Analysis function imparting method, analysis function imparting device, and analysis function imparting program
An analysis function providing method executed by an analysis function providing device includes first analyzing a virtual machine of a script engine and acquiring a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next and a conditional branch flag that is an area for holding a flag as to whether or not branch is made at a time of conditional branch in an execution state, and providing an analysis function to the script engine by applying a hook including processing of detecting an instruction sequence a number of times of repeated execution of which is greater than or equal to a threshold and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter and the conditional branch flag.
1 . An analysis-function-providing method executed by an analysis-function-providing device, the analysis-function-providing method comprising:
first analyzing a virtual machine of a script engine and acquiring a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next and a conditional branch flag that is an area for holding a flag as to whether or not branch is made at a time of conditional branch in an execution state; and
providing an analysis function to the script engine by applying a hook including processing of detecting an instruction sequence a number of times of repeated execution of which is greater than or equal to a threshold and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter and the conditional branch flag that are architecture information obtained by the first analyzing.
2 . The analysis-function-providing method according to claim 1 , provides an analysis function by applying a hook including processing of detecting an arrangement of a same VPC repeatedly executed twice or more as the instruction sequence.
3 . An analysis-function-providing method executed by an analysis-function-providing device, the analysis-function-providing method comprising:
first analyzing a virtual machine of a script engine, and acquiring a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next;
second analyzing an instruction set architecture that is a system of instructions of the virtual machine and acquiring a branch virtual machine instruction that is a virtual machine instruction that causes branch; and
providing an analysis function to the script engine by applying a hook including processing of constructing a virtual machine branch trace associated with the virtual program counter before and after execution of a branch virtual machine instruction, detecting an instruction sequence in which a repetition mode satisfies a predetermined condition, and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter that is architecture information obtained by the first analyzing and the second analyzing.
4 . The analysis-function-providing method according to claim 1 , wherein the first analyzing performs analysis using a test script.
5 . An analysis-function-providing device comprising:
processing circuitry configured to:
analyze a virtual machine of a script engine and acquire a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next and a conditional branch flag that is an area for holding a flag as to whether or not branch is made at a time of conditional branch in an execution state; and
provide an analysis function to the script engine by applying a hook including processing of detecting an instruction sequence a number of times of repeated execution of which is greater than or equal to a threshold and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter and the conditional branch flag that are architecture information obtained by analysis of the virtual machine.