Static analysis method for use of worst stack
Through static analysis methods, the symbol table is parsed, the code is disassembled, and the CFG is reconstructed, and the worst stack path is calculated, which solves the stack overflow problem in embedded software, and accurately analyzes the use of the worst stack, reducing the risk of software crash.
Patent Information
- Application Number
- CN202411679192.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-04-11
AI Technical Summary
In the field of embedded software, stack overflow is a common mistake, especially in the field of high security critical software, which is difficult to manually analyze the worst stack usage, resulting in unpredictable consequences such as software crashes.
Provides a static analysis method for the worst stack use. By analyzing the symbol table in the executable file, disassemble the code, analyzing the stack size of the function itself, rebuilding the control flow graph (CFG), deeply traversing the CFG under the specified entrance, calculating the stack size accumulated in each function call path, comparing the maximum accumulated stack size, and determining the worst stack path.
This method can accurately identify various types of functions, consider recursion and function pointers, ensure the accuracy of rebuilding CFG, and is suitable for processors using PowerPC instruction sets. It is not affected by specific processor models, compiler types and versions. It can accurately analyze the worst stack usage and reduce the risk of stack overflow.
Smart Images
Figure CN119806993A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to the field of embedded technology, and in particular to a static analysis method for worst case stack usage. Background Art
[0002] In the field of embedded software, stack overflow is a common error that often leads to unpredictable consequences such as software crashes. Especially in the field of high safety-critical software such as FADEC, stack overflow is a serious and intolerable error. Therefore, the analysis of the worst-case stack usage of software is crucial. During the entire life cycle of software development and maintenance, the worst-case stack usage should always be analyzed to ensure that the stack margin is sufficient and there is no overflow risk. Therefore, the analysis method of the worst-case stack usage is indispensable, and considering the complexity of the software control flow, it is difficult for humans to do this job. Summary of the invention
[0003] Purpose of the invention: The purpose of the present invention is to provide a static analysis method for worst-case stack usage, which can analyze the function path and size of the worst-case stack usage under a specified entry.
[0004] Technical solution: A static analysis method for worst-case stack usage described in the present invention comprises the following steps: (1) Parse the symbol table in the executable file to obtain all function information; (2) Disassemble the executable file to obtain the disassembled code; (3) Analyze the stack size used by all functions; (4) Reconstruct the CFG of all functions by identifying all jump instructions in the assembly code; (5) Deeply traverse the CFG under the specified entry to obtain all possible function call paths; (6) Calculate the cumulative stack size used under each function call path, and then compare the maximum cumulative stack size used. The corresponding path is the worst stack path.
[0005] Furthermore, in step (1), the executable file is in ELF format.
[0006] Furthermore, in step (1), the function information includes the function name, the starting address and the length.
[0007] Furthermore, step (3) is as follows: the meaning of the instruction at 000C65EC is: (r1)=r1, r1=r1-0x38.
[0008] Furthermore, step (5) is as follows: suppose the worst stack usage of the main function is to be analyzed, then the first address of the main function is designated as the entry, and then the CFG under the entry is traversed.
[0009] A static analysis system for worst-case stack usage according to the present invention comprises: Parsing module: used to parse the symbol table in the executable file and obtain all function information; Disassembly module: used to disassemble the executable file and obtain the disassembly code; Analysis module: used to analyze the stack size used by all functions; Reconstruction module: used to identify all jump instructions in the assembly code and rebuild the CFG of all functions; Traversal module: deeply traverse the CFG under the specified entry to obtain all possible function call paths; Calculation module: used to calculate the cumulative stack size used under each function call path, and then compare to obtain the maximum cumulative stack size used. The corresponding path is the worst stack path.
[0010] Furthermore, in the parsing module, the executable file is in ELF format.
[0011] Furthermore, in the parsing module, the function information includes the function name, the starting address and the length.
[0012] Furthermore, in the analysis module, the details are as follows: the meaning of the instruction at 000C65EC is: (r1)=r1, r1=r1-0x38.
[0013] Furthermore, in the reconstruction module, the details are as follows: suppose the worst stack usage of the main function is to be analyzed, then the first address of the main function is designated as the entry, and then the CFG under the entry is traversed.
[0014] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: it is applicable to processors using the PowerPC instruction set, and is not affected by the specific processor model, nor by the compiler type, version, and compilation options; it can accurately identify various types of functions: global functions, static functions, inline functions, assembly functions, and library functions, and fully considers the two special calls of recursion and function pointers, ensuring the accuracy of reconstructing CFG. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 It is a flow chart of the present invention Figure 2 It is an example diagram of the analysis of the present invention; Figure 3 The PowerPC™ e500 Application Binary Interface User's Guide of the present invention; Figure 4 The present invention allocates stack frame space in advance; Figure 5 It is the eabi file requirement of the present invention; Figure 6 This is a specific example diagram of the stack size used by the present invention for analysis itself. DETAILED DESCRIPTION
[0016] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.
[0017] like Figure 1 As shown, the steps of the method provided by the embodiment of the present invention are as follows: A worst-case stack usage static analysis method based on PowerPC processor, the specific steps are as follows: Step 1: Parse the symbol table in the executable file (usually in ELF format) to obtain all function information, including function name, start address and length, such as Figure 2 shown.
[0018] Step 2: Disassemble the executable file to obtain the disassembled code; Step 3: For all functions, analyze the stack size they use; in the PowerPC architecture, according to the eabi file (PowerPC™ e500 Application Binary Interface User's Guide), r1 is the stack register. Figure 3 When compiling each function, the compiler will allocate stack frame space in advance according to the requirements of the EABI file to save input parameters, field information, local variables, return values, etc. The specific contents are shown in the figure below: The compiler calculates the stack size required by the current function in advance, and directly operates the r1 register through assembly instructions during compilation to achieve early allocation of stack space. According to the eabi file requirements of the PPC processor, the assembly instruction for the compiler to implement stack space allocation is the stwu instruction. Specific requirements are as follows Figure 5 As shown, after the assembly code is obtained, the stack size of the function is located by using regular expressions to match instructions in the form of stwu r1, XXX (r1).
[0019] like Figure 6 As shown, the meaning of the instruction at 000C65EC of the function Lib_verifyArea is: (r1) = r1, r1 = r1-0x38. In the PowerPC architecture, the stack grows toward lower addresses, so the stack size used by the function Lib_verifyArea itself is 56 bytes.
[0020] Step 4: Reconstruct the CFG of all functions by identifying all jump instructions in the assembly code; Step 5: Deeply traverse the CFG under the specified entry to obtain all possible function call paths. For example, Example 1 is as follows: Assuming that we want to analyze the worst stack usage of the main function, we specify the first address of the main function as the entry point, and then traverse the CFG under the entry point. Assume that there are 3 function call paths obtained: main->f1; main->f2->f3; main->f4->f5->f6 Step 6: Calculate the cumulative stack size used under each function call path, and then compare the maximum cumulative stack size used. The corresponding path is the worst stack path.
[0021] For example, continue with Example 1 described in 5): Assuming that according to the method in 3), the stack sizes used by all functions under the three function call paths are: main 16 bytes; f1 32 bytes; f2 64 bytes; f3 40 bytes; f4 16 bytes; f5 16 bytes; f6 48 bytes, then the cumulative stack sizes used under the three paths are: main->f1 48 bytes main->f2->f3 120 bytes main->f4->f5->f6 96 bytes It can be concluded that the worst stack usage of the main function is 120 bytes, and the corresponding path is main->f2->f3.
[0022] An embodiment of the present invention further provides a static analysis system for worst-case stack usage, including: Parsing module: used to parse the symbol table in the executable file and obtain all function information; the executable file is in ELF format. Function information includes function name, starting address and length Disassembly module: used to disassemble the executable file and obtain the disassembly code; Analysis module: used to analyze the stack size used by all functions; the details are as follows: the meaning of the instruction at 000C65EC is: (r1) = r1, r1 = r1-0x38.
[0023] Reconstruction module: used to identify all jump instructions in the assembly code and rebuild the CFG of all functions; Traversal module: deeply traverse the CFG under the specified entry to obtain all possible function call paths; the details are as follows: if you want to analyze the worst stack usage of the main function, specify the first address of the main function as the entry, and then traverse the CFG under the entry.
[0024] Calculation module: used to calculate the cumulative stack size used under each function call path, and then compare to obtain the maximum cumulative stack size used. The corresponding path is the worst stack path.
Claims
1. A static analysis method for worst-case stack usage, characterized in that: The following steps are involved: (1) Parse the symbol table in the executable file to obtain all function information; (2) Disassemble the executable file to obtain the disassembled code; (3) Analyze the stack size used by all functions; (4) Reconstruct the CFG of all functions by identifying all jump instructions in the assembly code; (5) Deeply traverse the CFG under the specified entry to obtain all possible function call paths; (6) Calculate the cumulative stack size used under each function call path, and then compare the maximum cumulative stack size used. The corresponding path is the worst stack path.
2. The static analysis method for worst-case stack usage according to claim 1, characterized in that: In step (1), the executable file is in ELF format.
3. The static analysis method for worst-case stack usage according to claim 1, characterized in that: In step (1), the function information includes the function name, starting address and length.
4. The static analysis method for worst-case stack usage according to claim 1, characterized in that: Step (3) is as follows: The meaning of the instruction at 000C65EC is: (r1) = r1, r1 = r1-0x38.
5. The static analysis method for worst stack usage according to claim 1, characterized in that: Step (5) is as follows: suppose the worst stack usage of the main function is to be analyzed, then the first address of the main function is specified as the entry, and then the CFG under the entry is traversed.
6. A static analysis system for worst-case stack usage, characterized in that: include: Parsing module: used to parse the symbol table in the executable file and obtain all function information; Disassembly module: used to disassemble the executable file and obtain the disassembly code; Analysis module: used to analyze the stack size used by all functions; Reconstruction module: used to identify all jump instructions in the assembly code and rebuild the CFG of all functions; Traversal module: deeply traverse the CFG under the specified entry to obtain all possible function call paths; Calculation module: used to calculate the cumulative stack size used under each function call path, and then compare to obtain the maximum cumulative stack size used. The corresponding path is the worst stack path.
7. A static analysis system for worst-case stack usage according to claim 6, characterized in that: In the parsing module, the executable file is in ELF format.
8. The worst stack usage static analysis system according to claim 6, characterized in that: In the parsing module, function information includes function name, starting address and length.
9. The worst stack usage static analysis system according to claim 6, characterized in that: In the analysis module, the details are as follows: The meaning of the instruction at 000C65EC is: (r1) = r1, r1 = r1-0x38.
10. The worst stack usage static analysis system according to claim 6, characterized in that: In the reconstruction module, the details are as follows: if you want to analyze the worst stack usage of the main function, specify the first address of the main function as the entry, and then traverse the CFG under the entry.