基于内存管理的模式化软件关键行为跟踪技术

摘要

To solve the problems of the software key behavior identification ,information collection and so on in terms of software tracing ,a pattern‐oriented software key behavior tracing based on the memory management was proposed .Firstly ,through cog‐nizing and defining the software behavior ,the fact that the function call sequence by time order was the object of software beha‐vior tracing was pointed out .Through the contrast analysis of two kinds of function of the HOOK technology and combining both advantages on this basis ,the real‐time state of run‐time functions in libraries of the objective software was obtained by using the technology of memory‐resident program based on small memory management in heap and container management keeping the stack balance of the system .Experimental results show that the method can manage nodes of target monitor software behavior in a flexible way and trace the software key behavior effectively .%为解决软件跟踪过程中关键行为识别与信息获取等问题，提出基于内存管理的模式化软件关键行为跟踪技术。对软件行为的概念进行认知和定义，指出软件行为跟踪的目标为按时间排序的函数调用序列；在此基础上，对比分析了两类HOOK函数技术，结合两者优势，依赖基于小内存管理的堆空间代码驻留技术和维持栈空间平衡的容器管理技术，实时监控库函数的运行状态。实验结果表明，该方法能够灵活控制软件行为的监控节点，有效跟踪软件关键行为的运行轨迹。