Analysis function for suppressing stop of execution due to an exception
A method includes: acquiring a hook point and a virtual program counter by analyzing a virtual machine of a script engine; acquiring a branch virtual machine instruction by analyzing an instruction set architecture; and providing an analysis function to the script engine based on the acquired virtual program counter and the acquired branch virtual machine instruction, wherein the analysis function is provided by applying a hook to the acquired hook point and wherein the hook includes processing of, in response to an occurrence of an exception, changing a pointing destination of a virtual stack pointer to a return destination of a function immediately before a part where the exception has occurred.
1 . An analysis function providing method performed by a computer, the analysis function providing method comprising:
acquiring a hook point of a script engine and a virtual program counter by analyzing a virtual machine of the script engine, wherein:
the acquired hook point is a part where an analysis code is inserted by applying a hook; and
the acquired virtual program counter is a variable indicating an instruction of the virtual machine of the script engine to be executed next;
acquiring a branch virtual machine instruction by analyzing an instruction set architecture, wherein:
the instruction set architecture is a system of instructions of the virtual machine of the script engine; and
the acquired branch virtual machine instruction is a virtual machine instruction that causes a branch; and
providing an analysis function to the script engine based on the acquired virtual program counter and the acquired branch virtual machine instruction, wherein the analysis function is executed in the script engine by applying the hook to the acquired hook point of the script engine, and wherein the hook includes processing of, in response to an occurrence of an exception, changing a pointing destination of a virtual stack pointer in a memory to a return destination of a function before a part where the exception has occurred.
2 . The analysis function providing method of claim 1 , wherein;
providing the analysis function includes:
inserting, into a script to be analyzed, an exception handler having a function of transferring processing to a virtual machine area when occurrence of an exception is caught; and
inserting the hook into the acquired hook point of the script engine by using a hook handler including processing of changing the pointing destination of the virtual stack pointer in the memory to the return destination of the function before the pointing destination of the virtual stack pointer in the virtual machine area.
3 . The analysis function providing method of claim 2 , wherein;
analyzing the instruction set architecture includes;
acquiring a virtual machine execution trace that is an execution trace executed in the virtual machine of the script engine, wherein the virtual machine execution trace records a pointer of an executed virtual machine instruction handler in which a virtual machine opcode of the virtual machine execution trace is virtually allocated as an identifier, and the acquired virtual program counter;
acquiring the branch virtual machine instruction includes:
detecting the acquired branch virtual machine instruction by a variation in an amount of change in the acquired virtual program counter for each virtual machine opcode of the virtual machine execution trace; and
the hook handler includes:
first processing of referring to a list of branch virtual machine instructions detected by a detection process, detecting a branch virtual machine instruction from the virtual machine execution trace, and constructing a virtual machine branch trace associated with the acquired virtual program counter before and after execution of the detected branch virtual machine instruction;
second processing of constructing a call stack from the virtual machine branch trace;
third processing of detecting an area of the memory satisfying a predetermined condition regarding commonality with the call stack as a virtual stack, and further detecting an area of the memory pointing to the virtual stack as a virtual stack pointer; and
fourth processing of changing a pointing destination of the virtual stack pointer to a return destination of a function before the pointing destination of the virtual stack pointer.
4 . The analysis function providing method of claim 3 , wherein:
analyzing the virtual machine of the script engine includes;
acquiring a plurality of execution traces while changing a condition at a time of execution;
acquiring the hook point of the script engine includes:
analyzing the execution trace; and
detecting the acquired hook point of the script engine;
acquiring the virtual program counter includes:
clustering the plurality of execution traces to detect a boundary of each virtual machine instruction;
analyzing the plurality of execution traces using differential execution analysis focusing on a number of times of reading the memory and a boundary of each virtual machine instruction detected by a detection process; and
detecting the acquired virtual program counter; and
wherein the analysis function providing method further comprises:
analyzing a binary of the script engine; and
detecting a dispatcher on the basis of a boundary of each virtual machine instruction detected by the detection process.
5 . The analysis function providing method of claim 1 , further comprising performing the analysis function using a test script.
6 . An analysis function providing device comprising:
a memory; and
a processor coupled to the memory and configured to perform operations comprising:
acquiring a hook point of a script engine and a virtual program counter by analyzing a virtual machine of the script engine, wherein:
the acquired hook point is a part where an analysis code is inserted by applying a hook; and
the acquired virtual program counter is a variable indicating an instruction of the virtual machine of the script engine to be executed next;
acquiring a branch virtual machine instruction by analyzing an instruction set architecture, wherein:
the instruction set architecture is a system of instructions of the virtual machine of the script engine; and
the acquired branch virtual machine instruction is a virtual machine instruction that causes a branch; and
providing an analysis function to the script engine based on the acquired virtual program counter and the acquired branch virtual machine instruction, wherein the analysis function is executed in the script engine by applying the hook to the acquired hook point of the script engine, and wherein the hook includes processing of, in response to an occurrence of an exception, changing a pointing destination of a virtual stack pointer in a memory to a return destination of a function before a part where the exception has occurred.
7 . A non-transitory computer readable storage medium having an analysis function providing program stored thereon that, when executed by a processor, causes the processor to perform operations comprising:
acquiring a hook point of a script engine and a virtual program counter by analyzing a virtual machine of the script engine, wherein:
the acquired hook point is a part where an analysis code is inserted by applying a hook; and
the acquired virtual program counter is a variable indicating an instruction of the virtual machine of the script engine to be executed next;
acquiring a branch virtual machine instruction by analyzing an instruction set architecture, wherein:
the instruction set architecture is a system of instructions of the virtual machine of the script engine; and
the acquired branch virtual machine instruction is a virtual machine instruction that causes a branch; and
providing an analysis function to the script engine based on the acquired virtual program counter and the acquired branch virtual machine instruction, wherein the analysis function is executed in the script engine by applying the hook to the acquired hook point of the script engine, and wherein the hook includes processing of, in response to an occurrence of an exception, changing a pointing destination of a virtual stack pointer in a memory to a return destination of a function before a part where the exception has occurred.