A dynamic link library updating method, device, equipment and medium

Abstract

Embodiments of the present application disclose a dynamic link library updating method, device, equipment and medium, the method comprising: obtaining a process list of a dynamic link library to be processed and a new dynamic link library; selecting a target process from the process list and obtaining a virtual address interval of a code segment of the dynamic link library to be processed in the target process; obtaining a virtual address of a next instruction to be executed of the target process and judging whether the virtual address is in the virtual address interval; if the virtual address is not in the virtual address interval, pausing execution of the target process; performing binary difference analysis on the same interface of the dynamic link library to be processed and the new dynamic link library; obtaining new memory page file data from the new dynamic link library, covering data in a difference memory page with the new memory page file data, and resuming execution of the process. By locating and replacing the process outside the virtual address interval, the dynamic link library updating is completed without restarting the process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of link library updating, and in particular to a dynamic link library updating method, a dynamic link library updating device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] The prior art relies on compiler instrumentation and other invasive modifications, and either adopts a whole library file replacement method, which cannot accurately control the replacement timing and range at the binary instruction level. In the scenario where multiple processes share the same dynamic library, there is a lack of accurate monitoring of the process execution state, which can easily cause memory conflicts or execution exceptions during code replacement, and it is difficult to achieve true seamless updating.

[0003] When updating a dynamic link library in a conventional software, the related processes or services usually need to be restarted to complete the replacement, which will cause business interruption and seriously affect system continuity and user experience. SUMMARY

[0004] In view of the above problems, the present application embodiments are proposed to provide a dynamic link library updating method, a dynamic link library updating device, an electronic device and a computer readable storage medium which overcome the above problems or at least partially solve the above problems.

[0005] To solve the above problems, the first aspect of the present application embodiments provides a dynamic link library updating method, which comprises:

[0006] Obtaining a process list of a dynamic link library to be processed and a new dynamic link library;

[0007] Selecting a target process from the process list and obtaining a virtual address interval of a code segment of the dynamic link library to be processed in the target process;

[0008] Obtaining a virtual address of a next instruction to be executed of the target process, and determining whether the virtual address is in the virtual address interval;

[0009] If the virtual address is not in the virtual address interval, suspending the execution of the target process;

[0010] Performing binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine the changed difference memory page;

[0011] Obtaining new memory page file data from the new dynamic link library, covering the data in the difference memory page with the new memory page file data, and resuming the execution of the process.

[0012] Optionally, the acquiring the code segment of the to-be-processed dynamic link library in the virtual address interval of the target process comprises:

[0013] Acquiring memory mapping information of the target process;

[0014] Determining the code segment corresponding to the to-be-processed dynamic link library according to the memory mapping information;

[0015] Determining a virtual address range of the code segment in the virtual address space of the target process as the virtual address interval of the target process.

[0016] Optionally, the determining the code segment corresponding to the to-be-processed dynamic link library according to the memory mapping information comprises:

[0017] Acquiring an interface file of the target process, and reading the memory mapping information from the interface file of the target process;

[0018] Analyzing the memory mapping information to obtain a memory segment corresponding to the to-be-processed dynamic link library; the memory having an executable attribute in the memory segment is the code segment of the to-be-processed dynamic link library.

[0019] Optionally, the performing binary difference analysis on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library to determine the changed difference memory pages comprises:

[0020] Comparing binary codes of the same interfaces in the to-be-processed dynamic link library and the new dynamic link library;

[0021] Identifying changed interfaces; the changed interfaces include interfaces with changed binary codes, added interfaces, or deleted interfaces;

[0022] Determining virtual memory pages occupied by binary codes of the changed interfaces, and generating a difference memory page list according to the virtual memory pages; the difference memory page list includes a plurality of difference memory pages.

[0023] Optionally, the acquiring new memory page file data from the new dynamic link library, and covering data in the difference memory pages with the new memory page file data comprises:

[0024] Selecting a virtual memory page from the difference memory page list;

[0025] Acquiring a page table of the target process, and querying a start address corresponding to the virtual memory page according to the page table;

[0026] Reading new data of a memory page size corresponding to the difference memory page from the new dynamic link library to obtain the new memory page file data.

[0027] write the new memory page file data into the physical memory page pointed by the start address.

[0028] Optionally, the method further comprises:

[0029] If the virtual address is in the virtual address interval, return to the process list and select a next process from the process list for the overlay processing.

[0030] Optionally, the suspending the execution of the target process comprises sending a stop signal to the target process, and / or directly performing the data overlay operation when the process is in an un-interruptable blocking state.

[0031] According to a second aspect of the embodiments of the present application, an updating device of a dynamic link library is provided, and the device comprises:

[0032] a process list obtaining module, configured to obtain a process list of a dynamic link library to be processed and a new dynamic link library;

[0033] an address interval determining module, configured to select a target process from the process list and obtain a virtual address interval of a code segment of the dynamic link library to be processed in the target process;

[0034] a virtual address judging module, configured to obtain a virtual address of a next instruction to be executed of the target process and judge whether the virtual address is in the virtual address interval;

[0035] a target process suspending module, configured to suspend the execution of the target process if the virtual address is not in the virtual address interval;

[0036] an interface difference analyzing module, configured to perform binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine a changed difference memory page;

[0037] a file data overlaying module, configured to obtain new memory page file data from the new dynamic link library, overlay data in the difference memory page with the new memory page file data, and resume the execution of the process.

[0038] According to a third aspect of the embodiments of the present application, an electronic device is provided, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program is executed by the processor to implement the steps of the updating method of the dynamic link library according to any one of the above aspects.

[0039] According to a fourth aspect of the embodiments of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the updating method of the dynamic link library according to any one of the above aspects.

[0040] The technical solutions provided by the embodiments of the present application can have the following beneficial effects.

[0041] The embodiments of the present application disclose a dynamic link library updating method, device, equipment and medium, the method comprising: obtaining a process list of a to-be-processed dynamic link library and a new dynamic link library; selecting a target process from the process list and obtaining a virtual address interval of a code segment of the to-be-processed dynamic link library in the target process; obtaining a virtual address of a next instruction to be executed of the target process and determining whether the virtual address is in the virtual address interval; if the virtual address is not in the virtual address interval, suspending execution of the target process; performing binary difference analysis on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library to determine a changed difference memory page; obtaining new memory page file data from the new dynamic link library, covering data in the difference memory page with the new memory page file data, and resuming execution of the process. By locating and replacing the specific memory page that has changed through binary difference analysis, the amount of data that needs to be written is greatly reduced, the time required for the updating operation is shortened, and the replacement is performed by using the virtual address of the next instruction to be executed of the process being located outside the virtual address interval of the dynamic link library code segment, so that the process is only suspended for a very short time, thereby achieving updating of the dynamic link library without restarting the process or service. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 is a step flowchart of a dynamic link library updating method provided by the embodiments of the present application;

[0043] Figure 2 is a step flowchart of another dynamic link library updating method provided by the embodiments of the present application;

[0044] Figure 3 is a logic block diagram of determining a link library interface state of a dynamic link library updating method provided by the embodiments of the present application;

[0045] Figure 4 is a logic block diagram of interface binary difference analysis of a dynamic link library updating method provided by the embodiments of the present application;

[0046] Figure 5 is a logic block diagram of covering data in a difference memory page of a dynamic link library updating method provided by the embodiments of the present application;

[0047] Figure 6is a logic block diagram of a dynamic link library updating method provided by an embodiment of the present application;

[0048] Figure 7 is a structural block diagram of a dynamic link library updating device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the above objectives, characteristics and advantages of the present application more apparent, comprehensible and easily understood, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] When updating a dynamic link library in a conventional software, it is usually necessary to restart the related process or service to complete the replacement, which will cause business interruption and seriously affect system continuity and user experience.

[0051] One of the core ideas of the embodiments of the present application is to locate and replace the specific memory page that has changed through binary difference analysis, greatly reducing the amount of data that needs to be written, shortening the time required for the updating operation, and replacing the next instruction to be executed by the process using the virtual address located outside the dynamic link library code segment virtual address interval, only temporarily suspending the process for a very short time, thereby achieving the updating of the dynamic link library without restarting the process or service.

[0052] Reference Figure 1 , a step flowchart of a dynamic link library updating method provided by an embodiment of the present application is shown, and the method specifically includes the following steps:

[0053] Step 101, obtaining a process list of a dynamic link library to be processed and a new dynamic link library;

[0054] A dynamic link library (Dynamic Link Library, commonly as.dll file in Windows, and commonly as.so file in Linux / Unix) is a library file containing code and data that can be used by multiple programs simultaneously. The dynamic link library to be processed refers to a specific dynamic link library file that is currently being used by one or more processes in the system, but is planned to be upgraded, replaced or repaired. The new dynamic link library refers to the updated version of the dynamic link library file used to replace the "dynamic link library to be processed". It contains the code that needs to be updated, the vulnerabilities that need to be repaired or the new functions that need to be added.

[0055] The process list is a data structure maintained by the operating system kernel, used to track and manage all running (or in other states) processes in the current system.

[0056] In the embodiment of the present application, the process list of the dynamic link library to be processed is obtained by querying the operating system (such as traversing the ` / proc` file system or using `ldd`, `lsof`, etc.), and all active processes in the system that are currently loaded in the memory and reference the library to be upgraded are dynamically identified, thereby forming a process set to be processed. At the same time, the new dynamic link library refers to reading the compiled new library file version from the storage medium (such as a disk). The new dynamic link library must be binary compatible with the old dynamic link library at the interface level, but it contains repaired defects, performance optimization or new functions inside, resulting in differences in machine instructions (binary code).

[0057] Step 102, selecting a target process from the process list, and obtaining the code segment of the dynamic link library to be processed in the virtual address interval of the target process;

[0058] The virtual address interval refers to a continuous memory address range with the same properties and purposes in the virtual address space of the process.

[0059] In the embodiment of the present application, selecting a target process from the process list is to select a target process from the obtained process set to be processed as the current processing object.

[0060] Obtaining the code segment of the dynamic link library to be processed in the virtual address interval of the target process is to accurately locate the code segment of the library to be upgraded by analyzing the virtual memory mapping information of the target process (the typical path is ` / proc / [pid] / maps` in the Linux system), that is, the specific range [MStart, MEnd] of the memory region loaded into the process virtual address space with the permission of "executable".

[0061] Step 103, obtaining the virtual address of the next instruction to be executed of the target process, and judging whether the virtual address is in the virtual address interval;

[0062] In the embodiment of the present application, the virtual address value stored in the hardware program counter (PC register) of the target process is directly obtained by querying the process state information in the operating system (such as reading ` / proc / [pid] / stat` in Linux or using the `ptrace` system call). This address value represents the exact location of the next machine instruction to be run when the process is scheduled to execute by the CPU.

[0063] After obtaining the address, the system compares it with the previously determined virtual address range [MStart, MEnd] of the code segment of the dynamic library to be replaced. Only when the instruction address is definitely located outside the range, it is proved that the execution flow of the current process is completely not running on the code of the library to be replaced. At this time, the process can be executing the instructions of the main program or other irrelevant libraries, thereby providing a safe execution window for the subsequent short-term suspension of the process and the overwriting of the memory.

[0064] Step 104, if the virtual address is not in the virtual address range, suspending the execution of the target process;

[0065] In an embodiment of the present application, once the system confirms that the next instruction of the target process is located outside the code segment of the dynamic library to be replaced (i.e. when it is determined to be a safe opportunity), the suspension operation on the target process is triggered immediately. This action is usually realized by sending a `SIGSTOP` signal or the like to the target process, and the purpose is to freeze the execution state of the process.

[0066] Suspending the process ensures that the execution flow of the process will not change during the entire process of subsequent memory analysis and data overwriting, especially will not suddenly jump back to the code segment to be replaced, thereby avoiding the fatal situation that the code execution is tampered halfway. A disturbance-free running environment is provided for a series of operations such as binary difference analysis, physical memory page searching and data overwriting. Although it needs to be suspended, the suspension occurs in the "safe window" where the process does not use the library to be updated, and the duration is extremely short (only covering the memory replacement operation), which has little impact on the business services provided by the process, thereby achieving a user experience that is completely different from the traditional "restart" in technology.

[0067] Step 105, performing binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine the difference memory page that has changed;

[0068] Binary difference analysis is to compare the file contents of the "dynamic link library to be processed" (old library) and the "new dynamic link library" on the disk, accurately identify all changed application programming interfaces (APIs) from the level of machine instructions, and locate the specific memory pages affected by these changes.

[0069] The difference memory page is the virtual memory page or pages where the binary code of the application programming interface (API) whose content has changed is located, which is identified in the step of binary difference analysis.

[0070] In the embodiment of the present application, after suspending the target process, the system reads the original files of the new dynamic link library and the to-be-processed dynamic link library in parallel, and performs in-depth binary comparison on all application programming interfaces with the same name in both of them. The purpose is to analyze the binary code content of each same interface.

[0071] By performing binary difference analysis on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library, several types of changes can be accurately identified: code modification, that is, the internal logic of the interface is changed, resulting in a change in the binary instruction sequence. Code addition or deletion, that is, new logic is added or part of the code is deleted in the interface, causing the size or layout of the binary code block to change. Internal call offset change, that is, the internal logic of the interface does not change, but the address of the other function called by the interface changes, which also causes the operands of the related instructions to change.

[0072] Finally, the virtual memory pages occupied by the binary code of all the interfaces that are detected to have changes are screened out to form a "difference memory page list".

[0073] Step 106: obtaining new memory page file data from the new dynamic link library, covering the data in the difference memory page with the new memory page file data, and resuming the execution of the process.

[0074] In the embodiment of the present application, the system first reads the original data block (`NewPageFileData`) with a size of one memory page (such as 4 KB) corresponding to each virtual page in the "difference memory page list" from the new dynamic link library file. Then, the new data block is accurately covered into the physical memory page mapped by the difference memory page in the target process by using the memory management interface of the operating system or directly writing into ` / proc / [pid] / mem` and the like.

[0075] This covering operation is in the smallest unit of a page, which ensures that the process will directly run the new binary code when it executes the updated API next time. Only the changed pages are replaced, and the amount of data written is extremely small.

[0076] Finally, the SIGCONT signal is sent to the target process to resume its execution. Since the replacement operation is completed when the process is suspended and the execution point is located in the safe area, the process cannot perceive that the library it depends on has been updated in the memory after it is woken up, so the seamless upgrade of the dynamic link library is realized without interrupting the business and restarting the service.

[0077] Referring to Figure 2 , a step flowchart of another method for updating a dynamic link library provided by an embodiment of the present application is shown, and the method specifically includes the following steps:

[0078] Step 201, obtaining a process list of a dynamic link library to be processed and a new dynamic link library;

[0079] All processes in the system that currently reference the dynamic link library to be processed (to be upgraded or replaced) are queried to form a completed reference process list.

[0080] For example, assuming that the operating system is CTyunOS, the version of the dynamic link library to be processed is libkdb5.so.10.0, it needs to be upgraded to the new dynamic link library libkdb5.so.10.2, and the system memory page size is 4K. All running processes on the system are obtained by ps, and the processes that use the dynamic link library libkdb5.so.10.0 are queried using the ldd command to form a process list 【23890, 11093】

[0081] In the embodiment of the application, the process list of the dynamic link library to be processed is obtained by querying the operating system (such as traversing the ` / proc` file system or using `ldd`, `lsof`, etc.), dynamically identifying all active processes in the system that are currently loaded in memory and reference the library to be upgraded, thereby forming a process set to be processed. At the same time, obtaining the new dynamic link library means reading the compiled new library file version from the storage medium (such as a disk). This new dynamic link library must be binary compatible with the old dynamic link library at the interface level, but it contains repaired defects, performance optimization or new functions inside, resulting in differences in machine instructions (binary code).

[0082] Step 202, selecting a target process from the process list and obtaining a virtual address interval of a code segment of the dynamic link library to be processed in the target process;

[0083] A process is selected from the reference process list, and according to the memory mapping information of the process, a virtual memory region interval [MStart, MEnd] of the code segment of the dynamic link library to be processed in the process virtual address space is obtained;

[0084] The memory mapping information is the content distribution of the virtual address space of a process, for example, which segment of memory is a data segment, which segment of memory is a data segment, and which memory segments are executable. The memory mapping information can be obtained through / proc / [process id] / maps. / proc / [process id] / maps is a special interface file provided by the Linux operating system kernel through the proc virtual file system for each process, which is used to describe the memory mapping layout of the virtual address space of the process. From the / proc / [process id] / maps file, first, lock which memory segments (generally three) are used by the corresponding dynamic link library; the memory segment with the executable attribute in the memory segment attribute is the code segment of the dynamic link library, so as to obtain the virtual memory region interval of the code segment of the dynamic link library to be processed in the virtual address space of the process.

[0085] For example, the first process 23890 is selected, and the virtual memory region of the code segment of the dynamic link library libkdb5.so.10.0 in the virtual address space of the process 23890 is obtained through the system file / proc / 23890 / maps, which is [7f0249802000, 7f0249808000].

[0086] In the embodiment of the application, selecting a target process from the process list is to select a target process from the obtained process set to be processed as a current processing object. The virtual address interval of the code segment of the dynamic link library to be processed in the target process is obtained by analyzing the virtual memory mapping information (the typical path is / proc / [pid] / maps in the Linux system) of the target process, and the code segment of the library to be upgraded is accurately located, that is, the memory region with the permission of "executable" is loaded into the specific range [MStart, MEnd] in the virtual address space of the process.

[0087] In some embodiments, the step 202 can include the following sub-steps:

[0088] Sub-step S11, obtaining the memory mapping information of the target process;

[0089] The memory mapping information is the metadata maintained by the operating system kernel for each process, which describes the layout of the virtual address space. It records the start and end addresses, access permissions, mapped source files (if any), and other key information of each continuous region (memory mapping segment) in the virtual address space.

[0090] In the embodiments of the present application, the virtual address space layout data of the target process is read and parsed through a standard interface provided by the operating system. In a Linux system, this is usually done by accessing the ` / proc` virtual file system, specifically at ` / proc / [target process ID] / maps`. This file is dynamically generated by the kernel, and its content reflects the target process memory space in real time, describing an independent memory mapping region.

[0091] In sub-step S12, a code segment corresponding to the dynamic link library to be processed is determined according to the memory mapping information.

[0092] In the embodiments of the present application, after successfully obtaining the complete memory mapping information of the target process, the system performs targeted screening and feature matching. All mapping entries associated with the file path of the "dynamic link library to be processed" are searched in the memory mapping information, thereby preliminarily locking all regions occupied by the library in the process memory. In these preliminarily locked entries, a specific memory segment with a permission attribute marked as "executable" is identified. In the Linux ` / proc / [pid] / maps` output, this usually appears as an entry with a permission flag of `r-xp` (i.e., readable, executable, private mapping). This memory segment with "executable" permission is the code segment of the dynamic link library. The start and end virtual addresses described by this segment are extracted, thereby obtaining the precise virtual address interval [MStart, MEnd].

[0093] In some embodiments, the step S12 can include the following sub-steps:

[0094] In sub-step S121, an interface file of the target process is obtained, and the memory mapping information is read from the interface file of the target process. In sub-step S122, the memory mapping information is analyzed to obtain a memory segment corresponding to the dynamic link library to be processed. The memory with an executable attribute in the memory segment is the code segment of the dynamic link library to be processed.

[0095] In the embodiments of the present application, the interface file is obtained and the memory mapping information is read through an interface provided by the operating system, non-invasively obtaining the internal state of the target process. The corresponding interface file of the target process in the operating system ` / proc` virtual file system, i.e., ` / proc / [target process ID] / maps`, is located and opened. By reading the entire content of this file, a complete memory mapping information can be obtained, providing a data basis for the next step of analysis.

[0096] Analyzing the memory mapping information to locate the code segment is the data analysis and positioning phase, and its core task is to accurately filter the target from the complex memory mapping information. The read memory mapping information is parsed line by line, and by comparing the mapping file path, all memory segments associated with the "to-be-processed dynamic link library" are filtered out. Then, in these associated memory segments, the key feature matching is performed: looking for a specific memory segment containing the 'executable' flag (represented as `r-xp` in Linux) in the permission attribute field. Finally, the memory segment that meets this feature is confirmed as the code segment of the to-be-processed dynamic link library, and its virtual address range is taken as the benchmark for subsequent operations.

[0097] Sub-step S13, the virtual address range of the code segment in the virtual address space of the target process is determined as the virtual address interval of the target process.

[0098] In the embodiment of the application, after successfully identifying the specific memory segment corresponding to the to-be-processed dynamic link library with "executable" permission from the memory mapping information, the start address and the end address in the memory segment description information are extracted. These two addresses define a continuous virtual memory range, which is formally set as the "target virtual address interval" relied on by the subsequent process.

[0099] Referring to Figure 3 , a logic block diagram for determining the interface state of the dynamic link library in the updating method of the dynamic link library provided by the embodiment of the application is shown, Figure 3 which shows the core logic for determining whether the process is currently executing the code of the to-be-replaced dynamic link library. It determines the execution state of the process by obtaining the address of the next instruction of the target process (PC register value) and determining whether the address falls within the virtual address interval of the to-be-replaced library code segment. If it is not within the interval, the process is currently not running the binary instructions in the dynamic link library, and the process is in a safe state, and the subsequent replacement operation can be performed; if it is within the interval, the process is running the binary instructions in the dynamic link library, and the process is in a risky state and needs to be avoided.

[0100] Step 203, obtaining the virtual address of the next instruction to be executed of the target process, and determining whether the virtual address is in the virtual address interval;

[0101] The system proc (process information virtual) file system data acquisition system obtains the value PAddr (the value stored in the PC register, that is, the instruction pointer is a virtual address) in the PC register (hardware register). The PC register (usually referred to as the IP instruction pointer in the x86 architecture) stores the address of the next instruction to be executed by the CPU in the virtual address space. It is judged whether the virtual address of the next instruction to be executed by PAddr is located in the virtual memory region [MStart, MEnd], that is, MStart<=PAddr<=MEnd. For example, the address value in the current system PC register is 7f0351801000, 7f0351801000 is not located in the virtual memory region interval [7f0249802000, 7f0249805000], and the dynamic link library to be processed can be upgraded or replaced.

[0102] In the embodiment of the application, the virtual address value stored in the hardware program counter (PC register) of the target process is directly obtained by querying the process state information in the operating system (for example, reading ` / proc / [pid] / stat` in Linux or using the `ptrace` system call). The address value represents the exact location of the next instruction to be run when the process is scheduled for execution by the CPU.

[0103] After obtaining the address, the system compares it with the virtual address interval [MStart, MEnd] of the code segment of the dynamic library to be replaced determined in advance. Only when the instruction address is definitely located outside the interval, it is proved that the execution flow of the current process is completely not running on the code of the library to be replaced. At this time, the process may be executing the main program or the instructions of other irrelevant libraries, thereby providing a safe execution window for the subsequent short-term suspension of the process and the overwriting of the memory.

[0104] Step 204, if the virtual address is not in the virtual address interval, suspending the execution of the target process; in some embodiments, the step of suspending the execution of the target process includes sending a stop signal to the target process, and / or directly performing a data overwriting operation when the process is in an unblockable blocked state.

[0105] The virtual address of the next instruction to be executed by the target process is not in the virtual address interval, a signal SIGSTOP (stop signal) is sent to the current process, and the execution of the process is suspended. If the process is in an unblockable state or a deep kernel sleep state, the SIGSTOP (stop signal) is invalid, and the step of sending the SIGSTOP (stop signal) can be directly skipped, and the replacement of the dynamic link library can be directly performed, because the essence of the current process is in a blocked state.

[0106] For example, the address value in the current system PC register is 7f0351801000, which is not located in the virtual memory region interval [7f0249802000, 7f0249805000]. The to-be-processed dynamic link library can be upgraded or replaced, and the system tool kill command is used to send SIGSTOP to the process 23890 to pause the execution of the process.

[0107] In the embodiment of the application, once the system confirms that the next instruction of the target process is located outside the code segment of the to-be-replaced dynamic library (i.e., the safe opportunity is determined), the pause operation on the target process is triggered immediately. This action is usually realized by sending a signal such as `SIGSTOP' to the target process, and the purpose is to freeze the execution state of the process.

[0108] The paused process ensures that the execution flow of the process does not change during the entire process of subsequent memory analysis and data overlay, especially does not suddenly jump back into the to-be-replaced code segment, thereby avoiding the fatal situation that the code execution is tampered halfway. A disturbance-free running environment is provided for a series of operations such as binary difference analysis, physical memory page searching, and data overlay. Although the process needs to be paused, the pause occurs in the "safe window" in which the process does not use the to-be-updated library, and the duration is extremely short (only covering the memory replacement operation), which has little impact on the business services provided by the process, thereby realizing a user experience that is completely different from the traditional "restart" in technology.

[0109] Reference Figure 4 Fig. 2 shows a logic block diagram of interface binary difference analysis of a dynamic link library updating method provided by an embodiment of the application, Figure 4 The process of comparing the new and old dynamic link libraries to determine the specific updating range is described. By reading and comparing the code segments and data segments of the two, binary-level difference analysis is performed on the same interfaces, so that the interfaces that have changed are accurately identified, and the virtual memory pages affected by these changes are finally located, and a list of difference memory pages to be replaced is generated.

[0110] In step 205, binary difference analysis is performed on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library to determine the difference memory pages that have changed.

[0111] In the embodiment of the application, after the target process is paused, the system reads the original files of the new dynamic link library and the to-be-processed dynamic link library in parallel, and deeply compares all application programming interfaces with the same name in the two. The purpose is to analyze the binary code content of each same interface.

[0112] By performing binary difference analysis on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library, several types of changes can be accurately identified: code modification, i.e., internal logic change of the interface, resulting in change of binary instruction sequence. Code addition or deletion, i.e., addition of new logic or deletion of part of the code in the interface, causing change of size or layout of the binary code block. Internal call offset change, i.e., although the interface itself does not change, the address of the other function called by the interface changes, which also causes change of the operand of the related instruction.

[0113] Finally, the virtual memory pages occupied by the binary codes of all the interfaces with detected changes are screened out to form a "difference memory page list".

[0114] In some embodiments, the step 205 can include the following sub-steps:

[0115] Sub-step S21, comparing the binary codes of the same interfaces in the to-be-processed dynamic link library and the new dynamic link library; sub-step S22, identifying the interfaces with changes; the interfaces with changes include interfaces with binary code changes, newly added interfaces, or deleted interfaces; sub-step S23, determining the virtual memory pages occupied by the binary codes of the interfaces with changes, and generating a difference memory page list according to the virtual memory pages; the difference memory page list includes a plurality of difference memory pages.

[0116] The code segment and data segment contents of the to-be-processed dynamic link library and the new dynamic link library are read, and difference analysis is performed on the same API interfaces of the to-be-processed dynamic link library and the new dynamic link library, including change of the same API binary code, addition of an API, and deletion of an API. The difference analysis on the same API interfaces of the to-be-processed dynamic link library and the new dynamic link library can be performed by using a corresponding algorithm. For the API interfaces with differences, the virtual address memory pages corresponding to the complete binary codes of the APIs are located, and a difference virtual memory list DiffPageList is generated. The replacement of the dynamic link library is performed in the granularity of a memory page, i.e., one memory page is replaced by one memory page. A virtual memory page VirtPage of the dynamic link library is selected from the difference virtual memory list.

[0117] For example, the code segment and data segment data in the dynamic link library libkdb5.so.10.0, libkdb5.so.10.2, ELF file are read, the address interval of each API interface binary code in the dynamic link library is obtained through the symbol table symtab and the string table symstr in the dynamic link library libkdb5.so.10.0, libkdb5.so.10.2, ELF file. The difference analysis of the binary code of each API interface is performed, and it is obtained that the binary codes of the API interfaces krb5_dbe_cpw and krb5_dbe_create_key_data exist difference;

[0118] According to the memory region interval of the process address virtual space dynamic link library and the addressing of the interface in the ELF code segment, it is obtained that krb5_dbe_cpw is located in the virtual memory page [7f0249802000, 7f0249803000] and krb5_dbe_create_key_data is located in the virtual memory page [7f0249805000, 7f0249806000], and a difference virtual memory page list

V1, V2

[0119] In the embodiment of the application, the binary codes of the same interfaces in the dynamic link library to be processed and the new dynamic link library are compared, the ELF format files of the dynamic link library to be processed and the new dynamic link library are read in parallel through the system, and all application programming interfaces with the same name are located according to the symbol table and the string table, and the instruction sequences corresponding to each same-name interface in the two libraries are compared.

[0120] The changed interfaces include three types of changed interfaces: the binary code changed interface is an interface whose name does not change but the internal machine instruction sequence changes; the newly added interface is an interface that exists in the new dynamic link library but does not exist in the dynamic link library to be processed; and the deleted interface is an interface that exists in the dynamic link library to be processed but is removed in the new dynamic link library. After the changed interfaces are identified, an output is a "changed interface list".

[0121] Based on the generated "changed interface list", for each interface in the list, all virtual memory pages occupied by the binary code of the interface are obtained according to the layout of the interface in the virtual address space of the target process. The addresses of these virtual memory pages are added to the "difference memory page list".

[0122] Referring to Figure 5 , a logical block diagram of covering data in the difference memory page in the updating method of the dynamic link library provided by the embodiment of the application is shown, Figure 5The operation flow of incremental updating with memory page as granularity is shown. The system selects a virtual memory page from the difference memory page list one by one, finds the corresponding physical memory page address through querying the process page table, then reads the corresponding data from the new dynamic link library, and covers it into the target physical memory page. After all the difference pages are replaced, the process is resumed.

[0123] Step 206, obtaining new memory page file data from the new dynamic link library, covering the data in the difference memory page with the new memory page file data, and resuming the execution of the process.

[0124] In the embodiment of the application, the system first reads the original data block (`NewPageFileData`) corresponding to each virtual page in the "difference memory page list" from the new dynamic link library file, and the size of the data block is one memory page (such as 4KB). Then, the new data block is accurately covered into the physical memory page mapped by the difference memory page in the target process through the memory management interface of the operating system or directly writing into ` / proc / [pid] / mem` and the like. The covering operation is in the minimum unit of page, which ensures that the process will directly run the new binary code when the next execution reaches the updated API. Only the changed pages are replaced, and the data writing amount is extremely small. Finally, the SIGCONT signal is sent to the target process to resume its execution. Since the replacement operation is completed when the process is paused and the execution point is located in the safe area, the process cannot perceive that the library it depends on has been updated in the memory after being woken up, so the seamless upgrade of the dynamic link library is realized without interrupting the business and restarting the service.

[0125] In some embodiments, the step 206 can include the following sub-steps:

[0126] Sub-step S31, selecting a virtual memory page from the difference memory page list; sub-step S32, obtaining the page table of the target process, and querying the starting address corresponding to the virtual memory page according to the page table; sub-step S33, reading new data corresponding to the difference memory page from the new dynamic link library, and obtaining the new memory page file data; sub-step S34, writing the new memory page file data into the physical memory page pointed by the starting address.

[0127] The virtual memory page VirtPage corresponding to the physical memory page start address PhyPageAddr is indexed by the page table of the process currently performing dynamic link library replacement. Indexing the virtual memory page corresponding to the physical memory page start address has the effect of determining the location that needs to be upgraded or replaced. The data size of the API interface containing the difference is read from the new dynamic link library as a page file data NewPageFileData (new memory page file data), and the data in the physical memory page with the start address PhyPageAddr is overwritten with the new memory page file data. It is determined whether the difference virtual memory list DiffPageList is processed. If the difference virtual memory list DiffPageList is processed, a start signal SIGCONT is sent to the current process to resume running; otherwise, jump to the step of selecting a virtual memory page VirtPage of a dynamic link library from the difference virtual memory list PageList.

[0128] After completing the replacement of all difference memory pages in a process, it is determined whether there are still unprocessed processes in the process list. If so, jump to the step of selecting the next process from the process list to complete the data replacement operation until all processes in the process list are processed.

[0129] For example, the krb5_dbe_cpw interface and the corresponding first virtual memory page list V1 are processed first. According to the process page table, the physical memory page start address corresponding to V1 is 0x0000000052003000. A page of memory page size containing the binary code of the krb5_dbe_cpw interface is read from the new dynamic link library libkdb5.so.10.2, ELF file, and directly overwritten in the physical memory page with the start address 0x0000000052003000 through V1. A page of memory page size containing the binary code of the krb5_dbe_create_key_data interface is read from the new dynamic link library libkdb5.so.10.2, ELF file, and directly overwritten in the physical memory page with the start address 0x0000000052004000 through V2.

[0130] The difference virtual memory page list V1, V2 is processed, and a SIGCONT signal is sent to the process 23890 to resume its running. Then, the next process 11093 is processed by repeating the same steps. If the process list is processed, the entire dynamic link library is upgraded from libkdb5.so.10.0 to the new dynamic link library libkdb5.so.10.2.

[0131] In the embodiment of the present application, the virtual memory page to be processed is selected from the generated "difference memory page list", and a virtual memory page that has not been processed is selected. The physical memory starting address is queried, and the purpose is to convert the virtual address into a physical address that can be directly addressed by hardware. The page table structure of the target process is obtained, and the selected virtual memory page address is used as an index to query the page table, so as to parse the starting address of the physical memory page mapped by the virtual page. The new dynamic link library file is accessed again, and according to the ELF file structure of the library, the code region corresponding to the difference memory page currently being processed is located, and the original binary data of exactly one memory page size is read therefrom. This part of data is the new memory page file data ready to cover the old content. The read new memory page file data is directly and completely written into the space pointed to by the obtained physical memory page starting address through the underlying interface (such as writing into ` / proc / [pid] / mem`) or the memory mapping mechanism provided by the operating system.

[0132] In step 207, if the virtual address is in the virtual address interval, return to the process list and select the next process from the process list for coverage processing.

[0133] In the embodiment of the present application, when the system judges that the program counter (PC) value of the target process is located outside the code segment of the dynamic link library to be processed (that is, in a safe state), that is, the virtual address is in the virtual address interval, it does not immediately perform the pause and replacement operations on the process, but returns to the starting point of the flow, that is, the step of "selecting a target process from the process list", and selects the next process for coverage processing. The whole system can automatically and continuously process each process that references the dynamic library without external intervention. Once a process is determined to be "safely processable" or "not needed to be processed", the system will immediately switch to the next process in the list, and all processes in the list will be traversed, so that the library updating task of all target processes is efficiently completed.

[0134] Reference Figure 6 Fig. 1 shows a logic block diagram of a dynamic link library updating method provided by an embodiment of the present application, based on Figure 6 Fig. 1 shows a dynamic link library updating method provided by an embodiment of the present application, and the whole process from the beginning to the end systematically depicts the complete closed loop from obtaining the process list, judging the safe opportunity, pausing the process, binary difference analysis, difference memory page generation and replacement, to finally restoring the process and processing the next task in a loop, clearly showing the logical connection and sequence relationship between the modules.

[0135] The embodiment of the application discloses a dynamic link library updating method, device, equipment and medium, the method comprises the following steps: acquiring a process list of a dynamic link library to be processed and a new dynamic link library; selecting a target process from the process list and acquiring a virtual address interval of a code segment of the dynamic link library to be processed in the target process; acquiring a virtual address of a next instruction to be executed of the target process and judging whether the virtual address is in the virtual address interval; if the virtual address is not in the virtual address interval, suspending the execution of the target process; performing binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine a changed difference memory page; acquiring new memory page file data from the new dynamic link library, covering the data in the difference memory page with the new memory page file data, and resuming the execution of the process. By locating and replacing the specific memory page changed through binary difference analysis, the amount of data to be written is greatly reduced, the time required for the updating operation is shortened, and the replacement is performed by using the virtual address of the next instruction to be executed of the process being located outside the virtual address interval of the dynamic link library code segment, so that the process or service is only suspended for a very short time, thereby achieving the updating of the dynamic link library without restarting the process or service.

[0136] It should be noted that, for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the application are not limited to the action sequence described, because according to the embodiments of the application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the application.

[0137] Referring to Figure 7 , a structure block diagram of a dynamic link library updating device provided by the embodiment of the application is shown, the device comprises:

[0138] The process list acquisition module 301 is used for acquiring a process list of a dynamic link library to be processed and a new dynamic link library;

[0139] The address interval determination module 302 is used for selecting a target process from the process list and acquiring a virtual address interval of a code segment of the dynamic link library to be processed in the target process;

[0140] The virtual address judgment module 303 is used for acquiring a virtual address of a next instruction to be executed of the target process and judging whether the virtual address is in the virtual address interval;

[0141] The target process suspension module 304 is used for suspending the execution of the target process if the virtual address is not in the virtual address interval;

[0142] The interface difference analysis module 305 is configured to perform binary difference analysis on the same interfaces of the to-be-processed dynamic link library and the new dynamic link library to determine the changed difference memory pages.

[0143] The file data covering module 306 is configured to acquire new memory page file data from the new dynamic link library, cover the data in the difference memory pages with the new memory page file data, and resume the execution of the process.

[0144] In some embodiments, the address interval determination module 302 comprises:

[0145] The mapping information acquisition submodule is configured to acquire the memory mapping information of the target process.

[0146] The code segment determination submodule is configured to determine the code segment corresponding to the to-be-processed dynamic link library according to the memory mapping information.

[0147] The virtual address interval determination submodule is configured to determine the virtual address range of the code segment in the virtual address space of the target process as the virtual address interval of the target process.

[0148] In some embodiments, the code segment determination submodule comprises:

[0149] The mapping information reading unit is configured to acquire the interface file of the target process and read the memory mapping information from the interface file of the target process.

[0150] The mapping information analysis unit is configured to analyze the memory mapping information to obtain the memory segment corresponding to the to-be-processed dynamic link library; the memory with an executable attribute in the memory segment is the code segment of the to-be-processed dynamic link library.

[0151] In some embodiments, the interface difference analysis module 305 comprises:

[0152] The interface code comparison submodule is configured to compare the binary codes of the same interfaces in the to-be-processed dynamic link library and the new dynamic link library.

[0153] The changed interface identification submodule is configured to identify the changed interfaces; the changed interfaces include the interfaces with changed binary codes, the newly added interfaces, or the deleted interfaces.

[0154] The memory page list generation submodule is configured to determine the virtual memory pages occupied by the binary codes of the changed interfaces, generate a difference memory page list according to the virtual memory pages; the difference memory page list comprises a plurality of difference memory pages.

[0155] In some embodiments, the file data overlay module 306 comprises:

[0156] a virtual memory page selection sub-module configured to select a virtual memory page from the list of difference memory pages;

[0157] a start address determination sub-module configured to obtain a page table of the target process and query a start address corresponding to the virtual memory page according to the page table;

[0158] a new memory page data reading sub-module configured to read new data of a memory page size corresponding to the difference memory page from the new dynamic link library to obtain new memory page file data;

[0159] a new memory page data writing sub-module configured to write the new memory page file data into a physical memory page pointed by the start address.

[0160] In some embodiments, the apparatus further comprises:

[0161] a process scheduling module configured to return to the process list and select a next process for overlay processing from the process list if the virtual address is within the virtual address range.

[0162] In some embodiments, the pausing of the execution of the target process comprises sending a stop signal to the target process and / or directly performing a data overlay operation when the process is in an unblockable blocking state.

[0163] For the apparatus embodiment, it is basically similar to the method embodiment, so it is described more simply, and the related parts refer to the part of the method embodiment.

[0164] The embodiment of the application further provides an electronic device, comprising a processor, a memory and a computer program stored in the memory and capable of running on the processor, when the computer program is executed by the processor, each process of the method embodiment of the dynamic link library updating method is implemented, and the same technical effects are achieved, and thus the description is not repeated here.

[0165] The embodiment of the application further provides a computer readable storage medium, a computer program is stored in the computer readable storage medium, when the computer program is executed by the processor, each process of the method embodiment of the dynamic link library updating method is implemented, and the same technical effects are achieved, and thus the description is not repeated here.

[0166] It has to be understood that the terms "including", "containing" or any other similar terms are intended to be open-ended terms that specify the presence of the stated features, integers, steps, components, elements, or the like, but do not preclude the presence or addition of one or more other features, integers, steps, components, elements, or the like.

[0167] Furthermore, it is to be understood that the scope of the methods and apparatus of the present embodiments are not limited by the order of execution of the functions as described, nor by the order of the steps as described. For example, the described methods can be executed in an order different than that described, and / or various steps can be combined, omitted, or added, and / or the described methods can be executed in substantially simultaneous fashion, or in reverse order. Furthermore, features described in relation to certain examples can be combined in other examples.

[0168] From the above description of the embodiments, it is manifest that the above-described methods can be realized by means of software and general purpose hardware platforms, and of course can be realized by hardware, but the former is a more preferred embodiment. Based on such an understanding, the technical solutions of the present application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a number of instructions for causing a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0169] The embodiments of the present application are described above with reference to the accompanying drawings, but the present application is not limited to the above-described specific embodiments, and the above-described specific embodiments are merely illustrative, not restrictive. Those skilled in the art can make many modifications under the teachings of the present application without departing from the scope of the present application, and all such modifications are intended to be within the scope of the present application.

Claims

1. A method of updating a dynamic link library, characterized by, The method comprises: acquiring a process list of a dynamic link library to be processed and a new dynamic link library; selecting a target process from the process list and acquiring a virtual address interval of a code segment of the dynamic link library to be processed in the target process; acquiring a virtual address of a next instruction to be executed of the target process and judging whether the virtual address is in the virtual address interval; if the virtual address is not in the virtual address interval, pausing execution of the target process; performing binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine a changed difference memory page; acquiring new memory page file data from the new dynamic link library, covering data in the difference memory page with the new memory page file data, and resuming execution of the process.

2. The method of claim 1, wherein the dynamic link library is updated by, The acquiring of the virtual address interval of the code segment of the dynamic link library to be processed in the target process comprises: acquiring memory mapping information of the target process; determining a code segment corresponding to the dynamic link library to be processed according to the memory mapping information; determining a virtual address range of the code segment in a virtual address space of the target process as the virtual address interval of the target process.

3. The method of claim 2, wherein the dynamic link library is updated by, The determining of the code segment corresponding to the dynamic link library to be processed according to the memory mapping information comprises: acquiring an interface file of the target process and reading the memory mapping information from the interface file of the target process; analyzing the memory mapping information to obtain a memory segment corresponding to the dynamic link library to be processed; the memory with an executable attribute in the memory segment is the code segment of the dynamic link library to be processed.

4. The method of claim 1, wherein the dynamic link library is updated by, The binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine the changed difference memory page comprises: comparing binary codes of the same interfaces in the dynamic link library to be processed and the new dynamic link library; identifying changed interfaces; the changed interfaces include interfaces with changed binary codes, added interfaces or deleted interfaces; determining virtual memory pages occupied by binary codes of the changed interfaces, generating a difference memory page list according to the virtual memory pages; the difference memory page list includes a plurality of difference memory pages.

5. The method of claim 4, wherein the dynamic link library is updated by, The acquiring of new memory page file data from the new dynamic link library, covering data in the difference memory page with the new memory page file data comprises: selecting a virtual memory page from the difference memory page list; acquiring a page table of the target process and querying a start address corresponding to the virtual memory page according to the page table; reading new data of a memory page size corresponding to the difference memory page from the new dynamic link library to obtain the new memory page file data; writing the new memory page file data into a physical memory page pointed by the start address.

6. The method of claim 1, wherein the dynamic link library is updated by, The method further comprises: if the virtual address is in the virtual address interval, returning to the process list and selecting a next process from the process list for covering processing.

7. The method of claim 1, wherein the dynamic link library is updated by, The suspending the execution of the target process comprises sending a stop signal to the target process, and / or directly performing a data overwrite operation when the process is in an unblockable blocking state.

8. An updating apparatus of a dynamic link library, characterized by comprising: The device comprises: a process list obtaining module, configured to obtain a process list of a dynamic link library to be processed and a new dynamic link library; an address interval determining module, configured to select a target process from the process list and obtain a virtual address interval of a code segment of the dynamic link library to be processed in the target process; a virtual address judging module, configured to obtain a virtual address of a next instruction to be executed of the target process and judge whether the virtual address is in the virtual address interval; a target process suspending module, configured to suspend the execution of the target process if the virtual address is not in the virtual address interval; an interface difference analyzing module, configured to perform binary difference analysis on the same interfaces of the dynamic link library to be processed and the new dynamic link library to determine a changed difference memory page; a file data overwriting module, configured to obtain new memory page file data from the new dynamic link library, overwrite data in the difference memory page with the new memory page file data, and resume the execution of the process.

9. An electronic device, comprising: comprise: a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program being executed by the processor to implement the steps of the dynamic link library updating method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, a program is stored on the computer readable storage medium, and the program is executed by the processor to implement the steps of the dynamic link library updating method according to any one of claims 1-7.

Images