WO2024046260A1 - 一种热补丁方法及相关装置 - Google Patents

一种热补丁方法及相关装置 Download PDF

Info

Publication number
WO2024046260A1
WO2024046260A1 PCT/CN2023/115208 CN2023115208W WO2024046260A1 WO 2024046260 A1 WO2024046260 A1 WO 2024046260A1 CN 2023115208 W CN2023115208 W CN 2023115208W WO 2024046260 A1 WO2024046260 A1 WO 2024046260A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
functions
processes
information
call information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/115208
Other languages
English (en)
French (fr)
Inventor
朱玲
罗龙君
李宗武
桑琰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP23859291.9A priority Critical patent/EP4560510A4/en
Publication of WO2024046260A1 publication Critical patent/WO2024046260A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/656—Updates while running
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/658—Incremental updates; Differential updates
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4812—Task transfer initiation or dispatching by interrupt, e.g. masked
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/485—Task life-cycle, e.g. stopping, restarting, resuming execution
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/4881—Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/547—Remote procedure calls [RPC]; Web services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00—Indexing scheme relating to G06F9/00
    • G06F2209/48—Indexing scheme relating to G06F9/48
    • G06F2209/484—Precedence
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present application relates to the field of computer technology, and in particular, to a hot patch method and related devices.
  • the server's kernel can already fix kernel defects without restarting the system based on hot patching, which is called kernel hot patching.
  • kernel hot patching hot patching
  • Processes, threads, and shared software libraries also need to be patched. Otherwise, the server may be exposed to attacks that exploit vulnerabilities such as Heartbleed or GHOST.
  • a common way to deal with library vulnerabilities in a server is to restart the server or restart the application causing downtime and the vulnerability window. Additionally, administrators rarely know which libraries a service is using, so they need to restart the entire server to update the service.
  • the technical problem to be solved by the embodiments of this application is to provide a hot patch method and related devices, which can repair vulnerabilities in the software library running on the server without restarting the process, and solve the problems caused by restarting the server or application program. Losses due to service suspension.
  • the implementation example of this application provides a hot patch method, which is characterized in that the method includes: determining patch files generated for multiple objective functions; determining M from N processes based on the multiple objective functions.
  • the target process and records the initial call information of the M target processes.
  • the initial call information includes the information that each of the target processes calls the multiple target functions.
  • N and M are integers greater than 0, and N is greater than Or equal to M; determine the current call information corresponding to each of the M target processes, each of the current call information includes information that the corresponding target process currently calls the multiple target functions; based on the initial
  • the calling information and the current calling information corresponding to each target process and the patch file are used to perform hot patch operations on the M target processes respectively.
  • multiple target processes that call the vulnerable function are first determined, and the information that each target process calls the target function (such as the vulnerable function) is recorded (that is, the initial call information); Next, obtain the information of each target process currently calling the vulnerability function (which can also be understood as the information of the current vulnerability function being called); further, based on the information of the current vulnerability function being called, determine the vulnerabilities that can currently be patched. function; finally, the target process that can currently be patched is determined based on the initial call information of multiple target processes, and the target process is patched based on the patch file, so that the software running on the server can be patched without restarting the process.
  • the library repairs vulnerabilities and solves the loss of service suspension caused by restarting the server or application.
  • it is necessary to wait until all target processes do not call the vulnerable function before patching all target processes (or threads) at once, resulting in low patching efficiency.
  • the initial call information since all the target processes that need to be patched are recorded in advance, as well as the information on how each target process calls the vulnerable function (i.e., the initial call information), after determining the vulnerable function that can currently be patched, you can Based on the initial call information, the target process that can currently be patched is determined from multiple target processes, so that patching can be implemented flexibly according to priority or strategy, thus improving the efficiency of hot patching.
  • the patch file includes repair information for each of the multiple objective functions
  • determining the patch file generated for the multiple objective functions includes: comparing multiple functions The original code and the repair code are used to determine the plurality of objective functions from the plurality of functions; based on the repair code, the repair information of each of the plurality of objective functions is determined.
  • an application service can be run on the electronic device, and multiple functions may be called in the application service.
  • the vulnerable functions need to be patched.
  • the electronic device can first determine the function of the vulnerability in the application service based on the original code and repair code of the application service (which can be understood as the code modified by the programmer for the vulnerability), and then based on the repair code, it can The patch files for all vulnerable functions are obtained, and the vulnerable functions can be patched based on the patch files, thereby improving the security of the system.
  • comparing the original code and the repair code of multiple functions and determining the multiple target functions from the multiple functions includes: running the original code and the repair code respectively. , obtain the first intermediate information of the original code and the second intermediate information of the repair code by modifying the compiler parameters; determine from the multiple functions based on the first intermediate information and the second intermediate information the multiple objective functions.
  • the original code and the repair code of the application service can be run separately on the compiler of the electronic device, and then the intermediate files of the original code and the intermediate files of the repair code are respectively obtained by hijacking GCC. Further, the target function (such as the vulnerability function) can be determined by comparing the intermediate files of the original code and the intermediate files of the repaired code.
  • the intermediate information between the original code and the repair code can be obtained, which avoids By changing the CC variables of the build project to indirectly call the compiler to obtain the original code and the intermediate files of the repair code, which leads to the problem of limited application scenarios, it reduces the debugging overhead and has a wider scope of application.
  • the method further includes: determining M target processes from N processes based on the multiple target functions, including: determining whether each of the N processes calls the At least one of the plurality of target functions; the N processes include one or more of a running process, a newly started process and a process that is about to be pulled up; if one of the plurality of target functions is called At least one of the processes is determined as the target process.
  • a process calling a target function such as a vulnerability function
  • a target function such as a vulnerability function
  • the vulnerable functions that can currently be patched it can be determined from multiple target processes based on the initial call information.
  • the target processes that can currently be patched are identified, so that patches can be flexibly patched according to priorities or policies, thus improving the efficiency of hot patching.
  • recording the initial call information of the M target processes includes: replacing the memory page corresponding to each of the M target processes with a soft interrupt instruction, and the The soft interrupt instruction is used to suspend the operation of the corresponding target process; and obtain the initial call information of the M target processes.
  • the memory page corresponding to the target process can be replaced with a soft interrupt instruction to suspend the running of the target process, so that the initial call of the target process can be obtained information to record in advance all the target processes that need to be patched, and the information about calling vulnerable functions by each target process.
  • the vulnerable functions that can currently be patched you can start from multiple target processes based on the initial call information. Determine the target processes that can currently be patched, so that you can flexibly patch based on priority or strategy, thereby improving the efficiency of hot patching.
  • determining the current call information corresponding to each of the M target processes includes: recording the current call information of each of the M target processes. information of multiple target functions, and update the corresponding current call information.
  • performing a hot patch operation on the M target processes based on the initial call information, the current call information corresponding to each target process, and the patch file includes: According to the hot patch strategy, based on the initial call information and the current call information corresponding to each of the target processes and the repair information of each of the multiple target functions, the M target processes are Hot patch operations are performed on target processes that meet the hot patch policy.
  • the hot patch policy can be a customized policy, and the hot patch policy can be divided into multiple dimensions, for example, the function dimension: when a certain vulnerable function is not called by all processes/threads, that is, the vulnerable function (funcx ) when the corresponding value is 0, you can start patching; thread dimension: when func1, func2, and func3 are not called by thread_x, that is, when the corresponding value of thread_x is reduced to 0, you can start patching; full dimension: all vulnerable functions are not called When called by all threads, that is, when the values corresponding to all vulnerable functions are reduced to 0, patching can begin.
  • the function dimension when a certain vulnerable function is not called by all processes/threads, that is, the vulnerable function (funcx ) when the corresponding value is 0, you can start patching
  • thread dimension when func1, func2, and func3 are not called by thread_x, that is, when the corresponding value of thread_x is reduced to 0, you can start patching
  • full dimension all vulnerable functions are not called When called by
  • the present application provides a hot patch device, which is characterized in that the device includes: a first processing unit for determining patch files generated for multiple objective functions; a second processing unit for determining based on the The plurality of target functions determine M target processes from the N processes, and record the initial call information of the M target processes.
  • the initial call information includes information that each of the target processes calls the multiple target functions.
  • N and M are integers greater than 0, and N is greater than or equal to M; the third processing unit is used to determine the M targets
  • the current call information corresponding to each of the target processes in the target process, each of the current call information includes information that the corresponding target process currently calls the multiple target functions; a fourth processing unit, configured to based on the initial call information According to the current calling information and the patch file corresponding to each of the target processes, hot patch operations are performed on the M target processes respectively.
  • the patch file includes repair information for each of the multiple objective functions
  • the first processing unit is specifically configured to: compare the original code and the original code of the multiple functions. a repair code that determines the plurality of objective functions from the plurality of functions; and based on the repair code, determines the repair information for each of the plurality of objective functions.
  • the first processing unit is specifically configured to: run the original code and the repair code respectively, and obtain the first intermediate information of the original code and the first intermediate information of the original code by modifying compiler parameters. Repairing second intermediate information of the code; determining the plurality of objective functions from the plurality of functions based on the first intermediate information and the second intermediate information.
  • the second processing unit is specifically configured to: determine whether each of the N processes calls at least one of the multiple target functions; the N processes include One or more of a running process, a newly launched process, and a process that is about to be launched; if at least one of the plurality of target functions is called, the corresponding process is determined to be the target process.
  • the second processing unit is specifically configured to: replace the memory page corresponding to each of the M target processes with a soft interrupt instruction, and the soft interrupt instruction is used to Pause and run the corresponding target process; obtain the initial call information of the M target processes.
  • the third processing unit is specifically configured to: record the information that each of the M target processes currently calls the multiple target functions, and update the corresponding Current call information.
  • the fourth processing unit is specifically configured to: according to the hot patch strategy, based on the initial call information and the current call information corresponding to each of the target processes and the multiple target functions
  • the repair information of each of the target functions in the M target processes is used to perform a hot patch operation on the target process that satisfies the hot patch policy among the M target processes.
  • the present application provides a computer storage medium, characterized in that the computer storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the first aspects is implemented.
  • inventions of the present application provide an electronic device.
  • the electronic device includes a processor, and the processor is configured to support the electronic device in implementing corresponding functions in a hot patch method provided in the first aspect.
  • the electronic device may also include a memory coupled to the processor that stores necessary program instructions and data for the electronic device.
  • the electronic device may also include a communication interface for the electronic device to communicate with other devices or communication networks.
  • the present application provides a chip system, which includes a processor and is used to support an electronic device to implement the functions involved in the above-mentioned first aspect, for example, generating or processing information involved in the above-mentioned hot patch method.
  • the chip system further includes a memory, and the memory is used to store necessary program instructions and data of the electronic device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the present application provides a computer program, characterized in that the computer program includes instructions that, when the computer program is executed by a computer, cause the computer to perform any of the methods described in the first aspect. .
  • FIG. 1 is a schematic structural diagram of an electronic device 100 provided by an embodiment of the present invention.
  • FIG. 2 is a software structure block diagram of the electronic device 100 according to the embodiment of the present invention.
  • Figure 3 is an architectural diagram of a user-mode hot patch library provided by the prior art.
  • Figure 4 is a schematic flow chart of patch production by a user-mode hot patch library provided by the prior art.
  • Figure 5 is a schematic diagram of preparing and applying patches in a user-mode hot patch library provided by the prior art.
  • Figure 6 is a schematic diagram of the system architecture of a hot patch provided by an embodiment of the present invention.
  • Figure 7 is a schematic flowchart of a user mode hot patch method in an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of user mode hot patch production according to an embodiment of the present invention.
  • Figure 9 is a schematic diagram of a hijacking compiler provided by an embodiment of the present invention.
  • Figure 10 is a schematic diagram of user mode injection provided by an embodiment of the present invention.
  • Figure 11 is a schematic diagram of initial call data statistics provided by an embodiment of the present invention.
  • Figure 12 is a schematic diagram of a statistics call provided by an embodiment of the present invention.
  • Figure 13 is a schematic diagram of a user mode hot patch process provided by an embodiment of the present invention.
  • Figure 14 is a schematic diagram of a hot patch device provided by this application according to an embodiment of the present invention.
  • an embodiment means that a particular feature, structure or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application.
  • the appearances of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those skilled in the art understand, both explicitly and implicitly, that the embodiments described herein may be combined with other embodiments.
  • Tracing function a Linux system call, is used for process tracking. It provides the parent process with the ability to observe and control the execution of its child processes, and allows the parent process to check and replace the kernel image (including registers) of the child process. value.
  • Compiler Computer Collection, CC
  • compiler variables defined when building the project.
  • System call can run another specified program and load the new program into the memory space of the current process.
  • FIG. 1 shows a schematic structural diagram of an electronic device 100 .
  • electronic device 100 may have more or fewer components than shown in the figures, may combine two or more components, or may have a different component configuration.
  • the various components shown in the figures may be implemented in hardware, software, or a combination of hardware and software including one or more signal processing and/or application specific integrated circuits.
  • the electronic device 100 may include: a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2.
  • Mobile communication module 150 wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone interface 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, And subscriber identification module (subscriber identification module, SIM) card interface 195, etc.
  • SIM subscriber identification module
  • the sensor module 180 may include a pressure sensor 180A, a gyro sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, and an environment.
  • the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100 .
  • the electronic device 100 may include more or fewer components than shown in the figures, or some components may be combined, some components may be separated, or some components may be arranged differently.
  • the components illustrated may be implemented in hardware, software, or a combination of software and hardware.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (NPU) wait.
  • application processor application processor, AP
  • modem processor graphics processing unit
  • GPU graphics processing unit
  • image signal processor image signal processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • baseband processor baseband processor
  • NPU neural-network processing unit
  • different processing units can be independent devices or integrated in one or more processors.
  • the controller may be the nerve center and command center of the electronic device 100 .
  • the controller can generate operation control signals based on the instruction operation code and timing signals to complete the control of fetching and executing instructions.
  • the processor 110 may also be provided with a memory for storing instructions and data.
  • the memory in processor 110 is cache memory. This memory may hold instructions or data that have been recently used or recycled by processor 110 . If the processor 110 needs to use the instructions or data again, it can be called directly from the memory. Repeated access is avoided and the waiting time of the processor 110 is reduced, thus improving the efficiency of the system.
  • processor 110 may include one or more interfaces.
  • Interfaces may include integrated circuit (inter-integrated circuit, I2C) interface, integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, pulse code modulation (PCM) interface, universal asynchronous receiver and transmitter (universal asynchronous receiver/transmitter, UART) interface, Mobile Industry Division mobile industry processor interface (MIPI), general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and/or universal serial bus (universal serial bus , USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • MIPI Mobile Industry Division mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB universal serial bus
  • the interface connection relationships between the modules illustrated in the embodiment of the present invention are only schematic illustrations and do not constitute a structural limitation of the electronic device 100 .
  • the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.
  • the charging management module 140 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110.
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140, and supplies power to the processor 110, internal memory 121, external memory, display screen 194, camera 193, wireless communication module 160, etc.
  • the wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.
  • the electronic device 100 implements display functions through a GPU, a display screen 194, an application processor, and the like.
  • the GPU is an image processing microprocessor and is connected to the display screen 194 and the application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering.
  • Processor 110 may include one or more GPUs that execute program instructions to generate or alter display information.
  • the display screen 194 is used to display images, videos, etc.
  • Display 194 includes a display panel.
  • the display panel can use a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active matrix organic light emitting diode or an active matrix organic light emitting diode (active-matrix organic light emitting diode).
  • LCD liquid crystal display
  • OLED organic light-emitting diode
  • AMOLED organic light-emitting diode
  • FLED flexible light-emitting diode
  • Miniled MicroLed, Micro-oLed, quantum dot light emitting diode (QLED), etc.
  • the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.
  • the electronic device 100 can implement the shooting function through an ISP, a camera 193, a video codec, a GPU, a display screen 194, an application processor, and the like.
  • the ISP is used to process the data fed back by the camera 193. For example, when taking a photo, the shutter is opened, the light is transmitted to the camera sensor through the lens, the optical signal is converted into an electrical signal, and the camera sensor passes the electrical signal to the ISP for processing, and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on image noise, brightness, and skin color. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, the ISP may be provided in the camera 193.
  • Camera 193 is used to capture still images or video.
  • the object passes through the lens to produce an optical image that is projected onto the photosensitive element.
  • the photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor.
  • CMOS complementary metal-oxide-semiconductor
  • the photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to convert it into a digital image signal.
  • ISP outputs digital image signals to DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other format image signals.
  • electronic device 100 may include other cameras.
  • the electronic device may also include a dot matrix emitter (not shown in the figure) for emitting light.
  • the camera collects the light reflected by the face and obtains the face image.
  • the processor processes and analyzes the face image and compares it with the stored face image information for verification.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the electronic device 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.
  • Video codecs are used to compress or decompress digital video.
  • Electronic device 100 may support one or more video codecs. In this way, the electronic device 100 can play or record videos in multiple encoding formats, such as moving picture experts group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.
  • MPEG moving picture experts group
  • MPEG2 MPEG2, MPEG3, MPEG4, etc.
  • NPU is a neural network (NN) computing processor.
  • NN neural network
  • Intelligent cognitive applications of the electronic device 100 can be implemented through the NPU, such as image recognition, face recognition, speech recognition, text understanding, etc.
  • the external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100.
  • the external memory card communicates with the processor 110 through the external memory interface 120 to implement the data storage function. Such as saving music, videos, etc. files in external memory card.
  • Internal memory 121 may be used to store computer executable program code, which includes instructions.
  • the processor 110 executes instructions stored in the internal memory 121 to execute various functional applications and data processing of the electronic device 100 .
  • the internal memory 121 may include a program storage area and a data storage area.
  • the stored program area can store the operating system and at least one application required for the function (such as Such as face recognition function, fingerprint recognition function, mobile payment function, etc.).
  • the storage data area can store data created during the use of the electronic device 100 (such as face information template data, fingerprint information templates, etc.).
  • the internal memory 121 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, universal flash storage (UFS), etc.
  • the electronic device 100 can implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone interface 170D, and the application processor. Such as music playback, recording, etc.
  • the audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals.
  • Speaker 170A also called “speaker” is used to convert audio electrical signals into sound signals.
  • Receiver 170B also called “earpiece” is used to convert audio electrical signals into sound signals.
  • Microphone 170C also called “microphone” or “microphone”, is used to convert sound signals into electrical signals.
  • the headphone interface 170D is used to connect wired headphones.
  • the headphone interface 170D may be a USB interface 130, or may be a 3.5mm open mobile terminal platform (OMTP) standard interface, or a Cellular Telecommunications Industry Association of the USA (CTIA) standard interface.
  • OMTP open mobile terminal platform
  • CTIA Cellular Telecommunications Industry Association of the USA
  • the pressure sensor 180A is used to sense pressure signals and can convert the pressure signals into electrical signals.
  • pressure sensor 180A may be disposed on display screen 194 .
  • the gyro sensor 180B may be used to determine the motion posture of the electronic device 100 .
  • the angular velocity of electronic device 100 about three axes ie, x, y, and z axes
  • Proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode.
  • the light emitting diode may be an infrared light emitting diode.
  • the ambient light sensor 180L is used to sense ambient light brightness.
  • the electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness.
  • the ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures.
  • Fingerprint sensor 180H is used to collect fingerprints.
  • the electronic device 100 can use the collected fingerprint characteristics to achieve fingerprint unlocking, access to application locks, fingerprint photography, fingerprint answering of incoming calls, etc.
  • the fingerprint sensor 180H can be disposed below the touch screen.
  • the electronic device 100 can receive the user's touch operation on the area corresponding to the fingerprint sensor on the touch screen.
  • the electronic device 100 can respond to the touch operation and collect the fingerprint of the user's finger. information.
  • Temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device 100 utilizes the temperature detected by the temperature sensor 180J to execute the temperature processing strategy.
  • Touch sensor 180K also called “touch panel”.
  • the touch sensor 180K can be disposed on the display screen 194.
  • the touch sensor 180K and the display screen 194 form a touch screen, which is also called a "touch screen”.
  • the touch sensor 180K is used to detect a touch operation on or near the touch sensor 180K.
  • the touch sensor can pass the detected touch operation to the application processor to determine the touch event type.
  • Visual output related to the touch operation may be provided through display screen 194 .
  • the touch sensor 180K may also be disposed on the surface of the electronic device 100 at a location different from that of the display screen 194 .
  • the buttons 190 include a power button, a volume button, etc.
  • Key 190 may be a mechanical key. It can also be a touch button.
  • the electronic device 100 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 100 .
  • the indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, or may be used to indicate messages, missed calls, notifications, etc.
  • the SIM card interface 195 is used to connect a SIM card.
  • the SIM card can be connected to or separated from the electronic device 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195 .
  • the electronic device 100 uses an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100 .
  • the software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture.
  • This embodiment of the present invention takes the Android system with a layered architecture as an example to illustrate the software structure of the electronic device 100 .
  • FIG. 2 is a software structure block diagram of the electronic device 100 according to the embodiment of the present invention.
  • the layered architecture divides the software into several layers, and each layer has clear roles and division of labor.
  • the layers communicate through software interfaces.
  • the Android system is divided into four layers, from top to bottom: application layer, application framework layer, Android runtime and system libraries, and kernel layer.
  • the application layer can include a series of application packages.
  • the application package can include camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video Frequency, SMS and other applications (also called applications).
  • the application framework layer provides an application programming interface (API) and programming framework for applications in the application layer.
  • API application programming interface
  • the application framework layer includes some predefined functions.
  • the application framework layer can include a window manager, content provider, view system, phone manager, resource manager, notification manager, etc.
  • a window manager is used to manage window programs.
  • the window manager can obtain the display size, determine whether there is a status bar, lock the screen, capture the screen, etc.
  • Content providers are used to store and retrieve data and make this data accessible to applications.
  • Said data can include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.
  • the view system includes visual controls, such as controls that display text, controls that display pictures, etc.
  • a view system can be used to build applications.
  • the display interface can be composed of one or more views.
  • a display interface including a text message notification icon may include a view for displaying text and a view for displaying pictures.
  • the phone manager is used to provide communication functions of the electronic device 100 .
  • call status management including connected, hung up, etc.
  • the resource manager provides various resources to applications, such as localized strings, icons, pictures, layout files, video files, etc.
  • the notification manager allows applications to display notification information in the status bar, which can be used to convey notification-type messages and can automatically disappear after a short stay without user interaction.
  • the notification manager is used to notify download completion, message reminders, etc.
  • the notification manager can also be notifications that appear in the status bar at the top of the system in the form of charts or scroll bar text, such as notifications for applications running in the background, or notifications that appear on the screen in the form of a conversation interface. For example, text information is prompted in the status bar, a beep sounds, the electronic device vibrates, the indicator light flashes, etc.
  • Android Runtime includes core libraries and virtual machines. Android runtime is responsible for the scheduling and management of the Android system.
  • the core library contains two parts: one is the functional functions that need to be called by the Java language, and the other is the core library of Android.
  • the application layer and application framework layer run in virtual machines.
  • the virtual machine executes the java files of the application layer and application framework layer into binary files.
  • the virtual machine is used to perform object life cycle management, stack management, thread management, security and exception management, and garbage collection and other functions.
  • System libraries can include multiple functional modules. For example: surface manager (surface manager), media libraries (Media Libraries), 3D graphics processing libraries (for example: OpenGL ES), 2D graphics engines (for example: SGL), etc.
  • the surface manager is used to manage the display subsystem and provides the fusion of 2D and 3D layers for multiple applications.
  • the media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc.
  • the media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.
  • the 3D graphics processing library is used to implement 3D graphics drawing, image rendering, composition, and layer processing.
  • 2D Graphics Engine is a drawing engine for 2D drawing.
  • the kernel layer is the layer between hardware and software.
  • the kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.
  • the user mode hot patch technology is as follows:
  • FIG 3 is an architectural diagram of a user-mode hot patch library provided by the existing technology.
  • libcare generates a patch file by comparing the assembly file generated during the construction of the original code and the new version code; libcare identifies the process And loads the patch in a manner similar to loading a shared object (library) into the target process memory; ibcare changes the instructions of the target process and jumps to the patch.
  • Figure 4 is a schematic process diagram for making patches by a user-mode hot patch library provided by the prior art.
  • the user-mode hot patch making of libcare is mainly done by changing the compiled CC variables (project When calling the compiler variable, it will jump to the program set by libcare).
  • This has two purposes. One is to call the compiler again in the libcare program, and on this basis, you can add compilation parameters that were not originally available; the other is In this way, the output location of the compiled intermediate file can be obtained. Then, libcare generates the patch file by comparing the source code and the intermediate file (assembly file) of the patch code.
  • Figure 5 is a schematic diagram of preparing and applying patches in a user-mode hot patch library provided by the prior art.
  • libcare traverses the /proc/ file
  • the process that needs to be patched is found among all processes.
  • libcare waits until there is no patch symbol information in the stack of each thread in the process, then stops the process through ptrace, performs code injection, and inserts the entry of the target function into the process. Modified to jump to the patch function location.
  • This solution can repair vulnerabilities in the software library running on the server without restarting the electronic device (such as the server), but it has the following shortcomings:
  • Disadvantage 1 libcare indirectly calls the compiler to generate assembly files by changing the compiler variables (CC variables) of the built project, but Some scenarios are not applicable. For example, some projects require cross-compilation and use compiler variables, which will conflict with the construction of patches. For example, some projects may not be built using compiler variables, so they cannot be built. Patch construction.
  • Disadvantage 2 During the patch preparation process, libcare obtains the target process by traversing the /proc/ folder during the stage of identifying the target process. This causes many non-target processes to be scanned. If there are too many processes, it will consume a lot of time.
  • Disadvantage 3 In order to maintain the memory consistency of the process, it is necessary to ensure that each thread is running in a safe position (there is no patch symbol information in the stack). libcare will sequentially traverse all threads until all threads are in a safe position. Only then will the jump instructions be injected into the process. This prevents libcare from configuring partial thread patching.
  • the hot patch method provided in this application can be used to solve the above technical problems.
  • FIG. 6 is a schematic diagram of a hot patch system architecture provided by an embodiment of the present invention.
  • This system can run in the software system of the above-mentioned electronic device 100 and can be used to modify the software library without restarting the process. Repair vulnerabilities to avoid service suspension losses caused by restarting electronic devices (such as servers) or applications.
  • the system architecture can include a patch production tool (upatch build), a patch enhancement tool (upatch helper), a user-mode injection tool (compel program), and a kernel-mode patch module (upatch handler).
  • the patch production tool can generate user-space patch files by hijacking gcc, comparing difference functions (such as vulnerability functions), and processing intermediate files. How the patch production tool produces user-space patch files will be explained in detail later, and I will not go into details here.
  • the patch enhancement tool can be used to query whether a patch is inserted into an executable file (which can be a patch file for a binary file), to query the version of the patch in the executable file, and to query the correspondence between the patch and the executable file.
  • User-mode injection tools can be used to obtain the initial stack call status of the process/thread (i.e.
  • the kernel-mode patch module can be used to update the function call data of processes/threads in real time and patch user-mode processes/threads. This will be explained in detail later, so I won’t go into details here.
  • system architecture of a hot patch in Figure 6 is only an exemplary implementation in the embodiment of the present application.
  • the system architecture of the hot patch in the embodiment of the present application includes but is not limited to the above system architecture.
  • Figure 7 is a schematic flow chart of a user mode hot patching method in an embodiment of the present application.
  • the hot patching method in an embodiment of the present application will be described below in conjunction with Figure 7 and based on the electronic device 100 in Figure 1. Describe it. It should be noted that, in order to describe the hot patch method in the embodiment of the present application in more detail, the present application describes that the corresponding execution subject is the electronic device 100 in each process step, but this does not mean that the embodiment of the present application can only be performed through all the processes. The described execution subject performs the corresponding method flow.
  • Step S201 The electronic device determines patch files generated for multiple objective functions.
  • the patch file includes repair information for each of the multiple objective functions.
  • Multiple target functions may include, but are not limited to, one or more of functions that require vulnerability, functions that need to add content, and functions that need to delete content.
  • a patch file can be understood as an executable program used to repair multiple target function vulnerabilities, which includes repair information for each target function.
  • the repair information of each objective function can be understood as the executable program used to repair the corresponding objective function.
  • the electronic device 100 determines the patch files generated for multiple target functions, including: the electronic device 100 compares the original codes and repair codes of the multiple functions, and determines the patch files from the multiple functions.
  • the plurality of objective functions are described; based on the repair code, the repair information of each of the plurality of objective functions is determined.
  • an application service may be run on the electronic device 100, and multiple functions may be called in the application service.
  • the application service if a vulnerability occurs in one or more functions, the vulnerable functions need to be patched.
  • the electronic device 100 can be based on the original code and repair code of the application service (which can be understood as the code modified by the programmer for the vulnerability), First determine the functions with vulnerabilities in the application service, and then based on the repair code, the patch files for all vulnerable functions can be obtained, and then the vulnerable functions can be patched based on the patch files, which improves the security of the system.
  • the electronic device 100 compares the original code and the repair code of multiple functions, and determines the multiple target functions from the multiple functions, including: the electronic device 100 runs the original code respectively. code and the repair code, obtain the first intermediate information of the original code and the second intermediate information of the repair code by modifying compiler parameters; based on the first intermediate information and the second intermediate information, from the The plurality of objective functions are determined among the plurality of functions.
  • the first intermediate information may include, but is not limited to, data and results generated during the running of the original code; the second intermediate information may include, but is not limited to, data and results generated during the running of the repair code.
  • the original code and the repair code of the application service can be run separately on the compiler (GNU Compiler Collection, GCC) of the electronic device 100, and then the intermediate files of the original code and the intermediate files of the repair code are respectively obtained by hijacking GCC.
  • the patch creation tool can determine the vulnerable function by comparing the intermediate files of the original code and the intermediate files of the repaired code.
  • the intermediate information between the original code and the repair code can be obtained, which avoids By changing the CC variables of the build project to indirectly call the compiler to obtain the original code and the intermediate files of the repair code, which leads to the problem of limited application scenarios, it reduces the debugging overhead and has a wider scope of application.
  • Figure 8 is a schematic flow chart of user-mode hot patch production provided by an embodiment of the present invention.
  • the electronic device 100 can run the repair code and the original code respectively, and then hijack the compiler (such as gcc Compiler) execution entry, check environment variables (whether repair code compilation or original code compilation), determine the stage of patch production; apply for new memory space, layout new parameter set, modify the gcc original stack, and re-execute the system call (i.e. execve Call); compile and generate the original object file (pre object) and repair object file (post object), as well as related intermediate files.
  • the compiler such as gcc Compiler
  • check environment variables whether repair code compilation or original code compilation
  • the original object file can correspond to the source code of a running user mode process in the past and compile a binary file
  • the repair object file is obtained by recompiling the modified source code (without errors); further, compare the pre object and post object files to obtain the different functions and related data; generate according to the processing of the difference function, related data, meta information, etc.
  • User mode hot patch in binary format (Executable and Linkable Format, ELF).
  • Figure 9 is a schematic diagram of a hijacking compiler provided by an embodiment of the present invention.
  • Step S202 The electronic device determines M target processes from N processes based on the plurality of target functions, and records the initial call information of the M target processes.
  • the N processes include one or more of a running process, a newly launched process, and a process that is about to be launched.
  • the initial call information includes information that each of the target processes calls the multiple target functions, and each of the target processes is a process that calls one or more of the multiple target functions.
  • N and M is an integer greater than 0, and N is greater than or equal to M.
  • the target process that can currently be patched is determined based on the initial call information of multiple target processes, and the target process is patched based on the patch file, so that the software library running on the server can be patched without restarting the process.
  • determining M target processes from N processes based on the multiple target functions includes: determining whether each of the N processes calls one of the multiple target functions. At least one of; the N processes include one or more of a running process, a newly launched process, and a process that is about to be launched; if at least one of the multiple target functions is called, then The corresponding process is determined as the target process.
  • recording the initial call information of the M target processes includes: replacing the memory page corresponding to each of the M target processes with a soft interrupt instruction, and the The soft interrupt instruction is used to suspend the operation of the corresponding target process; and obtain the initial call information of the M target processes.
  • the memory page can be used to store the executable program of the process;
  • the soft interrupt instruction can be understood as when the event cannot be processed in a short time, it is completed by the soft interrupt, that is, the running process can be suspended through the soft interrupt instruction.
  • the memory pages corresponding to the target processes can be replaced with soft interrupt instructions to suspend the operation.
  • the target process can obtain the initial call information of the target process, so as to record in advance all the target processes that need to be patched, and the information of each target process calling the vulnerable function. After determining the vulnerable function that can currently be patched, The target process that can currently be patched can be determined from multiple target processes based on the initial call information, thereby enabling flexible patching based on priority or strategy, thus improving the efficiency of hot patching.
  • Figure 10 is a schematic diagram of user mode injection provided by an embodiment of the present invention.
  • you can first search for the virtual memory space in the address mapping space of the running process ( virtual memory area, vma); after reading the vma information, find the corresponding memory page and replace it with a soft interrupt instruction.
  • each file in the kernel has a corresponding index node inode in the file system (inode is a data structure in the UNIX operating system and contains some important information related to each file in the file system) , there is an attribute memory address (i_mapping) in the inode, and i_mapping saves the address space mapping information vma.
  • all mmap call entries will check the file to determine whether it is a target binary file (whether a binary file needs to be patched); look for the address mapping of the running process vma in the space; after reading the vma information, find the corresponding memory page and replace it with a soft interrupt instruction; trigger the uprobe handler, and the kernel mode module performs related processing.
  • Figure 11 is a schematic diagram of initial call data statistics provided by an embodiment of the present invention.
  • the calling situation is passed to the kernel hot patch module. This information will be used in subsequent patches; the memory storing the compel program is deleted; all threads of the process are restored and the process runs normally.
  • Step S203 The electronic device determines the current calling information corresponding to each of the M target processes.
  • each of the current calling information includes information corresponding to the target process currently calling the plurality of target functions.
  • determining the current call information corresponding to each of the M target processes includes: recording the current call information of each of the M target processes. information about multiple target functions, and update the corresponding current call information.
  • the vulnerable function will be recorded in the corresponding current call information. Without pausing all threads or processes, the information of the target process currently calling the vulnerable function can be obtained for subsequent detection.
  • the vulnerability functions that are currently not called are determined as vulnerable functions that can currently be patched, thereby improving the efficiency of hot patching and maintaining the memory consistency of the process.
  • Figure 12 is a schematic diagram of a statistical call provided by an embodiment of the present invention.
  • the entrance and exit of the vulnerable function can be hijacked to update the call statistics in real time, such as when When thread 1 calls func1, the count increases by one, and when the call completes, the count decreases by one.
  • Step S204 The electronic device performs hot patch operations on the M target processes based on the initial call information, the current call information corresponding to each target process, and the patch file.
  • Figure 13 is a schematic diagram of a user-mode hot patch process provided by an embodiment of the present invention.
  • the figure is based on user-mode hot patching. Difference file and generate a patch file through the user mode patch tool; after the user mode generates the patch file, use the patch enhancement tool (upatch helper) to send the corresponding relationship between the vulnerability function and the binary file (repair information) to the kernel mode module; identify whether the process calls the vulnerability function, if called, triggers the kernel module to replace the corresponding memory page with a soft interrupt instruction; counts the initial call information of the process function through the user mode injection tool; saves the statistical data to the kernel module; the kernel module detects the process call information in real time, And the calling information of the thread calling the vulnerable function is updated in real time; according to the configuration policy, when the corresponding vulnerable function call is detected to be 0, it jumps to the new function address; the user mode problem is repaired and the hot patch process is completed.
  • the patch enhancement tool upatch helper
  • performing a hot patch operation on the M target processes based on the initial call information, the current call information corresponding to each target process, and the patch file includes: According to the hot patch strategy, based on the initial call information and the current call information corresponding to each of the target processes and the repair information of each of the multiple target functions, the M target processes are Hot patch operations are performed on target processes that meet the hot patch policy.
  • the hot patch strategy can be a customized strategy.
  • the hot patch strategy can be divided into multiple dimensions. For example, the function dimension: when a certain vulnerable function is not called by all processes/threads, that is, the value corresponding to the vulnerable function (funcx) When it is 0, you can start patching; thread dimension: when func1, func2, and func3 are not called by threadx, that is, when the corresponding value of threadx is reduced to 0, you can start patching; full dimension: when all vulnerable functions are not called by all threads , that is, when the values corresponding to all vulnerability functions are reduced to 0, patching can begin.
  • the function dimension when a certain vulnerable function is not called by all processes/threads, that is, the value corresponding to the vulnerable function (funcx) When it is 0, you can start patching
  • thread dimension when func1, func2, and func3 are not called by threadx, that is, when the corresponding value of threadx is reduced to 0, you can start patching
  • full dimension when all vulnerable functions are not called by all thread
  • FIG 14 is a schematic diagram of a hot patch device provided by this application according to an embodiment of the present invention.
  • the hot patch device 30 may include a first processing unit 301, a second processing unit 302, and a third processing unit. 303.
  • the fourth processing unit 304, the detailed description of each module is as follows.
  • the first processing unit 301 is used to determine patch files generated for multiple objective functions.
  • the second processing unit 302 is configured to determine M target processes from the N processes based on the plurality of target functions, and record the initial call information of the M target processes, where the initial call information includes each of the target processes.
  • Information about the process calling the multiple target functions, N and M are integers greater than 0, and N is greater than or equal to M.
  • the third processing unit 303 is configured to determine the current call information corresponding to each of the M target processes.
  • Each of the current call information includes information that the corresponding target process currently calls the multiple target functions.
  • the fourth processing unit 304 is configured to perform hot patch operations on the M target processes based on the initial call information, the current call information corresponding to each target process, and the patch file.
  • the patch file includes repair information for each of the multiple objective functions
  • the first processing unit 301 is specifically configured to: compare the original codes of the multiple functions. and a repair code to determine the plurality of objective functions from the plurality of functions; and based on the repair code, determine the repair information for each of the plurality of objective functions.
  • the first processing unit 301 is specifically configured to: run the original code and the repair code respectively, and obtain the first intermediate information of the original code and the repair code by modifying compiler parameters.
  • the second intermediate information of the repair code based on the first intermediate information and the second intermediate information, determine the plurality of objective functions from the plurality of functions.
  • the second processing unit 302 is specifically configured to: determine whether each of the N processes calls at least one of the multiple target functions; the N processes include One or more of a running process, a newly launched process, and a process that is about to be launched; if at least one of the plurality of target functions is called, the corresponding process is determined to be the target process.
  • the second processing unit 302 is specifically configured to replace the memory page corresponding to each of the M target processes with a soft interrupt instruction.
  • the soft interrupt instruction is Suspend and run the corresponding target process; obtain the initial call information of the M target processes.
  • the third processing unit 303 is specifically configured to: record each of the M target processes.
  • the target process currently calls information on the plurality of target functions, and updates the corresponding current call information.
  • the fourth processing unit 304 is specifically configured to: according to the hot patch strategy, based on the initial call information and the current call information corresponding to each of the target processes and the multiple targets According to the repair information of each target function in the function, a hot patch operation is performed on a target process among the M target processes that satisfies the hot patch strategy.
  • the present application provides a computer storage medium, which is characterized in that the computer storage medium stores a computer program, and when the computer program is executed by a processor, any one of the above hot patching methods is implemented.
  • An embodiment of the present application provides an electronic device.
  • the electronic device includes a processor, and the processor is configured to support the electronic device to implement corresponding functions in any of the above hot patch methods.
  • the electronic device may also include a memory coupled to the processor that stores necessary program instructions and data for the electronic device.
  • the electronic device may also include a communication interface for the electronic device to communicate with other devices or communication networks.
  • the present application provides a chip system, which includes a processor and is used to support an electronic device to implement the above-mentioned functions, for example, generate or process information involved in the above-mentioned hot patch method.
  • the chip system further includes a memory, and the memory is used to store necessary program instructions and data of the electronic device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the present application provides a computer program, which is characterized in that the computer program includes instructions that, when the computer program is executed by a computer, cause the computer to execute the above-mentioned user mode hot patching method.
  • the disclosed device can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the above units is only a logical function division. In actual implementation, there may be other divisions.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical or other forms.
  • the units described above as separate components may or may not be physically separated.
  • the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which can be a personal computer, a server or a network device, etc., specifically a processor in a computer device) to execute all or part of the steps of the above methods in various embodiments of the present application.
  • a computer device which can be a personal computer, a server or a network device, etc., specifically a processor in a computer device
  • the aforementioned storage media may include: U disk, mobile hard disk, magnetic disk, optical disk, read-only memory (Read-Only Memory, abbreviation: ROM) or random access memory (Random Access Memory, abbreviation: RAM), etc.
  • U disk mobile hard disk
  • magnetic disk magnetic disk
  • optical disk read-only memory
  • read-only memory Read-Only Memory
  • RAM random access memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Stored Programmes (AREA)

Abstract

本申请实施例公开了一种热补丁方法及相关装置，其特征在于，确定针对多个目标函数生成的补丁文件；基于多个目标函数从N个进程中确定M个目标进程，并记录M个目标进程的初始调用信息，初始调用信息包括每个目标进程调用多个目标函数的信息；确定M个目标进程中每个目标进程对应的当前调用信息，每个当前调用信息包括对应目标进程当前调用多个目标函数的信息；基于初始调用信息和每个目标进程对应的当前调用信息以及补丁文件，对M个目标进程分别进行热补丁操作。采用本申请实施例可以在不重启进程的情况下对电子设备上运行的软件库进行漏洞的修复。

Description

一种热补丁方法及相关装置
本申请要求于2022年08月30日提交中国专利局、申请号为202211048918.4、申请名称为“一种热补丁方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种热补丁方法及相关装置。
背景技术
目前，服务器的内核已经能够基于热补丁的方式在不重启系统的情况下，修复内核缺陷，称之为内核热补丁，但是要安全地操作服务器，仅修补其服务器内核是不够的。进程、线程、共享软件库也需要打补丁。否则，服务器可能面临利用Heartbleed或GHOST等漏洞的攻击。一般处理服务器的库漏洞的常用方法是重启服务器或重启导致停机和漏洞窗口的应用程序。此外，管理人员很少知道服务正在使用的哪些库，因此他们需重新启动整个服务器以更新服务。
因此，如何提供一种热补丁方法，可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失，是亟待解决的问题。
发明内容
本申请实施例所要解决的技术问题在于，提供一种热补丁方法及相关装置，可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失。
第一方面，本申请实施案例提供一种热补丁方法，其特征在于，所述方法包括：确定针对多个目标函数生成的补丁文件；基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息，所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，N和M为大于0的整数，且N大于或等于M；确定所述M个目标进程中每个所述目标进程对应的当前调用信息，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息；基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
在本发明实施例中，先确定调用漏洞函数的多个目标进程(即需要打补丁的进程)，并记录下每个目标进程调用目标函数(如漏洞函数)的信息(即初始调用信息)；接下来，再获取每个目标进程当前调用漏洞函数的信息(也可以理解为当前漏洞函数被调用的信息)；进一步地，可以基于当前漏洞函数被调用的信息，确定当前可以进行打补丁的漏洞函数；最终，基于多个目标进程的初始调用信息确定当前可以进行打补丁的目标进程，并基于补丁文件对目标进程进行打补丁操作，从而可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失。在现有技术中，需要等待所有目标进程都不调用漏洞函数时，一次性对所有目标进程(或线程)进行打补丁，导致打补丁效率低的问题。而在本申请中，由于提前记录下了所有需要打补丁的目标进程，以及每个目标进程调用漏洞函数的信息(即初始调用信息)，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
在一种可能的实现方式中，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息，所述确定针对多个目标函数生成的补丁文件，包括：对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
在本发明实施例中，在电子设备上可以运行应用服务，应用服务中可能会调用多个函数。在应用服务运行过程中，若某一个或多个函数出现漏洞，则需要对出现漏洞的函数进行打补丁操作。在进行打补丁操作前，电子设备可以基于应用服务的原始代码和修复代码(可以理解为编程人员针对漏洞修改后的代码)，先确定应用服务中出现漏洞的函数，然后在基于修复代码，能够得到针对所有漏洞函数的补丁文件，进而能够基于该补丁文件对漏洞函数进行打补丁操作，提升了系统的安全性。
在一种可能的实现方式中，所述对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数，包括：分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
在本发明实施例中，电子设备的编译器上可以分别运行应用服务的原始代码和修复代码，然后通过劫持GCC分别获取原始代码的中间文件，和修复代码的中间文件。进一步地，可以通过比较原始代码的中间文件和修复代码的中间文件，确定目标函数(如漏洞函数)。由于在本申请中，对用户(构建系统)屏蔽了复杂的流程，且能够一键生成用户态标准的补丁文件，而无需调用CC变量，就能够获取到原始代码和修复代码的中间信息，避免了通过改变构建项目的CC变量来间接的调用编译器获取原始代码和修复代码的中间文件，导致应用场景受限的问题，从而降低了调测开销，适用范围更广。
在一种可能的实现方式中，所述方法还包括：所述基于所述多个目标函数从N个进程中确定M个目标进程，包括：判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
在本发明实施例中，可以先判断正在运行的进程、新拉起的进程和即将被拉起的进程中是否存在调用目标函数(如漏洞函数)的进程，若存在则将其确定为目标进程，以提前记录下了所有需要打补丁的目标进程，和每个目标进程调用漏洞函数的信息，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
在一种可能的实现方式中，所述记录所述M个目标进程的初始调用信息，包括：将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；获取所述M个目标进程的所述初始调用信息。
在本发明实施例中，当确定了多个后续需要进行打补丁的目标进程后，可以将目标进程对应的内存页替换为软中断指令，以暂停运行目标进程，从而可以获取目标进程的初始调用信息，以提前记录下了所有需要打补丁的目标进程，和每个目标进程调用漏洞函数的信息，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
在一种可能的实现方式中，所述确定所述M个目标进程中每个所述目标进程对应的当前调用信息，包括：记录所述M个目标进程中每个所述目标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
在现有技术中，需要暂停所有线程(或进程)，才能获取目标进程(或线程)的当前函数调用信息，导致业务性能效率降低的问题。而在本发明实施例中，目标进程每次调用漏洞函数时，都会将漏洞函数记录在对应的当前调用信息中，因此无需暂停所有线程或进程，就能获取到目标进程当前调用漏洞函数的信息，从而提升了热补丁效率，同时维护了进程的内存一致性。
在一种可能的实现方式中，所述基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作，包括：根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
在本发明实施例中，热补丁策略可以是自定义的策略，热补丁策略可以分为多个维度，例如，函数维度：某个漏洞函数不被所有进程/线程调用时，即漏洞函数(funcx)对应的值为0时，可以开始打补丁；线程维度：func1、func2、func3不在被thread_x调用时，即thread_x对应的值减为0时，可以开始打补丁；全维度：所有漏洞函数不被所有线程调用时，即所有漏洞函数对应的值均减至0时，可以开始打补丁。进一步地，可以根据热补丁策略和多个目标进程的初始调用信息以及每个目标进程当前调用漏洞函数的情况来决定何时开始打补丁，以实现根据优先级、策略灵活打补丁，从而提升了打补丁效率。
第二方面，本申请提供了一种热补丁装置，其特征在于，所述装置包括：第一处理单元，用于确定针对多个目标函数生成的补丁文件；第二处理单元，用于基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息，所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，N和M为大于0的整数，且N大于或等于M；第三处理单元，用于确定所述M个目 标进程中每个所述目标进程对应的当前调用信息，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息；第四处理单元，用于基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
在一种可能的实现方式中，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息，所述第一处理单元，具体用于：对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
在一种可能的实现方式中，所述第一处理单元，具体用于：分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
在一种可能的实现方式中，所述第二处理单元，具体用于：判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
在一种可能的实现方式中，所述第二处理单元，具体用于：将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；获取所述M个目标进程的所述初始调用信息。
在一种可能的实现方式中，所述第三处理单元，具体用于：记录所述M个目标进程中每个所述目标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
在一种可能的实现方式中，所述第四处理单元，具体用于：根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
第三方面，本申请提供了一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述第一方面任意一项所述的方法。
第四方面，本申请实施例提供一种电子设备，该电子设备中包括处理器，处理器被配置为支持该电子设备实现第一方面提供的一种热补丁方法中相应的功能。该电子设备还可以包括存储器，存储器用于与处理器耦合，其保存该电子设备必要的程序指令和数据。该电子设备还可以包括通信接口，用于该电子设备与其他设备或通信网络通信。
第五方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持电子设备实现上述第一方面中所涉及的功能，例如，生成或处理上述热补丁方法中所涉及的信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存电子设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
第六方面，本申请提供一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行上述第一方面中任意一项所述的方法。
附图说明
图1为本发明实施例提供的一种电子设备100的结构示意图。
图2为本发明实施例的电子设备100的软件结构框图。
图3为现有技术提供的一种用户态热补丁库的架构图。
图4为现有技术提供的一种用户态热补丁库制作补丁的流程示意图。
图5为现有技术提供的一种用户态热补丁库准备和应用补丁的示意图。
图6是本发明实施例提供的一种热补丁的系统架构示意图。
图7为本申请实施例中的一种用户态热补丁方法的流程示意图。
图8为本发明实施例提供的一种用户态热补丁制作的流程示意图。
图9为本发明实施例提供的一种劫持编译器的示意图。
图10为本发明实施例提供的一种用户态注入的示意图。
图11为本发明实施例提供的一种初始调用数据统计示意图。
图12为本发明实施例提供的一种统计调用的示意图。
图13为本发明实施例提供的一种用户态热补丁过程的示意图。
图14是本发明实施例提供的本申请提供了一种热补丁装置的示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例进行描述。
本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
首先，对本申请中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)Linux，一种自由和开放源码的类UNIX操作系统。
(2)用户态热补丁库(libcare)，可以为Linux上可执行文件和库提供实时补丁而无需重启应用程序的库。
(3)跟踪函数(ptrace)，Linux系统调用,用于进程跟踪，提供了父进程可以观察和控制其子进程执行的能力，并允许父进程检查和替换子进程的内核镜像(包括寄存器)的值。
(4)编译器(Compiler Collection，CC)变量，构建项目时定义的编译器变量。
(5)系统调用(execve)，能够运行另外一个指定的程序，把新程序加载到当前进程的内存空间内。
图1示出了电子设备100的结构示意图。
下面以电子设备100为例对实施例进行具体说明。应该理解的是，电子设备100可以具有比图中所示的更多的或者更少的部件，可以组合两个或多个的部件，或者可以具有不同的部件配置。图中所示出的各种部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件、或硬件和软件的组合中实现。
电子设备100可以包括：处理器110，外部存储器接口120，内部存储器121，通用串行总线(universal serial bus，USB)接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器模块180，按键190，马达191，指示器192，摄像头193，显示屏194，以及用户标识模块(subscriber identification module，SIM)卡接口195等。其中，传感器模块180可以包括压力传感器180A，陀螺仪传感器180B，气压传感器180C，磁传感器180D，加速度传感器180E，距离传感器180F，接近光传感器180G，指纹传感器180H，温度传感器180J，触摸传感器180K，环境光传感器180L，骨传导传感器180M等。
可以理解的是，本发明实施例示意的结构并不构成对电子设备100的具体限定。在本申请另一些实施例中，电子设备100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，存储器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
其中，控制器可以是电子设备100的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施例中，处理器110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处 理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对电子设备100的结构限定。在本申请另一些实施例中，电子设备100也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。
电源管理模块141用于连接电池142，充电管理模块140与处理器110。电源管理模块141接收电池142和/或充电管理模块140的输入，为处理器110，内部存储器121，外部存储器，显示屏194，摄像头193，和无线通信模块160等供电。
电子设备100的无线通信功能可以通过天线1，天线2，移动通信模块150，无线通信模块160，调制解调处理器以及基带处理器等实现。
电子设备100通过GPU，显示屏194，以及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏194和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏194用于显示图像，视频等。显示屏194包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，电子设备100可以包括1个或N个显示屏194，N为大于1的正整数。
电子设备100可以通过ISP，摄像头193，视频编解码器，GPU，显示屏194以及应用处理器等实现拍摄功能。
ISP用于处理摄像头193反馈的数据。例如，拍照时，打开快门，光线通过镜头被传递到摄像头感光元件上，光信号转换为电信号，摄像头感光元件将所述电信号传递给ISP处理，转化为肉眼可见的图像。ISP还可以对图像的噪点，亮度，肤色进行算法优化。ISP还可以对拍摄场景的曝光，色温等参数优化。在一些实施例中，ISP可以设置在摄像头193中。
摄像头193用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(charge coupled device，CCD)或互补金属氧化物半导体(complementary metal-oxide-semiconductor，CMOS)光电晶体管。感光元件把光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施例中，电子设备100可以包括其他摄像头。电子设备还可以包括点阵发射器(图中未示出)，用于发射光线。摄像头采集人脸反射的光线，得到人脸图像，处理器对人脸图像进行处理和分析，通过与存储的人脸图像的信息进行比较以进行验证。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当电子设备100在频点选择时，数字信号处理器用于对频点能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。电子设备100可以支持一种或多种视频编解码器。这样，电子设备100可以播放或录制多种编码格式的视频，例如：动态图像专家组(moving picture experts group，MPEG)1，MPEG2，MPEG3，MPEG4等。
NPU为神经网络(neural-network，NN)计算处理器，通过借鉴生物神经网络结构，例如，借鉴人脑神经元之间传递模式，对输入信息快速处理，还可以不断的自学习。通过NPU可以实现电子设备100的智能认知等应用，例如：图像识别，人脸识别，语音识别，文本理解等。
外部存储器接口120可以用于连接外部存储卡，例如Micro SD卡，实现扩展电子设备100的存储能力。外部存储卡通过外部存储器接口120与处理器110通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器121可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。处理器110通过运行存储在内部存储器121的指令，从而执行电子设备100的各种功能应用以及数据处理。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用(比 如人脸识别功能，指纹识别功能、移动支付功能等)等。存储数据区可存储电子设备100使用过程中所创建的数据(比如人脸信息模板数据，指纹信息模板等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
电子设备100可以通过音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，以及应用处理器等实现音频功能。例如音乐播放，录音等。
音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。
扬声器170A，也称“喇叭”，用于将音频电信号转换为声音信号。
受话器170B，也称“听筒”，用于将音频电信号转换成声音信号。
麦克风170C，也称“话筒”，“传声器”，用于将声音信号转换为电信号。
耳机接口170D用于连接有线耳机。耳机接口170D可以是USB接口130，也可以是3.5mm的开放移动电子设备平台(open mobile terminal platform，OMTP)标准接口，美国蜂窝电信工业协会(cellular telecommunications industry association of the USA，CTIA)标准接口。
压力传感器180A用于感受压力信号，可以将压力信号转换成电信号。在一些实施例中，压力传感器180A可以设置于显示屏194。压力传感器180A的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。
陀螺仪传感器180B可以用于确定电子设备100的运动姿态。在一些实施例中，可以通过陀螺仪传感器180B确定电子设备100围绕三个轴(即，x，y和z轴)的角速度。
接近光传感器180G可以包括例如发光二极管(LED)和光检测器，例如光电二极管。发光二极管可以是红外发光二极管。
环境光传感器180L用于感知环境光亮度。电子设备100可以根据感知的环境光亮度自适应调节显示屏194亮度。环境光传感器180L也可用于拍照时自动调节白平衡。
指纹传感器180H用于采集指纹。电子设备100可以利用采集的指纹特性实现指纹解锁，访问应用锁，指纹拍照，指纹接听来电等。其中，该指纹传感器180H可以设置在触控屏下方，电子设备100可以接收用户在触控屏上该指纹传感器对应的区域的触摸操作，电子设备100可以响应于该触摸操作，采集用户手指的指纹信息。
温度传感器180J用于检测温度。在一些实施例中，电子设备100利用温度传感器180J检测的温度，执行温度处理策略。
触摸传感器180K，也称“触控面板”。触摸传感器180K可以设置于显示屏194，由触摸传感器180K与显示屏194组成触摸屏，也称“触控屏”。触摸传感器180K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器，以确定触摸事件类型。可以通过显示屏194提供与触摸操作相关的视觉输出。在另一些实施例中，触摸传感器180K也可以设置于电子设备100的表面，与显示屏194所处的位置不同。
按键190包括开机键，音量键等。按键190可以是机械按键。也可以是触摸式按键。电子设备100可以接收按键输入，产生与电子设备100的用户设置以及功能控制有关的键信号输入。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和电子设备100的接触和分离。在一些实施例中，电子设备100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在电子设备100中，不能和电子设备100分离。
电子设备100的软件系统可以采用分层架构，事件驱动架构，微核架构，微服务架构，或云架构。本发明实施例以分层架构的Android系统为例，示例性说明电子设备100的软件结构。
图2是本发明实施例的电子设备100的软件结构框图。
分层架构将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层，应用程序框架层，安卓运行时(Android runtime)和系统库，以及内核层。
应用程序层可以包括一系列应用程序包。
如图2所示，应用程序包可以包括相机，图库，日历，通话，地图，导航，WLAN，蓝牙，音乐，视 频，短信息等应用程序(也可以称为应用)。
应用程序框架层为应用程序层的应用程序提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图2所示，应用程序框架层可以包括窗口管理器，内容提供器，视图系统，电话管理器，资源管理器，通知管理器等。
窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。
内容提供器用来存放和获取数据，并使这些数据可以被应用程序访问。所述数据可以包括视频，图像，音频，拨打和接听的电话，浏览历史和书签，电话簿等。
视图系统包括可视控件，例如显示文字的控件，显示图片的控件等。视图系统可用于构建应用程序。显示界面可以由一个或多个视图组成的。例如，包括短信通知图标的显示界面，可以包括显示文字的视图以及显示图片的视图。
电话管理器用于提供电子设备100的通信功能。例如通话状态的管理(包括接通，挂断等)。
资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。
通知管理器使应用程序可以在状态栏中显示通知信息，可以用于传达告知类型的消息，可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用程序的通知，还可以是以对话界面形式出现在屏幕上的通知。例如在状态栏提示文本信息，发出提示音，电子设备振动，指示灯闪烁等。
Android Runtime包括核心库和虚拟机。Android runtime负责安卓系统的调度和管理。
核心库包含两部分：一部分是java语言需要调用的功能函数，另一部分是安卓的核心库。
应用程序层和应用程序框架层运行在虚拟机中。虚拟机将应用程序层和应用程序框架层的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
系统库可以包括多个功能模块。例如：表面管理器(surface manager)，媒体库(Media Libraries)，三维图形处理库(例如：OpenGL ES)，2D图形引擎(例如：SGL)等。
表面管理器用于对显示子系统进行管理，并且为多个应用程序提供了2D和3D图层的融合。
媒体库支持多种常用的音频，视频格式回放和录制，以及静态图像文件等。媒体库可以支持多种音视频编码格式，例如:MPEG4，H.264，MP3，AAC，AMR，JPG，PNG等。
三维图形处理库用于实现三维图形绘图，图像渲染，合成，和图层处理等。
2D图形引擎是2D绘图的绘图引擎。
内核层是硬件和软件之间的层。内核层至少包含显示驱动，摄像头驱动，音频驱动，传感器驱动。
接下来，提出本申请所具体要解决的技术问题。现有技术中，关于用户态热补丁技术如下：
在现有技术中，libcare利用ptrace和proc文件可以在不重启进程的情况下对Linux系统上运行的目标进程进行热补丁操作。如图3所示，图3为现有技术提供的一种用户态热补丁库的架构图，图中libcare通过比较原代码和新版本代码在构建期间生成的汇编文件生成补丁文件；libcare识别进程并加载补丁，方式类似于将共享对象(库)加载到目标进程内存中；ibcare更改目标进程的指令，将其跳转到补丁处。接下来，如图4所示，图4为现有技术提供的一种用户态热补丁库制作补丁的流程示意图，图中libcare的用户态的热补丁制作主要是通过改变编译的CC变量(项目调用编译器变量时会跳转到libcare设置的程序)，这么做的目的有两个，一是可以在libcare的程序中再次调用编译器，在此基础上可以增加原本没有的编译参数；二是通过这种方式可以获得编译的中间文件的输出位置。然后，libcare通过比较源代码和补丁代码的中间文件(汇编文件)生成补丁文件。进一步地，如图5所示，图5为现有技术提供的一种用户态热补丁库准备和应用补丁的示意图，图中在用户态的热补丁制作完成之后，libcare通过遍历/proc/文件夹在所有进程中找到需要打补丁的进程，为了维护内存一致性，libcare等待直至进程中的各个线程的栈中没有补丁的符号信息后，通过ptrace停止进程，进行代码注入，将目标函数的入口修改为跳转到补丁函数位置。
该方案可以在不重启电子设备(如服务器)的情况下对服务器上运行的软件库进行漏洞的修复，但是存在以下多个缺点：
缺点1：libcare通过改变构建项目的编译器变量(CC变量)来间接的调用编译器生成汇编文件，但是 某些场景并不适用，如某些项目需要交叉编译，也需要使用到编译器变量，这会与补丁的构建产生冲突；又如，有些项目的构建可能不使用编译器变量，那么就不能进行补丁的构建。
缺点2：在准备补丁过程中，libcare在识别目标进程阶段是通过遍历/proc/文件夹获得目标进程的，这就导致很多非目标进程也会被扫描，如果进程过多，会消耗很多时间。
缺点3：为了维护进程的内存一致性，要确保各个线程都处在安全的位置(栈中没有补丁的符号信息)运行，libcare会顺序的遍历所有线程，直到所有的线程都处于安全的位置，才会在进程中注入跳转的指令。这使得libcare不能配置部分线程打补丁。
综上所述，要解决现有技术的问题，达到用户态打补丁的目的需要解决三个关键问题：
问题1：Libcare在做补丁获取中间文件时都是使用调用CC变量方式，这种方式有很大局限性：与交叉编译有冲突，有些项目构建不会读取CC变量。因此，如何不调用CC变量实现热补丁文件的制作，是亟待解决的问题。
问题2：每次检查函数的调用情况时都需要将所有线程暂停，直到所有损坏函数不在被调用时，给该线程进行打补丁，这会给性能带来很大损耗。因此，如何减少检查进程的暂停次数，是亟待解决的问题。
问题3：Libcare在给进程打补丁时，仅能给一个进程打补丁，效率较低。因此，如何提升打补丁的效率，是亟待解决的问题。
在本申请提供的热补丁方法可以用于解决上述技术问题。
下面结合附图对本申请的实施例进行描述。
基于上述提出的技术问题，也为了便于理解本发明实施例，下面先对本发明实施例所基于的系统架构进行描述。请参见图6，图6是本发明实施例提供的一种热补丁的系统架构示意图，该系统可以运行在上述电子设备100的软件系统中，可以用于在不重启进程的情况下对软件库进行漏洞的修复，避免重启电子设备(如服务器)或应用程序带来的服务暂停的损失。该系统架构中可以包括补丁制作工具(upatch build)、补丁增强工具(upatch helper)、用户态注入工具(compel program)、内核态补丁模块(upatch handler)。其中，补丁制作工具可以通过劫持gcc、比较差异函数(如漏洞函数)、处理中间文件等操作生成用户态补丁文件，后续将详细说明补丁制作工具如何制作用户态补丁文件，在此先不赘述。补丁增强工具可以用于查询可执行文件(可以为二进制文件的补丁文件)中是否打入补丁、查询可执行文件中打入补丁的版本，以及查询补丁与可执行文件的对应关系。用户态注入工具可以用于获取漏洞函数的进程/线程(即目标进程\线程)初始栈调用状态，即可以获取每个进程/线程的初始调用函数的信息，并且可以将获取到的信息存储在内核态单元(即内存)中，后续将详细说明用户态注入工具如何获取目标进程\线程的初始调用函数的信息，在此先不赘述。内核态补丁模块可以用于实时更新进程/线程的函数调用数据以及给用户态进程/线程打补丁，后续将详细说明，在此先不赘述。
可以理解的是，图6中的一种热补丁的系统架构只是本申请实施例中的一种示例性的实施方式，本申请实施例中热补丁的系统架构包括但不仅限于以上系统架构。
请参见图7，图7为本申请实施例中的一种用户态热补丁方法的流程示意图，下面将结合附图7并基于上述图1中的电子设备100对本申请实施例中的热补丁方法进行描述。需要说明的是，为了更详细的描述本申请实施例中的热补丁方法，本申请在各个流程步骤中描述了相应的执行主体分别为电子设备100，但不代表本申请实施例只能通过所描述的执行主体进行对应的方法流程。
步骤S201：电子设备确定针对多个目标函数生成的补丁文件。
具体的，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息。多个目标函数可以包括但不限于出现漏洞的函数、需要增加内容的函数、需要删除内容的函数中的一种或多种。补丁文件可以理解为用于修复多个目标函数漏洞的可执行程序，其中包括了每个目标函数的修复信息。每个目标函数的修复信息可以理解为用于修复对应目标函数的可执行程序。
在一种可能的实现方式中，所述电子设备100确定针对多个目标函数生成的补丁文件，包括：电子设备100对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
具体的，在电子设备100上可以运行应用服务，应用服务中可能会调用多个函数。在应用服务运行过程中，若某一个或多个函数出现漏洞，则需要对出现漏洞的函数进行打补丁操作。在进行打补丁操作前，电子设备100可以基于应用服务的原始代码和修复代码(可以理解为编程人员针对漏洞修改后的代码)， 先确定应用服务中出现漏洞的函数，然后在基于修复代码，能够得到针对所有漏洞函数的补丁文件，进而能够基于该补丁文件对漏洞函数进行打补丁操作，提升了系统的安全性。
在一种可能的实现方式中，所述电子设备100对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数，包括：电子设备100分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
具体的，第一中间信息可以包括但不限于原始代码运行过程中产生的数据和结果；第二中间信息可以包括但不限于修复代码在运行过程中产生的数据和结果。电子设备100的编译器(GNU Compiler Collection，GCC)上可以分别运行应用服务的原始代码和修复代码，然后通过劫持GCC分别获取原始代码的中间文件，和修复代码的中间文件。进一步地，补丁制作工具可以通过比较原始代码的中间文件和修复代码的中间文件，确定漏洞函数。由于在本申请中，对用户(构建系统)屏蔽了复杂的流程，且能够一键生成用户态标准的补丁文件，而无需调用CC变量，就能够获取到原始代码和修复代码的中间信息，避免了通过改变构建项目的CC变量来间接的调用编译器获取原始代码和修复代码的中间文件，导致应用场景受限的问题，从而降低了调测开销，且适用范围更广。
例如，如图8所示，图8为本发明实施例提供的一种用户态热补丁制作的流程示意图，图中电子设备100可以分别运行修复代码和原始代码，然后通过劫持编译器(如gcc编译器)执行入口，检查环境变量(是修复代码编译，还是原始代码编译)，确定补丁制作所处阶段；申请新内存空间，布局新参数集，修改gcc原始栈，重新执行系统调用(即execve调用)；编译生成原始对象文件(pre object)和修复对象文件(post object)，以及相关的中间文件，其中，原始对象文件可以通过过去一份运行中的用户态进程对应源码并编译出二进制文件获得，修复对象文件通过修改后的源码(无错误)再次编译获得；进一步地，比较pre object和post object文件，获取存在差异的函数及相关数据；根据处理差异函数、相关数据、元信息等生成二进制格式(Executable and Linkable Format，ELF)的用户态热补丁。
需要说明的是，如图9所示，图9为本发明实施例提供的一种劫持编译器的示意图，图中在开始运行时，可以先注册补丁制作工具；编译器发起构建，执行进入入口点；判断进程是否为原进程，若是，则在原进程上重新发起系统调用；若否，则在修改后的进程上正常运行，按照预定参数，生成相应文件；最后运行结束。
步骤S202：电子设备基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息。
具体的，所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种。所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，每个所述目标进程为调用所述多个目标函数中一个或多个所述目标函数的进程，N和M为大于0的整数，且N大于或等于M。
在本申请中，先确定调用漏洞函数的多个目标进程(即需要打补丁的进程)，并记录下每个目标进程调用目标函数(如漏洞函数)的信息(即初始调用信息)；接下来，再获取每个目标进程当前调用漏洞函数的信息(也可以理解为当前漏洞函数被调用的信息)；进一步地，可以基于当前漏洞函数被调用的信息，确定当前可以进行打补丁的漏洞函数；最终，基于多个目标进程的初始调用信息确定当前可以进行打补丁的目标进程，并基于补丁文件对目标进程进行打补丁操作，从而可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失。在现有技术中，需要等待所有目标进程都不调用漏洞函数时，一次性对所有目标进程(或线程)进行打补丁，导致打补丁效率低的问题。而在本申请中，由于提前记录下了所有需要打补丁的目标进程，以及每个目标进程调用漏洞函数的信息(即初始调用信息)，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
在一种可能的实现方式中，所述基于所述多个目标函数从N个进程中确定M个目标进程，包括：判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
具体的，可以先判断正在运行的进程、新拉起的进程和即将被拉起的进程中是否存在调用漏洞函数的进程，若存在则将其确定为目标进程，以提前记录下了所有需要打补丁的目标进程，和每个目标进程调用漏洞函数的信息，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中 确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
在一种可能的实现方式中，所述记录所述M个目标进程的初始调用信息，包括：将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；获取所述M个目标进程的所述初始调用信息。
具体的，内存页可以用于存储进程的可执行程序；软中断指令可以理解为当短时间不能处理完事件时，由软中断完成，即可以通过软中断指令暂停运行进程。通过对运行中进程、新拉起进程、即将拉起进程分析和识别，确定了多个后续需要进行打补丁的目标进程后，可以将目标进程对应的内存页替换为软中断指令，以暂停运行目标进程，从而可以获取目标进程的初始调用信息，以提前记录下了所有需要打补丁的目标进程，和每个目标进程调用漏洞函数的信息，在确定了当前可以进行打补丁的漏洞函数后，可以基于初始调用信息从多个目标进程中确定出当前可以进行打补丁的目标进程，从而可以实现根据优先级、或者策略灵活打补丁，从而提升了热补丁效率。
例如，如图10所示，图10为本发明实施例提供的一种用户态注入的示意图，图中对于正在运行中的进程来说，可以先寻找运行中进程地址映射空间中虚拟内存空间(virtual memory area，vma)；读出该vma信息后，找到对应内存页，替换为软中断指令。需要说明的是，内核中每个文件，在文件系统中有与之对应的索引节点inode(inode为UNIX操作系统中的一种数据结构，包含了与文件系统中各个文件相关的一些重要信息),inode中有属性内存地址(i_maping),i_mapping保存地址空间映射信息vma。对于新拉起的进程或是即将被拉起的进程来说，所有的mmap调用入口都会对文件进行检查，判断是否为目标二进制文件(否需打补丁的二进制文件)；寻找运行中进程地址映射空间中vma；读出该vma信息后，找到对应内存页，替换为软中断指令；触发uprobe handler，内核态模块进行相关处理。
又例如，如图11所示，图11为本发明实施例提供的一种初始调用数据统计示意图，图中可以先申请一块内存，存放compel program，compel program中收集线程对函数(需要打补丁的函数)的调用统计值；停止该进程中的所有线程；可以同时记录所有线程的调用上下文(如程序计数器、堆栈指针寄存器)，修改线程调用上下文，使其执行compel program；统计所有线程对漏洞函数调用情况，并将该调用情况传递给内核热补丁模块，该信息会在后续打补丁时使用；删除存放compel program的内存；恢复该进程所有线程，进程正常运行。
需要说明的是，本次操作仅进行一次，进程也仅停一次，完成进程/线程信息统计后，可以删除相关内存空间。
步骤S203：电子设备确定所述M个目标进程中每个所述目标进程对应的当前调用信息。
具体的，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息。
在一种可能的实现方式中，所述确定所述M个目标进程中每个所述目标进程对应的当前调用信息，包括：记录所述M个目标进程中每个所述目标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
具体的，目标进程每次调用漏洞函数时，都会将漏洞函数记录在对应的当前调用信息中，无需暂停所有线程或进程，就能获取到目标进程当前调用漏洞函数的信息，以便在后续进行打补丁时，将当前没有被调用的漏洞函数确定为当前可以进行打补丁的漏洞函数，从而提升了热补丁效率，同时维护了进程的内存一致性。
例如，如图12所示，图12为本发明实施例提供的一种统计调用的示意图，图中可以在目标进程调用函数时，劫持漏洞函数的入口和出口，以实时更新调用统计，如当线程1调用func1时计数加一，当调用完成后计数减一。
步骤S204：电子设备基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
具体的，可以先确定调用漏洞函数的多个目标进程(即需要打补丁的进程)，并记录下每个目标进程调用目标函数(如漏洞函数)的信息(即初始调用信息)；接下来，再获取每个目标进程当前调用漏洞函数的信息(也可以理解为当前漏洞函数被调用的信息)；进一步地，可以基于当前漏洞函数被调用的信息，确定当前可以进行打补丁的漏洞函数；最终，基于多个目标进程的初始调用信息确定当前可以进行打补丁的目标进程，并基于补丁文件对目标进程进行打补丁操作，从而可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失。
例如，如图13所示，图13为本发明实施例提供的一种用户态热补丁过程的示意图，图中基于用户态 差异文件并通过用户态补丁工具生成补丁文件；用户态生成补丁文件后，使用补丁增强工具(upatch helper)将漏洞函数与二进制文件(修复信息)对应关系发送给内核态模块；识别进程是否调用漏洞函数，若调用，则触发内核模块将对应的内存页替换为软中断指令；通过用户态注入工具统计进程函数初始调用信息；将该统计的数据保存至内核模块；内核模块实时检测进程调用信息，并实时更新线程调用漏洞函数的调用信息；根据配置策略，检测到对应漏洞函数调用为0时，跳转至新函数地址；完成对用户态问题的修复，热补丁流程结束。
在一种可能的实现方式中，所述基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作，包括：根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
具体的，热补丁策略可以是自定义的策略，热补丁策略可以分为多个维度，例如，函数维度：某个漏洞函数不被所有进程/线程调用时，即漏洞函数(funcx)对应的值为0时，可以开始打补丁；线程维度：func1、func2、func3不在被threadx调用时，即threadx对应的值减为0时，可以开始打补丁；全维度：所有漏洞函数不被所有线程调用时，即所有漏洞函数对应的值均减至0时，可以开始打补丁。进一步地，可以根据热补丁策略以及每个目标进程当前调用漏洞函数的情况来决定何时开始打补丁，以实现根据优先级、策略灵活打补丁，从而提升了打补丁效率。例如，可以基于每个目标进程当前调用漏洞函数的情况以及热补丁策略，确定满足补丁策略的目标进程，并将调用损坏函数的地方指向修复函数的地址，如线程1不在调用func1、func2、func3时，可以对func1、func2、func3进行打补丁，当线程1在此调用func1、func2、func3时，可以直接调用修复后的函数，即根据策略监测调用统计值，待统计值符合配置策略时，跳转至修复函数对应的地址空间，从而可以在不重启进程的情况下对服务器上运行的软件库进行漏洞的修复，解决重启服务器或应用程序带来的服务暂停的损失。
需要说明的是，若未找到合适时刻(对应值减至0)，在预设时间(如w秒)后，报错，即没有找到合适时机打补丁。进一步地，可以暂停x秒后，继续寻找到合适时机打补丁。
上述详细阐述了本发明实施例的方法，下面提供了本发明实施例的相关装置。
请参见图14，图14是本发明实施例提供的本申请提供了一种热补丁装置的示意图，该热补丁装置30，可以包括第一处理单元301、第二处理单元302、第三处理单元303、第四处理单元304，其中各个模块的详细描述如下。
第一处理单元301，用于确定针对多个目标函数生成的补丁文件。
第二处理单元302，用于基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息，所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，N和M为大于0的整数，且N大于或等于M。
第三处理单元303，用于确定所述M个目标进程中每个所述目标进程对应的当前调用信息，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息。
第四处理单元304，用于基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
在一种可能的实现方式中，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息，所述第一处理单元301，具体用于：对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
在一种可能的实现方式中，所述第一处理单元301，具体用于：分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
在一种可能的实现方式中，所述第二处理单元302，具体用于：判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
在一种可能的实现方式中，所述第二处理单元302，具体用于：将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；获取所述M个目标进程的所述初始调用信息。
在一种可能的实现方式中，所述第三处理单元303，具体用于：记录所述M个目标进程中每个所述目 标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
在一种可能的实现方式中，所述第四处理单元304，具体用于：根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
需要说明的是，本发明实施例中所描述的热补丁装置30中各功能单元的功能可参见上述图7中所述的方法实施例中的步骤S201-步骤S204的相关描述，此处不再赘述。
本申请提供了一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述任意一种热补丁方法。
本申请实施例提供一种电子设备，该电子设备中包括处理器，处理器被配置为支持该电子设备实现上述任意一种热补丁方法中相应的功能。该电子设备还可以包括存储器，存储器用于与处理器耦合，其保存该电子设备必要的程序指令和数据。该电子设备还可以包括通信接口，用于该电子设备与其他设备或通信网络通信。
本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持电子设备实现上述所涉及的功能，例如，生成或处理上述一种热补丁方法中所涉及的信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存电子设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请提供一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行上述一种用户态热补丁方法。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可能可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以为个人计算机、服务器或者网络设备等，具体可以是计算机设备中的处理器)执行本申请各个实施例上述方法的全部或部分步骤。其中，而前述的存储介质可包括：U盘、移动硬盘、磁碟、光盘、只读存储器(Read-Only Memory，缩写：ROM)或者随机存取存储器(Random Access Memory，缩写：RAM)等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (16)

  1. 一种热补丁方法，其特征在于，所述方法包括：
    确定针对多个目标函数生成的补丁文件；
    基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息，所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，N和M为大于0的整数，且N大于或等于M；
    确定所述M个目标进程中每个所述目标进程对应的当前调用信息，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息；
    基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
  2. 如权利要求1所述的方法，其特征在于，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息，所述确定针对多个目标函数生成的补丁文件，包括：
    对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；
    基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
  3. 如权利要求2所述的方法，其特征在于，所述对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数，包括：
    分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；
    基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
  4. 如权利要求1-3任意一项所述的方法，其特征在于，所述基于所述多个目标函数从N个进程中确定M个目标进程，包括：
    判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；
    若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
  5. 如权利要求4所述的方法，其特征在于，所述方法还包括：
    将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；
    获取所述M个目标进程的所述初始调用信息。
  6. 如权利要求1-5任意一项所述的方法，其特征在于，所述确定所述M个目标进程中每个所述目标进程对应的当前调用信息，包括：
    记录所述M个目标进程中每个所述目标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
  7. 如权利要求2-6任意一项所述的方法，其特征在于，所述基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作，包括：
    根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
  8. 一种热补丁装置，其特征在于，所述装置包括：
    第一处理单元，用于确定针对多个目标函数生成的补丁文件；
    第二处理单元，用于基于所述多个目标函数从N个进程中确定M个目标进程，并记录所述M个目标进程的初始调用信息，所述初始调用信息包括每个所述目标进程调用所述多个目标函数的信息，N和M为大于0的整数，且N大于或等于M；
    第三处理单元，用于确定所述M个目标进程中每个所述目标进程对应的当前调用信息，每个所述当前调用信息包括对应目标进程当前调用所述多个目标函数的信息；
    第四处理单元，用于基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述补丁文件，对所述M个目标进程分别进行热补丁操作。
  9. 如权利要求8所述的装置，其特征在于，所述补丁文件包括所述多个目标函数中每个所述目标函数的修复信息，所述第一处理单元，具体用于：
    对比多个函数的原始代码和修复代码，从所述多个函数中确定所述多个目标函数；
    基于所述修复代码，确定所述多个目标函数中每个所述目标函数的所述修复信息。
  10. 如权利要求9所述的装置，其特征在于，所述第一处理单元，具体用于：
    分别运行所述原始代码和所述修复代码，通过修改编译器参数获取所述原始代码的第一中间信息和所述修复代码的第二中间信息；
    基于所述第一中间信息和所述第二中间信息，从所述多个函数中确定所述多个目标函数。
  11. 如权利要求8-10任意一项所述的装置，其特征在于，所述第二处理单元，具体用于：
    判断所述N个进程中每个进程是否调用所述多个目标函数中的至少一个；所述N个进程包括正在运行的进程、新拉起的进程和即将被拉起的进程中的一种或多种；
    若调用所述多个目标函数中的至少一个，则将对应的进程确定为所述目标进程。
  12. 如权利要求11所述的装置，其特征在于，所述第二处理单元，具体用于：
    将所述M个目标进程中每个目标进程对应的内存页，替换为软中断指令，所述软中断指令用于暂停运行对应的目标进程；
    获取所述M个目标进程的所述初始调用信息。
  13. 如权利要求8-12任意一项所述的装置，其特征在于，所述第三处理单元，具体用于：
    记录所述M个目标进程中每个所述目标进程当前调用所述多个目标函数的信息，更新对应的所述当前调用信息。
  14. 如权利要求9-13任意一项所述的装置，其特征在于，所述第四处理单元，具体用于：
    根据热补丁策略，基于所述初始调用信息和每个所述目标进程对应的当前调用信息以及所述多个目标函数中每个所述目标函数的所述修复信息，对所述M个目标进程中满足所述热补丁策略的目标进程进行热补丁操作。
  15. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述权利要求1-7任意一项所述的方法。
  16. 一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行如权利要求1-7中任意一项所述的方法。
PCT/CN2023/115208 2022-08-30 2023-08-28 一种热补丁方法及相关装置 Ceased WO2024046260A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP23859291.9A EP4560510A4 (en) 2022-08-30 2023-08-28 METHOD FOR EMERGENCY CORRECTION AND ASSOCIATED APPARATUS

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211048918.4A CN117668846A (zh) 2022-08-30 2022-08-30 一种热补丁方法及相关装置
CN202211048918.4 2022-08-30

Publications (1)

Publication Number Publication Date
WO2024046260A1 true WO2024046260A1 (zh) 2024-03-07

Family

ID=90075722

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/115208 Ceased WO2024046260A1 (zh) 2022-08-30 2023-08-28 一种热补丁方法及相关装置

Country Status (3)

Country Link
EP (1) EP4560510A4 (zh)
CN (1) CN117668846A (zh)
WO (1) WO2024046260A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119473332A (zh) * 2024-11-25 2025-02-18 天翼云科技有限公司 热补丁重启生效方法、装置、网络设备和可读存储介质
CN120910872A (zh) * 2025-10-10 2025-11-07 芯潮流(珠海)科技有限公司 存储器的漏洞修复方法、计算机装置及可读存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120316770B (zh) * 2025-06-18 2025-08-19 深圳鼎智通讯股份有限公司 一种提高智能终端安全性的防攻击方法及系统
CN120781347B (zh) * 2025-09-05 2026-01-27 浪潮云信息技术股份公司 一种操作系统内核漏洞修复方法、装置、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011060160A (ja) * 2009-09-14 2011-03-24 Fujitsu Ltd ソフトウェア更新装置、方法、及びプログラム
US10310863B1 (en) * 2013-07-31 2019-06-04 Red Hat, Inc. Patching functions in use on a running computer system
CN110851168A (zh) * 2019-11-15 2020-02-28 腾讯科技（深圳）有限公司 数据处理方法及其装置、计算机可读存储介质
CN111324491A (zh) * 2020-03-18 2020-06-23 深圳Tcl数字技术有限公司 程序漏洞修复方法、装置及计算机可读存储介质
CN112395616A (zh) * 2019-08-15 2021-02-23 奇安信安全技术(珠海)有限公司 漏洞处理的方法、装置及计算机设备

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016068845A1 (en) * 2014-09-01 2016-05-06 Hewlett Packard Enterprise Development Lp Dynamically applying a patch to a shared library
US10416990B2 (en) * 2018-02-05 2019-09-17 Infosys Limited System and method for seamlessly patching shared libraries in server environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011060160A (ja) * 2009-09-14 2011-03-24 Fujitsu Ltd ソフトウェア更新装置、方法、及びプログラム
US10310863B1 (en) * 2013-07-31 2019-06-04 Red Hat, Inc. Patching functions in use on a running computer system
CN112395616A (zh) * 2019-08-15 2021-02-23 奇安信安全技术(珠海)有限公司 漏洞处理的方法、装置及计算机设备
CN110851168A (zh) * 2019-11-15 2020-02-28 腾讯科技（深圳）有限公司 数据处理方法及其装置、计算机可读存储介质
CN111324491A (zh) * 2020-03-18 2020-06-23 深圳Tcl数字技术有限公司 程序漏洞修复方法、装置及计算机可读存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4560510A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119473332A (zh) * 2024-11-25 2025-02-18 天翼云科技有限公司 热补丁重启生效方法、装置、网络设备和可读存储介质
CN120910872A (zh) * 2025-10-10 2025-11-07 芯潮流(珠海)科技有限公司 存储器的漏洞修复方法、计算机装置及可读存储介质

Also Published As

Publication number Publication date
CN117668846A (zh) 2024-03-08
EP4560510A4 (en) 2025-11-19
EP4560510A1 (en) 2025-05-28

Similar Documents

Publication Publication Date Title
WO2024046260A1 (zh) 一种热补丁方法及相关装置
US11500534B2 (en) Biometric recognition interaction method, graphics interaction interface, and related apparatus
CN115017534B (zh) 文件处理权限控制方法、装置及存储介质
CN114254285B (zh) 同时显示多个应用界面时进行生物特征认证的方法
CN114816167B (zh) 应用图标的显示方法、电子设备及可读存储介质
CN115442517B (zh) 图像处理方法、电子设备及计算机可读存储介质
CN114706633B (zh) 预加载方法、电子设备及存储介质
CN119376755A (zh) 一种应用程序优化方法及电子设备
CN116755748A (zh) 卡片更新方法、电子设备以及计算机可读存储介质
CN118444995B (zh) 应用启动方法和电子设备
CN114879896B (zh) 一种冻屏处理方法、电子设备及存储介质
CN115292199B (zh) 一种显存泄露的处理方法及相关装置
CN116661882A (zh) 预加载小程序的方法、电子设备及存储介质
CN116700768B (zh) 一种应用的处理方法及相关装置
CN116664734B (zh) 环形图的显示方法、电子设备及可读存储介质
WO2023143545A1 (zh) 资源处理方法、装置、电子设备及计算机可读存储介质
CN113535252B (zh) 应用程序的运行方法、相关设备及介质
CN120704811B (zh) 一种图像处理方法、装置和电子设备
CN115291995B (zh) 一种消息显示方法及相关电子设备、可读存储介质
CN117131497B (zh) 一种软件检测方法及电子设备
CN116700740B (zh) 软件修复方法和相关装置
CN115904142B (zh) 显示即时通信消息的方法和装置
CN118260753B (zh) 应用程序的管控方法及电子设备
CN119883393A (zh) 一种信息处理方法、装置、设备及计算机可读存储介质
CN117952579B (zh) 一种信息获取方法及移动终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23859291

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023859291

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023859291

Country of ref document: EP

Effective date: 20250221

NENP Non-entry into the national phase

Ref country code: DE

WWP Wipo information: published in national office

Ref document number: 2023859291

Country of ref document: EP