Reconstruction method and device of instruction stream, electronic equipment and readable storage medium

Abstract

The invention provides an instruction stream reconstruction method and device, electronic equipment and a readable storage medium. The instruction stream reconstruction method comprises the steps that a target instruction address sent by processing equipment according to a target sampling interval and execution times recorded in various types of registers respectively are acquired; the target instruction address is the address of a target machine instruction currently executed in the machine instruction set; each type of register has a corresponding instruction execution type; the number of execution times is the total number of execution times of the machine instruction of the corresponding instruction execution type, and determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instruction needing to be executed, the change condition of the execution times of each type of register in two adjacent sending operations is calculated, the target branch is determined from all branches according to the change condition, and the machine instruction set is reconstructed according to the target branch, so that the instruction stream can be accurately recovered.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and computer-readable storage medium for reconstructing an instruction stream. Background Art

[0002] The reconstruction of instruction stream is the core step of binary program analysis, which provides the basis for understanding program behavior, restoring control flow, supporting reverse engineering, detecting malicious code, etc. Whether it is security research, software debugging or performance optimization, the reconstruction of instruction stream is an indispensable technical means.

[0003] The related technology obtains the value of the program counter (PC) from the PC register at a certain time through a timer interrupt or a high-precision timer, and then uploads the PC value to a host computer, that is, a server or a storage device, so that the host computer reconstructs the instruction stream based on the PC value.

[0004] However, the instruction stream reconstruction method proposed in the related art can only perform statistics on the executed PC for a rough analysis, and cannot accurately restore the instruction stream. Summary of the invention

[0005] The embodiments of the present application provide a method, device, electronic device and computer-readable storage medium for reconstructing an instruction stream to solve the problems in the related art.

[0006] In a first aspect, an embodiment of the present application provides a method for reconstructing an instruction stream, the method comprising: Obtaining a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is an address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times machine instructions of the corresponding instruction execution type are executed; Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; Calculating the change in the number of executions of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; The machine instruction set is rebuilt according to the target branch.

[0007] In a second aspect, an embodiment of the present application provides a device for reconstructing an instruction stream, the device comprising: An acquisition module is used to acquire a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; and the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed; A determination module, used to determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; A calculation module, used for calculating the change of the execution times of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; A reconstruction module is used to reconstruct the machine instruction set according to the target branch.

[0008] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method of the first aspect.

[0009] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method of the first aspect.

[0010] In an embodiment of the present application, the target instruction address of the target machine instruction currently being executed in the machine instruction set sent by the processing device according to the target sampling interval, and the execution times of the machine instructions of the corresponding instruction execution type recorded in each of the multiple types of registers are obtained, and all branches between the two target instruction addresses are determined according to the source code recording the machine instruction to be executed and the target instruction addresses sent by two adjacent sending operations, and the change of the execution times of each type of register in the two adjacent sending operations is calculated, and the target branch is determined from all branches according to the change, and the machine instruction set is reconstructed according to the target branch. Since multiple types of registers are used to record the execution times of the machine instructions of the corresponding instruction execution type, when there are multiple branches, the target branch can be determined according to the change of the execution times recorded in each of the multiple types of registers, which can improve the accuracy of the instruction stream reconstruction.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 It is a flowchart of the steps of a method for reconstructing an instruction stream provided in an embodiment of the present application; Figure 2 It is a flowchart of the specific steps of a method for reconstructing an instruction stream provided in an embodiment of the present application; Figure 3 It is a program execution diagram provided by an embodiment of the present application; Figure 4 This is a block diagram of an instruction stream reconstruction device provided in an embodiment of the present application; Figure 5 is a block diagram of an electronic device provided in an embodiment of the present application; Figure 6 It is a block diagram of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0015] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally a class, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of associated objects, indicating that three kinds of relationships can exist, for example, A and / or B can be represented: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the front and back associated objects are a kind of "or" relationship. In the embodiment of the present application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0016] Figure 1is a flowchart of a method for reconstructing an instruction stream provided by an embodiment of the present application, such as Figure 1 As shown, the method may include: Step 101, obtaining the target instruction address sent by the processing device according to the target sampling interval, and the execution times recorded in each of the multiple types of registers; the target instruction address is the address of the target machine instruction currently being executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed.

[0017] For example, the processing device can be a hardware device that executes machine instructions. For example, a central processing unit (CPU), a graphics processing unit (GPU) or other processors, or a peripheral such as a common serial port. The target sampling interval refers to the fixed time interval or instruction interval for collecting machine instructions during program execution. For example, data is collected every 1,000 machine instructions. The target instruction address refers to the memory address of the machine instruction currently being executed. During program execution, the processing device will execute instructions according to the instruction address sequence or jump logic.

[0018] For example, a machine instruction set refers to a set of all machine instructions in a program, including addition instructions, jump instructions, memory access instructions, etc. A type register refers to a register used to record the number of times a specific type of instruction is executed. Multiple types of registers may include: a jump instruction non-jump register, a jump instruction jump register, and an addition instruction register. Instruction execution types include: a jump instruction non-jump type, a jump instruction jump type, and an addition instruction type. Each type of register corresponds to an instruction execution type. For example, a jump instruction non-jump register corresponds to a jump instruction non-jump type, a jump instruction jump register corresponds to a jump instruction jump type, and an addition instruction register corresponds to an addition instruction type. Among them, each machine instruction has a unique memory address. For example, jne a0, a1, other_label, if a0 is not equal to a1, it jumps to other_label, and the jump instruction jump register is incremented by 1. If a0 is equal to a1, it does not jump, but is executed sequentially, and the jump instruction non-jump register is incremented by 1. For example, the addition instruction count register will increase by 1 each time an addition instruction such as add a0, a1, a2 is encountered.

[0019] For example, assume that the following data is collected during program execution: the target instruction address is 0002, the addition instruction register value is 10, and the jump instruction register value is 2. When executing at address 0002, the addition instruction has been executed 10 times and the jump instruction has been executed 2 times. It can be inferred that this program segment is mainly composed of addition instructions and has fewer jump instructions. Through the above steps, the target instruction address and the execution times of various types of instructions during program execution can be obtained in real time, providing data support for program analysis, performance optimization and debugging. This method is suitable for scenarios such as dynamic analysis, performance profiling and reverse engineering.

[0020] Step 102, determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed.

[0021] For example, the target instruction address refers to the memory address of the machine instruction currently being executed. During program execution, the processing device executes instructions according to the instruction address sequence or jump logic.

[0022] For example, during the execution of the program, the target instruction address is collected according to the target sampling interval, and the current target instruction address is sent to the server or storage. Two adjacent sending operations include: a first sending operation and a second sending operation. In the first sending operation, the target instruction address 0002 is obtained, and in the second sending operation, the target instruction address 0014 is obtained. According to the source code, all branches from address 0002 to address 0014 can be obtained.

[0023] For example, the instruction addresses include: 0000, 0002, 0004, 0006, 0008, 0010, 0012, 0014. The program corresponding to instruction address 0000 is while (1), the program corresponding to instruction address 0002 is if (key_down==1), the program corresponding to instruction address 0004 is a=b+c, ​​the program corresponding to instruction address 0008 is if (key_down==0), the program corresponding to instruction address 0010 is a=0, and the program corresponding to instruction address 0014 is nop(). Then, the branches from address 0002 to address 0014 include: key_down==1->a=b+c->nop() branch and key_down==0->a=0->nop() branch.

[0024] Step 103, calculating the change in the number of executions of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change.

[0025] For example, two adjacent sending operations include: a first sending operation and a second sending operation. In the first sending operation, the execution count of each type of register is obtained. For example, the execution count of the jump instruction non-jump count register is 100, the execution count of the jump instruction jump count register is 20, and the execution count of the addition instruction count register is 30. In the second sending operation, the execution count of each type of register is obtained. For example, the execution count of the jump instruction non-jump count register is 100, the execution count of the jump instruction jump count register is 20, and the execution count of the addition instruction count register is 31.

[0026] For example, the change in the number of executions of each type of register in the first sending operation and the second sending operation is calculated. The change in the number of executions of the jump instruction non-jump count register is 0, the change in the number of executions of the jump instruction jump count register is 0, and the change in the number of executions of the addition instruction count register is 1, which means that the addition instruction is executed once. Therefore, among all branches, the branch whose number of executions of the addition instruction increases by one is determined as the target branch.

[0027] Step 104: rebuild the machine instruction set according to the target branch.

[0028] For example, after obtaining the target branch, the relevant machine instructions are extracted and reorganized according to the path of the target branch. Specifically, the instructions in the target branch path are extracted in sequence to form a new instruction set. By determining the target branch and extracting the relevant machine instructions, the machine instruction set can be reconstructed. This method is suitable for scenarios such as program analysis, optimization, and debugging to help understand the execution path and logic of the program. The reconstructed instruction set can be used for further analysis or simulated execution.

[0029] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions of the respective corresponding instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of the machine instructions, when there are multiple branches between the target instruction addresses sent by two adjacent sending operations, the change in the execution times of different instruction execution types can be obtained according to the change in the execution times recorded in the multiple types of registers, so as to determine the target branch according to the change in the execution times of different instruction execution types. The present application records the change in the target instruction address and the execution times of different instruction execution types between two samplings, infers the actual target branch from various branches that may be executed due to jump instructions, etc., and reconstructs the instruction stream according to the target branch, which can improve the accuracy of instruction stream reconstruction.

[0030] Figure 2is a flowchart of the specific steps of a method for reconstructing an instruction stream provided in an embodiment of the present application, such as Figure 2 As shown, the method may include: Step 201, obtain the target instruction address sent by the processing device according to the target sampling interval, and the execution times recorded in each of the multiple types of registers; the target instruction address is the address of the target machine instruction currently being executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed.

[0031] This step may specifically refer to the above step 101, and will not be described in detail here.

[0032] Optionally, the target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

[0033] For example, the operating frequency of the processor, that is, the processor main frequency, can be 1,000,000 instructions per unit time, and the preset ratio can be 1 / 1000, and sampling can be performed at 1 / 1000 of the processor main frequency, that is, sampling is performed every 1,000 instructions executed. This fixed ratio sampling will increase in proportion as the processor main frequency increases, and will eventually be sampled after a certain number of instructions are executed, such as 1,000 instructions, while periodic sampling is based on a fixed time. As the main frequency increases, the number of instructions executed during this period will increase, which is uncertain and affects instruction tracing. Fixed ratio sampling can improve the accuracy of instruction tracing.

[0034] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register. Before step 201, the method further includes: Step A1, obtaining an updated value of the jump instruction non-jump count register, wherein the initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value; Step A2, obtaining an updated value of the jump instruction jump count register, wherein the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value; Step A3, obtaining the update value of the addition instruction count register, wherein the initial value of the addition instruction count register is obtained by setting the update value of the addition instruction count register to the initialization value.

[0035] For steps A1 to A3, the update value of the jump instruction non-jump count register may be the number of executions of the jump instruction non-jump type machine instruction recorded in the jump instruction non-jump count register after sampling according to the target sampling interval. The update value of the jump instruction non-jump count register may be the number of executions of the jump instruction jump type machine instruction recorded in the jump instruction jump count register after sampling according to the target sampling interval. The update value of the addition instruction count register may be the number of executions of the addition instruction type machine instruction recorded in the addition instruction count register after sampling according to the target sampling interval.

[0036] For example, after sampling at the target sampling interval each time, the current target instruction address and the execution times recorded in various types of registers can be sent to a host computer such as a server or storage through a common serial port or other peripherals, and the execution times recorded in various types of registers can be cleared to be used for statistics in the next sampling cycle. For example, the initialization value can be 0. The initial value of the jump instruction non-jump count register can be set to 0, the initial value of the jump instruction jump count register can be set to 0, and the initial value of the addition instruction count register can be set to 0.

[0037] Step 202, determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed.

[0038] This step may be specifically referred to as the above step 102, and will not be described in detail here.

[0039] Optionally, step 202 may specifically include: Sub-step 2021, parsing the source code to obtain a program execution graph; Sub-step 2022, traversing the program execution graph starting from the machine instruction corresponding to the first instruction address, if a jump instruction exists and a jump is performed, constructing a branch according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the target instruction address sent earliest in two adjacent sending operations; Sub-step 2023, if the jump instruction does not exist and a jump is performed, a branch is constructed according to a machine instruction corresponding to the next instruction address to be executed sequentially according to the current machine instruction; Sub-step 2024, until the machine instruction corresponding to the second instruction address is traversed, all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address are obtained; the second instruction address is the target instruction address sent latest in two adjacent sending operations.

[0040] For sub-steps 2021 to 2024, the instruction addresses include: 0000, 0002, 0004, 0006, 0008, 0010, 0012, and 0014. The program corresponding to instruction address 0000 is while (1), the program corresponding to instruction address 0002 is if (key_down==1), the program corresponding to instruction address 0004 is a=b+c, ​​the program corresponding to instruction address 0008 is if (key_down==0), the program corresponding to instruction address 0010 is a=0, and the program corresponding to instruction address 0014 is nop (). Taking the first instruction address as 0002 and the second instruction address as 0014 as an example, the program execution graph is traversed from the machine instruction corresponding to 0002. There is a jump instruction at 0002. If there is a jump, it jumps to the machine instruction corresponding to 0008, and constructs a branch from 0002 to 0008. If no jump is made at 0002, a branch from 0002 to the machine instruction corresponding to 0004 is constructed. This continues until the machine instruction corresponding to 0014 is traversed, and all branches from the machine instruction corresponding to 0002 to the machine instruction corresponding to 0014 are obtained.

[0041] For example, after the host computer receives the target instruction address and the execution times recorded in various types of registers, it will try to restore the exact instruction set. At this time, a directed graph is constructed based on the entire binary program, namely the program execution graph. Each node of the graph represents a conditional jump instruction, and each edge represents a sequence of instructions executed sequentially. When a jump instruction is encountered, a new node is created, pointing to the jump and no jump nodes respectively.

[0042] For example, based on the collected current target instruction address and the target instruction address of the next sampling point, two nodes in the program execution graph can be determined, and then all possible routes between the two nodes are traversed, the number of related instructions is counted, and compared with the data of the counting register sent by the processing device. If they are exactly the same, the current route is the route actually executed by the processor, and the accurate instruction stream reconstruction of the current sampling cycle is completed. When the instruction stream reconstruction is completed in each sampling cycle, a complete instruction stream traceability is formed.

[0043] Optionally, sub-step 2021 may specifically include: Sub-step 20211, parsing the source code to obtain a set of program instructions in the source code; Sub-step 20212, traversing the program instruction set, and creating nodes and edges of the program execution graph according to types of program instructions in the program instruction set; Sub-step 20213, until all the program instructions in the program instruction set are traversed to obtain the program execution graph.

[0044] For sub-steps 20211-20213, traverse the program instruction set and create nodes and edges of the program execution graph. Create an empty graph structure for storing nodes and edges. Traverse the instructions in the program instruction set one by one. For each instruction, use the current instruction address as a node in the graph. If the node already exists, skip creation. If the current instruction is executed sequentially, create an edge from the current node to the next instruction node. If the current instruction is a jump instruction, create an edge from the current node to the jump target address node. If the current instruction is a function call instruction, create an edge from the current node to the function entry node and record the return address. If the current instruction is a return instruction, create an edge from the current node to the return address node. After the traversal is completed, generate the program execution graph.

[0045] Step 203: determine the difference between the execution times of the machine instructions that the jump instructions do not jump to in two adjacent sending operations as the first difference.

[0046] For example, the number of execution times of the machine instructions that the jump instruction did not jump to is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction not jumping count register.

[0047] For example, if the instruction is a jump instruction and no jump occurs, the value of the jump instruction non-jump count register is added to the first preset value for update. Taking the first preset value as 1 as an example, if the instruction is a jump instruction and no jump occurs, the value of the jump instruction non-jump count register is added to 1.

[0048] For example, after performing the above judgment operation on each instruction within the target sampling interval, the value of the jump instruction non-jump count register is determined as the number of executions of the machine instruction that the jump instruction does not jump. The two adjacent sending operations include: a first sending operation and a second sending operation. In the first sending operation, the number of executions of the jump instruction non-jump count register is 100. In the second sending operation, the number of executions of the jump instruction non-jump count register is 110, and the first difference is 10.

[0049] Step 204: determine the difference between the execution times of the machine instructions jumped by the jump instructions in two adjacent sending operations as the second difference.

[0050] For example, the number of execution times of the machine instruction jumped by the jump instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction jump count register.

[0051] For example, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added to the first preset value for update. Taking the first preset value as 1 as an example, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added to 1.

[0052] For example, after performing the above judgment operation on each instruction within the target sampling interval, the value of the jump instruction jump count register is determined as the number of executions of the machine instruction to which the jump instruction jumps. The two adjacent sending operations include: a first sending operation and a second sending operation. In the first sending operation, the number of executions of the jump instruction jump count register is 20. In the second sending operation, the number of executions of the jump instruction jump count register is 25, and the second difference is 5.

[0053] Step 205: determine the difference between the execution times of the machine instructions of the addition instructions in two adjacent sending operations as a third difference.

[0054] For example, the number of executions of the machine instruction of the addition instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the addition instruction counting register.

[0055] For example, if the instruction is an addition instruction, the value of the addition instruction count register is updated by adding the first preset value. Taking the first preset value as 1 as an example, if the instruction is an addition instruction, the value of the addition instruction count register is updated by adding 1.

[0056] For example, after performing the above judgment operation on each instruction within the target sampling interval, the value of the addition instruction count register is determined as the number of executions of the machine instruction of the addition instruction. The two adjacent sending operations include: a first sending operation and a second sending operation. In the first sending operation, the number of executions of the addition instruction count register is 15. In the second sending operation, the number of executions of the addition instruction count register is 24, and the third difference is 9.

[0057] Step 206, use the first difference as the change in the number of executions of the machine instruction that the jump instruction does not jump to, the second difference as the change in the number of executions of the machine instruction that the jump instruction jumps to, and the third difference as the change in the number of executions of the machine instruction of the addition instruction.

[0058] For example, the first difference indicates the change in the number of executions of the machine instruction that the jump instruction did not jump to in two adjacent sending operations, the second difference indicates the change in the number of executions of the machine instruction that the jump instruction jumped to in two adjacent sending operations, and the third difference indicates the change in the number of executions of the machine instruction of the addition instruction in two adjacent sending operations. Taking the first difference as 10, the second difference as 5, and the third difference as 9 as an example, the machine instruction that the jump instruction did not jump to in two adjacent sending operations was executed 10 times, the machine instruction that the jump instruction jumped to was executed 5 times, and the machine instruction of the addition instruction was executed 9 times. After obtaining the change in the number of executions of the machine instruction that the jump instruction did not jump to, the change in the number of executions of the machine instruction that the jump instruction jumped to, and the change in the number of executions of the machine instruction of the addition instruction, the target branch can be determined from all branches based on these three changes, so that more accurate tracing can be achieved.

[0059] Step 207: Determine a target branch from all the branches according to the change.

[0060] This step may be specifically referred to as the above step 103, and will not be described in detail here.

[0061] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; each branch has a first change value of the number of executions of the jump instruction non-jump count register, a second change value of the number of executions of the jump instruction jump count register; a third change value of the number of executions of the addition instruction count register; the change includes: a first difference value of the number of executions of the jump instruction non-jump count register in two adjacent sending operations, a second difference value of the number of executions of the jump instruction jump count register; the third difference value of the number of executions of the addition instruction count register. Step 207 may specifically include: Sub-step 2071: if there is a branch among all the branches whose first change value is the same as the first difference value, whose second change value is the same as the second difference value, and whose third change value is the same as the third difference value, then the branch is determined as the target branch.

[0062] For step 2071, taking the first difference value as 10, the second difference value as 5, and the third difference value as 9 as an example, if there is a branch in which the first change value of the execution number of the jump instruction non-jump count register is 10, the second change value of the execution number of the jump instruction jump count register is 5, and the third change value of the execution number of the addition instruction count register is 9, then the branch is the target branch.

[0063] For example, if there are two branches from address 0002 to address 0014, one branch executes the operation a=b+c, ​​and the other branch executes the operation a=0. During the two sampling periods, the program was executed from 0002 to 0014, but there are two paths between 0002 and 0014, and it is impossible to find out which path was actually taken. This is where the addition counter is used. After analyzing the two data packets, it is found that the addition counter changes from 23 to 24, indicating that the program must have executed an addition instruction when it was executed from 0002 to 0014. By analyzing the program execution graph, it can be seen that only the branch a=b+c has an addition instruction, so it is inferred that the program executes the branch key_down==1->a=b+c->nop(), and this branch is the target branch.

[0064] Step 208: rebuild the machine instruction set according to the target branch.

[0065] This step may be specifically referred to as the above step 104, and will not be described in detail here.

[0066] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions of the respective corresponding instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of the machine instructions, when there are multiple branches between the target instruction addresses sent by two adjacent sending operations, the change in the execution times of different instruction execution types can be obtained according to the change in the execution times recorded in the multiple types of registers, so as to determine the target branch according to the change in the execution times of different instruction execution types. The present application records the change in the target instruction address and the execution times of different instruction execution types between two samplings, infers the actual target branch from various branches that may be executed due to jump instructions, etc., and reconstructs the instruction stream according to the target branch, which can improve the accuracy of instruction stream reconstruction.

[0067] Figure 3 It is a program execution graph provided in an embodiment of the present application, and the program execution graph is generated based on the following code: PC Code 0000while(1){ 0002if(key_down==1){ 0004a=b+c; 0006} 0008else{ 0010a=0; 0012} 0014nop() 0016} The execution logic of the above code is to execute the conditional statement first. If key_down==1, then execute a=b+c, ​​otherwise, execute a=0. After the conditional statement is executed, the nop() function is executed, and then the conditional statement and nop() function are executed repeatedly.

[0068] This step includes: Step S1, start; Step S2, determining whether the first variable key_down is equal to 1, if the first variable key_down is equal to 1, executing step S3, otherwise executing step S4; Step S3, adding the value of the second variable b to the value of the third variable c to obtain the value of the fourth variable a; Step S4, assigning the value of the fourth variable a to 0; Step S5, executing the first function nop().

[0069] Figure 4 is a block diagram of an instruction stream reconstruction device 30 provided in an embodiment of the present application, the device comprising: The acquisition module 301 is used to acquire the target instruction address sent by the processing device according to the target sampling interval, and the execution times recorded in each of the multiple types of registers; the target instruction address is the address of the target machine instruction currently executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed; A determination module 302, configured to determine all branches between two target instruction addresses according to a source code and target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; A calculation module 303, configured to calculate a change in the number of executions of each type of register in two adjacent sending operations, and determine a target branch from all the branches according to the change; The reconstruction module 304 is used to reconstruct the machine instruction set according to the target branch.

[0070] Optionally, the determining module includes: A parsing submodule, used to parse the source code to obtain a program execution graph; A first construction submodule is used to traverse the program execution graph starting from the machine instruction corresponding to the first instruction address, and if a jump instruction exists and a jump is performed, a branch is constructed according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the target instruction address sent earliest in two adjacent sending operations; A second construction submodule is used for constructing a branch according to a machine instruction corresponding to the next instruction address to be executed sequentially according to the current machine instruction if the jump instruction does not exist and a jump is performed; A generation submodule is used to traverse the machine instruction corresponding to the second instruction address and obtain all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address; the second instruction address is the target instruction address sent latest in two adjacent sending operations.

[0071] Optionally, the parsing submodule includes: A parsing unit, used to parse the source code to obtain a set of program instructions in the source code; A traversal unit, used for traversing the program instruction set, and creating nodes and edges of the program execution graph according to types of program instructions in the program instruction set; The generating unit is used to traverse all the program instructions in the program instruction set to obtain the program execution graph.

[0072] Optionally, the instruction execution type includes: a jump instruction non-jump type, a jump instruction jump type, and an addition instruction type; the execution times recorded in each of the multiple types of registers include: the execution times of a machine instruction of which the jump instruction does not jump, the execution times of a machine instruction of which the jump instruction jumps, and the execution times of a machine instruction of which the addition instruction is executed; The computing module comprises: A first determining submodule, configured to determine a difference in the number of executions of machine instructions to which jump instructions are not jumped in two adjacent sending operations as a first difference; A second determining submodule, configured to determine a difference in the number of executions of the machine instruction jumped by the jump instruction in two adjacent sending operations as a second difference; A third determining submodule, configured to determine a difference in the number of executions of machine instructions of the addition instruction in two adjacent sending operations as a third difference; The fourth determination submodule is used to use the first difference as the change in the number of executions of the machine instruction that the jump instruction does not jump to, the second difference as the change in the number of executions of the machine instruction that the jump instruction jumps to, and the third difference as the change in the number of executions of the machine instruction of the addition instruction.

[0073] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; each branch has a first change value of the number of executions of the jump instruction non-jump count register, a second change value of the number of executions of the jump instruction jump count register; and a third change value of the number of executions of the addition instruction count register; the change conditions include: a first difference value of the number of executions of the jump instruction non-jump count register in two adjacent sending operations, a second difference value of the number of executions of the jump instruction jump count register; and a third difference value of the number of executions of the addition instruction count register; The determining module comprises: The fifth determination submodule is used to determine a branch as the target branch if there is a branch among all the branches whose first change value is the same as the first difference value, the second change value is the same as the second difference value, and the third change value is the same as the third difference value.

[0074] Optionally, the target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

[0075] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register and an addition instruction count register; the execution times recorded in each of the multiple types of registers include: the execution times of machine instructions where the jump instruction does not jump, the execution times of machine instructions where the jump instruction jumps and the execution times of machine instructions where the addition instruction is executed; the execution times of machine instructions where the jump instruction does not jump is determined by performing a judgment operation on each instruction within the target sampling interval and based on the value of the jump instruction non-jump count register; the execution times of machine instructions where the jump instruction jumps is determined by performing a judgment operation on each instruction within the target sampling interval and based on the value of the jump instruction jump count register; the execution times of machine instructions where the addition instruction is executed is determined by performing a judgment operation on each instruction within the target sampling interval and based on the value of the addition instruction count register.

[0076] Optionally, the judgment operation includes: if the instruction is a jump instruction and no jump occurs, then the value of the jump instruction non-jump count register is updated by adding a first preset value; if the instruction is a jump instruction and a jump occurs, then the value of the jump instruction jump count register is updated by adding the first preset value; if the instruction is an addition instruction, then the value of the addition instruction count register is updated by adding the first preset value.

[0077] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; and the device further includes: A first acquisition module is used to acquire an updated value of the jump instruction non-jump count register, wherein the initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value; A second acquisition module is used to acquire an updated value of the jump instruction jump count register, where the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value; The third acquisition module is used to acquire the update value of the addition instruction count register, and the initial value of the addition instruction count register is obtained by setting the update value of the addition instruction count register to the initialization value.

[0078] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions of the respective corresponding instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of the machine instructions, when there are multiple branches between the target instruction addresses sent by two adjacent sending operations, the change in the execution times of different instruction execution types can be obtained according to the change in the execution times recorded in the multiple types of registers, so as to determine the target branch according to the change in the execution times of different instruction execution types. The present application records the change in the target instruction address and the execution times of different instruction execution types between two samplings, infers the actual target branch from various branches that may be executed due to jump instructions, etc., and reconstructs the instruction stream according to the target branch, which can improve the accuracy of instruction stream reconstruction.

[0079] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0080] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0081] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0082] An embodiment of the present application provides an instruction stream reconstruction device, including a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors to include methods for performing one or more of the above embodiments.

[0083] Figure 54 is a block diagram of an electronic device 400 provided in an embodiment of the present application. For example, the electronic device 400 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0084] Reference Figure 5 , the electronic device 400 may include one or more of the following components: a processing component 402 , a memory 404 , a power component 406 , a multimedia component 408 , an audio component 410 , an input / output (I / O) interface 412 , a sensor component 414 , and a communication component 416 .

[0085] The processing component 402 generally controls the overall operation of the electronic device 400, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 402 may include one or more modules to facilitate the interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate the interaction between the multimedia component 408 and the processing component 402.

[0086] The memory 404 is used to store various types of data to support the operation of the electronic device 400. Examples of such data include instructions for any application or method operating on the electronic device 400, contact data, phone book data, messages, pictures, multimedia, etc. The memory 404 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0087] The power supply component 406 provides power to the various components of the electronic device 400. The power supply component 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 400.

[0088] The multimedia component 408 includes a screen that provides an output interface between the electronic device 400 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 408 includes a front camera and / or a rear camera. When the electronic device 400 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0089] The audio component 410 is used to output and / or input audio signals. For example, the audio component 410 includes a microphone (MIC), and when the electronic device 400 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 404 or sent via the communication component 416. In some embodiments, the audio component 410 also includes a speaker for outputting audio signals.

[0090] The input / output interface 412 provides an interface between the processing component 402 and the peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0091] The sensor assembly 414 includes one or more sensors for providing various aspects of status assessment for the electronic device 400. For example, the sensor assembly 414 can detect the open / closed state of the electronic device 400, the relative positioning of the components, such as the display and keypad of the electronic device 400, and the sensor assembly 414 can also detect the position change of the electronic device 400 or a component of the electronic device 400, the presence or absence of contact between the user and the electronic device 400, the orientation or acceleration / deceleration of the electronic device 400, and the temperature change of the electronic device 400. The sensor assembly 414 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 414 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 414 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0092] The communication component 416 is used to facilitate wired or wireless communication between the electronic device 400 and other devices. The electronic device 400 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 416 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0093] In an exemplary embodiment, the electronic device 400 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement the methods provided in the embodiments of the present application.

[0094] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 404 including instructions, and the instructions can be executed by a processor 420 of an electronic device 400 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0095] Figure 6 is a block diagram of another electronic device 500 provided in an embodiment of the present application. For example, the electronic device 500 may be provided as a server. Figure 6 , the electronic device 500 includes a processing component 522, which further includes one or more processors, and a memory resource represented by a memory 532, for storing instructions that can be executed by the processing component 522, such as an application. The application stored in the memory 532 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 522 is configured to execute instructions to perform the method provided in the embodiment of the present application.

[0096] The electronic device 500 may further include a power supply component 526 configured to perform power management of the electronic device 500, a wired or wireless network interface 550 configured to connect the electronic device 500 to a network, and an input / output interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, FreeBSD TM or the like.

[0097] An embodiment of the present application further provides a computer program product, including a computer program, which implements the method described in the above embodiment when executed by a processor.

[0098] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0099] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for reconstructing an instruction stream, characterized in that: The method comprises: Obtaining a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is an address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times machine instructions of the corresponding instruction execution type are executed; Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; Calculating the change in the number of executions of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; The machine instruction set is rebuilt according to the target branch.

2. The method according to claim 1, characterized in that The step of determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations includes: Parsing the source code to obtain a program execution graph; Traversing the program execution graph from the machine instruction corresponding to the first instruction address, if a jump instruction exists and a jump is performed, constructing a branch according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the target instruction address sent earliest in two adjacent sending operations; If the jump instruction does not exist and a jump is performed, a branch is constructed according to a machine instruction corresponding to the next instruction address to be executed sequentially according to the current machine instruction; Until the machine instruction corresponding to the second instruction address is traversed, all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address are obtained; the second instruction address is the target instruction address sent latest in two adjacent sending operations.

3. The method according to claim 2, characterized in that The step of parsing the source code to obtain a program execution graph includes: Parsing the source code to obtain a set of program instructions in the source code; Traversing the program instruction set, and creating nodes and edges of the program execution graph according to types of program instructions in the program instruction set; Until all the program instructions in the program instruction set are traversed, the program execution graph is obtained.

4. The method according to claim 1, characterized in that The instruction execution types include: jump instruction non-jump type, jump instruction jump type and addition instruction type; the execution times recorded in the multiple types of registers include: the execution times of machine instructions of jump instruction non-jump, the execution times of machine instructions of jump instruction jump and the execution times of machine instructions of addition instruction; The calculating of the change in the number of execution times of each type of register in two adjacent sending operations includes: Determine the difference in the number of executions of the machine instruction to which the jump instruction does not jump in two adjacent sending operations as a first difference; Determine the difference in the number of executions of the machine instruction jumped by the jump instruction in two adjacent sending operations as a second difference; determining a difference between the execution times of the machine instructions of the addition instructions in two adjacent sending operations as a third difference; The first difference is used as the change in the number of executions of the machine instruction that the jump instruction does not jump to, the second difference is used as the change in the number of executions of the machine instruction that the jump instruction jumps to, and the third difference is used as the change in the number of executions of the machine instruction of the addition instruction.

5. The method according to claim 1, characterized in that The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; each branch has a first change value of the number of executions of the jump instruction non-jump count register, a second change value of the number of executions of the jump instruction jump count register; and a third change value of the number of executions of the addition instruction count register; the change conditions include: a first difference value of the number of executions of the jump instruction non-jump count register in two adjacent sending operations, a second difference value of the number of executions of the jump instruction jump count register; and a third difference value of the number of executions of the addition instruction count register; Determining a target branch from all the branches according to the change includes: If there is a branch among all the branches whose first change value is the same as the first difference value, whose second change value is the same as the second difference value, and whose third change value is the same as the third difference value, then the branch is determined as the target branch.

6. The method according to claim 1, characterized in that The target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

7. The method according to claim 1, characterized in that The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the execution times recorded in each of the multiple types of registers include: the execution times of machine instructions of which the jump instruction does not jump, the execution times of machine instructions of which the jump instruction jumps, and the execution times of machine instructions of the addition instruction; The number of executions of the machine instructions to which the jump instruction does not jump is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction non-jump count register; The number of executions of the machine instruction jumped by the jump instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction jump count register; The execution times of the machine instruction of the addition instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the addition instruction counting register.

8. The method according to claim 7, characterized in that The judging operation includes: If the instruction is a jump instruction and no jump occurs, then the value of the jump instruction non-jump count register is added with a first preset value for updating; If the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added to the first preset value for updating; If the instruction is an addition instruction, the value of the addition instruction counting register is added to the first preset value for updating.

9. The method according to claim 1, characterized in that: The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the method further includes: Obtaining an updated value of the jump instruction non-jump count register, wherein the initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value; Obtaining an updated value of the jump instruction jump count register, wherein the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value; An updated value of the addition instruction count register is obtained, wherein the initial value of the addition instruction count register is obtained by setting the updated value of the addition instruction count register to the initialization value.

10. A device for reconstructing an instruction stream, characterized in that: The device comprises: An acquisition module is used to acquire a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; and the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed; A determination module, used to determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; A calculation module, used for calculating the change of the execution times of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; A reconstruction module is used to reconstruct the machine instruction set according to the target branch.

11. An electronic device, characterized in that: The invention comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the instruction stream reconstruction method as claimed in any one of claims 1 to 9.

12. A readable storage medium, characterized in that: The readable storage medium stores a program or an instruction, and when the program or the instruction is executed by a processor, the steps of the instruction stream reconstruction method according to any one of claims 1 to 9 are implemented.

Images