CN106528403B - Monitoring method when software based on binary code implanted prosthetics is run - Google Patents

Abstract

The invention discloses a software runtime monitoring method based on binary code implantation technology, which comprises the following steps: (1) extracting function calling relationship; (2) extracting function internal control flow information; (3) constructing a finite state machine; (4) initialization table TABbb; (5) initialization table TABstart and TABret; (6) initialization integer variable Cur_F and Cur_B; (7) implantation code; (8) monitoring software operation state; (9) end monitoring; The present invention It has the characteristics of low runtime overhead and relatively simple implementation.

Description

Software Runtime Monitoring Method Based on Binary Code Implantation Technology

technical field

The invention belongs to the technical field of computers, and further relates to a software runtime monitoring method based on binary code implantation in the technical field of software security. The invention is used for PE format files under the windows environment or ELF format files under the linux environment, and uses static binary code implantation technology to effectively monitor the running track of the software.

Background technique

With the development of computer technology, computer software has penetrated into various fields of the national economy. Once some key software is damaged, it will cause economic and security threats to users. Therefore, the security of software has become more and more important. . Running malicious code to gain access to illegitimate data through security vulnerabilities in specific software. Typical security vulnerabilities include buffer overflow vulnerabilities.

The software runtime monitoring method is a technology to judge the security of the software runtime by obtaining the software running status information and track during the actual running stage of the software, and comparing it with the expected running track analyzed in advance.

Usually, static analysis tools can be used to extract software control flow information, such as function call graphs, control flow graphs, etc. According to the type of target code to be analyzed, software static analysis can be divided into analysis based on source code and analysis based on binary code. For source code analysis, the source code program expression and data structure are directly analyzed; binary analysis is performed at the machine code level, and the intermediate expression of the executable code is analyzed. Analysis based on source code can only analyze the control flow information contained in the source code file, but cannot analyze the control flow information contained in the static library and dynamic library files that the software depends on. Based on the analysis of the binary code, not only the control flow information in the software executable file can be analyzed, but also some control flow information contained in the dynamic library file that the software depends on can be analyzed.

The trajectory of software runtime can be obtained through code implantation technology. Code implantation technology is divided into source code-based code implantation and binary-based implantation. Among them, the binary-based implant technology is further divided into dynamic implant and static implant. Compared with dynamic implantation, static implantation is completed before the program is executed, so the runtime overhead of static implantation is smaller, and the implementation of static implantation is relatively simple.

Beihang University discloses a vulnerability detection method in its patent "parallel security vulnerability detection method based on function call graph" (patent application number: 201110417105.3, application publication number: 102567200A). This method uses an analysis method based on source code, generates a function call graph in the corresponding module of the source code file, and only detects the security loopholes in the source code file. The disadvantage of this method is that it cannot analyze the function call relationship and control flow information in the corresponding module of the static library and dynamic library file that the source code depends on, and cannot analyze the existence of the static library and dynamic library that the source code file depends on. Security vulnerabilities are detected.

Changzhou Yunbo Software Engineering Technology Co., Ltd. discloses a method for analyzing the program flow information when the application software is running method for real-time detection. The method utilizes the code implantation technology based on the source code, which can monitor the runtime software in the computer system in real time. The disadvantage of this method is that the newly implanted code can only be executed after being compiled, which cannot avoid large runtime overhead.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the above-mentioned prior art, and propose a software runtime monitoring method based on binary code implantation.

In order to achieve the above object, the idea of the present invention is to use the static binary analysis tool to analyze the call relationship between the functions in the monitored software and the control flow information inside the function, and generate the function call graph G (E, F) and the control flow Graph G(B,E), then use the function call graph G(E,F) to construct a finite state machine FSM(Z,S,T,S0,A), and initialize the table TABbb with the control flow graph G(B,E) . Each state in the state machine corresponds to each function in the function call graph G(E, F), and an invalid state is added to the state machine. The transition relationship between any two valid states in the state machine represents the effective function call or function return relationship between the corresponding functions. Any illegal function call or return will cause the finite state machine to migrate to an invalid state. The number of rows contained in the table TABbb is the same as the number of basic blocks in the corresponding function, and each row contains three fields: (1) respectively represent the index of a basic block, (2) the entry address of the basic block relative to the entry address of the function where the basic block is located Offset, (3) The index of the successor block of the basic block. Use the static binary code implantation tool to load the dependent library containing the monitoring code into the process address space of the monitored software, and implant a call statement to the monitoring function at a specific location of the monitored software. When a function call, a function return, or a change in the control flow within the function occurs during the running of the monitored software, the monitoring function in the dependent library will be called. The monitoring function checks the finite state machine and TABbb to determine whether the running of the monitored software is consistent with the prior analysis and prediction The running trajectory is consistent.

The concrete steps that realize the object of the present invention are as follows:

(1) Extract function call relationship:

Use static binary analysis tools to extract the function call relationship in the monitored software executable file and its dependent library files, and store the function call relationship in the function call graph G(E,F) data structure, where E represents a directed A collection of edges, F represents the collection of all functions in the function call graph G(E,F);

(2) Extract the internal control flow information of the function:

Use the static binary analysis tool to extract the basic block and control flow information of each function in the function call graph G(E,F), and store the control flow information based on the basic block into the control flow graph G(B,E) data structure Among them, E represents the set of directed edges, and B represents the set of basic blocks in the control flow graph G(B,E);

(3) Construct a finite state machine:

(3a) Add state 0 to the non-empty finite set S of states of the finite state machine;

(3b) Number each function in the function call graph G(E,F), wherein the i-th function number is i;

(3c) assign the state 1 corresponding to the main(·) function in the function call graph G(E,F) to the initial state S0 of the finite state machine;

(3d) For the function f _i satisfying f _i ∈ F, add the state i to the state set S of the finite state machine and the final state set A of the finite state machine;

(3e) For f _i and f _j of f _i ∈ F, f _j ∈ F, if there is a directed edge from function f _i to function f _j , then add the following state transition to the state transition function T:

Z ₀ =0, Z ₁ =j→Nextstate[i]=state j

Z ₀ =1, Z ₁ =i→Nextstate[j]=state i

Among them, Z ₀ and Z ₁ represent the input letters of the finite state machine, Nextstate[i] represents the next state of state i, Nextstate[j] represents the next state of state j, i and j are function f _i and function f respectively the number of _j ;

(3f) For all states whose next state is empty, set its next state to state 0;

(4) Initialize the table TABbb:

Each function in the function call graph G(E,F) corresponds to a control flow graph G(B,E), and each function in the function call graph G(E,F) corresponds to an initialized table TABbb, where , the i-th line in the initialization table TABbb corresponds to the i-th basic block in the control flow graph G(B,E); each line contains three fields index, offset, and sucs, the field index represents the index of the i-th basic block, and the field offset indicates the relative offset of the entry address of the i-th basic block relative to the entry address of the function where the i-th basic block is located, and the field sucs indicates the index of the successor basic block of the i-th basic block;

(5) Initialize the tables TABstart and TABret:

(5a) After the monitored software is loaded, obtain the entry addresses of all functions in the function call graph G(E,F);

(5b) Add the relevant information of the i-th function to the i-th row of the table TABstart; wherein, the i-th row in the table TABstart corresponds to the i-th function in the function call graph G(E,F), and each row contains Three fields addr, index, ptr, the field addr indicates the entry address of the i-th function, the field index indicates the function number of the i-th function, and the field ptr indicates the pointer of the i-th function corresponding to the table TABbb;

(5c) Add the values 0, -1, -1 to the first row of the table TABret, each row in the table TABret corresponds to the number called in the graph G(E,F) during the execution of the monitored software function;

(6) Initialize the integer variables Cur_F and Cur_B:

Assign the number 1 of the main(·) function in the function call graph G(E,F) to the integer variable Cur_F, and assign the number 1 of the first basic block in the main(·) function to the integer variable Cur_B;

(7) Implant code:

(7a) Load the dynamic library containing the monitoring code into the process address space of the monitored software by using a static implant tool of binary code;

(7b) Search the monitoring function in the dynamic library according to the function name, and construct the calling statement to the monitoring function;

(7c) Use the code implantation tool to analyze the code implantation points in the monitored software according to the information in the function call graph G(E,F) and the control flow graph G(B,E);

(7d) implanting the constructed calling statement into the corresponding code implantation point;

(8) Monitoring software running status:

(8a) Judging whether the monitored software is executed to the entry position of a certain function in the function call graph G (E, F), if so, then perform step (8b), otherwise, perform step (8f);

(8b) Check the table TABstart according to the function entry address, and judge whether the function entry address is in the table TABstart, if so, pass the corresponding function number and positive integer 0 to the finite state machine, and execute step (8c), otherwise, execute step (9 );

(8c) judge whether the function number received by the finite state machine is 1, if so, then perform step (8d), otherwise, perform step (8e);

(8d) The current state of the finite state machine is set to the initial state S0, and step (8a) is performed;

(8e) judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, if so, then the finite state machine migrates to the state corresponding to the receiving number, and assign the function number value obtained in the step (8b) to Cur_F, Execute step (8a), otherwise, the finite state machine migrates to invalid state 0, and execute step (9);

(8f) judge whether the monitored software is executed to the call instruction position in the function in the function call graph G (E, F), if so, then execute step (8g), otherwise, execute step (8h);

(8g) adding the address of the next instruction after the function call call instruction to TABret; adding the numbering of the function where the function call call instruction is located, and the index of the basic block to TABret, and performing step (8a);

(8h) Judging whether the monitored software is executed to the exit point of the function in the function call graph G (E, F), if so, then perform step (8i), otherwise, perform step (8l);

(8i) judge whether the address value stored in the last row in the table TABret is 0, if so, then perform step (9), otherwise, perform step (8j);

(8j) judging whether the return address value in the function return instruction ret is consistent with the address value stored in the last row in the table TABret, if so, then execute step (8k), otherwise, execute step (9);

(8k) Pass the number of the function corresponding to the last line of the table TABret and the positive integer 1 to the finite state machine, and judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, and if so, then the finite state machine will migrate to the state corresponding to the receiving number , and assign the number of the function corresponding to the last row of the table TABret to the integer variable Cur_F, assign the basic block index value stored in the last row of the table TABret to the integer variable Cur_B, delete the last record in the table TABret, and execute step (8a ), otherwise, the finite state machine migrates to invalid state 0, and executes step (9);

(81) When the monitored software is executed to the entry position of the basic block in the control flow graph G (B, E), calculate the relative offset of the entry point of the basic block relative to the entry point of the function containing the basic block;

(8m) judge whether the calculated offset is 0, if so, execute step (8n), otherwise, execute step (8o);

(8n) assign positive integer 1 to variable Cur_B, perform step (8a);

(8o) judge whether this offset is the offset of one of the successor blocks corresponding to the basic block of Cur_B, if so, then assign the numbering of the successor block to the integer variable Cur_B, execute step (8a), otherwise execute step ( 9);

(9) End monitoring.

Compared with the prior art, the present invention has the following advantages:

First, because the present invention has adopted the static binary analysis tool, extracts the function call relationship in the monitored software file and its dependent library file, and stores the function call relationship in the function call graph G(E, F) data structure, extracts The basic block-based control flow information of each function in the function call graph G(E,F) can not only monitor the control flow corresponding to the software executable file, but also monitor the control flow corresponding to the dynamic library file that the software depends on. Therefore, the deficiency that the prior art can only monitor the control flow corresponding to the software source code file is overcome, so that the monitoring method of the present invention has more comprehensive advantages.

Second, because the present invention utilizes binary static code implantation tool, the dynamic storehouse that will comprise monitoring code is loaded in the process address space of monitored software, only software code is statically analyzed, find out code implantation point, and static The implantation process is completed before the software is executed, thereby overcoming the disadvantage of high runtime overhead in the prior art, so that the present invention has the characteristics of low runtime overhead and relatively simple implementation.

Detailed ways

Description of drawings

Fig. 1 is the overall flowchart of the present invention;

Fig. 2 is a flow chart of the steps of monitoring the running status of the software in the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings.

With reference to accompanying drawing 1, the specific steps of the present invention are further described.

Step 1, extract function call relationship.

Use static binary analysis tools to extract the function call relationship in the monitored software executable file and its dependent library files, and store the function call relationship in the function call graph G(E,F) data structure, where E represents a directed A collection of edges, F represents the collection of all functions in the function call graph G(E,F).

Step 2, extract the internal control flow information of the function.

Use the static binary analysis tool to extract the basic block and control flow information of each function in the function call graph G(E,F), and store the control flow information based on the basic block into the control flow graph G(B,E) data structure , where E represents the set of directed edges, and B represents the set of basic blocks in the control flow graph G(B,E).

Step 3, construct a finite state machine.

Add state 0 to the non-empty finite set S of states of the finite state machine.

Number each function in the function call graph G(E,F), where the i-th function is numbered i.

Assign the state 1 corresponding to the main(·) function in the function call graph G(E,F) to the initial state S0 of the finite state machine.

For the function f _i satisfying f _i ∈ F, add the state i to the state set S of the finite state machine and the final state set A of the finite state machine respectively.

For f _i ∈ F, f _j ∈ F of f _i and f _j , if there is a directed edge from function f _i to function f _j , the following state transition is added to the state transition function T:

Z ₀ =0, Z ₁ =j→Nextstate[i]=state j

Z ₀ =1, Z ₁ =i→Nextstate[j]=state i

Among them, Z ₀ and Z ₁ represent the input letters of the finite state machine, Nextstate[i] represents the next state of state i, Nextstate[j] represents the next state of state j, i and j are function f _i and function f respectively _j 's number.

For all states whose next state is empty, set their next state to state 0.

For a function call graph G(E,F) containing N functions, this algorithm will construct a finite state machine FSM(Z,S,T,S0,A) containing N+1 states, and state 0 represents an invalid state, The remaining N states correspond to the N functions in the function call graph G(E, F), and the effective function call or return relationship between any two functions will be mapped to the transition relationship between the corresponding states in the state machine. Any illegal The function call or return of will cause the finite state machine to migrate to an invalid state; where Z represents the input alphabet of the state machine, S represents the non-empty finite set of states of the state machine, S0 represents the initial state of the state machine, and A represents the state machine T represents the state transition function of the state machine: S×Z→S, the input alphabet Z of the state machine contains two letters Z ₀ and Z ₁ , Z ₀ takes 0 or 1, and Z ₁ takes 1 to a positive integer in N.

Step 4, initialize the table TABbb.

Each function in the function call graph G(E,F) corresponds to a control flow graph G(B,E), and each function in the function call graph G(E,F) corresponds to an initialized table TABbb, where , the i-th line in the initialization table TABbb corresponds to the i-th basic block in the control flow graph G(B,E); each line contains three fields index, offset, and sucs, the field index represents the index of the i-th basic block, and the field offset indicates the relative offset of the entry address of the i-th basic block relative to the entry address of the function where the i-th basic block is located, and the field sucs indicates the index of the successor basic block of the i-th basic block.

Step 5, initialize the tables TABstart and TABret.

After the monitored software is loaded, the entry addresses of all functions in the function call graph G(E,F) are obtained.

Add the relevant information of the i-th function to the i-th row of the table TABstart; wherein, the i-th row in the table TABstart corresponds to the i-th function in the function call graph G(E,F), and each row contains three fields addr, index, ptr, the field addr indicates the entry address of the i-th function, the field index indicates the function number of the i-th function, and the field ptr indicates the pointer of the i-th function corresponding to the table TABbb.

Add the values 0, -1, -1 to the first row of the table TABret, each row in the table TABret corresponds to the function called in the number call graph G(E,F) during the execution of the monitored software.

Step 6, initialize the integer variables Cur_F and Cur_B.

Assign the number 1 of the main(·) function in the function call graph G(E,F) to the integer variable Cur_F, and assign the number 1 of the first basic block in the main(·) function to the integer variable Cur_B.

Step 7, implant code.

Using the static implant tool of the binary code, the dynamic library containing the monitoring code is loaded into the process address space of the monitored software.

Find the monitoring function in the dynamic library according to the function name, and construct the calling statement to the monitoring function.

Use the code implant tool to analyze the code implant points in the monitored software according to the information in the function call graph G(E,F) and the control flow graph G(B,E).

The code implantation points include: the entry point BPatch_entry of the function in the function call graph G(E,F), the function exit point BPatch_exit, the function contains the static call instruction point BPatch_subroutine and the entry point of the basic block in the control flow graph G(B,E) Click BPatch_locBasicBlockEntry.

Implant the constructed calling statement into the corresponding code implantation point.

In the function call graph G(E,F), the entry point BPatch_entry of the function implants the call statement to the function call relationship validity verification function. The function of this function is: look up the table TABstart according to the function entry address, if the address is in TABstart Then pass the corresponding function number to the finite state machine FSM, and the FSM checks whether there is a transition relationship from the current state to the state corresponding to the acceptance number. If there is, it means that the function call is legal. In the function call graph G(E, F), the entry point BPatch_exit point of the function implants the call statement to the function return relationship legality inspection function. The function of this function is: according to the function return address in the ret instruction, look up the table TABret, if The return address recorded in the last row of the table TABret is 0, indicating that the monitored software executes to the exit point of the main(·) function in the function call graph G(E,F) and ends the execution; Whether the recorded return address is the same as the return address in the ret instruction, if so, pass the number of the corresponding function in the last line to the finite state machine FSM, and the FSM checks whether there is a transition relationship from the current state to the state corresponding to the acceptance number, if there is Indicates that the return of the function is legal, otherwise the monitoring will end. In the function call graph G(E,F), the call instruction point BPatch_subroutine of the function implants the call statement to the return information storage function. After the call instruction is executed, the function will use the address of the next instruction of the call instruction, including the call The function number of the instruction, the variables Cur_F and Cur_B are stored in the last row of the table TABret. The entry point BPatch_locBasicBlockEntry of the basic block in the control flow graph G(B,E) implants a call statement to the function's internal control flow validity verification function. The function of this function is based on the entry address of the basic block and the entry of the function where the basic block is located. The address calculates the relative offset of the entry point of the basic block to the entry point of the function, and then checks the table TABbb corresponding to the function where the basic block is located according to the variables Cur_F and Cur_B, if the offset is one of the successor blocks of the basic block corresponding to Cur_B Relative offset, it means that the control flow change is legal, update the value of Cur_B, otherwise, the monitoring ends.

Referring to accompanying drawing 2, the flow of the steps of monitoring software running status in the present invention will be further described.

Step 8, monitor the running status of the software.

(8a) Determine whether the monitored software is executed to the entry position of a certain function in the function call graph G(E, F), if so, perform step (8b), otherwise, perform step (8f).

(8b) Check the table TABstart according to the function entry address, and judge whether the function entry address is in the table TABstart, if so, pass the corresponding function number and positive integer 0 to the finite state machine, and execute step (8c), otherwise, execute step 9.

(8c) Determine whether the function number received by the finite state machine is 1, if so, execute step (8d), otherwise, execute step (8e).

(8d) Set the current state of the finite state machine as the initial state S0, and execute step (8a).

(8e) judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, if so, then the finite state machine migrates to the state corresponding to the receiving number, and assign the function number value obtained in the step (8b) to Cur_F, Execute step (8a), otherwise, the finite state machine migrates to invalid state 0, and executes step 9;

(8f) Determine whether the monitored software is executed to the call instruction position in the function in the function call graph G(E, F), if so, execute step (8g), otherwise, execute step (8h).

(8g) Add the address of the next instruction after the function call call instruction to TABret; add the number of the function where the function call call instruction is located, and the index of the basic block where it is located in TABret, and perform step (8a).

(8h) Determine whether the monitored software is executed to the exit point of the function in the function call graph G(E, F), if so, execute step (8i), otherwise, execute step (8l).

(8i) Determine whether the address value stored in the last row in the table TABret is 0, if yes, execute step 9, otherwise, execute step (8j).

(8j) Determine whether the return address value in the function return instruction ret is consistent with the address value stored in the last row in the table TABret, if so, execute step (8k), otherwise, execute step 9.

(8k) Pass the number of the function corresponding to the last line of the table TABret and the positive integer 1 to the finite state machine, and judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, and if so, then the finite state machine will migrate to the state corresponding to the receiving number , and assign the number of the function corresponding to the last row of the table TABret to the integer variable Cur_F, assign the basic block index value stored in the last row of the table TABret to the integer variable Cur_B, delete the last record in the table TABret, and execute step (8a ), otherwise, the finite state machine transitions to the invalid state 0, and executes step 9.

(8l) When the monitored software executes to the entry position of the basic block in the control flow graph G(B, E), calculate the relative offset of the entry point of the basic block relative to the entry point of the function containing the basic block.

(8m) Determine whether the calculated offset is 0, if so, execute step (8n), otherwise, execute step (8o).

(8n) Assign the positive integer 1 to the variable Cur_B, and execute step (8a).

(8o) Determine whether the offset is the offset of one of the successor blocks corresponding to the basic block of Cur_B, if so, assign the number of the successor block to the integer variable Cur_B, and perform step (8a), otherwise perform step 9 .

Step 9, end monitoring.

Claims (1)

1. A software runtime monitoring method based on binary code implantation technology, the specific steps are as follows: (1) Extract function call relationship: Use static binary analysis tools to extract the function call relationship in the monitored software executable file and its dependent library files, and store the function call relationship in the function call graph G(E,F) data structure, where E represents a directed A collection of edges, F represents the collection of all functions in the function call graph G(E,F); (2) Extract the internal control flow information of the function: Use the static binary analysis tool to extract the basic block and control flow information of each function in the function call graph G(E,F), and store the control flow information based on the basic block into the control flow graph G(B,E) data structure Among them, E represents the set of directed edges, and B represents the set of basic blocks in the control flow graph G(B,E); (3) Construct a finite state machine: (3a) Add state 0 to the non-empty finite set S of states of the finite state machine; (3b) Number each function in the function call graph G(E, F), wherein, the i-th function number is i, recorded as f _i ; (3c) assign the state 1 corresponding to the main(·) function in the function call graph G(E,F) to the initial state S0 of the finite state machine; (3d) For the function f _i satisfying f _i ∈ F, add the state i to the state set S of the finite state machine and the final state set A of the finite state machine; (3e) For f _i and f _j of f _i ∈ F, f _j ∈ F, if there is a directed edge from function f _i to function f _j , then add the following state transition to the state transition function T: Z ₀ =0, Z ₁ =j→Nextstate[i]=state j Z ₀ =1, Z ₁ =i→Nextstate[j]=state i Among them, Z ₀ and Z ₁ represent the input letters of the finite state machine, Nextstate[i] represents the next state of state i, Nextstate[j] represents the next state of state j, i and j are function f _i and function f respectively the number of _j ; (3f) For all states whose next state is empty, set its next state to state 0; (4) Initialize the form TABbb: Each function in the function call graph G(E,F) corresponds to a control flow graph G(B,E), and each function in the function call graph G(E,F) corresponds to an initialized table TABbb, where , the i-th line in the initialization table TABbb corresponds to the i-th basic block in the control flow graph G(B,E); each line contains three fields index, offset, and sucs, the field index represents the index of the i-th basic block, and the field offset indicates the relative offset of the entry address of the i-th basic block relative to the entry address of the function where the i-th basic block is located, and the field sucs indicates the index of the successor block of the i-th basic block; (5) Initialize the tables TABstart and TABret: (5a) After the monitored software is loaded, obtain the entry addresses of all functions in the function call graph G(E,F); (5b) Add the relevant information of the i-th function to the i-th row of the table TABstart; wherein, the i-th row in the table TABstart corresponds to the i-th function in the function call graph G(E,F), and each row contains Three fields addr, index, ptr, the field addr indicates the entry address of the i-th function, the field index indicates the function number of the i-th function, and the field ptr indicates the pointer of the i-th function corresponding to the table TABbb; (5c) Add the values 0, -1, -1 to the first row of the table TABret, each row in the table TABret corresponds to the number called in the graph G(E,F) during the execution of the monitored software function; (6) Initialize the integer variables Cur_F and Cur_B: Assign the number 1 of the main(·) function in the function call graph G(E,F) to the integer variable Cur_F, and assign the number 1 of the first basic block in the main(·) function to the integer variable Cur_B; (7) Implant code: (7a) Load the dynamic library containing the monitoring code into the process address space of the monitored software by using a static implant tool of binary code; (7b) Search the monitoring function in the dynamic library according to the function name, and construct the calling statement to the monitoring function; (7c) Use the code implantation tool to analyze the code implantation points in the monitored software according to the information in the function call graph G(E,F) and the control flow graph G(B,E); (7d) implanting the constructed calling statement into the corresponding code implantation point; (8) Monitoring software running status: (8a) Judging whether the monitored software is executed to the entry position of a certain function in the function call graph G (E, F), if so, then perform step (8b), otherwise, perform step (8f); (8b) Check the table TABstart according to the function entry address, and judge whether the function entry address is in the table TABstart, if so, pass the corresponding function number and positive integer 0 to the finite state machine, and execute step (8c), otherwise, execute step (9 ); (8c) judge whether the function number received by the finite state machine is 1, if so, then perform step (8d), otherwise, perform step (8e); (8d) The current state of the finite state machine is set to the initial state S0, and step (8a) is performed; (8e) judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, if so, then the finite state machine migrates to the state corresponding to the receiving number, and assign the function number value obtained in the step (8b) to Cur_F, Execute step (8a), otherwise, the finite state machine migrates to invalid state 0, and execute step (9); (8f) judge whether the monitored software is executed to the call instruction position in the function in the function call graph G (E, F), if so, then execute step (8g), otherwise, execute step (8h); (8g) adding the address of the next instruction after the function call call instruction to TABret; adding the numbering of the function where the function call call instruction is located, and the index of the basic block to TABret, and performing step (8a); (8h) Judging whether the monitored software is executed to the exit point of the function in the function call graph G (E, F), if so, then perform step (8i), otherwise, perform step (81); (8i) judge whether the address value stored in the last row in the table TABret is 0, if so, then perform step (9), otherwise, perform step (8j); (8j) judging whether the return address value in the function return instruction ret is consistent with the address value stored in the last row in the table TABret, if so, then execute step (8k), otherwise, execute step (9); (8k) Pass the number of the function corresponding to the last line of the table TABret and the positive integer 1 to the finite state machine, and judge whether the finite state machine can migrate from the current state to the state corresponding to the receiving number, and if so, then the finite state machine will migrate to the state corresponding to the receiving number , and assign the number of the function corresponding to the last row of the table TABret to the integer variable Cur_F, assign the basic block index value stored in the last row of the table TABret to the integer variable Cur_B, delete the last record in the table TABret, and execute step (8a ), otherwise, the finite state machine migrates to invalid state 0, and executes step (9); (81) When the monitored software is executed to the entry position of the basic block in the control flow graph G (B, E), calculate the relative offset of the entry point of the basic block relative to the entry point of the function containing the basic block; (8m) judge whether the calculated offset is 0, if so, execute step (8n), otherwise, execute step (8o); (8n) assign positive integer 1 to variable Cur_B, perform step (8a); (8o) judge whether this offset is the offset of one of the successor blocks corresponding to the basic block of Cur_B, if so, then assign the numbering of the successor block to the integer variable Cur_B, execute step (8a), otherwise execute step ( 9); (9) End monitoring.