Identifying active code sections via memory forensics
A system of identifying an executed code section of a software process, having a processing circuitry (PC) configured to: a) access a memory space of a first process executing in an operating environment; b) identify, from contents of the memory space, a software framework of the first process; c) find, in the memory space, based on the identified software framework, a first code section description structure; d) identify, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section; and e) determine, based on a value of the CSEI, whether the first code section has been executed.
1 . A system of identifying an executed code section of a software process, the system comprising a processing circuitry (PC) configured to:
a. access a memory space of a first process executing in an operating environment;
b. identify, from contents of the memory space, a software framework of the first process;
c. find, in the memory space, based on the software framework, a first code section description structure;
d. identify, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section; and
e. determine, based on a value of the CSEI, whether the first code section has been executed.
2 . The system of claim 1 , wherein the PC is additionally configured to:
f. add, to a software runtime bill-of-materials (RBOM), a code section identifier of the first code section, the code section identifier being based on the first code section description structure.
3 . The system of claim 2 , wherein the PC is additionally configured to:
g. repeat c.-f. for one or more additional code section description structures.
4 . The system of claim 3 , wherein the PC is additionally configured to:
h. responsive to an event, repeat a.-g. for one or more additional iterations.
5 . The system of claim 3 , wherein the PC is additionally configured to:
repeat a.-g. for one or more additional processes executing in the operating environment.
6 . The system of claim 4 , wherein the event is an expiration of a delay.
7 . The system of claim 1 , wherein the PC is additionally configured to, subsequent to e.:
identify, in the memory space, based on the identified software framework, an unloaded code section log structure;
determine, based on identifying one or more code section identifiers in the unloaded code section log structure, that respective code sections have been executed.
8 . The system of claim 7 , wherein the PC is additionally configured to:
adding the one or more code section identifiers to the RBOM.
9 . The system of claim 2 , wherein the code section identifier is selected from the group consisting of:
a. a module name,
b. a module path,
c. a file path,
d. a class name,
e. a function name,
f. a function signature,
g. a method name,
h. a method signature,
i. a namespace,
j. a scope,
k. a file name,
I. a file name with a starting line number, and
m. a file name with a starting line number and ending line number.
10 . The system of claim 1 , wherein the CSEI is based on at least one of the group consisting of:
a. a value of a pointer, identified from the code section description structure, to data or instructions of the first code section;
b. contents of a memory address, the memory address is written to by the first code section;
c. a value of a data field, identified from the code section description structure, indicative of whether code of the first code section has been cached;
d. a value of a data field, identified from the code section description structure, indicative of whether a data object associated with the first code section has been cached;
e. a value of a data field, identified from the code section description structure, utilized by a virtual machine for code use profiling; and
f. a value of a data field, identified from the code section description structure, indicating a count of invocations of the first code section.
11 . The system of claim 7 , wherein the software framework is Java and the unloaded code section log structure is UnloadingEventLog.
12 . The system of claim 10 , wherein the PC is configured to, responsive to determining that the software framework is Java, utilize a methodCounters field of a Methods structure as the CSEI.
13 . The system of claim 10 , wherein the PC is configured to, responsive to determining that the software framework is node.js, utilize a function data field of a SharedFunctionInfo structure as the CSEI.
14 . The system of claim 10 , wherein the PC is configured to, responsive to determining that the software framework is Ruby, utilize a flags field of a rb_method_entry_t structure as the CSEI.
15 . The system of claim 10 , wherein the PC is configured to, responsive to determining that the software framework is Ruby, utilize a total_calls field of a rb_iseq_constant_body structure as the CSEI.
16 . A processing circuitry-based method of identifying an executed code section of a software process, the method comprising:
a. accessing a memory space of a first process executing in an operating environment;
b. identifying, from contents of the memory space, a software framework of the first process;
c. finding, in the memory space, based on the software framework, a first code section description structure;
d. identifying, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section; and
e. determining, based on a value of the CSEI, whether the first code section has been executed.
17 . A computer program product comprising a non-transitory computer readable storage medium containing program instructions, which when read by a processor, cause the processor to perform a method of identifying an executed code section of a software process, the method comprising:
a. accessing a memory space of a first process executing in an operating environment;
b. identifying, from contents of the memory space, a software framework of the first process;
c. finding, in the memory space, based on the software framework, a first code section description structure;
d. identifying, from the first code section description structure, a code section execution indicator (CSEI) associated with a first code section; and
e. determining, based on a value of the CSEI, whether the first code section has been executed.