Configurable code fingerprint

• US 10,157,119 B2
• Filed: 10/10/2016
• Issued: 12/18/2018
• Est. Priority Date: 01/04/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Frazier, Giles R., Gschwind, Michael K., Jacobi, Christian, Shum, Chung-Lung K.
• Primary Examiner(s): Chen, Qing
• Application Number:
  US15/289,513
• Publication Number:
  US 20170192800A1
• Time in Patent Office: 799 Days
• Field of Search: 717124-135, 717158, 717159
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 9/44589 Program code verification, e.g. Java bytecode verification, proof-carrying code high-level semantic checks G06F8/43; testing and debugging software G06F11/36

Abstract

A method, computer program product, and system performing a method that include a processor defining a code fingerprint by obtaining parameters describing at least one of an event type or an event. The code fingerprint includes a first sequence. The processor loads the code fingerprint into a register accessible to the processor. Concurrent with executing a program, the processor obtains the code fingerprint from the register and identifies the code fingerprint in the program by comparing a second sequence in the program to the first sequence. Based on identifying the code fingerprint in the program, the processor alerts a runtime environment where the program is executing.

Claims

1. A computer-implemented method, comprising:

defining, by a processor, a code fingerprint by obtaining parameters describing at least one of an event type or an event, wherein the code fingerprint comprises a first sequence;

loading, by the processor, the code fingerprint into a first register accessible to the processor, wherein the first register comprises an initial code fingerprint comprising an initial code sequence;

concurrent with the loading the code fingerprint into the first register accessible to the processor, loading, by the processor, the initial code fingerprint into an historical register;

concurrent with executing a program, obtaining, by the processor, the code fingerprint from the first register;

identifying, by the processor, the code fingerprint in the program by comparing a second sequence in the program to the first sequence; and

based on the identifying, alerting, by the processor, a runtime environment, wherein the program is executing in the runtime environment.

2. The computer-implemented method of claim 1, wherein the parameters describe one of:

a load-type event or a branch-type event.

3. The computer-implemented method of claim 1, wherein the obtaining parameters further comprises obtaining a plurality of parameters from a source, retaining the plurality of parameters in a register, and selecting the parameters from the plurality of parameters in the register.

4. The computer-implemented method of claim 1, wherein the first sequence comprises a measured sequence.

5. The computer-implemented method of claim 1, wherein the comparing comprises:

obtaining, by the processor, the second sequence from a second register;

comparing, by the processor, the first sequence and the second sequence; and

determining, by the processor, that the first sequence and the second sequence are identical.

6. The computer-implemented method of claim 1, wherein the comparing comprises:

obtaining, by the processor, the second sequence from a second register;

comparing, by the processor, the first sequence and the second sequence; and

determining, by the processor, that a hamming distance between the first sequence and the second sequence comprises less than a specified value.

7. The computer-implemented method of claim 1, wherein the alerting comprises triggering, by the processor, a trap.

8. The computer-implemented method of claim 1, wherein the alerting comprises triggering, by the processor, a trap when a specific processor behavior described by the code fingerprint occurs at a given address.

9. The computer-implemented method of claim 1, wherein the code fingerprint comprises a conditional branch sequence with a target address in an instruction.

10. The computer-implemented method of claim 1, further comprising:

defining, by the processor, a new code fingerprint, wherein the new code fingerprint comprises a third sequence;

loading, by the processor, the new code fingerprint into the first register accessible to the processor; and

concurrent with the loading the new code fingerprint into the first register accessible to the processor, loading, by the processor, the code fingerprint into the historical register.

11. The computer-implemented method of claim 1, wherein the identifying further comprises obtaining, by the processor, the second sequence from the program by identifying when the second sequence occurs in the program, wherein the second sequence comprises the first sequence.

12. A computer program product comprising:

a non-transitory computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising;

defining, by the one or more processors, a code fingerprint by obtaining parameters describing at least one of an event type or an event, wherein the code fingerprint comprises a first sequence;

loading, by the one or more processors, the code fingerprint into a first register accessible to the one or more processors, wherein the first register comprises an initial code fingerprint comprising an initial code sequence;

concurrent with the loading the code fingerprint into the first register accessible to the one or more processors, loading, by the one or more processors, the initial code fingerprint into an historical register;

concurrent with executing a program, obtaining, by the one or more processors, the code fingerprint from the first register;

identifying, by the one or more processors, the code fingerprint in the program by comparing a second sequence in the program to the first sequence; and

based on the identifying, alerting, by the one or more processors, a runtime environment, wherein the program is executing in the runtime environment.

13. The computer program product of claim 12, wherein the parameters describe one of:

a load-type event or a branch-type event.

14. The computer program product of claim 12, wherein the obtaining parameters further comprises obtaining a plurality of parameters from a source, retaining the plurality of parameters in a register, and selecting the parameters from the plurality of parameters in the register.

15. The computer program product of claim 12, wherein the first sequence comprises a measured sequence, and wherein the alerting comprises triggering, by the one or more processors, a trap.

16. The computer program product of claim 12, wherein the comparing comprises:

obtaining, by the one or more processors, the second sequence from a second register;

comparing, by the one or more processors, the first sequence and the second sequence; and

determining, by the one or more processors, that the first sequence and the second sequence are identical.

17. The computer program product of claim 12, wherein the comparing comprises:

obtaining, by the one or more processors, the second sequence from a second register;

comparing, by the one or more processors, the first sequence and the second sequence; and

determining, by the one or more processors, that a hamming distance between the first sequence and the second sequence comprises less than a specified value.

18. A system comprising:

a memory;

one or more processors in communication with the memory; and

program instructions executable by the one or more processors via the memory to perform a method, the method comprising;

defining, by the one or more processors, a code fingerprint by obtaining parameters describing at least one of an event type or an event, wherein the code fingerprint comprises a first sequence;

loading, by the one or more processors, the code fingerprint into a first register accessible to the one or more processors, wherein the first register comprises an initial code fingerprint comprising an initial code sequence;

concurrent with the loading the code fingerprint into the first register accessible to the one or more processors, loading, by the one or more processors, the initial code fingerprint into an historical register;

concurrent with executing a program, obtaining, by the one or more processors, the code fingerprint from the first register;

identifying, by the one or more processors, the code fingerprint in the program by comparing a second sequence in the program to the first sequence; and

based on the identifying, alerting, by the one or more processors, a runtime environment, wherein the program is executing in the runtime environment.

19. The system of claim 18, wherein the comparing comprises:

obtaining, by the one or more processors, the second sequence from a second register;

comparing, by the one or more processors, the first sequence and the second sequence; and

determining, by the one or more processors, that a hamming distance between the first sequence and the second sequence comprises less than a specified value.

20. The system of claim 18, further comprising:

defining, by the one or more processors, a new code fingerprint, wherein the new code fingerprint comprises a third sequence;

loading, by the one or more processors, the new code fingerprint into the first register accessible to the one or more processors; and

concurrent with the loading the new code fingerprint into the first register accessible to the one or more processors, loading, by the one or more processors, the code fingerprint into the historical register.