Software bill-of-materials via stack sampling
A system of determining a software bill-of-materials (RBOM) of an operating environment, the system comprising a processing circuitry configured to: a) access a memory space of a first process executing in the operating environment; b) for one or more threads of the first process: read contents of one or more memory location of a thread stack associated with the respective thread, determine whether a contained value of a respective memory location is a code section execution address, and responsive to the contained value of the respective memory location of the thread stack being a code section execution address: i) determine, based on the memory space of the first process and/or an executable file associated with the first process, a code section identifier associated with the code section, and ii) add the code section identifier associated with the code section to the RBOM.
1 . A system of determining a software bill-of-materials (RBOM) of an operating environment, the system comprising a processing circuitry configured to:
a. access a memory space of a first process executing in the operating environment;
b. for one or more threads of the first process:
i. read contents of one or more memory location of a thread stack associated with the respective thread,
ii. determine whether a contained value of a respective memory location is a code section execution address, and
iii. responsive to the contained value of the respective memory location of the thread stack being a code section execution address:
a) determine, based on the memory space of the first process and/or an executable file associated with the first process, a code section identifier associated with a code section including the code section execution address, and
b) add the code section identifier associated with the code section to the RBOM.
2 . The system of claim 1 , wherein the processing circuitry is further configured to perform the determining the code section identifier based on one or more of:
a. a symbol table of the executable file;
b. a debug section of the executable file;
c. a program database associated with the executable file and
d. an abstract syntax tree derivative of one or more source code files associated with the executable file.
3 . The system of claim 1 , wherein the processing circuitry is further configured to:
e. repeat a.-b. for one or more additional processes executing in the operating environment.
4 . The system of claim 3 , wherein the processing circuitry is further configured to:
f. responsive to an event, repeat a.-d. for one or more additional iterations.
5 . The system of claim 4 , wherein the event is an expiration of a delay.
6 . A processing circuitry-based method of determining a software bill-of-materials (RBOM) of an operating environment, the method comprising:
a. accessing a memory space of a first process executing in the operating environment;
b. for one or more threads of the first process:
i. reading contents of one or more memory locations of a thread stack associated with the respective thread,
ii. determining whether a contained value of a respective memory location is a code section execution address, and
iii. responsive to the contained value of the respective memory location of the thread stack being a code section execution address:
a) determining, based on the memory space of the first process and/or an executable file associated with the first process, a code section identifier associated with a code section including the code section execution address, and
b) adding the code section identifier associated with the code section to the RBOM.
7 . A computer program product comprising a computer readable non-transitory storage medium containing program instructions, which program instructions when read by a processor, cause the processing circuitry to perform a method of determining a software bill-of-materials (RBOM) of an operating environment, the method comprising:
a. accessing a memory space of a first process executing in the operating environment;
b. for one or more threads of the first process:
i. reading contents of one or more memory locations of a thread stack associated with the respective thread,
ii. determining whether a contained value of a respective memory location is a code section execution address, and
iii. responsive to the contained value of the respective memory location of the thread stack being a code section execution address:
a) determining, based on the memory space of the first process and/or an executable file associated with the first process, a code section identifier associated with a code section including the code section execution address, and
b) adding the code section identifier associated with the code section to the RBOM.