Analysis function imparting device, analysis function imparting method, and analysis function imparting program

Abstract

In this invention, a virtual machine analysis unit (121) analyzes the VM of a script engine and acquires architecture-related information relating to the script engine. An instruction set architecture analysis unit (122) acquires information on an instruction set architecture, which is a system of instructions of the virtual machine, on the basis of the architecture-related information. An instrumentation bytecode extraction unit (1231) extracts instrumentation bytecodes on the basis of the acquired architecture-related information and the information on the instruction set architecture. An insertion unit (1232) inserts the extracted instrumentation bytecodes into bytecodes subject to analysis.

Description

[Technical Field]

[0001] The present invention relates to an analytical function providing device, an analytical function providing method, and an analytical function providing program. [Background technology]

[0002] Instrumentation is one of the techniques for analyzing software. This involves adding code with analytical functions to the program being analyzed, thereby obtaining information about the execution state of the program during runtime. For example, by inserting recording code for each instruction using instrumentation, it is possible to count the number of instructions executed, and by inserting similar code for each branch, it is possible to identify the control flow that was executed. This type of instrumentation is an important technology, and is widely used for software testing as well as cybersecurity purposes such as malware analysis and vulnerability detection.

[0003] There are two types of instrumentation: statically adding instrumentation before a program is executed, and dynamically adding instrumentation during execution. Furthermore, the targets of instrumentation vary widely, including source code, scripts, executable binaries (hereafter referred to as binaries), and bytecode. For example, instrumentation that is dynamically added to binaries is called dynamic binary instrumentation. Nowadays, not only is testing of scripts important, but the opportunities for malicious scripts to be used in attacks are also increasing, making instrumentation of scripts important.

[0004] There are two main methods used for instrumenting scripts: statically adding analysis scripts to scripts before execution, and dynamically adding analysis bytecodes when the script is converted into bytecode by a script engine (also called an interpreter) at runtime.

[0005] The former static addition method has the problem that it can be difficult to comprehensively find the locations where analysis scripts should be added. Another problem is that static addition may not be possible for scripts that are dynamically evaluated at runtime. Furthermore, if the script is obfuscated, comprehensive addition is also difficult, making it ineffective for analyzing malicious scripts. Therefore, the latter method, which dynamically adds scripts to bytecode at runtime, has become common. This method allows for instrumentation even in the aforementioned cases.

[0006] In dynamic instrumentation of a program, first, the conditions for behavior to be met and the type of analysis program to be added to the target program are defined. Then, the execution state of the target program is monitored, and when specific behavior that matches the conditions is observed, execution is stopped and transitioned to the analysis program. Then, once execution of the analysis program is complete, execution is returned to the position before it was stopped and resumed. In this way, the analysis program is executed without impairing the original behavior of the target program.

[0007] There are two main ways to implement bytecode instrumentation: one is to use the debugging functionality provided by the script engine, and the other is to independently monitor the execution of bytecode instructions and add bytecode without relying on the debugging functionality.

[0008] Non-Patent Document 1 proposes a method for implementing dynamic instrumentation for Java (registered trademark) bytecode. Non-Patent Document 2 proposes a method for implementing dynamic instrumentation for ActionScript 3 bytecode. [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] W. Binder, J. Hulaas, P. Moret, “Advanced Java Bytecode Instrumentation”, In Proceedings of the 5th International Symposium on Principles and Practice of Programming in Java, pp. 135-144, 2007 [Non-patent document 2] Jarkko Turkulainen, “Reflash: practical ActionScript3 instrumentation with RABCDAsm”, 2016 Summary of the Invention [Problem to be solved by the invention]

[0010] However, with conventional technologies, it can be difficult to provide dynamic bytecode instrumentation functionality. For example, dynamic bytecode instrumentation in scripts generally requires the use of support functions such as a debugger provided by the script engine. This is because the internal specifications of the virtual machine (VM) within the script engine that controls the execution of scripts are often not publicly available, making it difficult to monitor the execution state and transitions required for instrumentation without such support functions.

[0011] However, if such support functions are not provided, it is necessary to reverse engineer the VM to reveal its internal specifications, independently observe the execution path, analyze the bytecode, and obtain the information needed for instrumentation.

[0012] Conventional technologies use information specific to individual VMs, and require individual design and implementation for various scripting languages. However, manually analyzing, designing, and implementing this for each script engine is not realistic in terms of the effort required.

[0013] The present invention has been made in consideration of the above, and aims to make it possible to provide dynamic bytecode instrumentation functionality to script engines that do not have support functions such as a debugger and whose internal specifications are unknown, without requiring manual individual analysis, design, and implementation. [Means for solving the problem]

[0014] In order to solve the above-mentioned problems and achieve the object, the analysis function-imparting device of the present invention is characterized by having a first acquisition unit that analyzes the virtual machine of a script engine and acquires information about the architecture of the script engine, a second acquisition unit that acquires information about the instruction set architecture, which is the instruction system of the virtual machine, based on the information about the architecture, an extraction unit that extracts instrumentation bytecode based on the acquired information about the architecture and the information about the instruction set architecture, and an insertion unit that inserts the extracted instrumentation bytecode into the bytecode to be analyzed. [Effects of the Invention]

[0015] According to the present invention, it is possible to provide dynamic bytecode instrumentation functionality to script engines that do not have support functions such as a debugger and whose internal specifications are unknown, without requiring manual individual analysis, design, and implementation. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a schematic diagram illustrating the general configuration of the analysis function imparting device of this embodiment. [Figure 2] FIG. 2 is a diagram showing an example of a test script used for detecting a virtual program counter. [Figure 3] FIG. 3 is a diagram illustrating an example of an execution trace. [Figure 4] FIG. 4 is a diagram illustrating an example of a VM execution trace. [Figure 5] FIG. 5 is a flowchart showing the processing procedure of the analysis function providing process. [Figure 6]FIG. 6 is a flowchart showing the processing procedure of the execution trace acquisition processing. [Figure 7] FIG. 7 is a flowchart showing the processing procedure of the virtual program counter detection processing. [Figure 8] FIG. 8 is a flowchart showing the procedure of the VM instruction boundary detection process. [Figure 9] FIG. 9 is a flowchart showing the processing procedure of the dispatcher detection processing. [Figure 10] FIG. 10 is a flowchart showing the procedure of the code cache detection process. [Figure 11] FIG. 11 is a flowchart showing the procedure of the VM execution trace acquisition process. [Figure 12] FIG. 12 is a flowchart showing the procedure of the VM instruction collection process. [Figure 13] FIG. 13 is a flowchart showing the procedure of the VM instruction determination process. [Figure 14] FIG. 14 is a flowchart showing the procedure of the instrumentation bytecode extraction process. [Figure 15] FIG. 15 is a flowchart showing the procedure of the insertion process. [Figure 16] FIG. 16 is a flowchart showing the processing procedure of the execution process. [Figure 17] FIG. 17 is a diagram illustrating an example of a computer that executes an analysis function providing program. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0018] [Outline of the analytical function device] The analysis function-adding device of this embodiment is applied to a script engine, executes a test script while monitoring the binary of the script engine, and acquires branch traces and memory access traces as execution traces.The analysis function-adding device then analyzes the VM based on the execution traces and acquires architecture information related to the architecture of the script engine, such as a VPC (virtual program counter), a dispatcher, a conditional branch flag, and a code cache.

[0019] Furthermore, the analysis function providing device executes the test script while monitoring the VPC and the dispatcher, and acquires the VM execution trace. By analyzing this VM execution trace, it collects the VM instructions, identifies the VM instructions, and acquires the information of the instruction set architecture.

[0020] Based on the obtained architecture information, the analysis function adding device extracts instrumentation bytecode, embeds it into the bytecode to be analyzed, and executes it to realize dynamic bytecode instrumentation.In this way, even for script engines whose VM internal specifications are unknown, the analysis function adding device can detect various architectural information by analyzing the execution trace and VM execution trace, and realizes the addition of dynamic bytecode instrumentation functions without the need for manual reverse engineering.

[0021] Furthermore, the analysis function adding device can automatically add dynamic bytecode instrumentation functionality to various script engines by preparing test scripts, eliminating the need for individual design and implementation. Therefore, dynamic bytecode instrumentation can be performed and analysis can be performed on a wide variety of script engine implementations.

[0022] [Configuration of the analysis function-providing device] 1 is a schematic diagram illustrating the general configuration of an analytical function-imparting device according to the present embodiment. As illustrated in FIG. 1, an analytical function-imparting device 10 according to the present embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, a control unit 12, a storage unit 13, and an output unit 14.

[0023] The input unit 11 is realized using input devices such as a keyboard and a mouse, and accepts input of information from an operator or external sources, and inputs the information to the control unit 12. For example, the input unit 11 accepts input of a test script or a virtual machine binary. The input unit 11 also accepts input of information transmitted from an external device via a telecommunications line.

[0024] A test script is a script that is input when dynamically analyzing a script engine to obtain execution traces and VM execution traces. This test script focuses on the number of branch instruction executions and memory read / writes, and is used to capture differences in the behavior of the script engine that occur when the test script is executed a different number of times. This test script is prepared in advance of analysis and is created manually. Creating it requires knowledge of the specifications of the target scripting language.

[0025] Here, Figure 2 shows an example of a test script used for VPC detection. This test script uses a repetitive process (line 2). The test script changes the execution conditions and generates differences by increasing or decreasing the number of repetitions (line 2) and the number of repeated statements (lines 3 to 5) in the test script.

[0026] A script engine binary is an executable file that makes up a script engine. A script engine binary may consist of multiple executable files.

[0027] The output unit 14 is realized by a display device such as a liquid crystal display, a printing device such as a printer, etc. For example, the output unit 14 displays the results of the analysis function imparting process described below. The output unit 14 may also output various information to an external device.

[0028] The storage unit 13 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk, an optical disk, etc. The storage unit 13 stores in advance the processing program that operates the analysis function imparting device 10, data used during the execution of the processing program, etc., or temporarily stores them each time processing is performed.

[0029] The storage unit 13 stores an execution trace database (DB) 131, a VM execution trace DB 133, and an architecture information DB 132.

[0030] The execution trace DB 131 and the VM execution trace DB 133 store the execution traces and VM execution traces acquired by the execution trace acquisition unit 1211 and the VM execution trace acquisition unit 1221, respectively. The execution trace DB 131 and the VM execution trace DB 133 are managed by the analysis function-imparting device 10. Of course, the execution trace DB 131 and the VM execution trace DB 133 may be managed by another device (such as a server). In this case, the execution trace acquisition unit 1211 and the VM execution trace acquisition unit 1221 output the acquired execution traces and VM execution traces to a management server or the like for the execution trace DB 131 and the VM execution trace DB 133 via the communication interface of the output unit 14, and store them in the execution trace DB 131 and the VM execution trace DB 133.

[0031] The control unit 12 is realized using a CPU (Central Processing Unit), an MPU (Micro Processing Unit), etc., and executes processing programs stored in memory, thereby allowing the control unit 12 to function as a virtual machine analysis unit 121 (first acquisition unit), an instruction set architecture analysis unit 122 (second acquisition unit), and an instrumentation unit 123, as illustrated in FIG.

[0032] The virtual machine analysis unit 121 (first acquisition unit) analyzes the VM of the script engine and acquires information about the architecture of the script engine. Specifically, the virtual machine analysis unit 121 executes a test script while monitoring the binary of the script engine, and acquires branch traces and memory access traces as execution traces. The analysis function providing device then analyzes the virtual machine VM based on the execution traces and acquires architecture information. The architecture information includes any one of a virtual program counter, a dispatcher, a conditional branch flag, or a code cache.

[0033] The virtual machine analysis unit 121 includes an execution trace acquisition unit 1211 , a virtual program counter detection unit 1212 , a VM instruction boundary detection unit 1213 , a dispatcher detection unit 1214 , and a code cache detection unit 1215 .

[0034] The execution trace acquisition unit 1211 receives a test script and a script engine binary as inputs. The execution trace acquisition unit 1211 executes the test script while monitoring the execution of the script engine binary, thereby acquiring an execution trace.

[0035] An execution trace is made up of a branch trace and a memory access trace. A branch trace records the type of branch instruction at the time of execution, the branch source address, and the branch destination address. A memory access trace records the type of memory operation and the memory address of the operation target. It is known that branch traces and memory access traces can be acquired by instruction hooks. The execution trace acquired by the execution trace acquisition unit 1211 is stored in the execution trace DB 131.

[0036] 3 is a diagram showing an example of an execution trace. The execution trace has an element called trace. The trace indicates whether the log line is a branch trace or a memory access trace.

[0037] A branch trace log line is formatted as shown in lines 1 to 10 of Figure 3, and consists of three elements: type, src, and dst. type indicates whether the executed branch instruction was a call instruction, a jmp instruction, or a ret instruction. src indicates the address of the branch source, and dst indicates the address of the branch destination.

[0038] A log line of a memory access trace is formatted as shown in lines 11 to 13 of Figure 3, and consists of three elements: type, target, and value. type indicates whether the memory access is a read or write. target indicates the memory address that is the target of the memory access. value stores the result of the memory access.

[0039] The virtual program counter detection unit 1212 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131 to detect a VPC. The virtual program counter detection unit 1212 detects a VPC by analyzing multiple execution traces using differential execution analysis that focuses on the number of times memory is read and the boundaries of each VM instruction detected by the VM instruction boundary detection unit 1213. The virtual program counter detection unit 1212 utilizes the fact that a read into memory that holds a VPC always occurs after the execution of each VM instruction, and detects the VPC by finding the destination of this read.

[0040] For this reason, the virtual program counter detection unit 1212 uses differential execution analysis, focusing on the number of memory reads, to detect VPCs. The virtual program counter detection unit 1212 compares execution traces of multiple test scripts acquired using the test scripts, and finds memories whose memory read counts change in proportion to both the number of repetitions and the number of repeated statements. The virtual program counter detection unit 1212 then refers to the boundaries of each VM instruction detected by the VM instruction boundary detection unit 1213, and narrows down the memory values ​​read from the memory to those whose values ​​always point to the start points of the VM instructions. The virtual program counter detection unit 1212 detects these memories as VPCs.

[0041] The VM instruction boundary detection unit 1213 clusters the execution trace to detect the boundaries of each VM instruction. The VM instruction boundary detection unit 1213 clusters the execution trace and detects clusters with a threshold or more of execution count as VM instructions. Clustering detects consecutive code regions that are executed multiple times. For example, this may be done by grouping executed instructions that are close in code distance, by searching for common subsequences of executed code blocks, or by other methods. The analysis function providing device 10 detects the start and end points of consecutive instruction sequences that make up the detected VM instruction as boundaries. The VM instruction boundaries detected here are used in VPC detection and dispatcher detection.

[0042] The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary based on the VM instruction boundaries detected by the VM instruction boundary detection unit 1213, and detects, as a dispatcher, a portion with high similarity between each VM instruction. The detection of the portion with high similarity may use, for example, a sequence alignment algorithm or other methods.

[0043] The code cache detection unit 1215 receives an execution trace and a VM execution trace as input, and acquires the memory area indicated by the VPC from the VM execution trace. The code cache detection unit 1215 also acquires from the execution trace the code location that called the memory allocation function that allocated the memory area. The code cache detection unit 1215 also detects all areas allocated at the code location as code caches. The code cache detection unit 1215 then acquires from the execution trace the code locations that are writing to the code cache. The code cache detection unit 1215 also detects all areas written at the code location as updates to the code cache, and returns the code cache and the update locations.

[0044] The instruction set architecture analysis unit (second acquisition unit) 122 acquires information on the instruction set architecture, which is the instruction system of the VM, based on the acquired information on the architecture. Specifically, the instruction set architecture analysis unit 122 monitors the VPC and the dispatcher and analyzes the virtual machine execution trace executed in the VM, thereby collecting VM instructions, determining the VM instructions, and acquiring information on the instruction set architecture.

[0045] The instruction set architecture analysis unit 122 includes a VM execution trace acquisition unit 1221 , a VM instruction collection unit 1222 , and a VM instruction determination unit 1223 .

[0046] The VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input, similar to the execution trace acquisition unit 1211. The VM execution trace acquisition unit 1221 executes the test script while monitoring the execution of the script engine binary, thereby acquiring a VM execution trace, which is an execution trace executed on the VM.

[0047] The VM execution trace is composed of a VPC and a VM opcode for each executed VM instruction. The VPC can be recorded by monitoring the memory of the VPC detected by the virtual program counter detection unit 1212. The VM opcode here is an identifier virtually assigned to each VM instruction, linking the pointer to the VM instruction with the VM instruction. The VM execution trace acquired by the VM execution trace acquisition unit 1221 is stored in the VM execution trace DB 133.

[0048] Here, Fig. 4 is a diagram showing an example of a VM execution trace. Fig. 4 shows an excerpt of a VM execution trace. A log line of a VM execution trace has, for example, the format shown in Fig. 4 and consists of two elements: vpc and pointer. vpc indicates the value of VPC. Furthermore, pointer indicates the value of the pointer obtained from the pointer cache that points to the beginning of the VM instruction handler to be executed.

[0049] The VM instruction collection unit 1222 receives a VPC and a dispatcher as input. The VM instruction collection unit 1222 also acquires various scripts from the Internet. Then, the VM instruction collection unit 1222 executes the scripts while monitoring the VPC and the dispatcher, and acquires a VM execution trace. The VM instruction collection unit 1222 also acquires VM instructions from the VM execution trace and adds them to a list of VM instructions. Then, when a VM instruction not in the list is no longer found, the VM instruction collection unit 1222 returns the list of VM instructions.

[0050] The VM instruction determination unit 1223 uses the symbol table and information on the instruction set architecture to determine the VM instruction corresponding to the variable stored in the symbol table. Specifically, the VM instruction determination unit 1223 receives as input a list of VM instructions, VM instruction boundaries, and the symbol table. The VM instruction determination unit 1223 also extracts the execution trace and the VM execution trace from the execution trace DB 131.

[0051] Then, the VM instruction determination unit 1223 associates the executed VM instruction with the relevant portion of the execution trace from the list of VM instructions, VM instruction boundaries, execution trace, and VM execution trace. Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that reads a memory area for a value held in the symbol table from the read memory access trace, and determines that the VM instruction reads the value of a variable held in the symbol table. Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that writes a value to a memory area for a value held in the symbol table from the read memory access trace, and determines that the VM instruction updates the value of a variable held in the symbol table.

[0052] The instrumentation unit 123 receives an instrumentation script and an analysis target script as input, and inserts instrumentation bytecode extracted from the instrumentation script into the analysis target bytecode for execution. The instrumentation unit 123 includes an instrumentation bytecode extraction unit 1231, an insertion unit 1232, and an execution unit 1233.

[0053] The instrumentation bytecode extraction unit (extraction unit) 1231 extracts instrumentation bytecodes based on the acquired information about the architecture and the information about the instruction set architecture. Specifically, the instrumentation bytecode extraction unit 1231 receives an instrumentation script as an input, executes it, and extracts the bytecodes written to the code cache.

[0054] The insertion unit 1232 inserts the extracted instrumentation bytecode into the bytecode to be analyzed. Specifically, the insertion unit 1232 receives the script to be analyzed and the extracted bytecode as input, temporarily suspends execution of the script to be analyzed, and expands the extracted bytecode into memory space. The insertion unit 1232 then outputs the memory address where the bytecode is expanded.

[0055] The execution unit 1233 executes the script into which the instrumentation bytecode has been inserted. That is, the execution unit 1233 executes the script to be analyzed into which the instrumentation bytecode has been inserted, and outputs the input value in which the problem occurred as the analysis result to the output unit 14.

[0056] Specifically, the execution unit 1233 receives as input the memory address where the bytecode has been expanded by the insertion unit 1232. The execution unit 1233 also receives as input the VPC and the dispatcher and monitors them.

[0057] The execution unit 1233 then resumes the execution of the analysis target script that was temporarily stopped by the insertion unit 1232, and if the VM instruction acquired from the dispatcher is a VM instruction to be instrumented, it saves the current VPC, rewrites the VPC to the memory address where the bytecode is expanded, and executes the inserted bytecode. Furthermore, once the execution unit 1233 has executed the bytecode up to the end, it restores the VPC to the saved value. Once the execution of the analysis target script is complete, the execution unit 1233 outputs the analysis result.

[0058] [Processing procedure for adding analysis functions] Next, a description will be given of the processing procedure of the analysis function imparting process by the analysis function imparting device 10 according to this embodiment. Fig. 5 is a flowchart showing the processing procedure of the analysis function imparting process.

[0059] First, the input unit 11 receives a test script and a script engine binary as input (step S1).

[0060] Then, the execution trace acquisition unit 1211 executes the test script while monitoring the binary of the script engine, thereby performing an execution trace acquisition process to acquire a branch trace and a memory access trace (step S2).

[0061] The virtual program counter detection unit 1212 extracts and analyzes the execution trace for the first test script stored in the execution trace DB 131, and performs virtual program counter detection processing to find VPCs (step S3). The VM instruction boundary detection unit 1213 detects VM instructions and performs VM instruction boundary detection processing to detect VM instruction boundaries (step S4). The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary and performs dispatcher detection processing to detect highly similar portions between VM instructions as dispatchers (step S5). The code cache detection unit 1215 receives the execution trace and the VM execution trace as input, and performs code cache detection processing to detect updated portions of the code cache (step S6).

[0062] The VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input, and executes the test script while monitoring the execution of the script engine binary, thereby performing a VM execution trace acquisition process (step S7). The VM instruction collection unit 1222 receives and monitors a VPC and a dispatcher, and performs a VM instruction collection process to collect a list of VM instructions (step S8). The VM instruction determination unit 1223 receives a list of VM instructions, VM instruction boundaries, and a symbol table as input, and performs a VM instruction determination process to determine a VM instruction corresponding to the symbol table (step S9).

[0063] The instrumentation bytecode extraction unit 1231 receives the instrumentation script (step S10). Then, the instrumentation bytecode extraction unit 1231 performs an instrumentation bytecode extraction process to extract instrumentation bytecodes based on the acquired information about the architecture and the information about the instruction set architecture (step S11).

[0064] The insertion unit 1232 also receives a script to be analyzed (step S12). The insertion unit 1232 then receives the analysis script as input and performs an insertion process to insert instrumentation bytecode (step S13). The execution unit 1233 also performs an execution process to execute the analysis script into which the instrumentation bytecode has been inserted (step S14). The execution unit 1233 then outputs the input value in which the problem occurred to the output unit 14 (step S15). This completes a series of analysis function imparting processes.

[0065] [Execution trace acquisition process procedure] FIG. 6 is a flowchart showing the processing procedure of the execution trace acquisition processing shown in FIG.

[0066] First, the execution trace acquisition unit 1211 receives a test script and a script engine binary as input (step S21). Then, the execution trace acquisition unit 1211 hooks the received script engine to acquire a branch trace (step S22). The execution trace acquisition unit 1211 also hooks the received script engine to acquire a memory access trace (step S23).

[0067] Then, the execution trace acquisition unit 1211 inputs the received test script in this state into the script engine to execute it (step S24), and stores the execution trace acquired thereby in the execution trace DB 131 (step S25).

[0068] The execution trace acquisition unit 1211 determines whether or not all of the input test scripts have been executed (step S26). If all of the input test scripts have been executed (step S26: Yes), the execution trace acquisition unit 1211 ends the process. On the other hand, if all of the input test scripts have not been executed (step S26: No), the execution trace acquisition unit 1211 returns to the execution of the test script in step S24 and continues the process.

[0069] [Procedure for detecting virtual program counter] FIG. 7 is a flowchart showing the procedure of the virtual program counter detection process shown in FIG.

[0070] First, the virtual program counter detection unit 1212 extracts one execution trace by the first test script from the execution trace DB 131 (step S31). Next, the virtual program counter detection unit 1212 focuses on memory access traces among the execution traces, and counts the number of reads for each memory read destination (step S32).

[0071] The virtual program counter detection unit 1212 receives as input the first test script used to acquire the execution trace (step S33), and analyzes the first test script to acquire the number of repetitions and the number of repeated statements (step S34).

[0072] Next, the virtual program counter detection unit 1212 extracts another execution trace by the first test script, which has a different number of repetitions and number of repeated statements, from the execution trace DB 131 (step S35).The virtual program counter detection unit 1212 then focuses on the memory access trace and counts the number of reads for each memory read destination (step S36).The virtual program counter detection unit 1212 also receives as input the first test script used to acquire the execution trace (step S37), analyzes the test script, and acquires the number of repetitions and the number of repeated statements (step S38).

[0073] Here, the virtual program counter detection unit 1212 narrows down the memory read destinations to only those whose read counts change in proportion to the increase or decrease in the number of repetitions or repeated statements (step S39). Furthermore, the virtual program counter detection unit 1212 narrows down the memory read destinations narrowed down in step S39 to those whose read memory values ​​always point to the start point of the VM instruction (step S40).

[0074] Then, the virtual program counter detection unit 1212 determines whether the memory read destinations have been narrowed down to only one (step S41). If the virtual program counter detection unit 1212 has not narrowed down the memory read destinations to only one (step S41: No), the process returns to step S35, where the virtual program counter detection unit 1212 extracts the next execution trace and continues processing. On the other hand, if the virtual program counter detection unit 1212 has narrowed down the memory read destinations to only one (step S41: Yes), the virtual program counter detection unit 1212 stores the narrowed down memory read destination as a virtual program counter in the architecture information DB 132 (step S42), and ends processing.

[0075] [VM instruction boundary detection processing procedure] FIG. 8 is a flowchart showing the procedure of the VM instruction boundary detection process shown in FIG.

[0076] First, the VM instruction boundary detection unit 1213 extracts execution traces from the execution trace DB 131 (step S51). The VM instruction boundary detection unit 1213 clusters the execution traces using a predetermined method (step S52). Any method may be used for clustering.

[0077] The VM instruction boundary detection unit 1213 detects, as a VM instruction, a cluster whose execution count is equal to or greater than a threshold (step S53). Then, the VM instruction boundary detection unit 1213 determines the start point and end point of a continuous instruction sequence that constitutes a VM instruction as a boundary (step S54). The VM instruction boundary detection unit 1213 outputs the VM instruction boundary as a return value (step S55), and ends the VM instruction boundary detection process.

[0078] [Dispatcher detection process procedure] FIG. 9 is a flowchart showing the procedure of the dispatcher detection process shown in FIG.

[0079] First, the dispatcher detection unit 1214 receives the script engine binary as an input (step S61). The dispatcher detection unit 1214 receives the boundaries of VM instructions from the VM instruction boundary detection unit 1213 (step S62).

[0080] The dispatcher detection unit 1214 extracts each VM instruction portion from the script engine binary based on the boundaries of the VM instructions received from the VM instruction boundary detection unit 1213 (step S63). The dispatcher detection unit 1214 calculates the similarity between the codes of each VM instruction using a predetermined method (step S64). Any method for calculating the similarity may be used as long as it is capable of calculating the similarity between the codes.

[0081] The dispatcher detection unit 1214 extracts a part with high similarity among all VM instructions based on the similarity calculated in step S64 (step S65), and then determines whether it is the end part of the VM instruction (step S66).

[0082] If it is not the end of the VM instruction (step S66: No), the dispatcher detection unit 1214 returns to step S65 and continues the process. If it is the end of the VM instruction (step S66: Yes), the dispatcher detection unit 1214 outputs the extracted part as a dispatcher (step S67) and ends the process.

[0083] [Code cache detection process procedure] FIG. 10 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0084] The code cache detection unit 1215 receives an execution trace and a VM execution trace as input (step S71), and acquires the memory area indicated by the VPC from the VM execution trace (step S72). The code cache detection unit 1215 also acquires, from the execution trace, the code location that called the memory allocation function that allocated the memory area (step S73). The code cache detection unit 1215 also detects all areas allocated at the code location as code caches (step S74). The code cache detection unit 1215 then acquires, from the execution trace, the code locations that are writing to the code cache (step S75). The code cache detection unit 1215 also detects all areas written at the code location as updates to the code cache (step S76), returns the code cache and the updated locations (step S77), and ends the process.

[0085] [VM execution trace acquisition process procedure] FIG. 11 is a flowchart showing the procedure of the VM execution trace acquisition process shown in FIG.

[0086] First, the VM execution trace acquisition unit 1221 receives a test script and a script engine binary as input (step S81). Then, the VM execution trace acquisition unit 1221 hooks the received script engine to record the VPC and VM opcode (step S82).

[0087] The VM execution trace acquisition unit 1221 inputs the received test script into the script engine and executes it (step S83), and stores the VM execution trace acquired thereby in the VM execution trace DB 133 (step S84).

[0088] The VM execution trace acquisition unit 1221 determines whether all the input test scripts have been executed (step S85). If all the input test scripts have been executed (step S85: Yes), the VM execution trace acquisition unit 1221 ends the process. If all the input test scripts have not been executed (step S85: No), the VM execution trace acquisition unit 1221 returns to the execution of the test script in step S83 and continues the process.

[0089] [VM instruction collection process procedure] FIG. 12 is a flowchart showing the procedure of the conditional branch flag detection process shown in FIG.

[0090] The VM instruction collection unit 1222 receives a VPC and a dispatcher as input (step S91). The VM instruction collection unit 1222 also acquires various scripts from the Internet (step S92). The VM instruction collection unit 1222 then executes the scripts while monitoring the VPC and the dispatcher to acquire a VM execution trace (step S93). The VM instruction collection unit 1222 also acquires VM instructions from the VM execution trace and adds them to a list of VM instructions (steps S94 to S95).

[0091] Then, the VM instruction collection unit 1222 checks whether there are any VM instructions not in the list (step S96). If there are any VM instructions not in the list (step S96: No), the VM instruction collection unit 1222 returns the process to step S92. On the other hand, if there are no more VM instructions not in the list (step S96: Yes), the VM instruction collection unit 1222 returns a list of VM instructions (step S97) and ends the process.

[0092] [VM instruction determination processing procedure] FIG. 13 is a flowchart showing the procedure of the VM instruction determination process shown in FIG.

[0093] The VM instruction determination unit (determination unit) 1223 receives as input a list of VM instructions, VM instruction boundaries, and a symbol table (steps S101 to S102). The symbol table manages information about variables held by a script and the values ​​held therein, and is acquired by a predetermined method. The VM instruction determination unit 1223 also extracts an execution trace and a VM execution trace from the execution trace DB 131 (step S103).

[0094] Then, the VM instruction determination unit 1223 associates the executed VM instruction with the relevant portion of the execution trace from the list of VM instructions, VM instruction boundaries, execution trace, and VM execution trace (step S104). Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that reads a memory area for a value held in the symbol table from the read memory access trace, and determines that it is a VM instruction that reads the value of a variable held in the symbol table (steps S105 to S106). Furthermore, the VM instruction determination unit 1223 searches for a VM instruction that writes a value to a memory area for a value held in the symbol table from the read memory access trace, and determines that it is a VM instruction that updates the value of a variable held in the symbol table (steps S107 to S108), and ends the process.

[0095] [Processing procedure for extracting instrumentation bytecode] FIG. 14 is a flowchart showing the procedure of the instrumentation bytecode extraction process shown in FIG.

[0096] The instrumentation bytecode extraction unit 1231 receives an instrumentation script as an input (step S111), monitors writing to the code cache (step S112), and executes the instrumentation script (step S113). If writing to the code cache has occurred (step S114, Yes), the instrumentation bytecode extraction unit 1231 extracts the written bytecode (step S115).

[0097] On the other hand, if there is no writing to the code cache (step S114, No), the instrumentation bytecode extraction unit 1231 continues executing the instrumentation script until it is completed (step S116, No → S117 → S114). Also, when the instrumentation bytecode extraction unit 1231 completes the execution of the instrumentation script (step S116, Yes), it outputs the extracted bytecode (step S118) and ends the process.

[0098] [Insert process procedure] FIG. 15 is a flowchart showing the procedure of the insertion process shown in FIG.

[0099] First, the insertion unit 1232 receives, as input, the analysis target script and the bytecode extracted by the instrumentation bytecode extraction unit 1231 (steps S121 to S122), and executes the analysis target script (step S123).

[0100] Next, the insertion unit 1232 temporarily stops the execution of the script to be analyzed (step S124), expands the extracted bytecode in memory space (step S125), outputs the memory address where the bytecode is expanded (step S126), and terminates the processing.

[0101] [Execution process procedure] FIG. 16 is a flowchart showing the processing procedure of the execution process shown in FIG.

[0102] The execution unit 1233 receives as input the memory address into which the bytecode is expanded, output from the insertion unit 1232 (step S131). The execution unit 1233 also receives as input the VPC and the dispatcher (step S132), and monitors the VPC and the dispatcher (steps S133 to S134). The execution unit 1233 also resumes the execution of the analysis target script that was temporarily stopped in process S124 of the insertion unit 1232 (step S135).

[0103] The execution unit 1233 acquires a VM instruction from the dispatcher (step S136). If the acquired VM instruction is a VM instruction to be instrumented (step S137, Yes), the execution unit 1233 saves the current VPC (step S138). In addition, the execution unit 1233 rewrites the VPC to the memory address where the bytecode is expanded (step S139), and executes the inserted bytecode (step S140).

[0104] Then, the execution unit 1233 executes the inserted bytecode until the end (step S141, No → S140), and if it has executed until the end (step S141, Yes), it restores the VPC to the value saved in step S138 (step S142) and continues execution of the script to be analyzed (step S143).

[0105] On the other hand, if the acquired VM instruction is not a VM instruction to be instrumented (No at step S137), the executing unit 1233 continues the execution of the analysis target script (step S143).

[0106] If the execution of the script to be analyzed has not finished (step S144, No), the execution unit 1233 returns the process to step S136, and if the execution has finished (step S144, Yes), the execution unit 1233 outputs the analysis result (step S145) and ends the process.

[0107] [effect] As described above, in the analysis function providing device 10 of this embodiment, the virtual machine analysis unit 121 analyzes the VM of the script engine and acquires information about the architecture of the script engine. The instruction set architecture analysis unit 122 acquires information about the instruction set architecture, which is the system of instructions for the virtual machine, based on the information about the architecture. The instrumentation bytecode extraction unit 1231 extracts instrumentation bytecode based on the acquired information about the architecture and the information about the instruction set architecture. The insertion unit 1232 inserts the extracted instrumentation bytecode into the bytecode to be analyzed.

[0108] Specifically, the information about the architecture includes any one of a virtual program counter, a dispatcher, a conditional branch flag, and a code cache. The second acquisition unit acquires the information about the instruction set architecture by monitoring the virtual program counter and the dispatcher and analyzing a virtual machine execution trace executed in the virtual machine.

[0109] This makes it possible to detect various architectural information through analysis based on the acquisition of execution traces and VM execution traces, even for script engines whose VM internal specifications are unknown, thereby realizing dynamic bytecode instrumentation without the need for manual reverse engineering.

[0110] Furthermore, the execution unit 1233 executes the script into which the instrumentation bytecode has been inserted, thereby making it possible to analyze the script executed on the script engine.

[0111] Furthermore, the analysis function providing device 10 can automatically provide dynamic bytecode instrumentation functionality to a variety of script engines by simply providing a test script, thereby enabling dynamic bytecode instrumentation to be realized without the need for individual design and execution. Therefore, it is possible to realize and analyze dynamic bytecode instrumentation for the implementation of a wide variety of script engines.

[0112] In this way, the analysis function providing device 10 of this embodiment enables dynamic bytecode instrumentation in a wide variety of script engines, making it possible to analyze the execution state of scripts. Therefore, by providing various script engines with the dynamic bytecode instrumentation function, it becomes possible to analyze scripts executed on the script engines.

[0113] [program] A program written in a computer-executable language may be created to execute the processes executed by the analysis function-imparting device 10 according to the above embodiment. In one embodiment, the analysis function-imparting device 10 can be implemented by installing an analysis function-imparting program that executes the analysis function-imparting process as package software or online software on a desired computer. For example, by executing the analysis function-imparting program on an information processing device, the information processing device can function as the analysis function-imparting device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the analysis function-imparting device 10 may also be implemented on a cloud server.

[0114] 17 is a diagram showing an example of a computer that executes an analysis function providing program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0115] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, a display 1061.

[0116] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored in the hard disk drive 1031 or memory 1010, for example.

[0117] The analysis function-imparting program is stored in the hard disk drive 1031, for example, as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the analysis function-imparting device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0118] Furthermore, data used for information processing by the analysis function-imparting program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0119] The program module 1093 and program data 1094 related to the analysis function-imparting program are not limited to being stored in the hard disk drive 1031, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the analysis function-imparting program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0120] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0121] 10. Analysis function device 11 Input section 12 Control Unit 13 Storage section 14 Output section 121 Virtual Machine Analysis Department 122 Instruction Set Architecture Analysis Unit 123 Instrumentation Department 131 Execution Trace DB 132 Architecture Information DB 133 VM Execution Trace DB 1211 Execution trace acquisition unit 1212 Virtual Program Counter Detector 1213 VM instruction boundary detection unit 1214 Dispatcher Detector 1215 Code Cache Detector 1221 VM Execution Trace Acquisition Unit 1222 VM Instruction Collection Unit 1223 VM instruction judgment unit 1231 Instrumentation Bytecode Extractor 1232 Insertion section 1233 Executive Department

Claims

1. a first acquisition unit that analyzes a virtual machine of the script engine and acquires information about the architecture of the script engine; a second acquisition unit that acquires information about an instruction set architecture, which is an instruction system of the virtual machine, based on the information about the architecture; an extraction unit that extracts instrumentation bytecodes based on the acquired information about the architecture and the information about the instruction set architecture; an insertion unit that inserts the extracted instrumentation bytecode into a bytecode to be analyzed; An analytical function-imparting device comprising:

2. 2. The analysis function providing device according to claim 1, further comprising an execution unit that executes a script into which the instrumentation bytecode is inserted.

3. 2. The analysis function providing device according to claim 1, wherein the information about the architecture includes any one of a virtual program counter, a dispatcher, a conditional branch flag, and a code cache.

4. 4. The analysis function providing device according to claim 3, wherein the second acquisition unit acquires information about the instruction set architecture by monitoring the virtual program counter and the dispatcher and analyzing a virtual machine execution trace executed in the virtual machine.

5. An analysis function imparting method executed by an analysis function imparting device, a first acquisition step of analyzing a virtual machine of the script engine to acquire information about the architecture of the script engine; a second acquisition step of acquiring information on an instruction set architecture, which is an instruction system of the virtual machine, based on the information on the architecture; an extraction step of extracting instrumentation bytecodes based on the acquired information about the architecture and the information about the instruction set architecture; an insertion step of inserting the extracted instrumentation bytecode into a bytecode to be analyzed; An analytical function imparting method comprising:

6. a first acquisition step of analyzing a virtual machine of the script engine to acquire information about the architecture of the script engine; a second acquisition step of acquiring information on an instruction set architecture, which is an instruction system of the virtual machine, based on the information on the architecture; an extraction step of extracting instrumentation bytecodes based on the acquired information about the architecture and the information about the instruction set architecture; an insertion step of inserting the extracted instrumentation bytecode into a bytecode to be analyzed; A program that provides analytical functions to enable a computer to execute the above.

Images