Method and device for acquiring function call sequence of process and electronic equipment

Abstract

The embodiment of the invention discloses a method and device for obtaining a function call sequence of a process and electronic equipment, relates to the technical field of computer application, and aims to provide convenience for a user to analyze the process. The method is applied to a Linux system, and comprises the following steps: receiving an acquisition instruction of a kernel mode function call sequence of a specified process; the acquisition instruction comprises an identifier of the specified process; according to the acquisition instruction, acquiring a kernel mode function call sequence of the specified process; determining management information corresponding to the specified process according to the identifier of the specified process; determining a user mode function call sequence of the specified process according to the management information corresponding to the specified process; and combining the kernel mode function call sequence with the user mode function call sequence to obtain a function call sequence of a full chain of the specified process. The method and the device are suitable for analyzing the user process.

Description

Technical Field

[0001] This application relates to the field of computer application technology, and in particular to a method, apparatus, electronic device, and readable storage medium for obtaining a process's function call sequence. Background Technology

[0002] On the Linux platform, process backtraces are divided into user-mode backtraces and kernel-mode backtraces.

[0003] Currently, Linux manages function call sequences separately for user mode and kernel mode. When a user needs to obtain the complete chain of function call sequences of a process, they need to use one command to obtain the user-mode function call sequence and another command to list the process's function call trajectory in the kernel. However, because the two commands are executed at different times and the program runs very fast, the obtained user-mode function call sequences and kernel-mode function call sequences are not necessarily correlated, which cannot support user analysis of processes and brings great difficulties to user program analysis.

[0004] Obtaining the interrelated user-mode function call sequences and kernel-mode function call sequences is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, electronic device, and readable storage medium for obtaining the function call sequence of a process, which facilitates user analysis of processes.

[0006] In a first aspect, embodiments of this application provide a method for obtaining a function call sequence of a process, applied to a Linux system. The method includes: receiving an instruction to obtain a kernel-mode function call sequence of a specified process; the instruction includes an identifier of the specified process; obtaining the kernel-mode function call sequence of the specified process according to the instruction; determining management information corresponding to the specified process according to the identifier of the specified process; determining the user-mode function call sequence of the specified process according to the management information corresponding to the specified process; and combining the kernel-mode function call sequence with the user-mode function call sequence to obtain the complete chain of function call sequences of the specified process.

[0007] According to a specific implementation of an embodiment of this application, determining the user-mode function call sequence of the specified process based on the management information corresponding to the specified process includes: determining the virtual memory management unit of the specified process from the management information corresponding to the specified process; determining the user-mode call stack of the specified process based on the virtual memory management unit of the specified process; and determining the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process.

[0008] According to a specific implementation of an embodiment of this application, determining the user-mode call stack of the specified process based on the virtual memory management unit of the specified process includes: traversing each virtual memory block of the virtual memory management unit of the specified process, searching for a target memory block in each virtual memory block that is identified by a specified identifier; and determining the user-mode call stack of the specified process based on the target memory block.

[0009] According to a specific implementation of an embodiment of this application, determining the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process includes: parsing each stack frame of the user-mode call stack of the specified process to determine the user-mode function call sequence corresponding to the specified process.

[0010] According to a specific implementation of an embodiment of this application, determining the user-mode call stack of the specified process based on the target memory block includes: determining the address of the user-mode call stack of the specified process based on the address stored at a specified location in the target memory block; wherein, the address stored at the specified location in the memory block with the specified identifier is the address of the user-mode call stack of the specified process; and determining the user-mode call stack of the specified process based on the address of the user-mode call stack of the specified process.

[0011] According to a specific implementation of an embodiment of this application, the management information corresponding to the specified process is the task structure corresponding to the specified process.

[0012] Secondly, embodiments of this application provide a device for obtaining a process function call sequence, applied to a Linux system. The device includes: a receiving module, configured to receive an instruction to obtain a kernel-mode function call sequence of a specified process; the instruction includes an identifier of the specified process; an obtaining module, configured to obtain the kernel-mode function call sequence of the specified process according to the obtaining instruction; a first determining module, configured to determine management information corresponding to the specified process according to the identifier of the specified process; a second determining module, configured to determine the user-mode function call sequence of the specified process according to the management information corresponding to the specified process; and a combining module, configured to combine the kernel-mode function call sequence and the user-mode function call sequence to obtain the complete chain of function call sequences of the specified process.

[0013] According to a specific implementation of an embodiment of this application, the first determining module includes: a first determining submodule, configured to determine the virtual memory management unit of the specified process from the management information corresponding to the specified process; a second determining submodule, configured to determine the user-mode call stack of the specified process based on the virtual memory management unit of the specified process; and a third determining submodule, configured to determine the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process.

[0014] According to a specific implementation of an embodiment of this application, the second determining submodule is specifically used for: traversing each virtual memory block of the virtual memory management unit of the specified process, searching for a target memory block in each virtual memory block that is identified by a specified identifier; and determining the user-mode call stack of the specified process based on the target memory block.

[0015] According to a specific implementation of an embodiment of this application, the third determining submodule is specifically used to: parse each stack frame of the user-mode call stack of the specified process, and determine the user-mode function call sequence corresponding to the specified process.

[0016] According to a specific implementation of an embodiment of this application, the second determining submodule is specifically used for: determining the address of the user-mode call stack of the specified process based on the address stored at a specified location of the target memory block; wherein, the address stored at the specified location of the memory block with the specified identifier is the address of the user-mode call stack of the specified process; and determining the user-mode call stack of the specified process based on the address of the user-mode call stack of the specified process.

[0017] According to a specific implementation of an embodiment of this application, the management information corresponding to the specified process is the task structure corresponding to the specified process.

[0018] Thirdly, embodiments of this application provide an electronic device, which includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method for obtaining the function call sequence of the process described in any of the foregoing implementations.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the method for obtaining the function call sequence of a process as described in any of the foregoing implementations.

[0020] This embodiment describes a method, apparatus, electronic device, and readable storage medium for obtaining the function call sequence of a process. It receives an instruction to obtain the kernel-mode function call sequence of a specified process. Based on the instruction, it obtains the kernel-mode function call sequence of the specified process. Then, based on the identifier of the specified process, it determines the management information corresponding to the specified process. Further, based on the management information, it determines the user-mode function call sequence of the specified process. Finally, it combines the kernel-mode function call sequence and the user-mode function call sequence to obtain the complete chain of function call sequences for the specified process. Since the kernel-mode function call sequence and the user-mode function call sequence of the specified process are obtained through the instruction to obtain the kernel-mode function call sequence, i.e., through a single instruction, the kernel-mode function call sequence and the user-mode function call sequence are obtained. This allows for the acquisition of interrelated kernel-mode and user-mode function call sequences, i.e., the complete chain of function call sequences, thus facilitating user analysis of a specified process. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a method for obtaining a process's function call sequence according to an embodiment of this application; Figure 2 A flowchart illustrating a method for obtaining a process function call sequence according to a specific embodiment of this application; Figure 3 A schematic diagram of the structure of a device for obtaining a process function call sequence according to an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0024] To enable those skilled in the art to better understand the technical concept, implementation scheme and beneficial effects of the embodiments of this application, detailed descriptions are provided below through specific embodiments.

[0025] Figure 1 A flowchart illustrating a method for obtaining a process function call sequence according to an embodiment of this application is shown below. Figure 1 As shown, the method for obtaining the function call sequence of a process in this embodiment is applied to a Linux system.

[0026] Linux is a free and open-source UNIX-like operating system. Its kernel was first released by Linus Torvalds on October 5, 1991. It is based on the POSIX standard, supports multi-user, multi-tasking, multi-threading, and multi-CPU operation, and can run a variety of utility software, applications, and network protocols.

[0027] The method in this embodiment includes: S101, Receive the instruction to obtain the kernel-mode function call sequence of the specified process.

[0028] In this embodiment, the acquisition instruction includes the identifier of the specified process.

[0029] In this embodiment, the identifier of a specified process includes information such as the name and number of the specified process that can uniquely represent a process.

[0030] Backtrace is a debugging technique used to display the sequence of function calls (call chain) of a process, helping developers quickly locate the root cause of problems.

[0031] In Linux systems, kernel mode and user mode are two operating modes of the CPU, used to isolate the permissions of the operating system kernel and applications, ensuring system security and stability.

[0032] The core differences and mechanisms between kernel mode and user mode are as follows: Kernel mode is the mode in which the CPU runs the operating system kernel code and has the highest privileges (Ring 0). It can directly access all hardware resources (such as memory, disk, network devices, etc.) and execute privileged instructions (such as modifying the interrupt table and managing process scheduling).

[0033] User mode is the mode in which the CPU runs ordinary applications, with restricted privileges (Ring 3). Its privileges are limited to accessing restricted memory space and resources. It cannot directly manipulate hardware and must request kernel services through system calls. Typical scenarios include running applications such as browsers and text editors, and calling library functions (such as printf()) or non-privileged instructions.

[0034] A sequence of functions called by a process in user mode can be called a user-mode function call sequence, and a sequence of functions called by a process in kernel mode can be called a kernel-mode function call sequence.

[0035] When a process encounters a problem or when it is necessary to delve into the internal details of a process (such as for performance optimization), a user can issue a command to retrieve the kernel-mode function call sequence of a specified process.

[0036] S102. According to the acquisition instruction, acquire the kernel-mode function call sequence of the specified process.

[0037] Specifically, based on the fetch instruction, the kernel-mode function call sequence of a specified process can be retrieved from the kernel-mode call stack. The kernel-mode call stack, typically located in kernel space (0xC0000000-0xFFFFFFFF), is dedicated to executing kernel code when a process enters kernel mode (e.g., during system calls or interrupts). Its size is usually 8KB (32-bit) or 16KB (64-bit), sharing the thread_union union space with the thread_info structure. It can generally be associated with the task_struct->stack pointer, storing process context (e.g., register states) and the kernel function call chain. Its main uses are executing system calls, interrupt handling, and nested kernel function calls.

[0038] S103. Determine the management information corresponding to the specified process based on the identifier of the specified process.

[0039] The management information corresponding to the specified program in this embodiment includes information about the user-mode function call sequence of the specified program.

[0040] In Linux systems, each program has corresponding management information, which includes the identifier of the program to which it belongs. Thus, the management information corresponding to a specific process can be determined based on the identifier of the specified program.

[0041] In some examples, the management information corresponding to a specified process is the task structure corresponding to that process. The task structure can also be called task_struct.

[0042] In the Linux kernel, task_struct is a core data structure that describes a process or thread. It encapsulates all runtime information about the process, including process identification and status, scheduling information, memory management, file system and signal information, etc.

[0043] S104. Determine the user-mode function call sequence of the specified process based on the management information corresponding to the specified process.

[0044] The management information corresponding to a specified process can be used to find information about the user-mode function call sequence of that process.

[0045] S105. Combine the kernel-mode function call sequence with the user-mode function call sequence to obtain the complete chain of function call sequences for the specified process.

[0046] The kernel-mode function call sequence of the specified process obtained in step S102 and the user-mode function call sequence of the specified process determined in step S104 are combined to obtain the full chain of function call sequences of the specified process.

[0047] In some examples, kernel-mode function call sequences are combined with user-mode function call sequences, including placing the user-mode function call sequence before the kernel-mode function call sequence.

[0048] After obtaining the complete function call sequence, the complete function call sequence can be output, allowing users to analyze a specified process by combining the complete function call sequence.

[0049] In this embodiment, a command to obtain the kernel-mode function call sequence of a specified process is received. Based on the command, the kernel-mode function call sequence of the specified process is obtained. Then, based on the identifier of the specified process, the management information corresponding to the specified process is determined. Further, based on the management information, the user-mode function call sequence of the specified process is determined. Finally, the kernel-mode function call sequence and the user-mode function call sequence are combined to obtain the complete chain of function call sequences for the specified process. Since the kernel-mode function call sequence and the user-mode function call sequence of the specified process are obtained through the command to obtain the kernel-mode function call sequence, i.e., through a single command, the kernel-mode function call sequence and the user-mode function call sequence are obtained. This allows for the acquisition of interrelated kernel-mode function call sequences and user-mode function call sequences, i.e., the complete chain of function call sequences. This facilitates user analysis of the specified process. Furthermore, in this embodiment, no interaction with the specified process is required during the acquisition of the user-mode function call sequence. Therefore, the user-mode function call sequence can be obtained regardless of the state of the specified process, solving the problem in the prior art where the specified process is in an uninterruptible sleep state. When sleeping, the process cannot be associated with the specified process because it cannot receive signals, thus preventing the acquisition of the user-mode function call sequence.

[0050] In one embodiment of determining the user-mode function call sequence of a specified process, the user-mode function call sequence of the specified process is determined based on the management information corresponding to the specified process (S104), including: S104a. Determine the virtual memory management unit of the specified process from the management information corresponding to the specified process.

[0051] The management information corresponding to a specified process includes the virtual memory management unit for that process.

[0052] The Virtual Memory Areas (VMA) describe a contiguous region of virtual memory (such as the code segment, heap, or stack) within a process's address space. It is organized using linked lists or red-black trees, allowing the kernel to quickly traverse all the virtual addresses of a process.

[0053] S104b: Determine the user-mode call stack of the specified process based on the virtual memory management unit of the specified process.

[0054] The user-mode call stack is a block of memory located at user-mode addresses in virtual memory. It stores the function call chain, local variables, parameters, and return addresses of user-mode programs. It is typically located in the process's user space (0x00000000-0xBFFFFFFF). Its address grows from high to low addresses, with an initial size usually of 8MB (adjustable via `ulimit -s`), dynamically expanded by the kernel in case of page faults. Each process (and thread) has its own independent user stack. The main thread and child threads share the same virtual address space, but their stack regions differ. Its main function is to handle ordinary function calls, recursion, and local variable storage.

[0055] In some examples, the user-mode call stack of a specified process is determined based on the virtual memory management unit of that process (S104b), including: A1. Traverse each virtual memory block of the virtual memory management unit of the specified process and find the target memory block marked with the specified identifier in each virtual memory block.

[0056] The virtual memory management unit comprises multiple virtual memory blocks, each containing different information. One of these virtual memory blocks stores information related to the user-mode call stack, which allows the user-mode call stack of a specific process to be determined.

[0057] In a specific example, the user-mode call stack grows from top to bottom. Correspondingly, in the virtual memory management unit, there is a memory block marked VM_GROWSDOWN. This memory block can store a pointer that points to the address of the user-mode call stack.

[0058] A2. Determine the user-mode call stack of the specified process based on the target memory block.

[0059] The target memory block contains the starting address of the user-mode call stack. Therefore, the user-mode call stack of a specified process can be determined based on the address stored in the target memory block.

[0060] S104c: Determine the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process.

[0061] In some examples, the user-mode function call sequence of a specified process is determined based on the user-mode call stack of that process (S104c), including: B1. Analyze each stack frame of the user-mode call stack of the specified process to determine the user-mode function call sequence corresponding to the specified process.

[0062] During process execution, each function call pushes information such as the return address and parameters onto the stack. Therefore, by parsing the information in the stack frame, the call path from the current function to the top-level function can be obtained.

[0063] Each stack frame corresponds to a function. When parsing the stack frames of a specified process's user-mode call stack, they can be parsed in descending order of address, and the functions obtained from each stack frame form a user-mode function call chain.

[0064] In some examples, the user-mode call stack (A2) of a specified process is determined based on the target memory block, including: A21. Determine the address of the user-mode call stack of the specified process based on the address stored at the specified location in the target memory block.

[0065] The address stored at a specified location in the memory block with the specified identifier is the address of the user-mode call stack of the specified process.

[0066] The specified address of a memory block can be the address stored at the beginning of the memory block, or the address of the user-mode call stack of the specified process.

[0067] A22. Determine the user-mode call stack of a specified process based on the address of the user-mode call stack of that process.

[0068] The method for obtaining the function call sequence in this embodiment has the following important significance for system debugging, code understanding, and Linux ecosystem maintenance: 1. Reduce debugging blind spots: In the native Linux kernel, the separation between user-mode and kernel-mode calls (such as system calls and I / O operations) makes problem localization difficult. For example, if the user-mode function `foo()` triggers a kernel-mode `read()` failure, traditional methods cannot correlate the two and require manual log concatenation. Adding a unified sequence of user-mode and kernel-mode calls can significantly reduce debugging blind spots.

[0069] 2. Reduce context loss: When a native Linux kernel-mode exception (such as a page fault) occurs, there is a lack of user-mode call context, which increases the difficulty of analyzing the cause of the exception. A unified context call sequence can significantly reduce the difficulty of exception analysis.

[0070] 3. End-to-end problem diagnosis: Directly links user-space logic and kernel behavior. For example, it can trace the entire path from user-space malloc() to kernel brk(), quickly identifying the cause of memory allocation failures. 4. Performance optimization visualization: Statistically analyze the frequency of kernel mode switching triggered by user-mode functions (such as the number of write() calls) to identify the performance loss caused by high-frequency switching.

[0071] 5. Ease of learning and maintenance: Developers can understand the user-mode process and system call implementation details through the complete call chain (such as how open() passes parameters from user mode to the kernel driver), reducing the learning cost of kernel code.

[0072] 6. Enhanced security auditing: Detects whether malicious user-mode programs trigger kernel vulnerabilities (such as privilege escalation operations) through specific call chains, thereby improving system security.

[0073] The following detailed description of the solution in this application is based on a specific embodiment.

[0074] In this embodiment, the process for uniformly obtaining user-mode and kernel-mode function call sequences is an extension of the kernel function call sequence obtained from ` / proc / pid / stack`. Therefore, its prerequisite is that the user can obtain the kernel-mode function call sequence corresponding to a process using a command such as `sudo cat / proc / pid / stack`. By modifying the process of ` / proc / pid / stack`, a unified user-mode and kernel-mode function call sequence can be obtained. See also... Figure 2 The main steps are as follows: 1. Obtain the process ID (PID) via / proc / pid / stack.

[0075] pid specifies the identifier of the process.

[0076] 2. Obtain the task data structure of a process by its PID.

[0077] 3. Obtain the virtual memory management unit (vma) of the process through the task data structure.

[0078] 4. Traverse each virtual memory block of the virtual memory management unit.

[0079] 5. Determine whether the flag of each virtual memory block is VM_GROWSDOWN.

[0080] 6. If the vma virtual memory block has the VM_GROWSDOWN flag, then obtain the stack address of the specified process from vma->vma_start.

[0081] 7. Traverse the stack frame structure in the stack to obtain the user-mode function call sequence.

[0082] Given the stack address of a given process, the user-mode function call stack is determined. Then, each stack frame in that stack is parsed sequentially according to its structure. This yields the user-mode function call sequence.

[0083] 8. Obtain the kernel-mode function call sequence.

[0084] 9. Combine the obtained user-mode function call sequence with the kernel-mode function call sequence to form a complete, consistent function call sequence.

[0085] In this embodiment, consistency refers to the correlation between the user-mode function call sequence and the kernel-mode function call sequence.

[0086] 10. Output the function call sequence of this combination.

[0087] In a specific application, a process might have multiple functions, such as reading and writing to disk, transmitting data over a network, and performing scientific calculations. Suppose this process encounters a bug during network data transmission and enters an uninterruptible sleep state. In this situation, the process appears to be frozen, unable to run, and cannot be killed (unless the system restarts). Simultaneously, debugging tools cannot attach to this process, cannot examine the execution of its internal functions, and therefore cannot detect the bug caused by the network issue.

[0088] To identify the bug in this process, you can check ` / proc / pid / stack`. Since the functionality of ` / proc / pid / stack` is extended according to this embodiment, the current function call sequence of the process in both user mode and kernel mode can be obtained and combined. From the combined function call sequence, it is easy to find that the process is transmitting network data and has stopped in a network-related function, thus pinpointing the cause of the bug and greatly assisting in solving the problem.

[0089] One debugging tool is GDB (GNU Debugger), a powerful command-line debugging tool developed by the GNU project. It is primarily used for debugging programs written in languages ​​such as C and C++ in Linux / Unix environments. By dynamically controlling program execution and inspecting memory and variable states, it helps developers quickly locate and fix logical errors in the code.

[0090] In Linux systems, / proc / [PID] / stack is a special virtual file used to record the function call stack traces of a process when it executes in kernel space.

[0091] In this embodiment, the extended / proc / pid / stack functionality is utilized to simultaneously obtain the user-mode function call sequence and the kernel-mode call sequence, which facilitates the location of process-related problems (bugs, etc.). In addition, the inherent correlation and logical relationship between user-mode function calls and kernel-mode function calls can be examined at the same time, which facilitates a deeper understanding of the logical details and interrelationships in process execution and can provide more information for optimizing process performance.

[0092] Figure 3 This is a schematic diagram of the structure of a device for preventing suspected malicious ransomware attacks according to an embodiment of this application, as shown below. Figure 3As shown in the figure, this application provides a device for obtaining the function call sequence of a process, applied to a Linux system. The device includes: a receiving module 11, used to receive an instruction to obtain the kernel-mode function call sequence of a specified process; the instruction includes an identifier of the specified process; an obtaining module 12, used to obtain the kernel-mode function call sequence of the specified process according to the obtaining instruction; a first determining module 13, used to determine the management information corresponding to the specified process according to the identifier of the specified process; a second determining module 14, used to determine the user-mode function call sequence of the specified process according to the management information corresponding to the specified process; and a combining module 15, used to combine the kernel-mode function call sequence and the user-mode function call sequence to obtain the complete chain of function call sequences of the specified process.

[0093] The apparatus of this embodiment can be used to perform Figure 1 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0094] The apparatus in this embodiment receives an instruction to obtain the kernel-mode function call sequence of a specified process. Based on the instruction, it obtains the kernel-mode function call sequence of the specified process. Then, based on the identifier of the specified process, it determines the management information corresponding to the specified process. Further, based on the management information, it determines the user-mode function call sequence of the specified process. Finally, it combines the kernel-mode function call sequence and the user-mode function call sequence to obtain the complete chain of function call sequences for the specified process. Since the kernel-mode function call sequence and the user-mode function call sequence of the specified process are obtained through the instruction to obtain the kernel-mode function call sequence, i.e., through a single instruction, both the kernel-mode and user-mode function call sequences are obtained. This allows for the acquisition of interrelated kernel-mode and user-mode function call sequences, i.e., the complete chain of function call sequences. This facilitates user analysis of the specified process. Furthermore, in this embodiment, no interaction with the specified process is required during the acquisition of the user-mode function call sequence. Therefore, the user-mode function call sequence can be obtained regardless of the state of the specified process, solving the problem in the prior art where the specified process is in an uninterruptible sleep state. When sleeping, the process cannot be associated with the specified process because it cannot receive signals, thus preventing the acquisition of the user-mode function call sequence.

[0095] As an optional implementation, the first determining module includes: a first determining submodule, configured to determine the virtual memory management unit of the specified process from the management information corresponding to the specified process; a second determining submodule, configured to determine the user-mode call stack of the specified process based on the virtual memory management unit of the specified process; and a third determining submodule, configured to determine the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process.

[0096] As an optional implementation, the second determining submodule is specifically used for: traversing each virtual memory block of the virtual memory management unit of the specified process, finding the target memory block in each virtual memory block that is identified by the specified identifier; and determining the user-mode call stack of the specified process based on the target memory block.

[0097] As an optional implementation, the third determining submodule is specifically used to: parse each stack frame of the user-mode call stack of the specified process and determine the user-mode function call sequence corresponding to the specified process.

[0098] As an optional implementation, the second determining submodule is specifically used to: determine the address of the user-mode call stack of the specified process based on the address stored at a specified location of the target memory block; wherein, the address stored at the specified location of the memory block with the specified identifier is the address of the user-mode call stack of the specified process; and determine the user-mode call stack of the specified process based on the address of the user-mode call stack of the specified process.

[0099] As an optional implementation, the management information corresponding to the specified process is the task structure corresponding to the specified process.

[0100] The apparatus described in the above embodiments can be used to execute the technical solutions of the above method embodiments. The implementation principle and technical effects are similar, and will not be repeated here.

[0101] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, as shown below. Figure 4 As shown, the device may include: a housing 61, a processor 62, a memory 63, a circuit board 64, and a power supply circuit 65. The circuit board 64 is disposed inside the space enclosed by the housing 61, and the processor 62 and the memory 63 are disposed on the circuit board 64. The power supply circuit 65 is used to supply power to the various circuits or devices of the above-mentioned electronic device. The memory 63 is used to store executable program code. The processor 62 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 63, and is used to execute the method for obtaining the function call sequence of any process provided in the foregoing embodiments. Therefore, it can also achieve the corresponding beneficial technical effects, which have been described in detail above and will not be repeated here.

[0102] The aforementioned electronic devices exist in various forms, including but not limited to: (1) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile internet access capabilities. These terminals include: PDAs, MIDs, and UMPCs, such as iPads.

[0103] (2) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0104] (3) Other electronic devices with data interaction functions.

[0105] Accordingly, embodiments of this application also provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the method for obtaining the function call sequence of any process provided in the foregoing embodiments, thus achieving the corresponding technical effects. This has been described in detail above and will not be repeated here.

[0106] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0107] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0108] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0109] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this application, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0110] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0111] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for obtaining a function call sequence of a process, characterized in that, Applied to Linux systems, the method includes: Receive an instruction to obtain the kernel-mode function call sequence of a specified process; the instruction includes the identifier of the specified process; According to the acquisition instruction, the kernel-mode function call sequence of the specified process is acquired; Based on the identifier of the specified process, determine the management information corresponding to the specified process; Based on the management information corresponding to the specified process, determine the user-mode function call sequence of the specified process; The kernel-mode function call sequence is combined with the user-mode function call sequence to obtain the complete chain of function call sequences for the specified process.

2. The method according to claim 1, characterized in that, The step of determining the user-mode function call sequence of the specified process based on the management information corresponding to the specified process includes: The virtual memory management unit of the specified process is determined from the management information corresponding to the specified process; The user-mode call stack of the specified process is determined based on the virtual memory management unit of the specified process; Based on the user-mode call stack of the specified process, determine the user-mode function call sequence of the specified process.

3. The method according to claim 2, characterized in that, Determining the user-mode call stack of the specified process based on the virtual memory management unit of the specified process includes: Traverse each virtual memory block of the virtual memory management unit of the specified process, and search for the target memory block identified by the specified identifier in each virtual memory block; Based on the target memory block, determine the user-mode call stack of the specified process.

4. The method according to claim 2, characterized in that, Determining the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process includes: Analyze each stack frame of the user-mode call stack of the specified process to determine the user-mode function call sequence corresponding to the specified process.

5. The method according to claim 3, characterized in that, Determining the user-mode call stack of the specified process based on the target memory block includes: The address of the user-mode call stack of the specified process is determined based on the address stored at a specified location in the target memory block; wherein, the address stored at a specified location in the memory block with the specified identifier is the address of the user-mode call stack of the specified process. The user-mode call stack of the specified process is determined based on the address of the user-mode call stack of the specified process.

6. The method according to claim 1, characterized in that, The management information corresponding to the specified process is the task structure corresponding to the specified process.

7. A device for obtaining a function call sequence of a process, characterized in that, The device, used in Linux systems, includes: A receiving module is used to receive an instruction to obtain the kernel-mode function call sequence of a specified process; the instruction includes the identifier of the specified process. The acquisition module is used to acquire the kernel-mode function call sequence of the specified process according to the acquisition instruction; The first determining module is used to determine the management information corresponding to the specified process based on the identifier of the specified process; The second determining module is used to determine the user-mode function call sequence of the specified process based on the management information corresponding to the specified process; The combination module is used to combine the kernel-mode function call sequence with the user-mode function call sequence to obtain the complete chain of function call sequences for the specified process.

8. The apparatus according to claim 7, characterized in that, The first determining module includes: The first determining submodule is used to determine the virtual memory management unit of the specified process from the management information corresponding to the specified process; The second determining submodule is used to determine the user-mode call stack of the specified process based on the virtual memory management unit of the specified process; The third determining submodule is used to determine the user-mode function call sequence of the specified process based on the user-mode call stack of the specified process.

9. The apparatus according to claim 8, characterized in that, The second determining submodule is specifically used for: Traverse each virtual memory block of the virtual memory management unit of the specified process, and search for the target memory block identified by the specified identifier in each virtual memory block; Based on the target memory block, determine the user-mode call stack of the specified process.

10. The apparatus according to claim 8, characterized in that, The third determining submodule is specifically used for: Analyze each stack frame of the user-mode call stack of the specified process to determine the user-mode function call sequence corresponding to the specified process.

Images