules are obtained by fusing the first rule information, the second rule information and the third rule information, and pile insertion can be automatically performed according to the pile insertion rules in the pile insertion stage, thereby improving the pile insertion efficiency.

[0082] Step S203: Based on the plugging rule, the intermediate representation IR corresponding to the code to be verified is plugged to obtain the target code.

[0083] In an optional embodiment, based on the instrumentation rule, the intermediate representation IR corresponding to the code to be verified is instrumented to obtain the target code, including:

[0084] Step S2031: Read the instruction code in the intermediate representation IR corresponding to the code to be verified.

[0085] In the disclosed embodiment, the intermediate representation IR (Intermediate Representation, IR) corresponding to the code to be verified is an intermediate form that the code to be verified is converted into. The intermediate representation IR can provide a common representation form for different machine languages, thereby facilitating cross-language and cross-platform programming.

[0086] Step S2032: Match the instruction code with the plug-in rule to obtain a matching result.

[0087] In the disclosed embodiment, matching the instruction code with the insertion rule can be performed by matching each instruction code in the intermediate representation IR corresponding to the code to be verified with the instruction name corresponding to the initial insertion point in the insertion point matching rule of the insertion rule to obtain a matching result.

[0088] Step S2033: When the matching result indicates that the instruction code matches the initial insertion point indicated by the insertion rule, the query interface indicated by the insertion rule is called to perform static analysis on the instruction code to obtain an analysis result, which is used to indicate whether there is an abnormality in the instruction code.

[0089] In the disclosed embodiment, the query interface checks whether the operation involved in the instruction may overflow based on static analysis technology, and returns "false" for instructions that are determined not to overflow, and returns "true" for other cases. When the query interface returns "false", it means that based on the static analysis technology, it can be determined that there will be no overflow exception at the current stub point, and there is no need to detect errors in the symbolic execution stage, so there is no need to insert stub code.

[0090] In the disclosed embodiment, the instrumentation rules also include the expected result corresponding to the instruction code, and the method also includes: when the analysis result is consistent with the expected result, determining that there is no abnormality in the instruction code; when the analysis result is inconsistent with the expected result, determining that there is an abnormality in the instruction code.

[0091] Step S2034: When the analysis result indicates that there is no abnormality in the instruction code, the instruction code is skipped.

[0092] In the disclosed embodiment, the analysis result indicating that there is no abnormality in the instruction code may be that the query interface returns "false", or the analysis result is consistent with the expected result. In this case, the instruction code does not need to be inserted and the instruction code is skipped.

[0093] Step S2035: When the analysis result indicates that the instruction code is abnormal, the instruction code is plugged to obtain the target code.

[0094] In the embodiment of the present disclosure, the analysis result indicates that there is an abnormality in the instruction code, which may be that the query interface returns "true", or the analysis result does not match the expected result. At this time, the instruction code needs to be plugged in, and the instruction code is plugged in to obtain the target code.

[0095] Based on the above, it can be known that in the embodiment of the present disclosure, the query interface indicated by the insertion rule is called to perform static analysis on the instruction code. Before insertion, the initial insertion point can be statically analyzed through the corresponding query interface to determine whether there is an error risk there. By skipping the code when the analysis result indicates that there is no exception in the instruction code, unnecessary insertion operations can be reduced. When the analysis result indicates that there is an exception in the instruction code, the instruction code is inserted, which can facilitate the verification of necessary code.

[0096] Step S204: Perform verification operation on the target code to obtain a verification result.

[0097] In an optional embodiment, performing a verification operation on the target code to obtain a verification result includes:

[0098] Step S2041: Load the stub code corresponding to the stub function.

[0099] Step S2042: Combine the target code and the stub code to obtain the code to be executed.

[0100] In the disclosed embodiment, the target code and the stub code may be combined by a linker.

[0101] Step S2043: Based on the stub function list, the code to be executed is sliced ​​to obtain a slice set.

[0102] In the disclosed embodiment, a stub function list is extracted from a configured stub rule, and the code to be executed is sliced ​​using the stub function list as a slicing criterion to obtain a slice set, in which only the code related to the software error to be verified is retained.

[0103] Step S2044: perform symbolic execution on the slice set to obtain a verification result.

[0104] Based on the above, it can be known that in the embodiment of the present disclosure, by loading the stub code corresponding to the stub function and combining the target code and the stub code, a complete code to be executed can be obtained; by slicing the code to be executed based on the stub function list to obtain a slice set, the step of manually defining the focus point can be omitted, and the slicing process is automatically performed according to the stub function list, only the code related to the error type to be verified is retained, and the redundant code unrelated to the error type to be verified is screened out; by performing a symbolic execution operation on the slice set to obtain a verification result, the efficiency of the symbolic execution stage can be improved.

[0105] In an optional embodiment, a symbolic execution operation is performed on the slice set to obtain a verification result, including:

[0106] Read the target instruction, which is any instruction in the slice set; perform symbolic execution on the target instruction according to the error verification logic indicated by the stub function corresponding to the target instruction to obtain the symbolic execution result of the target instruction, which belongs to the verification result.

[0107] In the disclosed embodiment, for each instruction in the slice set, as the input of the symbolic execution engine, symbolic execution is performed. During the symbolic execution process, if a stub function is executed, the stub function is called to perform an error detection function to obtain a verification result.

[0108] Based on the above, it can be seen that in the embodiment of the present disclosure, the error verification logic defined in advance can automatically complete the symbolic execution operation according to the defined error verification logic during the symbolic execution phase of the target instruction, thereby shortening the symbolic execution time and improving the symbolic execution efficiency.

[0109] In an optional embodiment, after performing a verification operation on the target code and obtaining a verification result, the method further includes:

[0110] When the verification result indicates that there is an error in the code to be verified, an error report is generated.

[0111] In the disclosed embodiment, when the stub function detects an error in the code, that is, a software error, an error report is generated.

[0112] Based on the above, it can be seen that in the embodiment of the present disclosure, by generating an error report when the verification result indicates that there is an error in the code to be verified, the error result can be presented more intuitively, which is convenient for the verification personnel to analyze the error result and correct the error code in time.

[0113] In a specific implementation, the implementation of this method is mainly divided into three parts, namely, a configuration-based automatic instrumentation tool, a configuration-based slicing tool, and a symbolic execution tool. Figure 3 As shown, the three parts are described in detail below:

[0114] (1) Automatic pile driver

[0115] The automatic instrumenter works based on pre-configured instrumentation rules. To configure instrumentation rules, you need to perform the following three steps:

[0116] 1. Determine the initial insertion points that need to be identified based on the error type to be detected. For example, to check for integer variable overflow errors, instructions such as addition instructions, subtraction instructions, and multiplication instructions need to be used as initial insertion points;

[0117] 2. According to the error type to be detected, design the error checking logic and implement the corresponding stub function. For example, to detect the overflow of a 32-bit integer variable, you need to implement a stub function called "check_int32overflow". This stub function will be called by the symbolic execution tool during the symbolic execution phase, and the stub function will complete the error detection based on the parameters passed in by the symbolic execution tool.

[0118] 3. According to the error type to be detected, based on static analysis technology (pointer analysis, reachable definition analysis, active variable analysis and value range analysis, etc.), design a plug-in, which provides a query interface for subsequent plug-in calls to determine whether a stub function needs to be inserted at a specific plug-in point. For example, to check for overflow errors, a plug-in called "CheckOverflowPlugin" is implemented. The plug-in provides an interface called "canOverFlow". This interface receives an instruction as a parameter. The interface checks whether the operation involved in this instruction may overflow based on static analysis technology. For instructions that are determined not to overflow, "false" is returned, and "true" is returned in other cases. When the "canOverFlow" interface returns "false", it means that based on static analysis technology, it can be determined that there will be no overflow exception at the current plug-in point, and there is no need to detect errors in the symbolic execution stage, so there is no need to insert stub code.

[0119] Based on the above three preparations, collect information to form the instrumentation rule configuration. A typical instrumentation rule includes instrumentation point matching rules, query rules and insertion rules. Among them, the instrumentation point matching rules are composed of three fields: the instruction name, return value and instruction operand list of the initial instrumentation point; the query rule is composed of the query interface name and the expected result list; the insertion rule is composed of three fields: the return value of the stub function, the instruction and the instruction operand list (including the stub function name and the parameters required by the stub function).

[0120] The workflow of the instrumentation tool is as follows Figure 4 As shown, when the plugger works, it first reads the plugging rule configuration, loads the static analysis plug-in and the source code intermediate representation IR (Intermediate Representation, IR) corresponding to the code to be verified. Then, it traverses each instruction in the intermediate representation IR corresponding to the source code to check whether it matches the plugging rule. If it matches, it further calls the static analysis plug-in interface. The result returned by the interface meets the expected result in the configuration, indicating that the current instruction matches the rule and needs to be plugged. At this time, the necessary parameters are collected and the instruction of the pile function configured in the call rule is inserted.

[0121] After the instrumentation is completed, the intermediate representation IR corresponding to the instrumented source code is output, and then the stub code intermediate representation (stub code IR) of the stub function is loaded, and the linker is used to link the two parts of the IR file into an IR module, and then enter the next stage.

[0122] (2) Slicing

[0123] Slicing process Figure 5 As shown, from the configured instrumentation rules, a list of stub functions inserted into the instrumentation points is extracted, and the IR modules generated by the link are sliced ​​using this list of functions as a slicing criterion to obtain a slice set, in which only the code related to the software error to be verified is retained.

[0124] (3) Symbolic Execution

[0125] The symbolic execution process is as follows Figure 6 As shown, for each slice in the slice set, as the input of the symbolic execution engine, symbolic execution is performed. During the symbolic execution process, if the stub function is executed, the stub function is called to perform the error detection function. If the stub function detects a software error, an error report is generated.

[0126] Figure 7 FIG. 1 is a block diagram of a software verification device according to an exemplary embodiment. Figure 7 The device includes a determination module 701, a rule configuration module 702, an insertion module 703 and a verification module 704, wherein:

[0127] Determination module 701, used to determine the initial insertion point, query interface and stub function according to the error type to be detected, the initial insertion point indicates the instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates the error verification logic corresponding to the error type;

[0128] A rule configuration module 702, configured to configure the instrumentation rules based on the initial instrumentation point, the instrumentation function and the query interface;

[0129] The plugging module 703 is used to perform plugging processing on the intermediate representation IR corresponding to the code to be verified based on the plugging rule to obtain the target code;

[0130] The verification module 704 is used to perform verification operations on the target code to obtain a verification result.

[0131] In an optional embodiment, the verification module 704 includes:

[0132] Loading module, used to load the stub code corresponding to the stub function;

[0133] A combination module is used to combine the target code and the stub code to obtain the code to be executed;

[0134] A slicing module is used for slicing the code to be executed based on a pile function list to obtain a slice set, wherein the pile function list is used to indicate the pile functions inserted in the target code;

[0135] The verification submodule is used to perform symbolic execution operations on the slice set to obtain verification results.

[0136] In an optional embodiment, the verification submodule includes:

[0137] A first reading module, used for reading a target instruction, where the target instruction is any instruction in a slice set;

[0138] The verification unit is used to perform symbolic execution operation on the target instruction according to the error verification logic indicated by the stub function corresponding to the target instruction, and obtain the symbolic execution result of the target instruction, which belongs to the verification result.

[0139] In an optional embodiment, the plugging module 703 includes:

[0140] The second reading module is used to read the instruction code in the intermediate representation IR corresponding to the code to be verified;

[0141] A matching module is used to match the instruction code with the plug-in rule to obtain a matching result;

[0142] A static analysis module, for calling the query interface indicated by the plugging rule to perform static analysis on the instruction code and obtain an analysis result when the matching result indicates that the instruction code matches the initial plugging point indicated by the plugging rule, and the analysis result is used to indicate whether there is an abnormality in the instruction code;

[0143] A first plugging submodule is used to skip the instruction code when the analysis result indicates that there is no abnormality in the instruction code;

[0144] The second plugging submodule is used to perform plugging processing on the instruction code to obtain the target code when the analysis result indicates that the instruction code is abnormal.

[0145] In an optional embodiment, the instrumentation rule further includes an expected result corresponding to the instruction code, and the device further includes:

[0146] A first abnormality judgment module is used to determine that there is no abnormality in the instruction code when the analysis result is consistent with the expected result;

[0147] The second abnormality judgment module is used to determine that there is an abnormality in the instruction code when the analysis result does not match the expected result.

[0148] In an optional embodiment, the rule configuration module 702 includes:

[0149] A first rule information determination module, configured to determine first rule information according to an initial insertion point, wherein the first rule information includes an instruction name, a return value, and an instruction operand list corresponding to the initial insertion point;

[0150] A second rule information determination module, used to determine second rule information according to the query interface, the second rule information including an interface name corresponding to the query interface and an expected result;

[0151] The third rule information determination module is used for determining the third rule information according to the pile function, and the third rule information comprises the pile function name, instruction, return value and pile function execution required parameter corresponding to the pile function;

[0152] The fusion module is used to fuse the first rule information, the second rule information and the third rule information to obtain the instrumentation rule.

[0153] In an optional embodiment, the device further comprises:

[0154] The report generation module is used to generate an error report when the verification result indicates that there is an error in the code to be verified.

[0155] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware such as processing circuits or memories, or a combination thereof. Similarly, one processor or multiple processors or memories can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0156] In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing instructions executable by the processor; wherein the processor is used for the instructions to implement the software verification method as in the embodiment of the present disclosure.

[0157] Figure 8 is a block diagram of an electronic device for software verification according to an exemplary embodiment. The electronic device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The electronic device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a software verification method is implemented. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a key, trackball or touchpad set on the housing of the electronic device, or an external keyboard, touchpad or mouse, etc.

[0158] Those skilled in the art will understand that Figure 8 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present disclosure, and does not constitute a limitation on the electronic device to which the scheme of the present disclosure is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0159] In an exemplary embodiment, a storage medium is also provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the software verification method in the embodiment of the present disclosure.

[0160] In an exemplary embodiment, a computer program product including instructions is also provided. When the computer program product is run on a computer, the computer is caused to execute the software verification method in the embodiment of the present disclosure.

[0161] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present disclosure can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0162] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0163] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A software verification method, characterized in that: The method comprises: According to the error type to be detected, determine the initial insertion point, query interface and stub function, the initial insertion point indicates the instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates the error verification logic corresponding to the error type; Based on the initial insertion point, the stub function and the query interface, configuring an insertion rule; Based on the plugging rule, the intermediate representation IR corresponding to the code to be verified is plugged to obtain the target code; A verification operation is performed on the target code to obtain a verification result.

2. The method according to claim 1, characterized in that The verifying operation is performed on the target code to obtain a verification result, including: Load the stub code corresponding to the stub function; Combining the target code and the stub code to obtain a code to be executed; Based on the pile function list, the code to be executed is sliced ​​to obtain a slice set, wherein the pile function list is used to indicate the pile functions inserted in the target code; A symbolic execution operation is performed on the slice set to obtain the verification result.

3. The method according to claim 2, characterized in that The performing a symbolic execution operation on the slice set to obtain the verification result includes: Reading a target instruction, where the target instruction is any instruction in the slice set; According to the error verification logic indicated by the stub function corresponding to the target instruction, a symbolic execution operation is performed on the target instruction to obtain a symbolic execution result of the target instruction, and the symbolic execution result belongs to the verification result.

4. The method according to claim 1, characterized in that: The step of performing an instrumentation process on the intermediate representation IR corresponding to the code to be verified based on the instrumentation rule to obtain the target code includes: Read the instruction code in the intermediate representation IR corresponding to the code to be verified; Matching the instruction code with the plugging rule to obtain a matching result; In the case where the matching result indicates that the instruction code matches the initial insertion point indicated by the insertion rule, calling the query interface indicated by the insertion rule, performing static analysis processing on the instruction code, and obtaining an analysis result, wherein the analysis result is used to indicate whether the instruction code has an abnormality; If the analysis result indicates that there is no abnormality in the instruction code, skipping the instruction code; When the analysis result indicates that the instruction code is abnormal, the instruction code is subjected to an instrumentation process to obtain the target code.

5. The method according to claim 4, characterized in that The instrumentation rule also includes an expected result corresponding to the instruction code, and the method further includes: When the analysis result is consistent with the expected result, determining that there is no abnormality in the instruction code; When the analysis result does not match the expected result, it is determined that an abnormality exists in the instruction code.

6. The method according to claim 1, characterized in that The configuring of the instrumentation rules based on the initial instrumentation point, the stub function and the query interface includes: Determine first rule information according to the initial insertion point, the first rule information including an instruction name, a return value, and an instruction operand list corresponding to the initial insertion point; Determine second rule information according to the query interface, where the second rule information includes an interface name corresponding to the query interface and an expected result; Determine the 3rd rule information according to described pile function, described 3rd rule information comprises pile function title, instruction, return value and described pile function that described pile function is corresponding and performs required parameter; The first rule information, the second rule information and the third rule information are integrated to obtain the instrumentation rule.

7. The method according to claim 1, characterized in that After the verification operation is performed on the target code and a verification result is obtained, the method further includes: When the verification result indicates that there is an error in the code to be verified, an error report is generated.

8. A software verification device, characterized in that: The device comprises: A determination module, used to determine an initial insertion point, a query interface and a stub function according to an error type to be detected, wherein the initial insertion point indicates an instruction corresponding to the error type, the query interface is used to determine whether the initial insertion point needs to be inserted, and the stub function indicates an error verification logic corresponding to the error type; A rule configuration module, configured to configure a pile insertion rule based on the initial pile insertion point, the pile function and the query interface; An instrumentation module, configured to perform instrumentation processing on the intermediate representation IR corresponding to the code to be verified based on the instrumentation rules to obtain a target code; The verification module is used to perform a verification operation on the target code to obtain a verification result.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is used for executing the instructions to implement the software verification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the software verification method as claimed in any one of claims 1 to 7.

Images