CN-116756098-B - Data consistency analysis method, device, equipment, storage medium and product

CN116756098BCN 116756098 BCN116756098 BCN 116756098BCN-116756098-B

Abstract

The application provides a data consistency analysis method, a device, equipment, a storage medium and a product, and belongs to the technical field of software. The method comprises the steps of obtaining kernel files and memory mirror image data of an operating system, determining first section information in the kernel files and second section information in the memory mirror image data, wherein the first section information is used for storing key information of the kernel files, the second section information is used for storing key information of the memory mirror image data, filtering first relation data from the first section information and second relation data from the second section information, the first relation data and the second relation data are different manifestations of the same relation data of the operating system, and carrying out consistency analysis on the kernel files and the memory mirror image data based on the filtered first section information and the filtered second section information. The application can improve the accuracy of data analysis.

Inventors

HU MING

Assignees

OPPO广东移动通信有限公司

Dates

Publication Date: 20260512
Application Date: 20230517

Claims (17)

1. A method of data consistency analysis, the method comprising: Acquiring kernel files and memory mirror image data of an operating system, wherein the memory mirror image data is generated based on contents in the kernel files; Determining first section information in the kernel file and second section information in the memory mirror image data, wherein the first section information is used for storing key information of the kernel file, and the second section information is used for storing key information of the memory mirror image data; Filtering first relation data from the first piece of information and filtering second relation data from the second piece of information, wherein the first relation data and the second relation data are different expressions of the same relation data of the operating system, the first relation data are read-only data of a first function address, read-only data of a first instruction or read-only data of a first non-function address non-instruction, and the second relation data are read-only data of a second function address, read-only data of a second instruction or read-only data of a second non-function address non-instruction; Based on the filtered first section information and the filtered second section information, carrying out consistency analysis on the kernel file and the memory mirror image data to obtain a consistency analysis result, wherein the consistency analysis result is consistent or inconsistent; The filtering the first relationship data from the first piece of information and the second relationship data from the second piece of information comprises the following steps: Determining a first file corresponding to the first section information and a second file corresponding to the second section information, wherein the first file is used for storing a feature set corresponding to the first section information, the second file is used for storing a feature set corresponding to the second section information, the data volume of the first file is smaller than the data volume of the first section information, and the data volume of the second file is smaller than the data volume of the second section information; and filtering the first relation data and the second relation data from the first file and the second file respectively.
2. The method of claim 1, wherein filtering the first relationship data from the first piece of information and the second relationship data from the second piece of information comprises: Filtering a first data address from the first file and a second data address from the second file, wherein the first data address and the second data address are mutually converted addresses; Filtering preset values from the first file and the second file, wherein the preset values are filled into the first file and the second file based on the description information of the operating system; data for recording a data size is filtered from the first file and the second file.
3. The method of claim 1, wherein the determining the first file corresponding to the first piece of information and the second file corresponding to the second piece of information comprises: determining a kernel address space layout randomization KASLR feature of a kernel log included in the memory mirror data, and determining a first offset corresponding to the KASLR feature; removing segment information corresponding to the KASLR features from the second segment information based on the first offset to obtain third segment information, wherein the third segment information comprises a data address of the memory mirror image data; Removing segment information which is not in the address range of the memory mirror image data from the first segment information to obtain fourth segment information, wherein the fourth segment information comprises the data address of the kernel file; Determining the first file based on the feature set corresponding to the fourth piece of information, wherein the first file comprises a data address, data content corresponding to the data address and data length of the data content; And determining the same data address of the third section of information and the fourth section of information, acquiring data content corresponding to the same data address and the data length of the data content from the memory mirror data, and storing the same data address, the data content corresponding to the same data address and the data length of the data content into the second file.
4. The method of claim 1, wherein filtering the first relationship data from the first piece of information and the second relationship data from the second piece of information comprises: Determining a second offset of the second piece of information in the first piece of information, and aligning the first piece of information and the second piece of information based on the second offset; Determining fifth section information and sixth section information corresponding to the same data address from the aligned first section information and the aligned second section information; the first relationship data is filtered from the fifth piece of information and the second relationship data is filtered from the sixth piece of information.
5. The method of claim 4, wherein filtering the first relationship data from the fifth piece of information and the second relationship data from the sixth piece of information comprises: Determining instruction conversion information between the kernel file and the memory mirror data, wherein the instruction conversion information is used for representing conversion relation between instructions in the kernel file and instructions in the memory mirror data; and filtering a first instruction from the fifth piece of information and a second instruction from the sixth piece of information based on the instruction conversion information, wherein the first instruction and the second instruction are conversion relations which meet the instruction conversion information.
6. The method of claim 4 or 5, wherein said filtering the first relationship data from the fifth piece of information and the second relationship data from the sixth piece of information comprises: based on a preset granularity, comparing the contents included in the fifth section of information and the sixth section of information one by one; and when the comparison result is not matched, filtering the first relation data from the fifth piece of information and the second relation data from the sixth piece of information.
7. The method of claim 1, wherein determining the first piece of information in the kernel file and the second piece of information in the memory mirror data comprises: Determining the version identification of the kernel file and the version identification of the memory mirror image data; And under the condition that the version identification of the kernel file is consistent with the version identification of the memory mirror image data, determining first section information in the kernel file and second section information in the memory mirror image data.
8. A data consistency analysis apparatus, the apparatus comprising: The system comprises an acquisition module, a storage module and a storage module, wherein the acquisition module is used for acquiring a kernel file and memory mirror image data of an operating system, and the memory mirror image data is generated based on the content in the kernel file; The determining module is used for determining first section information in the kernel file and second section information in the memory mirror image data, wherein the first section information is used for storing key information of the kernel file, and the second section information is used for storing key information of the memory mirror image data; The filtering module is used for filtering first relation data from the first section of information and second relation data from the second section of information, wherein the first relation data and the second relation data are different expressions of the same relation data of the operating system, the first relation data are read-only data of a first function address, read-only data of a first instruction or read-only data of a first non-function address and non-instruction, and the second relation data are read-only data of a second function address, read-only data of a second instruction or read-only data of a second non-function address and non-instruction; The analysis module is used for carrying out consistency analysis on the kernel file and the memory mirror image data based on the filtered first section information and the filtered second section information to obtain a consistency analysis result, wherein the consistency analysis result is consistent or inconsistent; The filtering module is used for determining a first file corresponding to the first section information and a second file corresponding to the second section information, wherein the first file is used for storing a feature set corresponding to the first section information, the second file is used for storing a feature set corresponding to the second section information, the data size of the first file is smaller than that of the first section information, the data size of the second file is smaller than that of the second section information, and the first relation data and the second relation data are filtered from the first file and the second file respectively.
9. The apparatus of claim 8, wherein the filtering module is configured to filter a first data address from the first file and a second data address from the second file, the first data address and the second data address being translated addresses with respect to each other, filter a preset value from the first file and the second file, the preset value being populated into the first file and the second file based on description information of the operating system, and filter data from the first file and the second file for recording a data size.
10. The apparatus of claim 8, wherein the filtering module is configured to determine a kernel address space layout randomization KASLR feature of a kernel log included in the memory mirror data, determine a first offset corresponding to the KASLR feature, remove segment information corresponding to the KASLR feature from the second segment information based on the first offset to obtain third segment information, where the third segment information includes a data address of the memory mirror data, remove segment information not in an address range of the memory mirror data from the first segment information to obtain fourth segment information, where the fourth segment information includes a data address of the kernel file, determine the first file based on a feature set corresponding to the fourth segment information, where the first file includes a data address included in the fourth segment information, a data content corresponding to the data address, and a data length of the data content, determine identical data addresses of the third segment information and the fourth segment information, obtain identical data addresses of the identical data and the data address corresponding to the data content corresponding to the data address, and the identical data content of the data content corresponding to the data content in the data file, and store the identical data addresses of the identical data content.
11. The apparatus of claim 8, wherein the filtering module is configured to determine a second offset of the second piece of information in the first piece of information, align the first piece of information with the second piece of information based on the second offset, determine a fifth piece of information and a sixth piece of information corresponding to a same data address from the aligned first piece of information and the aligned second piece of information, and filter the first relationship data from the fifth piece of information and the second relationship data from the sixth piece of information.
12. The apparatus of claim 11, wherein the filtering module is configured to determine instruction translation information between the kernel file and the memory image data, the instruction translation information being configured to represent a translation relationship between instructions in the kernel file and instructions in the memory image data, and filter a first instruction from the fifth piece of information and a second instruction from the sixth piece of information based on the instruction translation information, the first instruction and the second instruction being configured to satisfy the translation relationship represented by the instruction translation information.
13. The apparatus according to claim 11 or 12, wherein the filtering module is configured to compare contents included in the fifth piece of information and the sixth piece of information on a piece-by-piece basis based on a preset granularity, and filter the first relationship data from the fifth piece of information and the second relationship data from the sixth piece of information if a comparison result is a mismatch.
14. The apparatus of claim 8, wherein the determining module is configured to determine a version identifier of the kernel file and a version identifier of the memory image data, and determine first piece of information in the kernel file and second piece of information in the memory image data if the version identifier of the kernel file and the version identifier of the memory image data are identical.
15. A terminal comprising one or more processors and one or more memories, the one or more memories having stored therein at least one program code loaded and executed by the one or more processors to implement the data consistency analysis method of any of claims 1-7.
16. A computer readable storage medium having stored therein at least one program code, the at least one program code loaded and executed by a processor to implement the data consistency analysis method of any of claims 1 to 7.
17. A computer program product, characterized in that the computer program product stores at least one program code for execution by a processor for implementing the data consistency analysis method according to any of claims 1 to 7.

Description

Data consistency analysis method, device, equipment, storage medium and product Technical Field The present application relates to the field of software technologies, and in particular, to a method, an apparatus, a device, a storage medium, and a product for analyzing data consistency. Background With the continuous development of emerging industries, a large number of users use products based on a bottom Linux operating system, such as mobile phones, vehicle-mounted terminals, wearable devices, network devices and the like based on the Linux operating system, however, the Linux operating system of the devices may be abnormally reset in the running process, after the Linux operating system is abnormally reset, memory images (dump data) are generated, the dump data are generated based on the content in a kernel file (vmlinux), and therefore, the data integrity in the dump data can be analyzed through consistency analysis on the dump data and vmlinux, so that whether data pollution and data jump exist or not can be identified. Disclosure of Invention The embodiment of the application provides a data consistency analysis method, a device, equipment, a storage medium and a product, which can improve the accuracy of data analysis. The technical scheme is as follows: in one aspect, a method for analyzing data consistency is provided, the method comprising: Acquiring kernel files and memory mirror image data of an operating system, wherein the memory mirror image data is generated based on contents in the kernel files; Determining first section information in the kernel file and second section information in the memory mirror image data, wherein the first section information is used for storing key information of the kernel file, and the second section information is used for storing key information of the memory mirror image data; Filtering first relationship data from the first piece of information and second relationship data from the second piece of information, the first relationship data and the second relationship data being different representations of the same relationship data of the operating system; and carrying out consistency analysis on the kernel file and the memory mirror image data based on the filtered first section information and the filtered second section information. In another aspect, there is provided a data consistency analysis apparatus, the apparatus comprising: The system comprises an acquisition module, a storage module and a storage module, wherein the acquisition module is used for acquiring a kernel file and memory mirror image data of an operating system, and the memory mirror image data is generated based on the content in the kernel file; The determining module is used for determining first section information in the kernel file and second section information in the memory mirror image data, wherein the first section information is used for storing key information of the kernel file, and the second section information is used for storing key information of the memory mirror image data; The filtering module is used for filtering first relation data from the first section of information and second relation data from the second section of information, and the first relation data and the second relation data are different representations of the same relation data of the operating system; And the analysis module is used for carrying out consistency analysis on the kernel file and the memory mirror image data based on the filtered first section information and the filtered second section information. In another aspect, a terminal is provided, the terminal including one or more processors and one or more memories, the one or more memories storing at least one program code therein, the at least one program code being loaded and executed by the one or more processors to implement the data consistency analysis method described above. In another aspect, a computer readable storage medium having stored therein at least one program code loaded and executed by a processor to implement the data consistency analysis method described above is provided. In another aspect, a computer program product is provided, the computer program product storing at least one program code for execution by a processor to implement the data consistency analysis method described above. Because the data formats of the memory mirror image data of different manufacturers are different, and the operating system changes the data in the kernel file when running, so as to ensure the randomness of the data, namely the data content of the memory mirror image data is also changed, and the related technology has no standardized processing method for the data content in the memory mirror image data, the related technology cannot realize consistency analysis of the memory mirror image data and the kernel file. In the embodiment of the application, the first segment information of the kernel file and the second segment informat