Analysis function providing device, analysis function providing method, and analysis function providing program

Abstract

A virtual machine analysis unit (121) analyzes a VM of a script engine and acquires information relating to the architecture of the script engine. A symbol table detection unit (1218) detects a symbol table, which holds information relating to variables, on the basis of the acquired information relating to the architecture. A symbol table analysis unit (1219) analyzes the structure of the symbol table. An instruction set architecture analysis unit (122) acquires information pertaining to an instruction set architecture, which is the structure of virtual machine instructions, on the basis of the acquired information relating to the architecture. A VM instruction determination unit (1223) determines, using the symbol table and the information pertaining to the instruction set architecture, a virtual machine instruction that corresponds to a variable held by the symbol table.

Description

[Technical Field]

[0001] The present invention relates to an analytical function providing device, an analytical function providing method, and an analytical function providing program. [Background technology]

[0002] One of the important techniques for analyzing software is tracking the values ​​of variables held by a program. This involves obtaining information such as what variables are being used by the program at a given time during program execution and what values ​​they hold. For example, debuggers have the ability to track information about variables and values ​​during execution, and are widely used during program development and debugging. What variables exist and what values ​​they hold are closely related to program behavior, so this is an important technique in software testing, reverse engineering, and so on (see Non-Patent Document 1).

[0003] Additionally, with the widespread use of scripts in program development, tracking the variables held by scripts is also an important technology. In scripts, information about variables and the values ​​they hold are managed by a symbol table in the script engine (also called an interpreter), and it is common to access and obtain information from that symbol table through analysis support functions such as a debugger provided by the script engine. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] JongHyup Lee, Thanassis Avgerinos, David Brumley,“TIE: Principled Reverse Engineering of Types in Binary Programs” Summary of the Invention [Problem to be solved by the invention]

[0005] However, with conventional technologies, it can be difficult to obtain variable information. This is because the internal specifications of the virtual machine (VM) within the script engine that controls script execution are often not publicly disclosed, making it difficult to identify the location where the symbol table is stored and analyze the structure of the symbol table without support functions. For example, if support functions such as the debugger mentioned above are not provided, it is necessary to reverse engineer the VM to identify the internal specifications, independently analyze the symbol table, and obtain information about variables and values. Manually analyzing, designing, and implementing this for each script engine is unrealistic in terms of the effort required.

[0006] The present invention has been made in consideration of the above, and aims to make it possible to provide a function for acquiring variable information to a script engine that does not have support functions such as a debugger and has a VM whose internal specifications are unknown, without requiring manual individual analysis, design, and implementation. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the object, the analysis function-imparting device of the present invention is characterized by having: a first acquisition unit that analyzes the virtual machine of a script engine and acquires information about the architecture of the script engine; a detection unit that detects a symbol table that holds information about variables based on the acquired information about the architecture; an analysis unit that analyzes the structure of the detected symbol table; a second acquisition unit that acquires information about the instruction set architecture, which is the instruction system of the virtual machine, based on the acquired information about the architecture; and a determination unit that uses the analyzed symbol table and the information about the instruction set architecture to determine the instruction of the virtual machine that corresponds to the variable held in the symbol table. [Effects of the Invention]

[0008] According to the present invention, it is possible to provide a function for obtaining variable information to a script engine that does not have support functions such as a debugger and has a VM whose internal specifications are unknown, without requiring manual individual analysis, design, and implementation. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram illustrating the general configuration of the analysis function imparting device of this embodiment. [Figure 2] FIG. 2 is a diagram showing an example of a test script (first test script) used for detecting a virtual program counter. [Figure 3] FIG. 3 is a diagram showing an example of a test script (second test script) used to detect a conditional branch flag. [Figure 4] FIG. 4 is a diagram illustrating an example of an execution trace. [Figure 5] FIG. 5 is a diagram illustrating an example of a VM execution trace. [Figure 6] FIG. 6 is a flowchart showing the processing procedure of the analysis function providing process. [Figure 7] FIG. 7 is a flowchart showing the processing procedure of the execution trace acquisition processing. [Figure 8] FIG. 8 is a flowchart showing the processing procedure of the virtual program counter detection processing. [Figure 9] FIG. 9 is a flowchart showing the procedure of the VM instruction boundary detection process. [Figure 10] FIG. 10 is a flowchart showing the procedure of the dispatcher detection process. [Figure 11] FIG. 11 is a flowchart showing the procedure of the conditional branch flag detection process. [Figure 12] FIG. 12 is a flowchart showing the procedure of the code cache detection process. [Figure 13] FIG. 13 is a flowchart showing the procedure of the variable detection process. [Figure 14]FIG. 14 is a flowchart showing the processing procedure of the symbol table detection process. [Figure 15] FIG. 15 is a flowchart showing the processing procedure of the symbol table analysis process. [Figure 16] FIG. 16 is a flowchart illustrating the procedure of the VM execution trace acquisition process. [Figure 17] FIG. 17 is a flowchart showing the procedure of the VM instruction collection process. [Figure 18] FIG. 18 is a flowchart showing the procedure of the VM instruction determination process. [Figure 19] FIG. 19 is a flowchart showing the procedure of the hook insertion process. [Figure 20] FIG. 20 is a diagram illustrating an example of a computer that executes an analysis function providing program. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0011] [Outline of the analytical function device] The analysis function-imparting device of this embodiment is applied to a script engine, executes a test script while monitoring the binary of the script engine, and acquires branch traces and memory access traces as execution traces.The analysis function-imparting device then analyzes the VM based on the execution traces and acquires architecture information related to the architecture of the script engine, such as a VPC (virtual program counter), a dispatcher, a conditional branch flag, and a code cache.

[0012] Furthermore, the analysis function providing device executes the test script while monitoring the VPC and the dispatcher, and acquires the VM execution trace. By analyzing this VM execution trace, it collects the VM instructions, identifies the VM instructions, and acquires the information of the instruction set architecture.

[0013] The analysis function adding device detects and analyzes the symbol table based on the obtained architecture information, and adds a function to acquire variable information of the script engine.In this way, even for script engines whose internal VM specifications are unknown, the analysis function adding device detects various architectural information through analysis based on the acquired execution trace and VM execution trace, and realizes adding a function to acquire variables without requiring manual reverse engineering.

[0014] Furthermore, the analysis function-imparting device can automatically add a variable acquisition function to various script engines by preparing test scripts, eliminating the need for individual design or implementation. This makes it possible to acquire variables from scripts written in various script languages, enabling more advanced script analysis.

[0015] [Configuration of the analysis function-providing device] 1 is a schematic diagram illustrating the general configuration of an analytical function-imparting device according to the present embodiment. As illustrated in FIG. 1, an analytical function-imparting device 10 according to the present embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, a control unit 12, a storage unit 13, and an output unit 14.

[0016] The input unit 11 is realized using input devices such as a keyboard and a mouse, and accepts input of information from an operator or external sources, and inputs the information to the control unit 12. For example, the input unit 11 accepts input of a test script or a script engine binary. The input unit 11 also accepts input of information transmitted from an external device via a telecommunications line.

[0017] A test script is a script that is input when dynamically analyzing a script engine to obtain an execution trace and a VM execution trace. This test script focuses on the number of branch instruction executions and memory read / writes, and is used to capture differences in the behavior of the script engine that occur when the test script is executed a different number of times. This test script is prepared in advance of analysis and is created manually. Creating this test script requires knowledge of the specifications of the target script language. In the analysis function-providing device of this embodiment, the test script used for VPC detection (first test script) is different from the test script used for conditional branch flag detection (second test script).

[0018] 2 shows an example of a test script (first test script) used for VPC detection. The first test script uses a repetitive process (line 2). The first test script changes the execution conditions and generates differences by increasing or decreasing the number of repetitions (line 2) and the number of repeated statements (lines 3 to 5) in the test script.

[0019] 3 is a diagram showing an example of a test script (second test script) used to detect conditional branch flags. The second test script uses multiple conditional branches (lines 4 to 8). In the second test script, the branch conditions are controlled so that the multiple conditional branches are either taken or not taken in a specific order pattern (lines 1 and 5). In the second test script, the number of conditional branches and the order pattern of branch success / failure are changed to generate differences.

[0020] A script engine binary is an executable file that makes up a script engine. A script engine binary may consist of multiple executable files.

[0021] The output unit 14 is realized by a display device such as a liquid crystal display, a printing device such as a printer, etc. For example, the output unit 14 displays the results of the analysis function imparting process described below. The output unit 14 may also output various information to an external device.

[0022] The storage unit 13 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk, an optical disk, etc. The storage unit 13 stores in advance the processing program that operates the analysis function imparting device 10, data used during the execution of the processing program, etc., or temporarily stores them each time processing is performed.

[0023] The storage unit 13 stores an execution trace database (DB) 131, a VM execution trace DB 133, and an architecture information DB 132.

[0024] The execution trace DB 131 and the VM execution trace DB 133 store the execution traces and VM execution traces acquired by the execution trace acquisition unit 1211 and the VM execution trace acquisition unit 1221, respectively. The execution trace DB 131 and the VM execution trace DB 133 are managed by the analysis function-imparting device 10. Of course, the execution trace DB 131 and the VM execution trace DB 133 may be managed by another device (such as a server). In this case, the execution trace acquisition unit 1211 and the VM execution trace acquisition unit 1221 output the acquired execution traces and VM execution traces to a management server or the like for the execution trace DB 131 and the VM execution trace DB 133 via the communication interface of the output unit 14, and store them in the execution trace DB 131 and the VM execution trace DB 133.

[0025] The control unit 12 is realized using a CPU (Central Processing Unit), an MPU (Micro Processing Unit), etc., and executes a processing program stored in a memory. As a result, the control unit 12 functions as a virtual machine analysis unit 121 (first acquisition unit), an instruction set architecture analysis unit 122 (second acquisition unit), and an analysis function assignment unit 123 (assignment unit), as illustrated in FIG.

[0026] The virtual machine analysis unit (first acquisition unit) 121 analyzes the VM of the script engine and acquires information about the architecture of the script engine. Specifically, the virtual machine analysis unit (first acquisition unit) 121 executes a test script while monitoring the binary of the script engine, and acquires a branch trace and a memory access trace as an execution trace. The virtual machine analysis unit 121 also analyzes the VM based on the execution trace and acquires information about the architecture of the script engine. The architecture information includes any one of a virtual program counter, a dispatcher, a conditional branch flag, or a code cache.

[0027] The virtual machine analysis unit 121 includes an execution trace acquisition unit 1211, a virtual program counter detection unit 1212, a VM instruction boundary detection unit 1213, a dispatcher detection unit 1214, a conditional branch flag detection unit 1215, a code cache detection unit 1216, a variable detection unit 1217, a symbol table detection unit 1218, and a symbol table analysis unit 1219.

[0028] The execution trace acquisition unit 1211 receives a test script and a script engine binary as inputs. The execution trace acquisition unit 1211 executes the test script while monitoring the execution of the script engine binary, thereby acquiring an execution trace.

[0029] An execution trace is made up of a branch trace and a memory access trace. A branch trace records the type of branch instruction at the time of execution, the branch source address, and the branch destination address. A memory access trace records the type of memory operation and the memory address of the operation target. It is known that branch traces and memory access traces can be acquired by instruction hooks. The execution trace acquired by the execution trace acquisition unit 1211 is stored in the execution trace DB 131.

[0030] 4 is a diagram showing an example of an execution trace. The execution trace has an element called trace. The trace indicates whether the log line is a branch trace or a memory access trace.

[0031] A branch trace log line is formatted as shown in lines 1 to 10 of Figure 4, and consists of three elements: type, src, and dst. type indicates whether the executed branch instruction was a call instruction, a jmp instruction, or a ret instruction. src indicates the address of the branch source, and dst indicates the address of the branch destination.

[0032] A log line of a memory access trace is formatted as shown in lines 11 to 13 of Figure 4, and consists of three elements: type, target, and value. type indicates whether the memory access is a read or write. target indicates the memory address that is the target of the memory access. value stores the result of the memory access.

[0033] The virtual program counter detection unit 1212 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131 to detect a VPC. The virtual program counter detection unit 1212 detects a VPC by analyzing multiple execution traces using differential execution analysis that focuses on the number of times memory is read and the boundaries of each VM instruction detected by the VM instruction boundary detection unit 1213. The virtual program counter detection unit 1212 utilizes the fact that a read into memory that holds a VPC always occurs after the execution of each VM instruction, and detects the VPC by finding the destination of this read.

[0034] For this reason, the virtual program counter detection unit 1212 uses differential execution analysis, focusing on the number of memory reads, to detect VPCs. The virtual program counter detection unit 1212 compares execution traces of multiple test scripts acquired using the test scripts, and finds memories whose memory read counts change in proportion to both the number of repetitions and the number of repeated statements. The virtual program counter detection unit 1212 then refers to the boundaries of each VM instruction detected by the VM instruction boundary detection unit 1213, and narrows down the memory values ​​read from the memory to those whose values ​​always point to the start points of the VM instructions. The virtual program counter detection unit 1212 detects these memories as VPCs.

[0035] The VM instruction boundary detection unit 1213 clusters the execution trace to detect the boundaries of each VM instruction. The VM instruction boundary detection unit 1213 clusters the execution trace and detects clusters with a threshold or more of execution count as VM instructions. Clustering detects consecutive code regions that are executed multiple times. For example, this may be done by grouping executed instructions that are close in code distance, by searching for common subsequences of executed code blocks, or by other methods. The analysis function providing device 10 detects the start and end points of consecutive instruction sequences that make up the detected VM instruction as boundaries. The VM instruction boundaries detected here are used in VPC detection and dispatcher detection.

[0036] The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary based on the VM instruction boundaries detected by the VM instruction boundary detection unit 1213, and detects, as a dispatcher, a portion with high similarity between each VM instruction. The detection of the portion with high similarity may use, for example, a sequence alignment algorithm or other methods.

[0037] The conditional branch flag detection unit 1215 extracts and analyzes the execution trace for the second test script stored in the execution trace DB 131 to find the conditional branch flag. Here, the VM instruction that causes a branch in the script is the branch VM instruction, and the conditional branch flag is an area that holds a flag indicating whether or not the branch will be taken at the time of the conditional branch. The conditional branch flag detection unit 1215 analyzes multiple execution traces using differential execution analysis that focuses on the number of times memory is read, and detects the conditional branch flag. The conditional branch flag detection unit 1215 executes conditional branches in various patterns, and detects the memory that stores the conditional branch flag by comparing the pattern of memory changes that occur at that time with the conditional branch pattern in the test script.

[0038] The code cache detection unit 1216 receives an execution trace and a VM execution trace as input, and acquires the memory area indicated by the VPC from the VM execution trace. The code cache detection unit 1216 also acquires from the execution trace the code location that called the memory allocation function that allocated the memory area. The code cache detection unit 1216 also detects all areas allocated at the code location as code caches. The code cache detection unit 1216 then acquires from the execution trace the code locations that are writing to the code cache. The code cache detection unit 1216 also detects all areas written at the code location as updates to the code cache, and returns the code cache and the update locations.

[0039] The variable detection unit 1217 receives a test script as input and extracts an execution trace corresponding to the test script from the execution trace DB 131. The variable detection unit 1217 also extracts pairs of variable names and values ​​written in the test script. The variable detection unit 1217 then searches the written memory access trace for a value whose coincidence with the variable name is higher than a predetermined threshold. The variable detection unit 1217 also searches the written memory access trace for a value whose coincidence with the value is higher than a predetermined threshold. The variable detection unit 1217 then returns the variable name and value corresponding to the variable as a storage destination.

[0040] The symbol table detection unit (detection unit) 1218 detects a symbol table based on the obtained information about the architecture. Specifically, the symbol table detection unit 1218 receives the script engine binary as input and receives variables and corresponding value storage destinations. The symbol table detection unit 1218 also extracts the execution trace from the execution trace DB 131 and collects memory reference relationships related to the value storage destinations through static analysis of the script engine binary. The symbol table detection unit 1218 also collects runtime memory references to variable names and values ​​from the memory access trace, and detects arrays having references to the variable names and values ​​as symbol tables. The symbol table detection unit 1218 then identifies the code location that allocates the memory area for the symbol table from the API trace, makes the location of the symbol table identifiable at runtime, and returns the symbol table.

[0041] Furthermore, symbol table analyzer (analysis unit) 1219 analyzes the structure of the detected symbol table. Specifically, symbol table analyzer 1219 receives the detected symbol table, test script, and script engine binary as input. Furthermore, symbol table analyzer 1219 extracts the execution trace from execution trace DB 131, performs static analysis of the script engine binary, and collects variable dependencies. Symbol table analyzer 1219 infers the types of structures constituting the symbol table using a predetermined method, such as that disclosed in Non-Patent Document 1. Then, based on the memory access trace, symbol table analyzer 1219 identifies variables that hold type information from the co-occurrence of values ​​held in the structures constituting the symbol table and the types of variables allocated by the test script, and returns the structure of the symbol table.

[0042] The instruction set architecture analysis unit (second acquisition unit) 122 acquires information on the instruction set architecture, which is the system of instructions for the VM, based on the acquired information on the architecture. Specifically, the instruction set architecture analysis unit 122 monitors the VPC and the dispatcher and analyzes the VM execution trace executed in the VM, thereby collecting VM instructions, determining the VM instructions, and acquiring information on the instruction set architecture.

[0043] The instruction set architecture analysis unit 122 includes a VM execution trace acquisition unit 1221, a VM instruction collection unit 1222, and a VM instruction determination unit 1223 (determination unit).

[0044] The VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input, similar to the execution trace acquisition unit 1211. The VM execution trace acquisition unit 1221 executes the test script while monitoring the execution of the script engine binary, thereby acquiring a VM execution trace, which is an execution trace executed on the VM.

[0045] The VM execution trace is composed of a VPC and a VM opcode for each executed VM instruction. The VPC can be recorded by monitoring the memory of the VPC detected by the virtual program counter detection unit 1212. The VM opcode here is an identifier virtually assigned to each VM instruction, linking the pointer to the VM instruction with the VM instruction. The VM execution trace acquired by the VM execution trace acquisition unit 1221 is stored in the VM execution trace DB 133.

[0046] Here, Fig. 5 is a diagram showing an example of a VM execution trace. Fig. 5 shows an excerpt of a VM execution trace. A log line of a VM execution trace has, for example, the format shown in Fig. 5 and consists of two elements: vpc and pointer. vpc indicates the value of VPC. Furthermore, pointer indicates the value of the pointer obtained from the pointer cache that points to the beginning of the VM instruction handler to be executed.

[0047] The VM instruction collection unit 1222 receives a VPC and a dispatcher as input. The VM instruction collection unit 1222 also acquires various scripts from the Internet. Then, the VM instruction collection unit 1222 executes the scripts while monitoring the VPC and the dispatcher, and acquires a VM execution trace. The VM instruction collection unit 1222 also acquires VM instructions from the VM execution trace and adds them to a list of VM instructions. Then, when a VM instruction not in the list is no longer found, the VM instruction collection unit 1222 returns the list of VM instructions.

[0048] The VM instruction determination unit (determination unit) 1223 uses the symbol table and information on the instruction set architecture to determine the VM instruction corresponding to the variable stored in the symbol table. Specifically, the VM instruction determination unit 1223 receives a list of VM instructions, VM instruction boundaries, and the symbol table as input. The VM instruction determination unit 1223 also extracts the execution trace and the VM execution trace from the execution trace DB 131.

[0049] Then, the VM instruction determination unit 1223 associates the executed VM instruction with the relevant portion of the execution trace from the list of VM instructions, VM instruction boundaries, execution trace, and VM execution trace. Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that reads a memory area for a value held in the symbol table from the read memory access trace, and determines that the VM instruction reads the value of a variable held in the symbol table. Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that writes a value to a memory area for a value held in the symbol table from the read memory access trace, and determines that the VM instruction updates the value of a variable held in the symbol table.

[0050] The analysis function adding unit (adding unit) 123 adds a function to output information on variables of the script engine to the script engine using the VM instruction determined to be a symbol table. Specifically, the hook inserting unit 1231 included in the analysis function adding unit 123 receives as input the symbol table, a VM instruction for reading and writing the symbol table, and the script engine binary, and adds a function to output information on the symbol table to the script engine binary using a hook. Furthermore, the hook inserting unit 1231 adds a function to output updated information to the script engine binary using a hook each time a VM instruction for updating the symbol table is executed.

[0051] Then, the hook insertion unit 1231 outputs the script engine binary to which the function of acquiring variable information has been added.

[0052] [Processing procedure for adding analysis functions] Next, a description will be given of the processing procedure of the analysis function imparting process by the analysis function imparting device 10 according to this embodiment. Fig. 6 is a flowchart showing the processing procedure of the analysis function imparting process.

[0053] First, the input unit 11 receives a test script and a script engine binary as input (step S1).

[0054] Then, the execution trace acquisition unit 1211 executes the test script while monitoring the binary of the script engine, thereby performing an execution trace acquisition process to acquire a branch trace and a memory access trace (step S2).

[0055] The virtual program counter detection unit 1212 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131, and performs a virtual program counter detection process to discover VPCs (step S3).The VM instruction boundary detection unit 1213 then detects VM instructions and performs a VM instruction boundary detection process to detect VM instruction boundaries (step S4).The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary and performs a dispatcher detection process to detect portions with high similarity between each VM instruction as dispatchers (step S5).The conditional branch flag detection unit 1215 extracts and analyzes the execution trace for the second test script stored in the execution trace DB 131, and performs a conditional branch flag detection process to discover conditional branch flags (step S6).

[0056] The code cache detection unit 1216 receives the execution trace and the VM execution trace as input, and performs a code cache detection process to detect updated parts of the code cache (step S7). The variable detection unit 1217 receives the test script as input, and performs a variable detection process to detect pairs of variable names and values ​​(step S8). The symbol table detection unit 1218 receives the script engine binary as input, and performs a symbol table detection process to detect an array having references to variable names and values ​​as a symbol table (step S9). The symbol table analysis unit 1219 receives the symbol table, the test script, and the script engine binary as input, and performs a symbol table analysis process to analyze the structure of the symbol table (step S10).

[0057] The VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input, and executes the test script while monitoring the execution of the script engine binary, thereby performing a VM execution trace acquisition process (step S11). The VM instruction collection unit 1222 receives and monitors a VPC and a dispatcher, and performs a VM instruction collection process to collect a list of VM instructions (step S12). The VM instruction determination unit 1223 receives a list of VM instructions, VM instruction boundaries, and a symbol table as input, and performs a VM instruction determination process to determine a VM instruction corresponding to the symbol table (step S13).

[0058] The hook insertion unit 1231 receives the symbol table as an input and performs a hook insertion process to add a function to acquire variable information to the script engine binary (step S14). The hook insertion unit 1231 also outputs the script engine to which the variable information acquisition function has been added to the output unit 14 (step S15). This completes the series of analysis function addition processes.

[0059] [Execution trace acquisition process procedure] FIG. 7 is a flowchart showing the processing procedure of the execution trace acquisition processing shown in FIG.

[0060] First, the execution trace acquisition unit 1211 receives a test script and a script engine binary as input (step S21). Then, the execution trace acquisition unit 1211 hooks the received script engine to acquire a branch trace (step S22). The execution trace acquisition unit 1211 also hooks the received script engine to acquire a memory access trace (step S23).

[0061] Then, the execution trace acquisition unit 1211 inputs the received test script in this state into the script engine to execute it (step S24), and stores the execution trace acquired thereby in the execution trace DB 131 (step S25).

[0062] The execution trace acquisition unit 1211 determines whether or not all of the input test scripts have been executed (step S26). If all of the input test scripts have been executed (step S26: Yes), the execution trace acquisition unit 1211 ends the process. On the other hand, if all of the input test scripts have not been executed (step S26: No), the execution trace acquisition unit 1211 returns to the execution of the test script in step S24 and continues the process.

[0063] [Procedure for detecting virtual program counter] FIG. 8 is a flowchart showing the procedure of the virtual program counter detection process shown in FIG.

[0064] First, the virtual program counter detection unit 1212 extracts one execution trace by the first test script from the execution trace DB 131 (step S31). Next, the virtual program counter detection unit 1212 focuses on memory access traces among the execution traces, and counts the number of reads for each memory read destination (step S32).

[0065] The virtual program counter detection unit 1212 receives as input the first test script used to acquire the execution trace (step S33), and analyzes the first test script to acquire the number of repetitions and the number of repeated statements (step S34).

[0066] Next, the virtual program counter detection unit 1212 extracts another execution trace by the first test script, which has a different number of repetitions and number of repeated statements, from the execution trace DB 131 (step S35).The virtual program counter detection unit 1212 then focuses on the memory access trace and counts the number of reads for each memory read destination (step S36).The virtual program counter detection unit 1212 also receives as input the first test script used to acquire the execution trace (step S37), analyzes the test script, and acquires the number of repetitions and the number of repeated statements (step S38).

[0067] Here, the virtual program counter detection unit 1212 narrows down the memory read destinations to only those whose read counts change in proportion to the increase or decrease in the number of repetitions or repeated statements (step S39). Furthermore, the virtual program counter detection unit 1212 narrows down the memory read destinations narrowed down in step S39 to those whose read memory values ​​always point to the start point of the VM instruction (step S40).

[0068] Then, the virtual program counter detection unit 1212 determines whether the memory read destinations have been narrowed down to only one (step S41). If the virtual program counter detection unit 1212 has not narrowed down the memory read destinations to only one (step S41: No), the process returns to step S35, where the virtual program counter detection unit 1212 extracts the next execution trace and continues processing. On the other hand, if the virtual program counter detection unit 1212 has narrowed down the memory read destinations to only one (step S41: Yes), the virtual program counter detection unit 1212 stores the narrowed down memory read destination as a virtual program counter in the architecture information DB 132 (step S42), and ends processing.

[0069] [VM instruction boundary detection processing procedure] FIG. 9 is a flowchart showing the procedure of the VM instruction boundary detection process shown in FIG.

[0070] First, the VM instruction boundary detection unit 1213 extracts execution traces from the execution trace DB 131 (step S51). The VM instruction boundary detection unit 1213 clusters the execution traces using a predetermined method (step S52). Any method may be used for clustering.

[0071] The VM instruction boundary detection unit 1213 detects, as a VM instruction, a cluster whose execution count is equal to or greater than a threshold (step S53). Then, the VM instruction boundary detection unit 1213 determines the start point and end point of a continuous instruction sequence that constitutes a VM instruction as a boundary (step S54). The VM instruction boundary detection unit 1213 outputs the VM instruction boundary as a return value (step S55), and ends the VM instruction boundary detection process.

[0072] [Dispatcher detection process procedure] FIG. 10 is a flowchart showing the procedure of the dispatcher detection process shown in FIG.

[0073] First, the dispatcher detection unit 1214 receives the script engine binary as an input (step S61). The dispatcher detection unit 1214 receives the boundaries of VM instructions from the VM instruction boundary detection unit 1213 (step S62).

[0074] The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary based on the boundaries of the VM instructions received from the VM instruction boundary detection unit 1213 (step S63). The dispatcher detection unit 1214 calculates the similarity between the codes of each VM instruction using a predetermined method (step S64). Any method for calculating the similarity may be used as long as it is capable of calculating the similarity between the codes.

[0075] The dispatcher detection unit 1214 extracts a part with high similarity among all VM instructions based on the similarity calculated in step S64 (step S65), and then determines whether it is the end part of the VM instruction (step S66).

[0076] If it is not the end of the VM instruction (step S66: No), the dispatcher detection unit 1214 returns to step S65 and continues the process. If it is the end of the VM instruction (step S66: Yes), the dispatcher detection unit 1214 outputs the extracted part as a dispatcher (step S67) and ends the process.

[0077] [Conditional branch flag detection processing procedure] FIG. 11 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0078] First, the conditional branch flag detection unit 1215 extracts one execution trace by the second test script from the execution trace DB 131 (step S71). Then, the conditional branch flag detection unit 1215 focuses on the memory access trace and counts the number of reads for each memory read destination (step S72).

[0079] The conditional branch flag detection unit 1215 also receives as input the second test script used to acquire the execution trace (step S73), analyzes this second test script, and acquires the number of conditional branches and the True / False order pattern (step S74).The conditional branch flag detection unit 1215 then narrows down the memory read destinations to only those whose read count changes in proportion to the number of conditional branches (step S75).Furthermore, the conditional branch flag detection unit 1215 narrows down the memory read destinations to only those whose read memory values ​​alternate between two values ​​in accordance with the True / False order pattern (step S76).

[0080] The conditional branch flag detection unit 1215 determines whether the memory read destinations have been narrowed down to only one (step S77). If the conditional branch flag detection unit 1215 has not narrowed down the memory read destinations to only one (step S77: No), it returns to step S71, extracts the next execution trace, and continues processing. On the other hand, if the conditional branch flag detection unit 1215 has narrowed down the memory read destinations to only one (step S77: Yes), it stores the narrowed down read destination in the architecture information DB 132 as a virtual program counter (step S78), and ends processing.

[0081] [Code cache detection process procedure] FIG. 12 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0082] The code cache detection unit 1216 receives an execution trace and a VM execution trace as input (step S81), and acquires the memory area indicated by the VPC from the VM execution trace (step S82). The code cache detection unit 1216 also acquires, from the execution trace, the code location that called the memory allocation function that allocated the memory area (step S83). The code cache detection unit 1216 also detects all areas allocated at the code location as code caches (step S84). The code cache detection unit 1216 then acquires, from the execution trace, the code locations that are writing to the code cache (step S85). The code cache detection unit 1216 also detects all areas written at the code location as updates to the code cache (step S86), returns the code cache and the updated locations (step S87), and ends the process.

[0083] [Variable detection processing procedure] FIG. 13 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0084] The variable detection unit 1217 receives a test script as input (step S91) and extracts an execution trace corresponding to the test script from the execution trace DB 131 (step S92). The variable detection unit 1217 also extracts a pair of variable name and value written in the test script (step S93). The variable detection unit 1217 then searches the written memory access trace for a value whose coincidence with the variable name is higher than a predetermined threshold (step S94). The variable detection unit 1217 also searches the written memory access trace for a value whose coincidence with the value is higher than a predetermined threshold (step S95). The variable detection unit 1217 then returns the variable name and value corresponding to the variable as a storage destination (step S96), and ends the process.

[0085] [Symbol table detection processing procedure] FIG. 14 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0086] The symbol table detection unit (extraction unit) 1218 detects a symbol table based on the obtained information about the architecture. Specifically, the symbol table detection unit 1218 receives the script engine binary as input (step S101) and receives storage destinations for variables and corresponding values ​​(step S102). The symbol table detection unit 1218 also extracts an execution trace from the execution trace DB 131 (step S103) and collects memory reference relationships around the storage destinations for values ​​through static analysis of the script engine binary (step S104). The symbol table detection unit 1218 also collects runtime memory references to variable names and values ​​from the memory access trace (step S105) and detects arrays that have references to variable names and values ​​as symbol tables (step S106). The symbol table detection unit 1218 then identifies code locations that allocate memory areas for the symbol table from the API trace, makes the location of the symbol table identifiable at runtime (step S107), returns the symbol table (step S108), and ends the process.

[0087] [Symbol table analysis processing procedure] FIG. 15 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0088] Furthermore, symbol table analysis unit (analysis unit) 1219 analyzes the structure of the detected symbol table. Specifically, symbol table analysis unit 1219 receives the detected symbol table, test script, and script engine binary as input (steps S111 to S113). Furthermore, symbol table analysis unit 1219 extracts the execution trace from execution trace DB 131, performs static analysis of the script engine binary, and collects variable dependencies (steps S114 to S115). Symbol table analysis unit 1219 infers the types of structures constituting the symbol table using a predetermined method, such as that disclosed in Non-Patent Document 1 (step S116). Then, based on the memory access trace, symbol table analysis unit 1219 identifies variables that hold type information from the co-occurrence of values ​​held by the structures constituting the symbol table and the types of variables allocated by the test script, returns the structure of the symbol table (steps S117 to S118), and ends the process.

[0089] [VM execution trace acquisition process procedure] FIG. 16 is a flowchart showing the procedure of the VM execution trace acquisition process shown in FIG.

[0090] First, the VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input (step S121). Then, the VM execution trace acquisition unit 1221 hooks the received script engine to record the VPC and VM opcode (step S122).

[0091] The VM execution trace acquisition unit 1221 inputs the received test script into the script engine and executes it (step S123), and stores the VM execution trace acquired thereby in the VM execution trace DB 133 (step S124).

[0092] The VM execution trace acquisition unit 1221 determines whether all the input test scripts have been executed (step S125). If all the input test scripts have not been executed (step S125: No), the VM execution trace acquisition unit 1221 returns to the execution of the test script in step S123 and continues the process. On the other hand, if all the input test scripts have been executed (step S125: Yes), the VM execution trace acquisition unit 1221 ends the process.

[0093] [VM instruction collection process procedure] FIG. 17 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0094] The VM instruction collection unit 1222 receives a VPC and a dispatcher as input (step S131). The VM instruction collection unit 1222 also acquires various scripts from the Internet (step S132). The VM instruction collection unit 1222 then executes the scripts while monitoring the VPC and the dispatcher to acquire a VM execution trace (step S133). The VM instruction collection unit 1222 also acquires VM instructions from the VM execution trace and adds them to a list of VM instructions (steps S134 to S135).

[0095] Then, the VM instruction collection unit 1222 checks whether there are any VM instructions not in the list (step S136). If there are any VM instructions not in the list (step S136: No), the VM instruction collection unit 1222 returns the process to step S132. On the other hand, if there are no more VM instructions not in the list (step S136: Yes), the VM instruction collection unit 1222 returns a list of VM instructions (step S137) and ends the process.

[0096] [VM instruction determination processing procedure] FIG. 18 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0097] The VM instruction determination unit (determination unit) 1223 uses the symbol table and information on the instruction set architecture to determine the VM instruction corresponding to the variable stored in the symbol table. Specifically, the VM instruction determination unit 1223 receives a list of VM instructions, VM instruction boundaries, and the symbol table as input (steps S141 to S142). The VM instruction determination unit 1223 also extracts the execution trace and the VM execution trace from the execution trace DB 131 (step S143).

[0098] Then, the VM instruction determination unit 1223 associates the executed VM instruction with the relevant portion of the execution trace from the list of VM instructions, VM instruction boundaries, execution trace, and VM execution trace (step S144). Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that reads a memory area for a value held in the symbol table from the read memory access trace, and determines that it is a VM instruction that reads the value of a variable held in the symbol table (steps S145 to S146). Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that writes a value to a memory area for a value held in the symbol table from the read memory access trace, and determines that it is a VM instruction that updates the value of a variable held in the symbol table (steps S147 to S148), and ends the process.

[0099] [Hook insertion process procedure] FIG. 19 is a flowchart showing the procedure of the hook insertion process shown in FIG.

[0100] The hook insertion unit 1231 receives as input a symbol table, a VM instruction for reading and writing the symbol table, and a script engine binary (steps S151 to S153), and adds a function for outputting information about the symbol table to the script engine binary using a hook (step S154). The hook insertion unit 1231 also adds a function for outputting updated information to the script engine binary using a hook each time a VM instruction for updating the symbol table is executed (step S155). The hook insertion unit 1231 then outputs the script engine binary to which the function for acquiring information about variables has been added (step S156), and ends the process.

[0101] [effect] As described above, in the analysis function providing device 10 of this embodiment, the virtual machine analysis unit (first acquisition unit) 121 analyzes the VM of the script engine and acquires information about the architecture of the script engine. The symbol table detection unit (detection unit) 1218 detects a symbol table that holds information about variables based on the acquired information about the architecture. The symbol table analysis unit (analysis unit) 1219 analyzes the structure of the symbol table. The instruction set architecture analysis unit (second acquisition unit) 122 acquires information about the instruction set architecture, which is the system of instructions for the virtual machine, based on the acquired information about the architecture. The VM instruction determination unit (determination unit) 1223 uses the symbol table and the information about the instruction set architecture to determine the virtual machine instruction that corresponds to the variable held in the symbol table.

[0102] Specifically, the architecture information includes any one of a virtual program counter, a dispatcher, a conditional branch flag, and a code cache. The instruction set architecture analyzer 122 obtains the information on the instruction set architecture by monitoring the virtual program counter and the dispatcher and analyzing the virtual machine execution trace executed in the virtual machine.

[0103] As a result, the analysis function providing device 10 of this embodiment can detect various architecture information by analyzing the execution trace and the VM execution trace even for a script engine whose internal VM specifications are unknown, thereby making it possible to obtain information on variables of the script engine.

[0104] Furthermore, the analysis function providing unit 123 provides the script engine with a function to output variable information of the script engine using the analyzed symbol table and the determined virtual machine command. This allows the analysis function providing device 10 to provide a variable information acquisition function without requiring manual reverse engineering.

[0105] Furthermore, the analysis function-imparting device 10 can automatically impart a variable information acquisition function to a variety of script engines by simply preparing a test script, so that the variable information acquisition function can be imparted without the need for individual design or execution. Therefore, the variable information acquisition function becomes possible for scripts created in various script languages, enabling more advanced script analysis.

[0106] Furthermore, the analysis function-imparting device 10 can analyze the script engine and retrofit the function of measuring code coverage, thereby automatically imparting the function of acquiring variable information to script engines of a wide variety of script languages.

[0107] In this way, the analysis function-imparting device 10 of this embodiment is useful for analyzing variable information of scripts written in a wide variety of script languages, and is suitable for implementing analysis even for scripts for which it is difficult to obtain variable information due to the absence of support functions such as a debugger or unknown internal specifications of the VM. Therefore, by imparting a function for obtaining variable information to various script engines, it becomes possible to analyze script variables and more deeply interpret the functions of the script.

[0108] [program] A program written in a computer-executable language may be created to execute the processes executed by the analysis function-imparting device 10 according to the above embodiment. In one embodiment, the analysis function-imparting device 10 can be implemented by installing an analysis function-imparting program that executes the analysis function-imparting process as package software or online software on a desired computer. For example, by executing the analysis function-imparting program on an information processing device, the information processing device can function as the analysis function-imparting device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the analysis function-imparting device 10 may also be implemented on a cloud server.

[0109] 20 is a diagram showing an example of a computer that executes an analysis function providing program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0110] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, a display 1061.

[0111] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored in the hard disk drive 1031 or memory 1010, for example.

[0112] The analysis function-imparting program is stored in the hard disk drive 1031, for example, as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the analysis function-imparting device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0113] Furthermore, data used for information processing by the analysis function-imparting program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0114] The program module 1093 and program data 1094 related to the analysis function-imparting program are not limited to being stored in the hard disk drive 1031, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the analysis function-imparting program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0115] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0116] 10. Analysis function device 11 Input section 12 Control Unit 13 Storage section 14 Output section 121 Virtual Machine Analysis Department 122 Instruction Set Architecture Analysis Unit 123 Analysis Function Addition Department 131 Execution Trace DB 132 Architecture Information DB 133 VM Execution Trace DB 1211 Execution trace acquisition unit 1212 Virtual Program Counter Detector 1213 VM instruction boundary detection unit 1214 Dispatcher Detector 1215 Conditional Branch Flag Detector 1216 Code Cache Detector 1217 Variable detection unit 1218 Symbol Table Detector 1219 Symbol Table Analysis Unit 1221 VM Execution Trace Acquisition Unit 1222 VM Instruction Collection Unit 1223 VM instruction judgment unit 1231 Hook insertion part

Claims

1. a first acquisition unit that analyzes a virtual machine of the script engine and acquires information about the architecture of the script engine; a detection unit that detects a symbol table that stores information about variables based on the acquired information about the architecture; an analysis unit that analyzes the structure of the detected symbol table; a second acquisition unit that acquires information about an instruction set architecture, which is an instruction system of the virtual machine, based on the acquired information about the architecture; a determination unit that determines an instruction of the virtual machine corresponding to a variable stored in the symbol table using the analyzed symbol table and information on the instruction set architecture; An analytical function-imparting device comprising:

2. 2. The analysis function providing device according to claim 1, further comprising an providing unit that provides a script engine with a function of outputting information on variables of the script engine using the symbol table and the determined virtual machine instructions.

3. 2. The analysis function providing device according to claim 1, wherein the information about the architecture includes any one of a virtual program counter, a dispatcher, a conditional branch flag, and a code cache.

4. 4. The analysis function providing device according to claim 3, wherein the second acquisition unit acquires information about the instruction set architecture by monitoring the virtual program counter and the dispatcher and analyzing a virtual machine execution trace executed in the virtual machine.

5. An analysis function imparting method executed by an analysis function imparting device, a first acquisition step of analyzing a virtual machine of the script engine to acquire information about the architecture of the script engine; a detection step of detecting a symbol table that holds information about variables based on the acquired information about the architecture; an analysis step of analyzing the structure of the detected symbol table; a second acquisition step of acquiring information on an instruction set architecture, which is an instruction system of the virtual machine, based on the acquired information on the architecture; a determining step of determining an instruction of the virtual machine corresponding to a variable stored in the symbol table using the analyzed symbol table and information on the instruction set architecture; A method for providing an analytical function, comprising:

6. a first acquisition step of analyzing a virtual machine of the script engine to acquire information about the architecture of the script engine; a detection step of detecting a symbol table that holds information about variables based on the acquired information about the architecture; an analysis step of analyzing the structure of the detected symbol table; a second acquisition step of acquiring information on an instruction set architecture, which is an instruction system of the virtual machine, based on the acquired information on the architecture; a determining step of determining an instruction of the virtual machine corresponding to a variable held in the symbol table using the analyzed symbol table and information on the instruction set architecture; A program that provides analytical functions to enable a computer to execute the above.

Images