CN119883372B

CN119883372B - Reconstruction method and device of instruction stream, electronic equipment and readable storage medium

Info

Publication number: CN119883372B
Application number: CN202510352845.5A
Authority: CN
Inventors: 赵华龙; 王强; 包云岗; 唐丹; 董璐
Original assignee: Beijing Open Source Chip Research Institute
Current assignee: Beijing Open Source Chip Research Institute
Priority date: 2025-03-24
Filing date: 2025-03-24
Publication date: 2025-06-27
Anticipated expiration: 2045-03-24
Also published as: CN119883372A

Abstract

The present application provides a method, device, electronic device and readable storage medium for reconstructing an instruction stream, comprising: obtaining a target instruction address sent by a processing device according to a target sampling interval, and the number of executions recorded in each of multiple types of registers; the target instruction address is the address of a target machine instruction currently being executed in a machine instruction set; each type of register has a corresponding instruction execution type; the number of executions is the total number of times a machine instruction of the corresponding instruction execution type is executed, and all branches between two target instruction addresses are determined based on source code and target instruction addresses sent by two adjacent sending operations; the source code records the machine instructions to be executed, calculates the change in the number of executions of each type of register in two adjacent sending operations, and determines the target branch from all branches based on the change, and reconstructs the machine instruction set based on the target branch, so as to accurately restore the instruction stream.

Description

Reconstruction method and device of instruction stream, electronic equipment and readable storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method and apparatus for reconstructing an instruction stream, an electronic device, and a computer readable storage medium.

Background

The reconstruction of the instruction stream is a core step of binary program analysis, and provides a basis for understanding program behaviors, recovering control streams, supporting reverse engineering, detecting malicious codes and the like. Whether it is security research, software debugging or performance optimization, the reconstruction of instruction streams is an indispensable technical means.

The related art acquires a value of a Program Counter (PC) from a PC by a timer interrupt or a high-precision timer according to a certain time, and then uploads the PC value to an upper computer, i.e., a server or a storage device, so that the upper computer performs reconstruction of an instruction stream based on the PC value.

However, the reconstruction method of the instruction stream proposed by the related art can only perform statistics on the executed PC to analyze roughly, and cannot recover the instruction stream accurately.

Disclosure of Invention

The embodiment of the application provides a reconstruction method and device of an instruction stream, electronic equipment and a computer readable storage medium, which are used for solving the problems in the related art.

In a first aspect, an embodiment of the present application provides a method for reconstructing an instruction stream, where the method includes:

The method comprises the steps of acquiring a target instruction address sent by processing equipment according to a target sampling interval and execution times respectively recorded in a plurality of types of registers, wherein the target instruction address is the address of a target machine instruction currently executed in a machine instruction set, each type of register is provided with a corresponding instruction execution type, and the execution times are the total execution times of the machine instruction of the corresponding instruction execution type;

determining all branches between two target instruction addresses according to a source code and the target instruction addresses sent by two adjacent sending operations, wherein the source code records a machine instruction to be executed;

Calculating the change condition of the execution times of each type of register in two adjacent sending operations, and determining a target branch from all branches according to the change condition;

reconstructing the set of machine instructions from the target branch.

In a second aspect, an embodiment of the present application provides an apparatus for reconstructing an instruction stream, where the apparatus includes:

The system comprises an acquisition module, a processing device, a storage module and a storage module, wherein the acquisition module is used for acquiring a target instruction address sent by the processing device according to a target sampling interval and execution times recorded in a plurality of types of registers respectively, wherein the target instruction address is the address of a target machine instruction currently executed in a machine instruction set;

The determining module is used for determining all branches between two target instruction addresses according to a source code and the target instruction addresses sent by two adjacent sending operations, wherein the source code records a machine instruction to be executed;

The calculation module is used for calculating the variation condition of the execution times of each type of register in two adjacent sending operations and determining a target branch from all branches according to the variation condition;

And the reconstruction module is used for reconstructing the machine instruction set according to the target branch.

In a third aspect, an embodiment of the present application further provides an electronic device, including a processor, and a memory for storing instructions executable by the processor, where the processor is configured to execute the instructions to implement the method of the first aspect.

In a fourth aspect, embodiments of the present application also provide a computer-readable storage medium, which when executed by a processor of an electronic device, causes the electronic device to perform the method of the first aspect.

In the embodiment of the application, the target instruction address of the target machine instruction currently executed in the machine instruction set sent by the processing equipment according to the target sampling interval and the execution times of the machine instruction of the corresponding instruction execution type recorded in each of the multiple types of registers are obtained, all branches between two target instruction addresses are determined according to the source codes recording the machine instruction to be executed and the target instruction addresses sent by the adjacent two sending operations, the change condition of the execution times of each type of register in the adjacent two sending operations is calculated, the target branch is determined from all branches according to the change condition, and the machine instruction set is reconstructed according to the target branch. Because the multiple types of registers are adopted, the execution times of machine instructions of respective corresponding instruction execution types are recorded, when multiple branches exist, a target branch can be determined according to the change condition of the execution times recorded in the multiple types of registers, and the accuracy of the reconstruction of the instruction stream can be improved.

The foregoing description is only an overview of the present application, and is intended to be implemented in accordance with the teachings of the present application in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present application more readily apparent.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort to a person skilled in the art.

FIG. 1 is a flow chart of steps of a method for reconstructing an instruction stream according to an embodiment of the present application;

FIG. 2 is a flowchart illustrating steps of a method for reconstructing an instruction stream according to an embodiment of the present application;

FIG. 3 is a program execution diagram provided by an embodiment of the present application;

FIG. 4 is a block diagram of a device for reconstructing an instruction stream according to an embodiment of the present application;

FIG. 5 is a block diagram of an electronic device provided by an embodiment of the present application;

fig. 6 is a block diagram of another electronic device provided by an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

The terms first, second and the like in the description and in the claims, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged, as appropriate, such that embodiments of the present application may be implemented in sequences other than those illustrated or described herein, and that the objects identified by "first," "second," etc. are generally of a type, and are not limited to the number of objects, such as the first object may be one or more. Furthermore, the term "and/or" in the specification and claims is used to describe an association relationship of an association object, and means that there may be three relationships, for example, a and/or B, and that there may be three cases where a exists alone, while a and B exist together, and B exists alone. The character "/" generally indicates that the context-dependent object is an "or" relationship. The term "plurality" in embodiments of the present application means two or more, and other adjectives are similar.

Fig. 1 is a flowchart of a step of a method for reconstructing an instruction stream according to an embodiment of the present application, where, as shown in fig. 1, the method may include:

Step 101, obtaining a target instruction address sent by processing equipment according to a target sampling interval and execution times recorded in each of a plurality of types of registers, wherein the target instruction address is an address of a target machine instruction currently executed in a machine instruction set, each type of register is provided with a corresponding instruction execution type, and the execution times are total times executed by the machine instruction of the corresponding instruction execution type.

By way of example, the processing device may be a hardware device executing machine instructions. For example, a central processing unit (CPU, central Processing Unit), a graphics processor (GPU, graphics Processing Unit), or other processor may be a common serial port or other peripheral device. The target sampling interval refers to a fixed time interval or instruction interval during which machine instructions are collected during program execution. For example, data is collected every 1000 machine instructions. The target instruction address refers to a memory address of a machine instruction currently being executed, and during program execution, the processing device executes the instructions according to the instruction address order or jump logic.

By way of example, a set of machine instructions refers to a set of all machine instructions in a program, including add instructions, jump instructions, memory access instructions, and the like. The type register refers to a register for recording the number of times a particular type of instruction is executed. The various types of registers may include a skip instruction non-skip register, a skip instruction skip register, and an add instruction register. The instruction execution types include a skip instruction non-skip type, a skip instruction skip type, and an add instruction type. Each type of register corresponds to an instruction execution type. For example, the skip instruction non-skip registers correspond to skip instruction non-skip types, the skip instruction skip registers correspond to skip instruction skip types, and the add instruction registers correspond to add instruction types. Wherein each machine instruction has a unique memory address. For example, jne a0, a1, other_label, if a0 is not equal to a1, jump to other_label while the jump instruction jumps to register plus 1, if a0 is equal to a1, not jump but execute sequentially while the jump instruction does not jump to register plus 1. For another example, the add instruction count register may increment by 1 each time an add instruction, add a0, a1, a2, is encountered.

By way of example, assuming that the target instruction address is 0002, the add instruction register value is 10, and the jump instruction register value is 2, during program execution, the add instruction has been executed 10 times and the jump instruction has been executed 2 times when executed at address 0002. It can be inferred that the program segment is dominated by add instructions and fewer jump instructions. Through the steps, the target instruction address and the execution times of various types of instructions in the program execution process can be obtained in real time, and data support is provided for program analysis, performance optimization and debugging. The method is suitable for the scenes of dynamic analysis, performance analysis, reverse engineering and the like.

And 102, determining all branches between two target instruction addresses according to a source code and the target instruction addresses sent by two adjacent sending operations, wherein the source code records a machine instruction to be executed.

By way of example, the target instruction address refers to the memory address of the machine instruction currently being executed. During program execution, the processing device executes instructions in accordance with instruction address order or jump logic.

For example, during program execution, the target instruction address is collected at a target sampling interval, and the current target instruction address is sent to the server or memory. The two adjacent sending operations comprise a first sending operation and a second sending operation. In the first issue operation, the target instruction address 0002 is acquired, and in the second issue operation, the target instruction address 0014 is acquired, and all branches from address 0002 to address 0014 are available from the source code.

The instruction addresses include 0000, 0002, 0004, 0006, 0008, 0010, 0012, 0014, for example. Wherein the program corresponding to instruction address 0000 is while (1), the program corresponding to instruction address 0002 is if (key_down= 1), the program corresponding to instruction address 0004 is a=b+c, the program corresponding to instruction address 0008 is if (key_down= 0), the program corresponding to instruction address 0010 is a=0, and the program corresponding to instruction address 0014 is nop (). Then the branches at address 0002 to address 0014 include a key_down= 1- > a=b+c- > nop () branch and a key_down= 0- > a=0- > nop () branch.

And step 103, calculating the change condition of the execution times of each type of register in the two adjacent sending operations, and determining a target branch from all branches according to the change condition.

The two adjacent transmission operations include, for example, a first transmission operation and a second transmission operation. In the first transmission operation, the number of executions of each type of register is acquired. For example, the number of executions of the skip instruction non-skip count register is 100, the number of executions of the skip instruction skip count register is 20, and the number of executions of the add instruction count register is 30. In the second transmission operation, the number of executions of each type of register is acquired. For example, the number of executions of the skip instruction non-skip count register is 100, the number of executions of the skip instruction skip count register is 20, and the number of executions of the add instruction count register is 31.

For example, the change condition of the execution times of each type of register in the first sending operation and the second sending operation is calculated, the change condition of the execution times of the skip instruction non-skip count register is 0, the change condition of the execution times of the skip instruction skip count register is 0, and the change condition of the execution times of the add instruction count register is 1, which indicates that the add instruction is executed once, so that the branch with the execution times of the add instruction increased once is determined as the target branch in all branches.

Step 104, reconstructing the machine instruction set according to the target branch.

Illustratively, after the target branch is taken, the relevant machine instructions are fetched and reorganized according to the path of the target branch. Specifically, instructions in the target branch path are sequentially extracted to form a new instruction set. By determining the target branch and fetching the relevant machine instructions, the set of machine instructions may be reconstructed. The method is suitable for program analysis, optimization, debugging and other scenes, and helps to understand the execution path and logic of the program. The reconstructed instruction set may be used for further analysis or simulation execution.

In summary, in the embodiment of the present application, multiple types of registers are used to record the execution times of machine instructions of respective corresponding instruction execution types, and because the execution times of machine instructions of different instruction execution types can reflect the actual execution behavior of the machine instructions more accurately, when multiple branches exist between target instruction addresses sent by two adjacent sending operations, the change condition of the execution times of different instruction execution types can be obtained according to the change condition of the execution times recorded in the multiple types of registers, so as to determine the target branch according to the change condition of the execution times of different instruction execution types. By recording the target instruction address between two samplings and the change of the execution times of different instruction execution types, the application deduces the actually-walked target branch from various branches possibly executed by jump instructions and the like, reconstructs the instruction stream according to the target branch, and can improve the accuracy of the instruction stream reconstruction.

Fig. 2 is a flowchart of specific steps of a method for reconstructing an instruction stream according to an embodiment of the present application, as shown in fig. 2, the method may include:

Step 201, obtaining a target instruction address sent by processing equipment according to a target sampling interval and execution times recorded in each of a plurality of types of registers, wherein the target instruction address is an address of a target machine instruction currently executed in a machine instruction set, each type of register is provided with a corresponding instruction execution type, and the execution times are total times executed by the machine instruction of the corresponding instruction execution type.

The step may refer to the above step 101, and will not be described herein in detail.

Optionally, the target sampling interval is obtained by multiplying the operating frequency of the processor by a preset ratio.

For example, the operating frequency of the processor, i.e., the main frequency of the processor, may be 1000000 instructions processed per unit time, the preset ratio may be 1/1000, and the sampling may be performed at 1/1000 of the main frequency of the processor, i.e., every 1000 instructions executed. The fixed proportion sampling is improved along with the improvement of the main frequency of the processor according to proportion, and finally, a certain number of instructions are sampled after being executed, for example, 1000 instructions are sampled, and the periodic sampling is carried out according to a fixed time, so that the instructions executed in the period of time are increased along with the improvement of the main frequency, uncertainty exists, instruction tracing is influenced, and the fixed proportion sampling can improve the accuracy of the instruction tracing.

Optionally, the plurality of types of registers include a skip instruction non-skip count register, a skip instruction skip count register, and an add instruction count register, and prior to step 201, the method further comprises:

A1, acquiring an updated value of the skip instruction non-skip count register, wherein an initial value of the skip instruction non-skip count register is obtained by setting the updated value of the skip instruction non-skip count register as an initialized value;

a2, acquiring an updated value of the jump instruction jump count register, wherein an initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register as the initialized value;

And step A3, obtaining an updated value of the addition instruction counting register, wherein the initial value of the addition instruction counting register is obtained by setting the updated value of the addition instruction counting register as the initialized value.

For steps A1-A3, the update value of the skip instruction non-skip count register may be the number of executions of the skip instruction non-skip type machine instruction recorded by the skip instruction non-skip count register after sampling at the target sampling interval. The updated value of the skip instruction non-skip count register may be the number of executions of the machine instruction of the skip instruction skip type recorded by the skip instruction skip count register after sampling at the target sampling interval. The update value of the addition instruction count register may be the number of times the machine instruction of the addition instruction type recorded by the addition instruction count register is executed after sampling at the target sampling interval.

For example, after sampling is performed at each target sampling interval, the current target instruction address and the execution times recorded in the multiple types of registers can be sent to an upper computer such as a server or a memory through a common peripheral such as a serial port, and the execution times recorded in the multiple types of registers are cleared at the same time for statistics of the next sampling period. For example, the initialization value may be 0. The initial value of the skip instruction non-skip count register may be set to 0, the initial value of the skip instruction skip count register may be set to 0, and the initial value of the add instruction count register may be set to 0.

And step 202, determining all branches between two target instruction addresses according to source codes and target instruction addresses sent by two adjacent sending operations, wherein the source codes record machine instructions to be executed.

The step may refer to the above step 102, and will not be described herein in detail.

Optionally, step 202 may specifically include:

a sub-step 2021, parsing the source code to obtain a program execution diagram;

Sub-step 2022, traversing the program execution graph from the machine instruction corresponding to the first instruction address, if a jump instruction exists and jumps, constructing a branch according to the machine instruction corresponding to the next instruction address of the jump instruction jump;

Sub-step 2023, if the jump instruction does not exist and the jump is performed, constructing a branch according to the machine instruction corresponding to the next instruction address executed in the current machine instruction sequence;

sub-step 2024, until traversing to the machine instruction corresponding to the second instruction address, obtaining all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address, where the second instruction address is the target instruction address transmitted last in the two adjacent transmission operations.

For sub-steps 2021-2024, the instruction address includes 0000, 0002, 0004, 0006, 0008, 0010, 0012, 0014. Wherein the program corresponding to instruction address 0000 is while (1), the program corresponding to instruction address 0002 is if (key_down= 1), the program corresponding to instruction address 0004 is a=b+c, the program corresponding to instruction address 0008 is if (key_down= 0), the program corresponding to instruction address 0010 is a=0, and the program corresponding to instruction address 0014 is nop (). Taking the first instruction address as 0002 and the second instruction address as 0014 as an example, traversing the program execution diagram from the machine instruction corresponding to 0002, if a jump instruction exists at 0002, jumping to the machine instruction corresponding to 0008 and constructing branches of the machine instructions corresponding to 0002 to 0008. If no jump is made at 0002, then branches of machine instructions corresponding to 0002 through 0004 are constructed. Until the machine instruction corresponding to 0014 is traversed, all branches from the machine instruction corresponding to 0002 to the machine instruction corresponding to 0014 are taken.

For example, after the host receives the target instruction address and the number of executions recorded in each of the various types of registers, an attempt will be made to restore the exact instruction set. At this time, a directed graph, i.e., a program execution graph, is constructed based on the entire binary program, each node of the graph representing a conditional jump instruction, and each edge representing a sequence of instructions that are executed sequentially. A jump instruction is encountered to create a new node pointing to the jump and non-jump nodes, respectively.

By way of example, two nodes in the program execution graph can be determined according to the current target instruction address collected and the target instruction address of the next sampling point, then all possible routes between the two nodes are traversed, the times of related instructions are counted and compared with the data of a counting register sent by the processing equipment, if the current route is identical, the current route is actually executed by the processor, namely, the accurate instruction stream reconstruction of the current sampling period is completed, and when each sampling period completes the instruction stream reconstruction, the complete instruction stream tracing is formed.

Optionally, the substep 2021 may specifically include:

a sub-step 20211 of parsing the source code to obtain a set of program instructions in the source code;

Sub-step 20212, traversing the set of program instructions, creating nodes and edges of the program execution graph according to the types of program instructions in the set of program instructions;

sub-step 20213, obtaining said program execution map until all of said program instructions in said set of program instructions have been traversed.

For sub-step 20211-sub-step 20213, the program instruction set is traversed, creating nodes and edges of the program execution graph. An empty graph structure is created for storing nodes and edges. Traversing instructions in the program instruction set one by one, and taking the current instruction address as one node in the graph for each instruction. If the node already exists, skipping creation, if the current instruction is executed sequentially, creating an edge from the current node to the next instruction node, if the current instruction is a jump instruction, creating an edge from the current node to the jump target address node, if the current instruction is a function call instruction, creating an edge from the current node to the function entry node, and recording a return address, if the current instruction is a return instruction, creating an edge from the current node to the return address node. After the traversal is ended, a program execution diagram is generated.

In step 203, the difference between the execution times of machine instructions for which the jump instruction does not jump in the two adjacent transmission operations is determined as the first difference.

For example, the number of executions of machine instructions for which a jump instruction does not jump is determined by determining each instruction within the target sampling interval based on the value of the jump instruction not jump count register.

For example, if the instruction is a jump instruction and no jump occurs, the value of the jump instruction non-jump count register is updated by adding a first preset value. Taking the first preset value as 1 as an example, if the instruction is a jump instruction and no jump occurs, adding 1 to the value of the jump instruction non-jump count register.

For example, after the above-described determination operation is performed for each instruction within the target sampling interval, the value of the skip instruction non-skip count register is determined as the number of executions of the machine instruction in which the skip instruction is non-skip. The two adjacent sending operations comprise a first sending operation and a second sending operation. In the first transmission operation, the execution number of the skip instruction non-skip count register is 100. In the second sending operation, the number of times the skip instruction does not skip the count register is executed is 110, and the first difference is 10.

Step 204, determining the difference between the execution times of the machine instruction skipped by the jump instruction in the two adjacent sending operations as the second difference.

For example, the number of executions of the machine instruction that the jump instruction jumps is determined by determining each instruction within the target sampling interval based on the value of the jump instruction jump count register.

For example, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added to the first preset value to update. Taking the first preset value as 1 as an example, if the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added with 1.

For example, after the above-described determination operation is performed for each instruction within the target sampling interval, the value of the jump instruction jump count register is determined as the number of executions of the machine instruction that the jump instruction jumps. The two adjacent sending operations comprise a first sending operation and a second sending operation. In the first transmission operation, the execution number of the jump instruction jump count register is 20. In the second sending operation, the execution number of the skip instruction skip count register is 25, and the second difference is 5.

In step 205, the difference in the number of times of execution of the machine instruction of the addition instruction in the adjacent two transmission operations is determined as a third difference.

For example, the number of times the machine instruction of the add instruction is executed is determined by performing a determination operation on each instruction within the target sampling interval, based on the value of the add instruction count register.

For example, if the instruction is an add instruction, the value of the add instruction count register is added to the first preset value to update. Taking the first preset value as 1 as an example, if the instruction is an add instruction, the value of the add instruction count register is added with 1.

For example, after the above-described determination operation is performed for each instruction within the target sampling interval, the value of the addition instruction count register is determined as the number of times of execution of the machine instruction of the addition instruction. The two adjacent sending operations comprise a first sending operation and a second sending operation. In the first issue operation, the number of executions of the add instruction count register is 15. In the second issue operation, the number of times the add instruction count register is executed is 24, and the third difference value is 9.

Step 206, using the first difference value as a variation of the execution times of the machine instructions which are not jumped by the jump instruction, using the second difference value as a variation of the execution times of the machine instructions which are jumped by the jump instruction, and using the third difference value as a variation of the execution times of the machine instructions which are the addition instructions.

For example, the first difference indicates a change in the number of executions of machine instructions for which the jump instruction does not jump in the two adjacent transmission operations, the second difference indicates a change in the number of executions of machine instructions for which the jump instruction jumps in the two adjacent transmission operations, and the third difference indicates a change in the number of executions of machine instructions for which the addition instruction jumps in the two adjacent transmission operations. Taking the first difference value as 10, the second difference value as 5 and the third difference value as 9 as an example, the machine instruction of which the jump instruction does not jump in the two adjacent sending operations is executed 10 times, the machine instruction of which the jump instruction jumps is executed 5 times, and the machine instruction of which the addition instruction is executed 9 times. After the change condition of the execution times of the machine instructions of which the jump instructions are not jumped, the change condition of the execution times of the machine instructions of which the jump instructions are jumped and the change condition of the execution times of the machine instructions of which the addition instructions are jumped are obtained, the target branch can be determined from all branches according to the three change conditions, and more accurate tracing can be realized.

And step 207, determining a target branch from all branches according to the change condition.

The step may refer to step 103, and will not be described herein.

Optionally, the multiple types of registers include a skip instruction non-skip count register, a skip instruction skip count register and an add instruction count register, each branch has a first variation value of the execution times of the skip instruction non-skip count register, a second variation value of the execution times of the skip instruction skip count register, and a third variation value of the execution times of the add instruction count register, where the variation includes a first difference value of the execution times of the skip instruction non-skip count register and a second difference value of the execution times of the skip instruction skip count register in two adjacent sending operations, and the third difference value step 207 of the execution times of the add instruction count register may specifically include:

sub-step 2071, determining the branch as the target branch if the first variation value of one branch is the same as the first difference value, the second variation value is the same as the second difference value, and the third variation value is the same as the third difference value.

For step 2071, taking the first difference as 10, the second difference as 5, and the third difference as 9 as an example, if there is a branch, the first change value of the execution times of the skip instruction non-skip count register is 10, the second change value of the execution times of the skip instruction skip count register is 5, and the third change value of the execution times of the add instruction count register is 9, the branch is the target branch.

For example, if there are two branches from address 0002 to address 0014, one branch performs an a=b+c operation and one branch performs an a=0 operation. During the two samplings, the procedure goes from 0002 to 0014, but there are two paths between 0002 and 0014, and it cannot be checked which path is actually taken. This is to analyze the twice packet by means of the adder counter to find that the adder counter has changed from 23 to 24, indicating that the program must execute an adder instruction during the execution of 0002 to 0014. While analyzing the program execution diagram, it can be known that only the branch a=b+c has one addition instruction, so it is inferred that the program executes the branch key_down= 1- > a=b+c- > nop (), and the branch is the target branch.

Step 208, reconstructing the set of machine instructions from the target branch.

This step may refer to step 104, and will not be described herein.

Fig. 3 is a program execution diagram provided by an embodiment of the present application, the program execution diagram being generated based on the following codes:

PC code

0000while(1){

0002if(key_down==1){

0004a=b+c;

0006}

0008else{

0010a=0;

0012}

0014nop()

0016}

The execution logic of the above code is to execute the conditional statement first, if key_down= 1, then execute a=b+c, otherwise execute a=0. After the execution of the conditional statement is ended, the nop () function is executed, and then the nop () function is repeatedly executed at all times while the conditional statement is executed.

The method comprises the following steps:

step S1, starting;

step S2, judging whether the first variable key_down is equal to 1, if so, executing step S3, otherwise, executing step S4;

Step S3, adding the value of the second variable b to the value of the third variable c to obtain the value of the fourth variable a;

Step S4, the value of the fourth variable a is assigned to be 0;

Step S5, executing a first function nop ().

Fig. 4 is a block diagram of an apparatus 30 for reconstructing an instruction stream according to an embodiment of the present application, where the apparatus includes:

the system comprises an acquisition module 301, a processing device, a control module and a control module, wherein the acquisition module 301 is used for acquiring a target instruction address sent by the processing device according to a target sampling interval and execution times recorded in a plurality of types of registers respectively, wherein the target instruction address is the address of a target machine instruction currently executed in a machine instruction set;

A determining module 302, configured to determine all branches between two target instruction addresses according to a source code and target instruction addresses sent by two adjacent sending operations;

a calculating module 303, configured to calculate a change condition of the execution times of each type of register in two adjacent sending operations, and determine a target branch from all branches according to the change condition;

A reconstruction module 304 for reconstructing the set of machine instructions from the target branch.

Optionally, the determining module includes:

The analysis submodule is used for analyzing the source code to obtain a program execution diagram;

the first construction submodule is used for traversing the program execution graph from a machine instruction corresponding to a first instruction address, and if a jump instruction exists and the jump is carried out, constructing a branch according to the machine instruction corresponding to the next instruction address of the jump instruction, wherein the first instruction address is the target instruction address which is transmitted earliest in two adjacent transmitting operations;

The second construction submodule is used for constructing branches according to machine instructions corresponding to the next instruction address executed in the current machine instruction sequence if the jump instructions do not exist and the jump is carried out;

and the generation submodule is used for obtaining all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address until the machine instruction corresponding to the second instruction address is traversed, wherein the second instruction address is a target instruction address which is transmitted latest in two adjacent transmitting operations.

Optionally, the parsing sub-module includes:

the analyzing unit is used for analyzing the source code to obtain a program instruction set in the source code;

A traversing unit, configured to traverse the program instruction set, and create nodes and edges of the program execution graph according to types of program instructions in the program instruction set;

And the generating unit is used for obtaining the program execution graph until all the program instructions in the program instruction set are traversed.

The execution times recorded in each of the plurality of types of registers comprise the execution times of machine instructions of which the jump instructions are not jumped, the execution times of machine instructions of which the jump instructions are jumped and the execution times of machine instructions of which the addition instructions are carried out;

The computing module comprises:

a first determining submodule, configured to determine a difference value of execution times of machine instructions, in which the jump instruction is not jumped, in two adjacent sending operations as a first difference value;

A second determining sub-module, configured to determine, as a second difference, a difference in execution times of machine instructions that are skipped by the jump instruction in the two adjacent transmission operations;

a third determining sub-module for determining a difference in the execution times of the machine instruction of the addition instruction in the adjacent two transmission operations as a third difference;

and a fourth determining sub-module, configured to take the first difference value as a change situation of the execution times of the machine instructions that the jump instruction does not jump, the second difference value as a change situation of the execution times of the machine instructions that the jump instruction jumps, and the third difference value as a change situation of the execution times of the machine instructions of the addition instruction.

Optionally, the multiple types of registers comprise a skip instruction non-skip count register, a skip instruction skip count register and an addition instruction count register, wherein each branch is provided with a first change value of the execution times of the skip instruction non-skip count register, a second change value of the execution times of the skip instruction skip count register, a third change value of the execution times of the addition instruction count register, and the change condition comprises a first difference value of the execution times of the skip instruction non-skip count register, a second difference value of the execution times of the skip instruction skip count register and a third difference value of the execution times of the addition instruction count register in two adjacent sending operations;

The determining module includes:

and a fifth determining submodule, configured to determine, if the first change value of one branch is the same as the first difference value, the second change value is the same as the second difference value, and the third change value is the same as the third difference value, the branch as the target branch.

The multiple types of registers comprise a skip instruction non-skip count register, a skip instruction skip count register and an addition instruction count register, wherein the execution times recorded in the multiple types of registers respectively comprise execution times of skip instruction non-skip machine instructions, execution times of skip instruction skip machine instructions and execution times of addition instruction machine instructions, the execution times of skip instruction non-skip machine instructions are determined according to the value of the skip instruction non-skip count register, the execution times of skip instruction skip machine instructions are determined according to the value of the skip instruction skip count register, and the execution times of addition instruction machine instructions are determined according to the value of the addition instruction count register.

Optionally, the judging operation includes updating a value of a skip instruction non-skip count register plus a first preset value if the instruction is a skip instruction and no skip occurs, updating a value of a skip instruction skip count register plus the first preset value if the instruction is a skip instruction and a skip occurs, and updating a value of an add instruction count register plus the first preset value if the instruction is an add instruction.

Optionally, the plurality of types of registers include a skip instruction non-skip count register, a skip instruction skip count register, and an add instruction count register, and the apparatus further includes:

the first acquisition module is used for acquiring an updated value of the skip instruction non-skip count register, wherein the initial value of the skip instruction non-skip count register is obtained by setting the updated value of the skip instruction non-skip count register as an initialized value;

the second acquisition module is used for acquiring the updated value of the jump instruction jump count register, and the initial value of the jump instruction jump count register is obtained by setting the updated value of the jump instruction jump count register as the initialization value;

And the third acquisition module is used for acquiring the updated value of the addition instruction counting register, and the initial value of the addition instruction counting register is obtained by setting the updated value of the addition instruction counting register as the initialized value.

For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.

In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described by differences from other embodiments, and identical and similar parts between the embodiments are all enough to be referred to each other.

The specific manner in which the various modules perform the operations in the apparatus of the above embodiments have been described in detail in connection with the embodiments of the method, and will not be described in detail herein.

Embodiments of the present application provide a reconstruction device for an instruction stream, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, comprising means for performing the method described in one or more of the embodiments.

Fig. 5 is a block diagram of an electronic device 400 according to an embodiment of the present application. For example, electronic device 400 may be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, exercise device, personal digital assistant, or the like.

Referring to FIG. 5, an electronic device 400 may include one or more of a processing component 402, a memory 404, a power supply component 406, a multimedia component 408, an audio component 410, an input/output (I/O) interface 412, a sensor component 414, and a communication component 416.

The processing component 402 generally controls overall operation of the electronic device 400, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to perform all or part of the steps of the methods described above. Further, the processing component 402 can include one or more modules that facilitate interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate interaction between the multimedia component 408 and the processing component 402.

Memory 404 is used to store various types of data to support operations at electronic device 400. Examples of such data include instructions for any application or method operating on electronic device 400, contact data, phonebook data, messages, pictures, multimedia, and so forth. The memory 404 may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.

The power supply component 406 provides power to the various components of the electronic device 400. The power components 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 400.

The multimedia component 408 includes a screen between the electronic device 400 and the user that provides an output interface. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may not only sense demarcations of touch or sliding actions, but also detect durations and pressures associated with the touch or sliding operations. In some embodiments, the multimedia component 408 includes a front camera and/or a rear camera. When the electronic device 400 is in an operational mode, such as a photographing mode or a multimedia mode, the front-facing camera and/or the rear-facing camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

The audio component 410 is for outputting and/or inputting audio signals. For example, the audio component 410 includes a Microphone (MIC) for receiving external audio signals when the electronic device 400 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may be further stored in the memory 404 or transmitted via the communication component 416. In some embodiments, audio component 410 further includes a speaker for outputting audio signals.

The input/output interface 412 provides an interface between the processing component 402 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to, a home button, a volume button, an activate button, and a lock button.

The sensor assembly 414 includes one or more sensors for providing status assessment of various aspects of the electronic device 400. For example, the sensor assembly 414 may detect an on/off state of the electronic device 400, a relative positioning of the components, such as a display and keypad of the electronic device 400, the sensor assembly 414 may also detect a change in position of the electronic device 400 or a component of the electronic device 400, the presence or absence of a user's contact with the electronic device 400, an orientation or acceleration/deceleration of the electronic device 400, and a change in temperature of the electronic device 400. The sensor assembly 414 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact. The sensor assembly 414 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 414 may also include an acceleration sensor, a gyroscopic sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 416 is used to facilitate communication between the electronic device 400 and other devices, either wired or wireless. The electronic device 400 may access a wireless network based on a communication standard, such as WiFi, an operator network (e.g., 2G, 3G, 4G, or 5G), or a combination thereof. In one exemplary embodiment, the communication component 416 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 further includes a Near Field Communication (NFC) module to facilitate short range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, electronic device 400 may be implemented by one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic elements for implementing the methods provided by embodiments of the application.

In an exemplary embodiment, a non-transitory computer-readable storage medium is also provided, such as memory 404, that includes instructions executable by processor 420 of electronic device 400 to perform the above-described method. For example, the non-transitory storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

Fig. 6 is a block diagram of another electronic device 500 provided by an embodiment of the application. For example, electronic device 500 may be provided as a server. Referring to fig. 6, electronic device 500 includes a processing component 522 that further includes one or more processors and memory resources represented by memory 532 for storing instructions, such as applications, executable by processing component 522. The application programs stored in the memory 532 may include one or more modules each corresponding to a set of instructions. Further, the processing component 522 is configured to execute instructions to perform the methods provided by embodiments of the present application.

The electronic device 500 may also include a power component 526 configured to perform power management of the electronic device 500, a wired or wireless network interface 550 configured to connect the electronic device 500 to a network, and an input/output interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as WindowsServerTM, macOSXTM, unixTM, linuxTM, freeBSDTM or the like.

The embodiment of the application also provides a computer program product, comprising a computer program which, when being executed by a processor, realizes the method described in the above embodiment.

Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the application pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It is to be understood that the application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. A method of reconstructing an instruction stream, the method comprising:

reconstructing the set of machine instructions from the target branch.

2. The method of claim 1, wherein determining all branches between two target instruction addresses based on the source code and the target instruction addresses sent by two adjacent send operations comprises:

analyzing the source code to obtain a program execution diagram;

Traversing the program execution diagram from a machine instruction corresponding to a first instruction address, and if a jump instruction exists and jumps, constructing a branch according to the machine instruction corresponding to the next instruction address of the jump instruction;

If the jump instruction does not exist and the jump is performed, constructing a branch according to the machine instruction corresponding to the next instruction address executed in the current machine instruction sequence;

And traversing to a machine instruction corresponding to a second instruction address to obtain all branches from the machine instruction corresponding to the first instruction address to the machine instruction corresponding to the second instruction address, wherein the second instruction address is a target instruction address which is transmitted latest in two adjacent transmitting operations.

3. The method of claim 2, wherein the parsing the source code to obtain a program execution diagram comprises:

Analyzing the source code to obtain a program instruction set in the source code;

Traversing the program instruction set, and creating nodes and edges of the program execution graph according to the types of program instructions in the program instruction set;

And obtaining the program execution diagram until all the program instructions in the program instruction set are traversed.

4. The method of claim 1, wherein the instruction execution type comprises a skip instruction non-skip type, a skip instruction skip type, and an add instruction type, and wherein the execution times recorded in each of the plurality of types of registers comprises a number of times a machine instruction that the skip instruction does not skip, a number of times a machine instruction that the skip instruction skips, and a number of times a machine instruction that the add instruction executes;

The calculating the variation condition of the execution times of each type of register in the two adjacent sending operations comprises the following steps:

Determining a difference value of execution times of machine instructions, which are not jumped by the jump instruction, in two adjacent sending operations as a first difference value;

Determining a difference value of execution times of machine instructions skipped by the skip instruction in the two adjacent sending operations as a second difference value;

Determining a difference value of execution times of machine instructions of the addition instruction in the adjacent two sending operations as a third difference value;

the first difference value is used as the variation condition of the execution times of the machine instructions which are not jumped by the jump instruction, the second difference value is used as the variation condition of the execution times of the machine instructions which are jumped by the jump instruction, and the third difference value is used as the variation condition of the execution times of the machine instructions of the addition instruction.

5. The method of claim 1, wherein the plurality of types of registers include a skip instruction non-skip count register, a skip instruction skip count register, and an add instruction count register, each branch having a first variation value of a number of executions of the skip instruction non-skip count register, a second variation value of a number of executions of the skip instruction skip count register, a third variation value of a number of executions of the add instruction count register, the variation including a first difference of the number of executions of the skip instruction non-skip count register, a second difference of the number of executions of the skip instruction skip count register, and a third difference of the number of executions of the add instruction count register in two adjacent send operations;

said determining a target branch from said all branches according to said change, comprising:

and if the first variation value of one branch in all branches is the same as the first difference value, the second variation value is the same as the second difference value, and the third variation value is the same as the third difference value, determining the branch as the target branch.

6. The method of claim 1, wherein the target sampling interval is a multiplication of an operating frequency of the processor by a preset ratio.

7. The method of claim 1, wherein the plurality of types of registers comprises a skip instruction non-skip count register, a skip instruction skip count register, and an add instruction count register, wherein the respective recorded execution times in the plurality of types of registers comprise a number of execution times of a machine instruction in which the skip instruction non-skip, a number of execution times of a machine instruction in which the skip instruction skip, and a number of execution times of a machine instruction of the add instruction;

the execution times of the machine instructions which are not jumped by the jump instruction are determined according to the value of a jump instruction non-jump count register by judging each instruction in the target sampling interval;

The execution times of the machine instructions of the jump instruction jump are determined by judging each instruction in the target sampling interval according to the value of a jump instruction jump count register;

the execution times of the machine instructions of the addition instruction are determined by judging each instruction in the target sampling interval and according to the value of the addition instruction count register.

8. The method of claim 7, wherein the determining operation comprises:

If the instruction is a jump instruction and no jump occurs, adding a first preset value to the value of a jump instruction non-jump counting register to update;

If the instruction is a jump instruction and a jump occurs, the value of the jump instruction jump count register is added with the first preset value to update;

And if the instruction is an addition instruction, adding the value of the addition instruction counting register to the first preset value to update.

9. The method of claim 1, wherein the plurality of types of registers include a skip instruction non-skip count register, a skip instruction skip count register, and an add instruction count register, the method further comprising:

Acquiring an updated value of the skip instruction non-skip count register, wherein an initial value of the skip instruction non-skip count register is obtained by setting the updated value of the skip instruction non-skip count register as an initialized value;

Acquiring an updated value of the skip instruction skip count register, wherein an initial value of the skip instruction skip count register is obtained by setting the updated value of the skip instruction skip count register as the initialized value;

And acquiring an updated value of the addition instruction count register, wherein an initial value of the addition instruction count register is obtained by setting the updated value of the addition instruction count register as the initialized value.

10. An apparatus for reconstructing an instruction stream, the apparatus comprising:

11. An electronic device comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, which when executed by the processor implements the steps of the method of reconstructing an instruction stream according to any one of claims 1 to 9.

12. A readable storage medium, characterized in that the readable storage medium has stored thereon a program or instructions which, when executed by a processor, implement the steps of the method of reconstructing an instruction stream according to any one of claims 1 to 9.