Systems and methods for detecting coroutines

1. A method for detecting coroutines, the method comprising:

identifying an application running on a computing device, wherein the application comprises a plurality of coroutines;

determining an address of a common entry point for coroutines, wherein the common entry point is found in a memory of the application;

identifying, using an injected code, at least one stack trace entry for the common entry point;

detecting coroutine context data based on the at least one stack trace entry;

adding an identifier of a coroutine associated with the coroutine context data to a list of detected coroutines; and

storing the list of detected coroutines in target process memory associated with the application.

2. The method of claim 1 , wherein the injected code is applied to the application as a live patch that is executed without restarting the application, and wherein the injected code enables detection of stacks that are not page-aligned.

3. The method of claim 1 , wherein determining the address of the common entry point is initiated in response to detecting a launch of the application.

4. The method of claim 1 , wherein detecting the coroutine context data further comprises:

tracing a call to a function used for coroutine operation in the application;

detecting the coroutine context data passed to the function.

5. The method of claim 4 , wherein tracing the call further comprises:

finding, in code of the application, an instruction where a stack pointer register is updated with a value from a register or memory;

placing a breakpoint on the instruction; and

detecting the coroutine context data in response to a hit on the breakpoint.

6. A method of claim 1 , further comprising:

applying a patch to a library function used to implement coroutines;

detecting the coroutine context data by accessing registers and memory from the patch.

7. A method of claim 1 , further comprising:

overriding coroutine implementation functions using a system library mechanism;

detecting the coroutine context data by accessing registers and memory from the overridden coroutine implementation functions.

8. The method of claim 1 , further comprising parsing the list of detected coroutines by reading the target process memory associated with the application.

9. A system for detecting coroutines, comprising:

a hardware processor configured to:

identify an application running on a computing device, wherein the application comprises a plurality of coroutines;

determine an address of a common entry point for coroutines, wherein the common entry point is found in a memory of the application;

identify, using an injected code, at least one stack trace entry for the common entry point;

detect coroutine context data based on the at least one stack trace entry;

add an identifier of a coroutine associated with the coroutine context data to a list of detected coroutines; and

store the list of detected coroutines in target process memory associated with the application.

10. The system of claim 9 , wherein the injected code is applied to the application as a live patch that is executed without restarting the application, and wherein the injected code enables detection of stacks that are not page-aligned.

11. The system of claim 9 , wherein determining the address of the common entry point is initiated in response to detecting a launch of the application.

12. The system of claim 9 , wherein the hardware processor is configured to detect the coroutine context data by:

tracing a call to a function used for coroutine operation in the application;

detecting the coroutine context data passed to the function.

13. The system of claim 12 , wherein the hardware processor is configured to trace the call by:

finding, in code of the application, an instruction where a stack pointer register is updated with a value from a register or memory;

placing a breakpoint on the instruction; and

detecting the coroutine context data in response to a hit on the breakpoint.

14. A system of claim 9 , wherein the hardware processor is configured to:

apply a patch to a library function used to implement coroutines;

detect the coroutine context data by accessing registers and memory from the patch.

15. A system of claim 9 , wherein the hardware processor is configured to:

override coroutine implementation functions using a system library mechanism;

detect the coroutine context data by accessing registers and memory from the overridden coroutine implementation functions.

16. The system of claim 9 , wherein the hardware processor is configured to parse the list of detected coroutines by reading the target process memory associated with the application.

17. A non-transitory computer readable medium storing thereon computer executable instructions for detecting coroutines, including instructions for:

identifying an application running on a computing device, wherein the application comprises a plurality of coroutines;

determining an address of a common entry point for coroutines, wherein the common entry point is found in a memory of the application;

identifying, using an injected code, at least one stack trace entry for the common entry point;

detecting coroutine context data based on the at least one stack trace entry;

adding an identifier of a coroutine associated with the coroutine context data to a list of detected coroutines; and

storing the list of detected coroutines in target process memory associated with the application.