Call Stack Acquisition via Control Flow Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional techniques fail to accurately reproduce a call stack containing a function call without frame pointers, limiting their application to programs with debug symbols or monitored environments, and risk incorrect detection of function pointers as return addresses.

Innovation Solution

A call stack acquisition device that extracts possible return addresses from a memory space and analyzes control flows to determine valid return addresses, avoiding errors in detection by examining the relationship between function calls and execution commands.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If general stack tracing technique is used to acquire return addresses by tracing frame pointers, then call stack can be reproduced, but it fails when frame pointers are not used due to compiler optimization or 64 bit Windows execution environment

Engineering Contradiction:

Improvecompatibility with different execution environmentsVSAvoidaccuracy of call stack reproduction

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces control flow information as an intermediary to bridge the gap between stack data and function call relationships. When frame pointers are unavailable, the system uses control flow graphs and return address validation mechanisms to infer call stack relationships, enabling accurate analysis across different execution environments including those without frame pointers

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent changes the approach from relying on frame pointer parameters to using control flow graph parameters and return address validation. By shifting from frame pointer-based tracing to control flow-based analysis, the system adapts to environments where frame pointers are optimized away while maintaining call stack reproduction accuracy

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If scanning return addresses in the stack is used to reproduce call stack without frame pointers, then call stack can be reproduced, but function pointers may be incorrectly detected as return addresses

Engineering Contradiction:

Improveability to handle programs without frame pointersVSAvoidaccuracy of return address detection

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent implements feedback mechanisms through control flow graph validation and return address verification. Each detected return address is validated against the control flow graph to confirm it actually represents a valid function return, providing feedback that eliminates false positives from function pointers while maintaining the ability to handle programs without frame pointers

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent replaces the mechanical approach of directly scanning for return addresses with a more sophisticated system that uses control flow analysis and validation algorithms. This substitution of mechanical scanning with intelligent validation significantly improves precision while maintaining versatility

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If debug symbols are used to reproduce call stack, then accurate call stack can be obtained, but the technique is limited to programs capable of acquiring debug symbols and cannot be applied to release builds or malware

Engineering Contradiction:

Improveaccuracy of call stack reproductionVSAvoidapplicability to different program types

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent extracts the essential functionality of call stack reproduction away from its dependency on debug symbols. By removing the requirement for debug symbols and building call stack analysis on fundamental stack data and control flow graphs, the system can accurately reproduce call stacks across all program types including release builds and malware without requiring any special program modifications

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS11481307B2Call stack acquisition device, call stack acquisition method and call stack acquisition program

Publication Date: 2022.10.25 NIPPON TELEGRAPH & TELEPHONE CORP

AI summary

For the purpose of reproducing a call stack accurately without restricting the range of application, a stack scanner extracts, from a stack area of a thread whose call stack is to be acquired in a memory space of an application process, possible return addresses that are addresses in a feasible region in the memory space each representing a command right after a function call command. A program analyzer analyzes a control flow representing a flow of control configured by a branch in a function that is called by the function call command right before the command represented by each of the possible return addresses and, when there is a route reaching a command currently being executed in the control flow, determines that the possible return address is a return address and, when there is not the route, determines that the possible return address is not a return address.