Memory access observation method, device, equipment, storage medium and product

Abstract

The embodiments of the present disclosure provide a memory access observation method, device, equipment, storage medium and product, which relate to the field of computer technology. The method includes: creating a subprocess of a target process; setting an observation point, where the observation point indicates a target address to be observed; and the subprocess observes the target address of the target process accessing the memory based on the observation point. First, the present disclosure creates a subprocess of the target process, which can avoid the impact on the target process when observing the target process. In addition, the present disclosure can observe the target process accessing the target address by setting an observation point indicating the target address, thereby achieving more fine-grained access to memory access.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a memory access observation method, device, equipment, storage medium and product. Background Art

[0002] Memory access security is a key issue in software development and has always troubled developers. Especially when using low-level languages ​​such as C and C++, users have more freedom to operate memory, but this also brings potential problems, such as wild pointers, null pointer references, and array out-of-bounds. These problems may cause abnormal behavior or even crash of the program during operation. More seriously, these memory errors may be exploited to cause information leakage, data tampering, or remote execution of malicious code.

[0003] To solve these problems, current programming languages ​​and operating systems have introduced various memory management mechanisms, such as memory protection, garbage collection, and smart pointers. In addition, static analysis tools and dynamic detection tools are also widely used to identify potential memory access problems, but these methods cannot achieve a more fine-grained observation of memory access. Summary of the invention

[0004] The embodiments of the present disclosure provide a memory access observation method, apparatus, device, computer-readable storage medium and product, which are used to solve the technical problem that the prior art cannot achieve finer-grained observation of memory access.

[0005] In a first aspect, an embodiment of the present disclosure provides a memory access observation method, comprising:

[0006] Create a child process of the target process;

[0007] Set an observation point, where the observation point indicates the target address to be observed;

[0008] The child process observes the target address of the target process's memory access based on the observation point.

[0009] In a second aspect, an embodiment of the present disclosure provides a memory access observation device, including:

[0010] Create a unit, which is used to create a child process of the target process;

[0011] A setting unit, used for setting an observation point, where the observation point indicates a target address to be observed;

[0012] The observation unit is used by the child process to observe the target address of the target process accessing the memory based on the observation point.

[0013] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a processor and a memory;

[0014] Memory stores computer-executable instructions;

[0015] The processor executes the computer-executable instructions stored in the memory, so that at least one processor executes the first aspect as well as various possible memory access observation methods of the first aspect.

[0016] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the first aspect and various possible memory access observation methods of the first aspect are implemented.

[0017] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the first aspect as well as various possible memory access observation methods of the first aspect.

[0018] The memory access observation method, device, equipment, storage medium and product provided in this embodiment include: creating a child process of the target process; setting an observation point, the observation point indicating the target address to be observed; the child process observes the target address of the target process accessing the memory based on the observation point. First, the present disclosure creates a child process of the target process, which can avoid the impact on the target process when observing the target process. In addition, by setting an observation point indicating the target address, the present disclosure can observe the target process accessing the target address, thereby achieving more fine-grained access to memory access. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 An example diagram of an application scenario of a memory access observation method provided by an embodiment of the present disclosure;

[0021] Figure 2 A flow chart of a memory access observation method provided by an embodiment of the present disclosure;

[0022] Figure 3 A flow chart of another memory access observation method provided by an embodiment of the present disclosure;

[0023] Figure 4 A schematic diagram of the structure of a memory access observation device provided by an embodiment of the present disclosure;

[0024] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0026] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the target users in an appropriate manner in accordance with relevant laws and regulations, and the target users' authorization should be obtained.

[0027] It is understandable that the above notification and the process of obtaining authorization of the target user are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0028] Among them, memory operations bring problems such as wild pointers, null pointer references and array out-of-bounds. Among them, wild pointers are usually caused by pointers that are not properly initialized or not cleared after release, pointing to invalid memory addresses, resulting in unpredictable behavior. Out-of-bounds access occurs when the program attempts to read or write data beyond the legal memory range, which may destroy data integrity or even damage the program structure. Since these problems are difficult to be fully detected during the development phase, once they occur in the production environment, they may cause huge losses, including system crashes, service interruptions, and even major security vulnerabilities. Although there are many online and offline solutions that can be used to observe and solve memory access anomalies, they each have different advantages and disadvantages. Related technologies can usually solve a specific type of memory problems, such as memory leaks, wild pointers or array out-of-bounds, but they often cannot fully cover all scenarios, nor can they accurately observe certain key data in a fine-grained manner.

[0029] In order to solve the technical problem, the present disclosure provides a memory access observation method, that is, byte-level access observation for the target address in the memory, including full observation of its read and write operations. This fine-grained observation mechanism can provide stronger targeting, especially when important data needs to be protected and observed. For example, when processing critical business data, it is crucial to ensure that the read and write operations of each byte are within a controllable range. The present disclosure can capture every access to the target address in the memory in real time, whether it is reading or writing, to ensure that these operations are safe, thereby effectively preventing potential problems.

[0030] It should be noted that the memory access observation method, apparatus, device, storage medium and product provided by the present disclosure can be applied to any electronic device.

[0031] The memory access observation method provided by the embodiment of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0032] Figure 1 This is an example diagram of an application scenario of a memory access observation method provided by an embodiment of the present disclosure. Figure 1 As shown, the memory has multiple addresses, such as address a1, address a2, address a3, address a4 and address a5. The memory can run instructions in the program to access the memory. Among them, the process accesses the memory to operate the program code, such as read operations and / or write operations. These operations may destroy the program structure, and then the memory access of the process needs to be observed to ensure the security of the program running in the memory.

[0033] Figure 2 A flowchart of a memory access observation method provided in an embodiment of the present disclosure, the memory access observation method may include the following steps:

[0034] S201. Create a child process of the target process.

[0035] Among them, the target process is the parent process of the child process.

[0036] In the disclosed embodiment, the target process can use the fork() system call to create a child process of the target process. The fork() system call is a system call used to create a process in the operating system. When the target process calls fork(), all resources of the target process (including code, data, and stack, etc.) are copied to create a child process identical to the target process. The child process starts executing from the next instruction after the fork() call, and the target process continues to execute the code after fork().

[0037] S202: Set an observation point, where the observation point indicates a target address to be observed.

[0038] The watch point function is a hardware function that allows the observation of the target address set in memory during debugging and memory access observation. When the target address is accessed (read or write), an interrupt or exception is triggered. The watch point function is often used in debugging scenarios to help observe specific memory access behaviors, especially when dealing with complex memory errors or debugging data-related issues.

[0039] S203: The child process observes the target address of the memory accessed by the target process based on the observation point.

[0040] The child process may observe the operations of the target process on the data stored at the target address, including write operations and / or read operations, and then determine whether there are any abnormalities in these operations to ensure the security of the memory.

[0041] In the disclosed embodiment, the child process calls ptrace to observe the target process, wherein ptrace is a system call in the operating system, which is mainly used for debugging programs. Ptrace allows a child process to observe and control the target process, and to check or modify the registers and memory of the target process. The most common use of ptrace is to perform operations such as breakpoint setting, single-step execution, and variable observation in debugging tools.

[0042] Furthermore, the main functions of ptrace are as follows: (1) Process tracking. The child process can attach to the target process through ptrace and track its execution status. (2) Control the execution flow. The child process can pause the target process, set breakpoints, memory observation points, perform single-step operations, etc. (3) Read and modify registers. The child process can read or modify the registers of the target process through ptrace. (4) Access memory. The child process can read and write the memory of the target process through ptrace to check variables or modify data. (5) Signal control. The child process can intercept the signal received by the target process and decide whether to pass or block the signal.

[0043] In addition, ptrace sets breakpoints and observation points based on the debugging function provided by the processor. Therefore, when using the ptrace interface, you can directly perform high-level debugging operations without worrying about the specific implementation of the underlying chip. Usually ptrace requires a process with management privileges to use it, but the parent process and the child process can use ptrace to observe each other. Therefore, to observe the target process, the present disclosure only needs to create a child process of the target process.

[0044] In the embodiments of the present disclosure, precise access observation at the byte level can be performed for specific data stored at the target address in the memory, including full observation of the read operation and / or write operation of the target process. This fine-grained observation mechanism can provide stronger pertinence, especially when it is necessary to protect and observe important data. For example, in the case of critical business data, it is ensured that the read and write operations of each byte are within a controllable range. The present disclosure can capture every access to the data at the target address in the memory in real time, ensuring that these operations meet the access requirements, thereby effectively preventing potential abnormal situations such as memory leaks, cross-boundary access and illegal operations. The present disclosure can not only improve the overall security of the memory, but also provide developers with more in-depth debugging information to help quickly locate memory problems and solve them. In addition, byte-level observation is more accurate than the common memory observation scheme in the related art, and can provide a higher level of protection for important data. This enables the present disclosure to achieve data protection and improve data security in the memory.

[0045] Figure 3 A flowchart of another memory access observation method provided by the present disclosure, the memory access observation method may include the following steps:

[0046] S301, creating a child process of the target process.

[0047] The specific implementation process of this step refers to S201 and will not be repeated here.

[0048] S302: The child process obtains the process ID of the target process.

[0049] Among them, the child process can obtain the process identifier (pid, ProcessIdentifie) of the target process by calling getpid().

[0050] S303: The child process suspends the target process according to the process identifier.

[0051] Among them, the child process uses ptrace(PTRACE_ATTACH,pid,NULL,NULL) to observe the target process and pause it.

[0052] In the disclosed embodiment, waitpid(pid, 0, __WALL) is called to block the signal (SIGSTOP) for waiting for the target process to be suspended. After receiving the signal, waitpid() returns to the child process that the target process has been suspended.

[0053] S304, when the target process is suspended, obtaining the target address to be observed.

[0054] The target address is predefined and refers to the memory address to be observed. Figure 1, the memory corresponds to address a1, address a2, address a3, address a4 and address a5. If the target address is address a4.

[0055] S305, determining an idle target watchpoint register.

[0056] It will be appreciated that the watchpoint register is used to store the target address and the control field.

[0057] In the disclosed embodiment, before determining the idle target watchpoint register, the method further includes: constructing an iovec (a data structure), where the iovec is used to read the state of the debug register.

[0058] The step of determining an idle target observation point register includes: acquiring a plurality of observation point registers; and determining one of the idle observation point registers as the target observation point register.

[0059] Specifically, the state information of the watchpoint register of the processor is obtained, and the state information includes: the number of multiple watchpoint registers, whether each watchpoint register is used, etc. Then, an idle watchpoint register is determined as the target watchpoint register among the multiple watchpoint registers.

[0060] S306, setting the target address in the target watchpoint register.

[0061] Among them, the target address is the address to be observed. In addition, it also includes: setting the first field in the target observation point register to indicate turning on the observation point, wherein it can be understood that turning on the observation point is to turn on the breakpoint function, so that the target process is suspended when accessing the target address.

[0062] S307, write the target address into the debug register.

[0063] In the disclosed embodiment, the child process calls ptrace (PTRACE_SETREGSET) to write the target address and the first field into the debug register of the processor to complete the setting of the observation point.

[0064] Among them, the debug register is used to implement the setting of the observation point according to the target address.

[0065] S308, enable the observation point function.

[0066] The function of enabling the watchpoint includes: setting a control field as a first field in a target watchpoint register, the first field being used to indicate the function of enabling the watchpoint; and writing the first field in a debug register.

[0067] In the present disclosure, the first field is such as "1". When the first field is written into the debug register, the watchpoint function is turned on, and the target process can be suspended when the target process accesses the target address.

[0068] S309: The child process resumes the operation of the target process according to the process identifier.

[0069] The child process calls ptrace(PTRACE_CONT, pid, NULL, NULL) to resume the operation of the target process. It can be understood that the disclosure returns the operation of the parent target to enable the target process to access the memory.

[0070] S310: If the target process accesses the target address, the child process suspends the running of the target process.

[0071] Among them, the child process can call waitpid(pid,0,__WALL) to wait for the target process to access the target address. If the target accesses the target address, it will trigger SIGTRAP (the signal for the target process to be suspended), and waitpid() returns to the child process that the target process has been suspended.

[0072] S311, the child process determines whether the target process accesses the target address abnormally.

[0073] Specifically, some logic can be added here, such as call stack check, legitimacy check, etc. to determine whether the target process accesses the target address abnormally. If abnormal, the exception can be reported or the target process's access to the target address can be denied.

[0074] S312, close the observation point.

[0075] Wherein, closing the observation point comprises: adjusting the control field in the target observation point register to the second field, the second control field is used to indicate closing the observation point; and writing the second field in the debug register.

[0076] Specifically, first, you need to reset the control field of the watchpoint register to the second control field, and then the child process calls ptrace (PTRACE_SETREGSET), deletes the first field in the debug register, and writes the second field to the debug register to close the watchpoint.

[0077] In the disclosed embodiment, closing the observation point can prevent the target process from pausing when the target process continues to access the target address, thereby avoiding repeated triggering of the observation point.

[0078] For example, refer to Figure 1 , if the target address is address a2, if the target process accesses address a2, then the target process

[0079] S313, the child process resumes the operation of the target process according to the process identifier.

[0080] It can be understood that the child process executes ptrace(PTRACE_SINGLESTEP, parent, NULL, NULL) to make the target process execute the current memory access instruction. After the current memory access instruction ends, the child process can control the target process to pause, and then repeat S305 to S313, wherein, each time it is executed, a different target address can be set, and then the memory access of different target addresses can be observed. In addition, S308 to S313 can also be repeatedly executed to observe the target process accessing the target address when running other memory access instructions.

[0081] Further, if the observation requirement is met, such as a plurality of different target addresses have been observed, or a preset number of observations have been made for the same target address, the observation requirement is met, and the observation of the target address can then be exited.

[0082] In an embodiment of the present disclosure, the child process may call ptrace(PTRACE_DETACH, pid, NULL, NULL) to exit the observation of the target process.

[0083] In summary, the present disclosure creates a subprocess of the target process, and the subprocess calls ptrace to observe the target process, and observes the memory access of the target process based on the observation point function of the processor debugging capability. It can be understood that the present disclosure first creates a subprocess, uses the subprocess to observe the operation of the target process, sets the observation point when the target process is controlled to suspend operation, and the observation point indicates the target address to be observed, and then turns on the observation point, and controls the target process to run after turning on the observation point. During the operation of the target process, since the observation point is turned on, if the target process accesses the target address, the target process can be paused, and then the subprocess observes whether the target process accesses the target address abnormally. After the observation is completed, the observation point can be closed, and the target process can be controlled to run, so that the target process can execute the current access instruction, so as not to repeatedly trigger the observation point (that is, the operation of the target process will not be repeatedly suspended, and the target process will be repeatedly observed to see whether the target process accesses the target address abnormally). Further, the present application can realize the observation of the target process accessing the target address by setting the observation point, and then realize a more fine-grained observation of the memory, and improve the security of the memory.

[0084] Figure 4 A schematic diagram of a memory access observation device provided in an embodiment of the present disclosure. The memory access observation device 40 may include the following units:

[0085] A creation unit 401 is used to create a subprocess of a target process, and an observation point indicates a target address to be observed;

[0086] A setting unit 402, used to set an observation point;

[0087] The observation unit 403 is used for the child process to observe the target address of the memory accessed by the target process based on the observation point.

[0088] In one embodiment, the setting unit 402 is specifically configured to:

[0089] When the target process is suspended, obtain the target address to be observed;

[0090] Determine the free target watchpoint registers;

[0091] Set the target address in the target watchpoint register;

[0092] Write the target address in the debug registers, which are used to implement watchpoints based on the target address.

[0093] In one embodiment, the observation unit 403 is specifically used to: enable the observation point function; the sub-process resumes the operation of the target process according to the process identifier; if the target process accesses the target address, the sub-process suspends the operation of the target process; the sub-process determines whether the target process accesses the target address abnormally.

[0094] In one embodiment, when the observation point function is enabled, the observation unit 403 is specifically used to: set the control field in the target observation point register to the first field, where the first field is used to indicate that the observation point function is enabled; and write the first field in the debug register.

[0095] In one embodiment, a closing unit (not shown) is used to close the observation point after the child process determines whether the target process accesses the target address abnormally;

[0096] The recovery unit (not shown) is used for the sub-process to recover the operation of the target process according to the process identifier.

[0097] In one embodiment, the closing unit is specifically used to adjust the control field in the target observation point register to the second field, where the second control field is used to indicate closing the observation point; and write the second field in the debug register.

[0098] In one embodiment, the method further comprises: an acquisition unit, configured to, when the target process is suspended, before acquiring the target address to be observed, enable the subprocess to acquire the process identifier of the target process;

[0099] The pause unit is used by the child process to pause the target process according to the process identifier.

[0100] In one embodiment, when determining an idle target watchpoint register, the setting unit 402 is specifically configured to: obtain multiple watchpoint registers; and determine one of the idle watchpoint registers as the target watchpoint register.

[0101] The specific implementation process of the memory access observation device provided in the embodiment of the present disclosure can refer to the above-mentioned memory access observation method, which will not be repeated here.

[0102] In order to implement the above embodiments, the embodiments of the present disclosure further provide a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, a memory access observation method as in any of the above embodiments is implemented.

[0103] In order to implement the above embodiments, the embodiments of the present disclosure further provide a computer program product, including a computer program, which implements the memory access observation method of any of the above embodiments when executed by a processor.

[0104] In order to implement the above embodiment, the present disclosure also provides an electronic device, including: a processor and a memory;

[0105] Memory stores computer-executable instructions;

[0106] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the memory access observation method as described in any of the above embodiments.

[0107] Figure 5 The electronic device 50 is a schematic diagram of the structure of the electronic device provided in the embodiment of the present disclosure, and the electronic device 50 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (Portable Media Players, PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0108] like Figure 5As shown, the electronic device 50 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 51, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 52 or a program loaded from a storage device 58 to a random access memory (RAM) 53. Various programs and data required for the operation of the electronic device 50 are also stored in the RAM 53. The processing device 51, the ROM 52, and the RAM 53 are connected to each other via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0109] Typically, the following devices may be connected to the I / O interface 55: input devices 56 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 57 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 58 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 59. The communication device 59 may allow the electronic device 50 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 50 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have instead.

[0110] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 59, or installed from the storage device 58, or installed from the ROM 52. When the computer program is executed by the processing device 51, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0111] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0112] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0113] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0114] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the target user computer, partially on the target user computer, as a separate software package, partially on the target user computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the target user computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0117] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0118] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] In a first aspect, according to one or more embodiments of the present disclosure, a memory access observation method is provided.

[0120] According to one or more embodiments of the present disclosure, setting an observation point includes:

[0121] When the target process is suspended, obtain the target address to be observed;

[0122] Determine the free target watchpoint registers;

[0123] Set the target address in the target watchpoint register;

[0124] Write the target address in the debug registers, which are used to implement watchpoints based on the target address.

[0125] According to one or more embodiments of the present disclosure, the child process observes the target address of the target process accessing the memory based on the observation point, including:

[0126] Enable the observation point function;

[0127] The child process resumes the operation of the target process according to the process identifier;

[0128] If the target process accesses the target address, the child process suspends the running of the target process;

[0129] The child process determines whether the target process's access to the target address is abnormal.

[0130] According to one or more embodiments of the present disclosure, the function of enabling the observation point includes:

[0131] Setting a control field as a first field in a target observation point register, the first field being used to indicate a function of enabling the observation point;

[0132] Write the first field in the debug register.

[0133] According to one or more embodiments of the present disclosure, after the child process determines whether the target process accesses the target address abnormally, the following further includes:

[0134] Close the observation point;

[0135] The child process resumes the operation of the target process according to the process ID.

[0136] According to one or more embodiments of the present disclosure, closing an observation point includes:

[0137] Adjusting the control field in the target watchpoint register to the second field, the second control field being used to indicate closing the watchpoint;

[0138] Write the second field in the debug register.

[0139] According to one or more embodiments of the present disclosure, when the target process is suspended, before obtaining the target address to be observed, the method further includes:

[0140] The child process obtains the process ID of the target process;

[0141] The child process suspends the target process based on the process ID.

[0142] According to one or more embodiments of the present disclosure, determining an idle target watchpoint register includes:

[0143] Get multiple watchpoint registers;

[0144] One of the free watchpoint registers is determined to be the target watchpoint register.

[0145] In a second aspect, according to one or more embodiments of the present disclosure, a memory access observation device is provided, comprising:

[0146] A creation unit is used to create a child process of the target process, and an observation point indicates a target address to be observed;

[0147] A setting unit, used for setting an observation point, where the observation point indicates a target address to be observed;

[0148] The observation unit is used by the child process to observe the target address of the target process accessing the memory based on the observation point.

[0149] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0150] Memory stores computer-executable instructions;

[0151] At least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the memory access observation method as described in the first aspect and various possible designs of the first aspect.

[0152] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the memory access observation method as described in the first aspect and various possible designs of the first aspect are implemented.

[0153] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, including a computer program, which, when executed by a processor, implements the memory access observation method as described in the first aspect and various possible designs of the first aspect.

[0154] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

[0155] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0156] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A memory access observation method, characterized in that: include: Create a child process of the target process; Setting an observation point, wherein the observation point indicates a target address to be observed; The child process observes the target address of the memory accessed by the target process based on the observation point.

2. The memory access observation method according to claim 1, characterized in that: The setting of observation points includes: When the target process is suspended, obtaining a target address to be observed; Determine the free target watchpoint registers; setting the target address in the target watchpoint register; The target address is written into a debug register, and the debug register is used to implement a watchpoint function according to the target address.

3. The memory access observation method according to claim 2, characterized in that: The child process observes the target address of the target process accessing the memory based on the observation point, including: Enable the function of the observation point; The child process resumes the operation of the target process according to the process identifier; If the target process accesses the target address, the child process suspends the running of the target process, and the child process determines whether the target process accesses the target address abnormally.

4. The memory access observation method according to claim 3, characterized in that: The function of opening the observation point includes: setting a first field in the target watchpoint register; The first field is written into the debug register, where the first field is used to indicate that a function of enabling the watchpoint is enabled.

5. The memory access observation method according to claim 4, characterized in that: After the sub-process determines whether the target process accesses the target address abnormally, the process further includes: Turn off the function of the observation point; The child process resumes the operation of the target process according to the process identifier.

6. The memory access observation method according to claim 5, characterized in that: The function of closing the observation point includes: Deleting the first field and setting the second field in the target observation point register; The second field is written into the debug register, where the second control field is used to indicate closing the watchpoint function.

7. The memory access observation method according to any one of claims 2 to 6, characterized in that: In the case where the target process is suspended, before obtaining the target address to be observed, the method further includes: The child process obtains the process identifier of the target process; The child process suspends the target process according to the process identifier.

8. The memory access observation method according to any one of claims 2 to 6, characterized in that: The step of determining an idle target observation point register comprises: Get multiple watchpoint registers; One of the idle watchpoint registers is determined as the target watchpoint register.

9. A memory access observation device, characterized in that: include: A creation unit, used for creating a subprocess of a target process, wherein the observation point indicates a target address to be observed; A setting unit, used for setting an observation point, wherein the observation point indicates a target address to be observed; An observation unit is used for the child process to observe the target address of the target process accessing the memory based on the observation point.

10. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the memory access observation method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the memory access observation method according to any one of claims 1 to 8 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the memory access observation method according to any one of claims 1 to 8 is implemented.

Images