Dynamic instrumentation method and apparatus for tracing and analyzing a program

• US 8,806,448 B2
• Filed: 05/27/2011
• Issued: 08/12/2014
• Est. Priority Date: 08/27/2010
• Status: Expired due to Fees

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Jeong, Jae-Hoon
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US13/117,809
• Publication Number:
  US 20120054723A1
• Time in Patent Office: 1,173 Days
• Field of Search: 717124-131
• US Class Current: 717/129
• CPC Class Codes: G06F 11/3644 by instrumenting at runtime

Abstract

An apparatus and method for dynamically analyzing a program are provided. The apparatus and method help minimize overhead in tracing the execution of the program without substantially affecting the operation of the program at run time. The method includes storing an environment value before execution of a function of a main page by storing a first instruction of the function in a temporary page before execution of the first instruction. The method also includes inserting a break instruction at an address of the first instruction in the main page, executing the break instruction, and storing an environment value after execution of the function by executing a break instruction of the temporary page.

Claims

1. A computer implemented method of dynamically analyzing a program, the computer implemented method causing the computer to execute steps comprising:

storing an environment value before an execution of a function of a main page by storing a first instruction of the function in a temporary page before execution of the first instruction, inserting a break instruction of the main page at an address of the first instruction in the main page, and executing the break instruction of the main page; and

storing the environment value after the execution of the function by executing a break instruction of the temporary page in a return address of the temporary page after a final instruction of the function is executed;

executing the break instruction of the main page, storing the environment value before execution of the function, and changing a return address of the function to an address of the first function in the temporary page.

2. The method of claim 1, wherein the first instruction of the function, a transfer instruction, and the break instruction of the temporary page are sequentially stored and executed in the temporary page,

wherein the transfer instruction enables a transfer to an address where a second instruction of the function is stored.

3. The method of claim 2, wherein the storing of the environment value before the execution of the function comprises:

storing the first instruction of the function in the temporary page and inserting the break instruction of the main page at the address of the first instruction in the main page.

4. The method of claim 3, further comprising:

executing the first instruction stored in the temporary page;

executing an instruction to transfer to the address where the second instruction of the function is stored; and

sequentially executing other instructions of the function after the executing of the second instruction of the function.

5. The method of claim 2, wherein the storing of the environment value after execution of the function comprises:

transferring an execution location to the return address according to the final instruction of the function; and

determining the environment value after execution of the function in an operating system area as the break instruction of the temporary page is executed,

wherein the return address represents an address of the break instruction of the temporary page, after the final instruction of the function is executed.

6. The method of claim 1, wherein, in response to the break instruction of the main page being executed, a probe handler is executed by an exception handler in an operating system area to determine and store the environment value of the function.

7. The method of claim 1, wherein:

the first instruction of the function is stored in the temporary page such that the break instruction of the main page is stored in the main page instead of the first instruction, the break instruction of the main page is executed, and the first instruction stored in the temporary page is executed.

8. The method of claim 1, wherein a processing program is executed to store information of tracing in an operating system area.

9. A hardware apparatus for dynamically analyzing a program, the apparatus comprising:

an instruction managing unit configured to store instructions of a function of a main page in a temporary page, and to insert a break instruction in the temporary page; and

a probe unit configured to detect an environment value of the function according to an execution of the break instruction of the temporary page, and to store the detected environment value;

executing the break instruction of the main page, storing the environment value before execution of the function, and changing a return address of the function to an address of the first function in the temporary page.

10. The apparatus of claim 9, wherein the instruction managing unit manages the instructions such that a first instruction of the function is stored in the temporary page before execution of the first instruction, a break instruction of the main page is inserted into an address of the first instruction in the main page such that the break instruction of the main page is executed, and a break instruction stored in a return address of the function of temporary page is executed after a final instruction of the function is executed.

11. The apparatus of claim 9, wherein the instruction managing unit executes an instruction to a transfer to an address where a second instruction of the function is stored after the first instruction stored in the temporary page is executed, and sequentially executes other instructions of the function after the second instruction of the function is executed.

12. The apparatus of claim 9, wherein the probe unit detects an environment value before execution of the function by executing the break instruction of the main page, and detects an environment value after execution of the function by executing the break instruction stored in the return address of the function of temporary page.

13. The apparatus of claim 9, wherein the instruction managing unit and the probe unit are implemented by a probe handler that is executed by an exception handler of an operating system area.

14. A computer implemented method of dynamically analyzing a program, the computer implemented method causing the computer to execute steps comprising:

determining a first environment value;

copying a first function instruction from a first address, the first address located in a main page;

storing the first function instruction in a second address, the second address located in a temporary page;

storing a first break instruction in the first address, in place of the first function instruction;

executing the first break instruction in the first address;

executing the first function instruction in the second address;

executing a second break instruction; and

determining a second environment value,

wherein the second break instruction is stored in an address that follows the second address.

15. The method of claim 14, wherein a transfer instruction is stored in an address that follows the second address and that precedes the address of the second break instruction,

wherein the transfer instruction enables a transfer to an address where a second instruction of the function is stored.

16. The method of claim 14, wherein the determining of the first environment value comprises executing a probe handler in an operating system area.

17. The method of claim 14, wherein the operation of determining the second environment value is executed after transferring an execution location to a return address, according to execution of a final function instruction.