Method, apparatus, electronic device, and readable storage medium for reconstructing instruction stream

Abstract

The present application provides a method, apparatus, electronic device, and readable storage medium for reconstructing an instruction stream, including: obtaining a target instruction address sent by a processing device at a target sampling interval, and the execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times that machine instructions of the corresponding instruction execution type have been executed. Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent in two adjacent sending operations; the source code records the machine instructions to be executed, calculate the change in the execution times of each type of register in two adjacent sending operations, and determine a target branch from all branches according to the change situation. Reconstruct the machine instruction set according to the target branch, and the instruction stream can be accurately restored.

Description

Technical Field

[0001] This application relates to the field of computer technologies, and in particular, to a method, apparatus, electronic device, and computer-readable storage medium for reconstructing an instruction stream. Background Art

[0002] The reconstruction of an instruction stream is a core step in binary program analysis, which provides a basis for understanding program behavior, restoring control flow, supporting reverse engineering, detecting malicious code, etc. Whether it is security research, software debugging, or performance optimization, the reconstruction of an instruction stream is an indispensable technical means.

[0003] Related technologies obtain the value of the program counter (PC) from the program counter register at regular intervals through timer interrupts or high-precision timers, and then upload the PC value to a host computer, that is, a server or a storage device. Then, the host computer reconstructs the instruction stream based on the PC value.

[0004] However, the method for reconstructing the instruction stream proposed by related technologies can only roughly analyze by counting the executed PCs and cannot accurately restore the instruction stream. Summary of the Invention

[0005] Embodiments of this application provide a method, apparatus, electronic device, and computer-readable storage medium for reconstructing an instruction stream to solve the problems in related technologies.

[0006] In a first aspect, embodiments of this application provide a method for reconstructing an instruction stream. The method includes:

[0007] Obtaining a target instruction address sent by a processing device at a target sampling interval, and the execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times that the machine instructions of the corresponding instruction execution type are executed;

[0008] Determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent in two adjacent sending operations; the source code records the machine instructions to be executed;

[0009] Calculating the change in the execution times of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change;

[0010] Reconstructing the machine instruction set according to the target branch.

[0011] In a second aspect, embodiments of this application provide an apparatus for reconstructing an instruction stream. The apparatus includes:

[0012] An acquisition module, configured to acquire a target instruction address sent by a processing device at a target sampling interval, and the execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times that machine instructions of the corresponding instruction execution type are executed.

[0013] A determination module, configured to determine all branches between two target instruction addresses according to a source code and the target instruction addresses sent in two adjacent transmission operations; the source code records the machine instructions to be executed.

[0014] A calculation module, configured to calculate the change in the execution times of each type of register in two adjacent transmission operations, and determine a target branch from all the branches according to the change.

[0015] A reconstruction module, configured to reconstruct the machine instruction set according to the target branch.

[0016] In a third aspect, an embodiment of the present application further provides an electronic device, including a processor; and a memory for storing executable instructions of the processor; wherein, the processor is configured to execute the instructions to implement the method in the first aspect.

[0017] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enabling the electronic device to execute the method in the first aspect.

[0018] In an embodiment of the present application, the target instruction address of the target machine instruction currently being executed in the machine instruction set sent by the processing device at the target sampling interval is acquired, and the execution times of the machine instructions of the corresponding instruction execution type recorded in each of multiple types of registers are acquired. According to the source code recording the machine instructions to be executed and the target instruction addresses sent in two adjacent transmission operations, all branches between the two target instruction addresses are determined, the change in the execution times of each type of register in the two adjacent transmission operations is calculated, and according to the change, a target branch is determined from all the branches, and the machine instruction set is reconstructed according to the target branch. Since multiple types of registers are used to record the execution times of the machine instructions of their respective corresponding instruction execution types, when there are multiple branches, the target branch can be determined according to the change in the execution times recorded in each of the multiple types of registers, which can improve the accuracy of instruction stream reconstruction.

[0019] The above description is only an overview of the technical solution of the present application. In order to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically gives the specific implementation manners of the present application. Brief Description of the Drawings

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0021] Figure 1 is a flowchart of the steps of a method for reconstructing an instruction stream provided by an embodiment of the present application;

[0022] Figure 2 is a specific flowchart of the steps of a method for reconstructing an instruction stream provided by an embodiment of the present application;

[0023] Figure 3 is a program execution diagram provided by an embodiment of the present application;

[0024] Figure 4 is a block diagram of an apparatus for reconstructing an instruction stream provided by an embodiment of the present application;

[0025] Figure 5 is a block diagram of an electronic device provided by an embodiment of the present application;

[0026] Figure 6 is a block diagram of another electronic device provided by an embodiment of the present application. Detailed Description of the Preferred Embodiments

[0027] The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts belong to the scope of protection of the present application.

[0028] The terms "first", "second", etc. in the description and claims of this application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of this application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are usually of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the description and claims is used to describe the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. In the embodiments of this application, the term "multiple" means two or more, and other quantifiers are similar.

[0029] Figure 1 is a step flowchart of a method for reconstructing an instruction stream provided by an embodiment of this application, as Figure 1 shown, the method may include:

[0030] Step 101, obtain the target instruction address sent by the processing device according to the target sampling interval, and the execution times recorded in each of multiple types of registers; the target instruction address is the address of the target machine instruction currently being executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instructions of the corresponding instruction execution type are executed.

[0031] Exemplarily, the processing device may be a hardware device that executes machine instructions. For example, a central processing unit (CPU, Central Processing Unit), a graphics processing unit (GPU, Graphics Processing Unit), or other processors, or it may also be a general serial port or other peripherals. The target sampling interval refers to a fixed time interval or instruction interval for collecting machine instructions during program execution. For example, data is collected every 1000 machine instructions. The target instruction address refers to the memory address of the machine instruction currently being executed. During program execution, the processing device executes instructions in the order of the instruction addresses or according to the jump logic.

[0032] Exemplarily, a machine instruction set refers to the set of all machine instructions in a program, including addition instructions, jump instructions, memory access instructions, etc. A type register refers to a register used to record the execution count of a specific type of instruction. Multiple types of registers can include: a non-jump register for jump instructions, a jump register for jump instructions, and an addition instruction register. Instruction execution types include: non-jump type for jump instructions, jump type for jump instructions, and addition instruction type. Each type of register corresponds to an instruction execution type. For example, the non-jump register for jump instructions corresponds to the non-jump type for jump instructions, the jump register for jump instructions corresponds to the jump type for jump instructions, and the addition instruction register corresponds to the addition instruction type. Among them, each machine instruction has a unique memory address. For example, for jne a0, a1, other_label, if a0 is not equal to a1, then jump to other_label, and at the same time, the jump register for jump instructions is incremented by 1. If a0 is equal to a1, then do not jump but execute sequentially, and at the same time, the non-jump register for jump instructions is incremented by 1. Another example is the addition instruction count register. Every time an addition instruction like add a0, a1, a2 is encountered, the addition count register is incremented by 1.

[0033] Exemplarily, assume the following data is collected during program execution: the target instruction address is 0002, the value of the addition instruction register is 10, and the value of the jump instruction register is 2. Then when executing at address 0002, the addition instruction has been executed 10 times, and the jump instruction has been executed 2 times. It can be inferred that this program segment mainly consists of addition instructions and has fewer jump instructions. Through the above steps, the target instruction address and the execution counts of various types of instructions during program execution can be obtained in real time, providing data support for program analysis, performance optimization, and debugging. This method is applicable to scenarios such as dynamic analysis, performance profiling, and reverse engineering.

[0034] Step 102: Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent in two adjacent send operations; the source code records the machine instructions to be executed.

[0035] Exemplarily, the target instruction address refers to the memory address of the machine instruction currently being executed. During program execution, the processing device executes instructions according to the instruction address sequence or jump logic.

[0036] Exemplarily, during program execution, the target instruction address is collected at a target sampling interval and sent to the server or memory. Two adjacent send operations include: the first send operation and the second send operation. In the first send operation, the target instruction address 0002 is obtained. In the second send operation, the target instruction address 0014 is obtained. All branches from address 0002 to address 0014 can be obtained from the source code.

[0037] Exemplarily, the instruction addresses include: 0000, 0002, 0004, 0006, 0008, 0010, 0012, 0014. Among them, the program corresponding to the instruction address 0000 is while(1), the program corresponding to the instruction address 0002 is if(key_down == 1), the program corresponding to the instruction address 0004 is a = b + c, the program corresponding to the instruction address 0008 is if(key_down == 0), the program corresponding to the instruction address 0010 is a = 0, and the program corresponding to the instruction address 0014 is nop(). Then, the branches from address 0002 to address 0014 include: the key_down == 1 -> a = b + c -> nop() branch and the key_down == 0 -> a = 0 -> nop() branch.

[0038] Step 103: Calculate the change in the execution count of each type of register in two adjacent send operations, and determine a target branch from all the branches according to the change.

[0039] Exemplarily, two adjacent send operations include: the first send operation and the second send operation. In the first send operation, obtain the execution count of each type of register. For example, the execution count of the non-jump count register of the jump instruction is 100, the execution count of the jump count register of the jump instruction is 20, and the execution count of the addition instruction count register is 30. In the second send operation, obtain the execution count of each type of register. For example, the execution count of the non-jump count register of the jump instruction is 100, the execution count of the jump count register of the jump instruction is 20, and the execution count of the addition instruction count register is 31.

[0040] Exemplarily, calculate the change in the execution count of each type of register in the first send operation and the second send operation. The change in the execution count of the non-jump count register of the jump instruction is 0, the change in the execution count of the jump count register of the jump instruction is 0, and the change in the execution count of the addition instruction count register is 1, which indicates that the addition instruction has been executed once. Thus, among all the branches, the branch where the execution count of the addition instruction increases by one is determined as the target branch.

[0041] Step 104: Reconstruct the machine instruction set according to the target branch.

[0042] Exemplarily, after obtaining the target branch, relevant machine instructions are extracted and reorganized according to the path of the target branch. Specifically, the instructions in the target branch path are extracted in order to form a new instruction set. By determining the target branch and extracting relevant machine instructions, the machine instruction set can be reconstructed. This method is applicable to scenarios such as program analysis, optimization, and debugging, and helps to understand the execution path and logic of the program. The reconstructed instruction set can be used for further analysis or simulation execution.

[0043] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions corresponding to their respective instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of the machine instructions, when there are multiple branches between the target instruction addresses sent in two adjacent send operations, the change situation of the execution times of different instruction execution types can be obtained according to the change situation of the execution times recorded in the multiple types of registers respectively, so as to determine the target branch according to the change situation of the execution times of different instruction execution types. By recording the target instruction addresses and the change situation of the execution times of different instruction execution types between two samplings, the actual target branch taken can be inferred from various branches that may be executed due to jump instructions, etc. Reconstructing the instruction stream according to the target branch can improve the accuracy of instruction stream reconstruction.

[0044] Figure 2 is a specific step flowchart of a method for reconstructing an instruction stream provided by an embodiment of the present application. As Figure 2 shown, the method may include:

[0045] Step 201, obtain the target instruction address sent by the processing device at a target sampling interval, and the execution times recorded in multiple types of registers respectively; the target instruction address is the address of the target machine instruction currently being executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instructions of the corresponding instruction execution type have been executed.

[0046] This step can specifically refer to the above step 101 and will not be elaborated here.

[0047] Optionally, the target sampling interval is obtained by multiplying the working frequency of the processor by a preset ratio.

[0048] Exemplarily, the operating frequency of the processor, i.e., the main frequency of the processor, can be to process 1,000,000 instructions per unit time. The preset ratio can be 1 / 1000. Sampling can be performed at 1 / 1000 of the main frequency of the processor, that is, sampling is performed every 1000 instructions executed. This fixed-ratio sampling will increase in proportion with the increase of the main frequency of the processor, and finally sampling will be performed after a certain number of instructions are executed, such as 1000 instructions. Periodic sampling, however, is based on a fixed time. Then, with the increase of the main frequency, the number of instructions executed during this period will increase, which has uncertainty and affects instruction tracing. Fixed-ratio sampling can improve the accuracy of instruction tracing.

[0049] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register. Before step 201, the method further includes:

[0050] Step A1, obtaining an updated value of the jump instruction non-jump count register. The initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value;

[0051] Step A2, obtaining an updated value of the jump instruction jump count register. The initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value;

[0052] Step A3, obtaining an updated value of the addition instruction count register. The initial value of the addition instruction count register is obtained by setting the updated value of the addition instruction count register to the initialization value.

[0053] For steps A1 - A3, the updated value of the jump instruction non-jump count register can be the number of executions of the machine instructions of the jump instruction non-jump type recorded in the jump instruction non-jump count register after sampling at the target sampling interval. The updated value of the jump instruction jump count register can be the number of executions of the machine instructions of the jump instruction jump type recorded in the jump instruction jump count register after sampling at the target sampling interval. The updated value of the addition instruction count register can be the number of executions of the machine instructions of the addition instruction type recorded in the addition instruction count register after sampling at the target sampling interval.

[0054] Exemplarily, after each sampling according to the target sampling interval, the current target instruction address and the execution times recorded in various types of registers can be sent to an upper computer such as a server or a memory through a common peripheral such as a serial port. At the same time, the execution times recorded in various types of registers are cleared for statistics in the next sampling cycle. For example, the initial value can be 0. The initial value of the non-jump count register of the jump instruction can be set to 0, the initial value of the jump count register of the jump instruction can be set to 0, and the initial value of the addition instruction count register can be set to 0.

[0055] Step 202: Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent in two adjacent sending operations; the source code records the machine instructions to be executed.

[0056] This step can specifically refer to the above step 102 and will not be elaborated here.

[0057] Optionally, step 202 may specifically include:

[0058] Sub-step 2021: Parse the source code to obtain a program execution graph;

[0059] Sub-step 2022: Traverse the program execution graph starting from the machine instruction corresponding to the first instruction address. If there is a jump instruction and a jump is made, construct a branch according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the earliest sent target instruction address in two adjacent sending operations;

[0060] Sub-step 2023: If there is no such jump instruction and a jump is made, construct a branch according to the machine instruction corresponding to the next instruction address executed in sequence of the current machine instruction;

[0061] Sub-step 2024: Until the machine instruction corresponding to the second instruction address is traversed, obtain all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address; the second instruction address is the latest sent target instruction address in two adjacent sending operations.

[0062] For sub-steps 2021 - 2024, the instruction addresses include: 0000, 0002, 0004, 0006, 0008, 0010, 0012, 0014. Among them, the program corresponding to the instruction address 0000 is while(1), the program corresponding to the instruction address 0002 is if(key_down == 1), the program corresponding to the instruction address 0004 is a = b + c, the program corresponding to the instruction address 0008 is if(key_down == 0), the program corresponding to the instruction address 0010 is a = 0, and the program corresponding to the instruction address 0014 is nop(). Taking the first instruction address as 0002 and the second instruction address as 0014 as an example, starting from the machine instruction corresponding to 0002, traverse the program execution graph. There is a jump instruction at 0002. If there is a jump, then jump to the machine instruction corresponding to 0008, and construct a branch from the machine instruction corresponding to 0002 to the machine instruction corresponding to 0008. If there is no jump at 0002, then construct a branch from the machine instruction corresponding to 0002 to the machine instruction corresponding to 0004. Until the machine instruction corresponding to 0014 is traversed, all branches from the machine instruction corresponding to 0002 to the machine instruction corresponding to 0014 are obtained.

[0063] Exemplarily, after the host computer receives the target instruction address and the execution times recorded in various types of registers respectively, it will attempt to restore the exact instruction set. At this time, a directed graph, that is, a program execution graph, is constructed based on the entire binary program. Each node of the graph represents a conditional jump instruction, and each edge represents a sequence of instructions executed sequentially. When a jump instruction is encountered, a new node is created, pointing to the jump and non-jump nodes respectively.

[0064] Exemplarily, according to the currently collected target instruction address and the target instruction address of the next sampling point, two nodes in the program execution graph can be determined, and then all possible routes between these two nodes are traversed, the times of relevant instructions are counted, and compared with the data in the count register sent by the processing device. If they are exactly the same, then the current route is the actual execution route of the processor, and the exact instruction stream reconstruction of the current sampling period is completed. When the instruction stream reconstruction is completed for each sampling period, a complete instruction stream traceability is formed.

[0065] Optionally, sub-step 2021 may specifically include:

[0066] Sub-step 20211, parse the source code to obtain the program instruction set in the source code;

[0067] Sub-step 20212, traverse the program instruction set, and create nodes and edges of the program execution graph according to the types of program instructions in the program instruction set;

[0068] Sub-step 20213, until all the program instructions in the program instruction set are traversed, and the program execution graph is obtained.

[0069] For sub-steps 20211 - 20213, traverse the program instruction set to create the nodes and edges of the program execution graph. Create an empty graph structure to store the nodes and edges. Traverse the instructions in the program instruction set one by one. For each instruction, use the current instruction address as a node in the graph. If the node already exists, skip the creation. If the current instruction is a sequential execution instruction, create an edge from the current node to the next instruction node. If the current instruction is a jump instruction, create an edge from the current node to the jump target address node. If the current instruction is a function call instruction, create an edge from the current node to the function entry node and record the return address. If the current instruction is a return instruction, create an edge from the current node to the return address node. After the traversal, generate the program execution graph.

[0070] Step 203, determine the difference between the execution counts of the machine instructions that are not jumped by the jump instruction in two adjacent send operations as the first difference.

[0071] Exemplarily, the execution count of the machine instruction that is not jumped by the jump instruction is determined by judging each instruction within the target sampling interval and according to the value of the jump instruction non-jump count register.

[0072] Exemplarily, if the instruction is a jump instruction and no jump occurs, update the value of the jump instruction non-jump count register by adding a first preset value. Taking the first preset value as 1, if the instruction is a jump instruction and no jump occurs, add 1 to the value of the jump instruction non-jump count register.

[0073] Exemplarily, after performing the above judgment operation on each instruction within the target sampling interval, determine the value of the jump instruction non-jump count register as the execution count of the machine instruction that is not jumped by the jump instruction. Taking two adjacent send operations including: the first send operation and the second send operation. In the first send operation, the execution count of the jump instruction non-jump count register is 100. In the second send operation, the execution count of the jump instruction non-jump count register is 110, then the first difference is 10.

[0074] Step 204, determine the difference between the execution counts of the machine instructions that are jumped by the jump instruction in two adjacent send operations as the second difference.

[0075] Exemplarily, the execution count of the machine instruction that is jumped by the jump instruction is determined by judging each instruction within the target sampling interval and according to the value of the jump instruction jump count register.

[0076] Exemplarily, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is updated by adding the first preset value. Taking the first preset value as 1 as an example, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is incremented by 1.

[0077] Exemplarily, after performing the above determination operation on each instruction within the target sampling interval, the value of the jump instruction jump count register is determined as the execution count of the machine instruction to which the jump instruction jumps. Taking two adjacent transmission operations as an example: the first transmission operation and the second transmission operation. In the first transmission operation, the execution count of the jump instruction jump count register is 20. In the second transmission operation, the execution count of the jump instruction jump count register is 25, so the second difference is 5.

[0078] Step 205, determine the difference between the execution counts of the machine instructions of the addition instruction in two adjacent transmission operations as the third difference.

[0079] Exemplarily, the execution count of the machine instruction of the addition instruction is determined based on the value of the addition instruction count register after performing the determination operation on each instruction within the target sampling interval.

[0080] Exemplarily, if the instruction is an addition instruction, the value of the addition instruction count register is updated by adding the first preset value. Taking the first preset value as 1 as an example, if the instruction is an addition instruction, the value of the addition instruction count register is incremented by 1.

[0081] Exemplarily, after performing the above determination operation on each instruction within the target sampling interval, the value of the addition instruction count register is determined as the execution count of the machine instruction of the addition instruction. Taking two adjacent transmission operations as an example: the first transmission operation and the second transmission operation. In the first transmission operation, the execution count of the addition instruction count register is 15. In the second transmission operation, the execution count of the addition instruction count register is 24, so the third difference is 9.

[0082] Step 206, use the first difference as the change in the execution count of the machine instruction when the jump instruction does not jump, the second difference as the change in the execution count of the machine instruction when the jump instruction jumps, and the third difference as the change in the execution count of the machine instruction of the addition instruction.

[0083] Exemplarily, the first difference indicates the change in the number of executed machine instructions of the jump instruction that did not jump in two adjacent transmission operations, the second difference indicates the change in the number of executed machine instructions of the jump instruction that jumped in two adjacent transmission operations, and the third difference indicates the change in the number of executed machine instructions of the addition instruction in two adjacent transmission operations. Taking the first difference as 10, the second difference as 5, and the third difference as 9 as an example, in two adjacent transmission operations, the machine instructions of the jump instruction that did not jump were executed 10 times, the machine instructions of the jump instruction that jumped were executed 5 times, and the machine instructions of the addition instruction were executed 9 times. After obtaining the change in the number of executed machine instructions of the jump instruction that did not jump, the change in the number of executed machine instructions of the jump instruction that jumped, and the change in the number of executed machine instructions of the addition instruction, the target branch can be determined from all branches according to these three changes, enabling more accurate tracing.

[0084] Step 207, determine the target branch from all the branches according to the change.

[0085] This step can specifically refer to the above-mentioned step 103 and will not be elaborated here.

[0086] Optionally, the multiple types of registers include: a non-jump count register for the jump instruction, a jump count register for the jump instruction, and an addition instruction count register; each branch has a first change value of the number of executions of the non-jump count register for the jump instruction, a second change value of the number of executions of the jump count register for the jump instruction; a third change value of the number of executions of the addition instruction count register; the change includes: the first difference in the number of executions of the non-jump count register for the jump instruction in two adjacent transmission operations, the second difference in the number of executions of the jump count register for the jump instruction; the third difference in the number of executions of the addition instruction count register. Step 207 may specifically include:

[0087] Sub-step 2071, if, among all the branches, there is a branch where the first change value is the same as the first difference, the second change value is the same as the second difference, and the third change value is the same as the third difference, then determine the branch as the target branch.

[0088] Regarding step 2071, taking the first difference as 10, the second difference as 5, and the third difference as 9 as an example, if there is a branch where the first change value of the number of executions of the non-jump count register for the jump instruction is 10, the second change value of the number of executions of the jump count register for the jump instruction is 5, and the third change value of the number of executions of the addition instruction count register is 9, then this branch is the target branch.

[0089] For example, if there are two branches from address 0002 to address 0014, one branch executes the operation a = b + c, and the other branch executes the operation a = 0. During two samplings, the program executes from 0002 to 0014. However, there are two paths between 0002 and 0014, and it is impossible to determine which path is actually taken. At this time, an addition counter is needed. By analyzing the two data packets, it is found that the addition counter changes from 23 to 24, indicating that during the execution of the program from 0002 to 0014, an addition instruction must have been executed. By analyzing the program execution graph, it can be known that only the branch a = b + c has an addition instruction. Therefore, it is inferred that the program executes the branch key_down == 1 -> a = b + c -> nop(), and this branch is the target branch.

[0090] Step 208, reconstruct the set of machine instructions according to the target branch.

[0091] This step can specifically refer to the above step 104 and will not be elaborated here.

[0092] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions corresponding to their respective instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of machine instructions, when there are multiple branches between the target instruction addresses sent in two adjacent send operations, the change situation of the execution times of different instruction execution types can be obtained according to the change situation of the execution times recorded in multiple types of registers respectively, so as to determine the target branch according to the change situation of the execution times of different instruction execution types. By recording the target instruction addresses and the change situation of the execution times of different instruction execution types between two samplings, the actual target branch taken is inferred from various branches that may be executed due to jump instructions, etc. Reconstructing the instruction stream according to the target branch can improve the accuracy of instruction stream reconstruction.

[0093] Figure 3 It is a program execution graph provided by an embodiment of the present application, and this program execution graph is generated based on the following code:

[0094] PC code

[0095] 0000while (1) {

[0096] 0002if (key_down == 1) {

[0097] 0004a = b + c;

[0098] 0006}

[0099] 0008else {

[0100] 0010a = 0;

[0101] 0012}

[0102] 0014nop();

[0103] 0016}

[0104] The execution logic of the above code is that first, the conditional statement is executed. If key_down == 1, then a = b + c is executed; otherwise, a = 0 is executed. After the execution of the conditional statement ends, the nop() function is executed, and then the conditional statement and the nop() function are executed repeatedly.

[0105] This step includes:

[0106] Step S1, start;

[0107] Step S2, determine whether the first variable key_down is equal to 1. If the first variable key_down is equal to 1, then execute Step S3; otherwise, execute Step S4;

[0108] Step S3, add the value of the second variable b to the value of the third variable c to obtain the value of the fourth variable a;

[0109] Step S4, assign the value of the fourth variable a to 0;

[0110] Step S5, execute the first function nop().

[0111] Figure 4 It is a block diagram of a reconstruction device 30 for an instruction stream provided by an embodiment of the present application. The device includes:

[0112] An acquisition module 301, configured to acquire the target instruction address sent by the processing device according to the target sampling interval, and the execution times recorded in each of multiple types of registers; the target instruction address is the address of the target machine instruction currently being executed in the machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times the machine instructions of the corresponding instruction execution type are executed;

[0113] A determination module 302, configured to determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent in two adjacent send operations; the source code records the machine instructions to be executed;

[0114] A calculation module 303, configured to calculate the change situation of the execution times of each type of register in two adjacent send operations, and determine the target branch from all the branches according to the change situation;

[0115] A reconstruction module 304, configured to reconstruct the machine instruction set according to the target branch.

[0116] Optionally, the determining module includes:

[0117] A parsing sub-module, configured to parse the source code to obtain a program execution graph;

[0118] A first construction sub-module, configured to traverse the program execution graph starting from the machine instruction corresponding to the first instruction address. If there is a jump instruction and a jump is made, a branch is constructed according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the target instruction address that is sent earliest in two adjacent send operations;

[0119] A second construction sub-module, configured to, if there is no such jump instruction and a jump is made, construct a branch according to the machine instruction corresponding to the next instruction address in the sequential execution of the current machine instruction;

[0120] A generation sub-module, configured to, until the machine instruction corresponding to the second instruction address is traversed, obtain all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address; the second instruction address is the target instruction address that is sent latest in two adjacent send operations.

[0121] Optionally, the parsing sub-module includes:

[0122] A parsing unit, configured to parse the source code to obtain a set of program instructions in the source code;

[0123] A traversing unit, configured to traverse the set of program instructions and create nodes and edges of the program execution graph according to the types of the program instructions in the set of program instructions;

[0124] A generation unit, configured to, until all the program instructions in the set of program instructions are traversed, obtain the program execution graph.

[0125] Optionally, the instruction execution types include: a type where a jump instruction does not jump, a type where a jump instruction jumps, and an addition instruction type; the execution times recorded in each of the multiple types of registers include: the execution times of machine instructions where a jump instruction does not jump, the execution times of machine instructions where a jump instruction jumps, and the execution times of machine instructions of addition instructions;

[0126] The calculation module includes:

[0127] A first determination sub-module, configured to determine the difference between the execution times of machine instructions where a jump instruction does not jump in two adjacent send operations as a first difference;

[0128] A second determination sub-module, configured to determine a difference between the execution counts of the machine instructions jumped by the jump instruction in two adjacent transmission operations as a second difference;

[0129] A third determination sub-module, configured to determine a difference between the execution counts of the machine instructions of the addition instruction in two adjacent transmission operations as a third difference;

[0130] A fourth determination sub-module, configured to use the first difference as the change in the execution count of the machine instruction that the jump instruction does not jump, the second difference as the change in the execution count of the machine instruction that the jump instruction jumps, and the third difference as the change in the execution count of the machine instruction of the addition instruction.

[0131] Optionally, the multiple types of registers include: a non-jump count register for the jump instruction, a jump count register for the jump instruction, and an addition instruction count register; each branch has a first change value of the execution count of the non-jump count register for the jump instruction, a second change value of the execution count of the jump count register for the jump instruction; a third change value of the execution count of the addition instruction count register; the change includes: a first difference in the execution count of the non-jump count register for the jump instruction in two adjacent transmission operations, a second difference in the execution count of the jump count register for the jump instruction; a third difference in the execution count of the addition instruction count register;

[0132] The determination module includes:

[0133] A fifth determination sub-module, configured to, if there is a branch among all branches where the first change value is the same as the first difference, the second change value is the same as the second difference, and the third change value is the same as the third difference, determine the branch as the target branch.

[0134] Optionally, the target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

[0135] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the execution counts respectively recorded in the multiple types of registers include: the execution count of machine instructions for which a jump instruction does not jump, the execution count of machine instructions for which a jump instruction jumps, and the execution count of machine instructions for an addition instruction; the execution count of machine instructions for which a jump instruction does not jump is determined by performing a judgment operation on each instruction within the target sampling interval according to the value of the jump instruction non-jump count register; the execution count of machine instructions for which a jump instruction jumps is determined by performing a judgment operation on each instruction within the target sampling interval according to the value of the jump instruction jump count register; the execution count of machine instructions for an addition instruction is determined by performing a judgment operation on each instruction within the target sampling interval according to the value of the addition instruction count register.

[0136] Optionally, the judgment operation includes: if the instruction is a jump instruction and no jump occurs, updating the value of the jump instruction non-jump count register by adding a first preset value; if the instruction is a jump instruction and a jump occurs, updating the value of the jump instruction jump count register by adding the first preset value; if the instruction is an addition instruction, updating the value of the addition instruction count register by adding the first preset value.

[0137] Optionally, the multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the apparatus further includes:

[0138] a first acquisition module, configured to acquire an updated value of the jump instruction non-jump count register, where the initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value;

[0139] a second acquisition module, configured to acquire an updated value of the jump instruction jump count register, where the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value;

[0140] a third acquisition module, configured to acquire an updated value of the addition instruction count register, where the initial value of the addition instruction count register is obtained by setting the updated value of the addition instruction count register to the initialization value.

[0141] In summary, in the embodiments of the present application, multiple types of registers are used to record the execution times of machine instructions corresponding to their respective instruction execution types. Since the execution times of machine instructions of different instruction execution types can more accurately reflect the actual execution behavior of machine instructions, when there are multiple branches between the target instruction addresses sent in two adjacent sending operations, the change situation of the execution times of different instruction execution types can be obtained according to the change situation of the execution times recorded in multiple types of registers respectively, so as to determine the target branch according to the change situation of the execution times of different instruction execution types. By recording the target instruction address and the change of the execution times of different instruction execution types between two samplings, the actual target branch taken can be inferred from various branches that may be executed due to jump instructions, etc., and the instruction stream can be reconstructed according to the target branch, which can improve the accuracy of instruction stream reconstruction.

[0142] For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments.

[0143] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. The same or similar parts between each embodiment can be referred to each other.

[0144] Regarding the device in the above embodiments, the specific manners in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0145] The embodiments of the present application provide a device for reconstructing an instruction stream, including a memory and more than one program, where the more than one program is stored in the memory and is configured to be executed by more than one processor. The more than one program includes means for performing the method described in the above one or more embodiments.

[0146] Figure 5 is a block diagram of an electronic device 400 provided by the embodiments of the present application. For example, the electronic device 400 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0147] Referring to Figure 5 , the electronic device 400 may include one or more of the following components: a processing component 402, a memory 404, a power component 406, a multimedia component 408, an audio component 410, an input / output (I / O) interface 412, a sensor component 414, and a communication component 416.

[0148] The processing component 402 generally controls the overall operation of the electronic device 400, such as operations associated with display, telephone calls, data communication, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to complete all or part of the steps of the above - mentioned methods. In addition, the processing component 402 may include one or more modules to facilitate the interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate the interaction between the multimedia component 408 and the processing component 402.

[0149] The memory 404 is used to store various types of data to support the operation of the electronic device 400. Examples of such data include instructions for any application or method operating on the electronic device 400, contact data, phone book data, messages, pictures, multimedia, etc. The memory 404 can be implemented by any type of volatile or non - volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read - only memory (EEPROM), erasable programmable read - only memory (EPROM), programmable read - only memory (PROM), read - only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0150] The power component 406 provides power to various components of the electronic device 400. The power component 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 400.

[0151] The multimedia component 408 includes a screen that provides an output interface between the electronic device 400 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also detect the duration and pressure associated with the touch or swipe operation. In some embodiments, the multimedia component 408 includes a front - facing camera and / or a rear - facing camera. When the electronic device 400 is in an operation mode, such as a shooting mode or a multimedia mode, the front - facing camera and / or the rear - facing camera can receive external multimedia data. Each front - facing camera and rear - facing camera can be a fixed optical lens system or have focal length and optical zoom capabilities.

[0152] The audio component 410 is used to output and / or input audio signals. For example, the audio component 410 includes a microphone (MIC). When the electronic device 400 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive external audio signals. The received audio signals can be further stored in the memory 404 or transmitted via the communication component 416. In some embodiments, the audio component 410 further includes a speaker for outputting audio signals.

[0153] The input / output interface 412 provides an interface between the processing component 402 and a peripheral interface module, and the peripheral interface module can be a keyboard, a click wheel, buttons, etc. These buttons can include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0154] The sensor component 414 includes one or more sensors for providing status assessments of various aspects of the electronic device 400. For example, the sensor component 414 can detect the on / off state of the electronic device 400, the relative positioning of components. For example, the components are the display and the keypad of the electronic device 400. The sensor component 414 can also detect a change in the position of the electronic device 400 or a component of the electronic device 400, the presence or absence of user contact with the electronic device 400, the orientation or acceleration / deceleration of the electronic device 400, and the temperature change of the electronic device 400. The sensor component 414 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor component 414 can also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 414 can further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0155] The communication component 416 is used to facilitate communication between the electronic device 400 and other devices in a wired or wireless manner. The electronic device 400 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G, or 5G), or a combination thereof. In an exemplary embodiment, the communication component 416 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 further includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0156] In an exemplary embodiment, the electronic device 400 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components for implementing the method provided by the embodiments of the present application.

[0157] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 404 including instructions, and the above instructions can be executed by a processor 420 of the electronic device 400 to complete the above method. For example, the non-transitory storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0158] Figure 6 is a block diagram of another electronic device 500 provided by the embodiments of the present application. For example, the electronic device 500 may be provided as a server. Referring to Figure 6 , the electronic device 500 includes a processing component 522, which further includes one or more processors, and memory resources represented by a memory 532 for storing instructions executable by the processing component 522, such as application programs. The application programs stored in the memory 532 may include one or more modules each corresponding to a set of instructions. In addition, the processing component 522 is configured to execute instructions to perform the method provided by the embodiments of the present application.

[0159] The electronic device 500 may further include a power supply component 526 configured to perform power management of the electronic device 500, a wired or wireless network interface 550 configured to connect the electronic device 500 to a network, and an input / output interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as WindowsServerTM, MacOSXTM, UnixTM, LinuxTM, FreeBSDTM, or the like.

[0160] The embodiments of the present application also provide a computer program product, including a computer program, and the computer program, when executed by a processor, implements the method described in the above embodiments.

[0161] Other embodiments of the present application will be readily apparent to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. The present application is intended to cover any variations, uses, or adaptations of the present application, which follow the general principles of the present application and include known common general knowledge or conventional technical means in the technical field not disclosed in the present disclosure. The specification and examples are only to be considered as exemplary, and the true scope and spirit of the present application are pointed out by the following claims.

[0162] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the present application is only limited by the appended claims.

Claims

1. A method for reconstructing an instruction stream, characterized in that: The method comprises: Obtaining a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is an address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the execution times are the total number of times machine instructions of the corresponding instruction execution type are executed; Determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; Calculating the change in the number of executions of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; The machine instruction set is rebuilt according to the target branch.

2. The method according to claim 1, characterized in that The step of determining all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations includes: Parsing the source code to obtain a program execution graph; Traversing the program execution graph from the machine instruction corresponding to the first instruction address, if a jump instruction exists and a jump is performed, constructing a branch according to the machine instruction corresponding to the next instruction address to which the jump instruction jumps; the first instruction address is the target instruction address sent earliest in two adjacent sending operations; If the jump instruction does not exist and a jump is performed, a branch is constructed according to a machine instruction corresponding to the next instruction address to be executed sequentially according to the current machine instruction; Until the machine instruction corresponding to the second instruction address is traversed, all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address are obtained; the second instruction address is the target instruction address sent latest in two adjacent sending operations.

3. The method according to claim 2, characterized in that The step of parsing the source code to obtain a program execution graph includes: Parsing the source code to obtain a set of program instructions in the source code; Traversing the program instruction set, and creating nodes and edges of the program execution graph according to types of program instructions in the program instruction set; Until all the program instructions in the program instruction set are traversed, the program execution graph is obtained.

4. The method according to claim 1, characterized in that: The instruction execution types include: jump instruction non-jump type, jump instruction jump type and addition instruction type; the execution times recorded in the multiple types of registers include: the execution times of machine instructions of jump instruction non-jump, the execution times of machine instructions of jump instruction jump and the execution times of machine instructions of addition instruction; The calculating of the change in the number of execution times of each type of register in two adjacent sending operations includes: Determine the difference in the number of executions of the machine instruction to which the jump instruction does not jump in two adjacent sending operations as a first difference; Determine the difference in the number of executions of the machine instruction jumped by the jump instruction in two adjacent sending operations as a second difference; determining a difference between the execution times of the machine instructions of the addition instructions in two adjacent sending operations as a third difference; The first difference is used as the change in the number of executions of the machine instruction that the jump instruction does not jump to, the second difference is used as the change in the number of executions of the machine instruction that the jump instruction jumps to, and the third difference is used as the change in the number of executions of the machine instruction of the addition instruction.

5. The method according to claim 1, characterized in that The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; each branch has a first change value of the number of executions of the jump instruction non-jump count register, a second change value of the number of executions of the jump instruction jump count register; and a third change value of the number of executions of the addition instruction count register; the change conditions include: a first difference value of the number of executions of the jump instruction non-jump count register in two adjacent sending operations, a second difference value of the number of executions of the jump instruction jump count register; and a third difference value of the number of executions of the addition instruction count register; Determining a target branch from all the branches according to the change includes: If there is a branch among all the branches whose first change value is the same as the first difference value, whose second change value is the same as the second difference value, and whose third change value is the same as the third difference value, then the branch is determined as the target branch.

6. The method according to claim 1, characterized in that The target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

7. The method according to claim 1, characterized in that The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the execution times recorded in each of the multiple types of registers include: the execution times of machine instructions of which the jump instruction does not jump, the execution times of machine instructions of which the jump instruction jumps, and the execution times of machine instructions of the addition instruction; The number of executions of the machine instructions to which the jump instruction does not jump is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction non-jump count register; The number of executions of the machine instruction jumped by the jump instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the jump instruction jump count register; The execution times of the machine instruction of the addition instruction is determined by performing a judgment operation on each instruction within the target sampling interval and according to the value of the addition instruction counting register.

8. The method according to claim 7, characterized in that The judging operation includes: If the instruction is a jump instruction and no jump occurs, then the value of the jump instruction non-jump count register is added with a first preset value for updating; If the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added to the first preset value for updating; If the instruction is an addition instruction, the value of the addition instruction counting register is added to the first preset value for updating.

9. The method according to claim 1, characterized in that: The multiple types of registers include: a jump instruction non-jump count register, a jump instruction jump count register, and an addition instruction count register; the method further includes: Obtaining an updated value of the jump instruction non-jump count register, wherein the initial value of the jump instruction non-jump count register is obtained by setting the updated value of the jump instruction non-jump count register to an initialization value; Obtaining an updated value of the jump instruction jump count register, wherein the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register to the initialization value; An updated value of the addition instruction count register is obtained, wherein the initial value of the addition instruction count register is obtained by setting the updated value of the addition instruction count register to the initialization value.

10. A device for reconstructing an instruction stream, characterized in that: The device comprises: An acquisition module is used to acquire a target instruction address sent by a processing device according to a target sampling interval, and execution times recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; and the execution times are the total number of times the machine instruction of the corresponding instruction execution type is executed; A determination module, used to determine all branches between two target instruction addresses according to the source code and the target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed; A calculation module, used for calculating the change of the execution times of each type of register in two adjacent sending operations, and determining a target branch from all the branches according to the change; A reconstruction module is used to reconstruct the machine instruction set according to the target branch.

11. An electronic device, characterized in that: The invention comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the instruction stream reconstruction method as claimed in any one of claims 1 to 9.

12. A readable storage medium, characterized in that: The readable storage medium stores a program or an instruction, and when the program or the instruction is executed by a processor, the steps of the instruction stream reconstruction method according to any one of claims 1 to 9 are implemented.

Images