【摘要】：嵌入式系統(tǒng)在人們的生活中隨處可見,但由于嵌入式系統(tǒng)的特點,使得在嵌入式操作系統(tǒng)的裁剪或移植過程中面臨著許多困難。本文主要研究了一種在仿真平臺上對Linux內(nèi)核運行進行自動跟蹤與分析的方法,可以對操作系統(tǒng)內(nèi)核代碼進行測試、分析與驗證,可以作為操作系統(tǒng)裁剪或移植過程中的一個輔助工具。 首先,本文介紹了行為分析的概念及特點,并分析了它在信息安全等領(lǐng)域中的應(yīng)用方法。分析了仿真平臺的特點以及它與傳統(tǒng)硬件平臺相比在進行系統(tǒng)分析和軟件跟蹤時存在的優(yōu)勢。結(jié)合行為分析的特點和仿真平臺的特點,提出了一種基于行為分析的仿真平臺上Linux內(nèi)核運行的跟蹤機制。針對本文的應(yīng)用環(huán)境定義了行為跟蹤的粒度,包括粗粒度跟蹤與細(xì)粒度跟蹤。粗粒度跟蹤是從函數(shù)級層次跟蹤被監(jiān)測函數(shù)序列的運行軌跡,它記錄了每一個被監(jiān)測函數(shù)執(zhí)行時的狀態(tài)以及被監(jiān)測函數(shù)的調(diào)用序列。細(xì)粒度跟蹤是從指令級層次跟蹤被監(jiān)測函數(shù)的運行軌跡,它記錄了被監(jiān)測函數(shù)執(zhí)行時每條指令的地址。對兩種跟蹤方式的算法進行了詳細(xì)描述；其次,簡單介紹了ARM微處理器的特點以及ARM函數(shù)調(diào)用標(biāo)準(zhǔn)。在ARM仿真平臺上,實現(xiàn)了粗粒度跟蹤與細(xì)粗粒度跟蹤的算法；最后,分析了在Linux2.6內(nèi)核中進程創(chuàng)建、進程調(diào)度以及程序加載的實現(xiàn)原理,在此基礎(chǔ)上設(shè)計了測試用例,對基于行為分析的仿真平臺上Linux內(nèi)核運行自動跟蹤與分析的方法進行了驗證。
[Abstract]:The embedded system can be seen everywhere in people's life, but because of the characteristic of the embedded system, it faces many difficulties in the process of cutting or transplanting the embedded operating system. This paper mainly studies a method of automatically tracking and analyzing the running of Linux kernel on the simulation platform, which can test, analyze and verify the kernel code of the operating system. It can be used as an auxiliary tool in the process of operating system tailoring or porting. Firstly, this paper introduces the concept and characteristics of behavior analysis, and analyzes its application in information security. The characteristics of the simulation platform and its advantages in system analysis and software tracking compared with the traditional hardware platform are analyzed. According to the characteristics of behavior analysis and simulation platform, a tracking mechanism of Linux kernel running on the simulation platform based on behavior analysis is proposed. The granularity of behavior tracking is defined for the application environment in this paper, including coarse-grained tracking and fine-grained tracking. Coarse-grained tracking is to track the track of the monitored function sequence from the function level. It records the state of each monitored function when it is executed and the call sequence of the monitored function. Fine-grained tracking is to track the track of the monitored function from the instruction level, which records the address of each instruction when the monitored function is executed. The algorithms of two tracking methods are described in detail. Secondly, the characteristics of ARM microprocessor and the standard of ARM function call are briefly introduced. The algorithms of coarse-grained tracking and fine-coarse-grained tracking are realized on the ARM simulation platform. Finally, the implementation principle of process creation, process scheduling and program loading in Linux2.6 kernel is analyzed, and the test cases are designed. The method of automatic tracking and analysis of Linux kernel running on the simulation platform based on behavior analysis is verified.
【學(xué)位授予單位】：華北電力大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2012
【分類號】：TP316.81;TP368.1

【參考文獻】

相關(guān)期刊論文 前10條

1 黎亮;傅一帆;;基于嵌入式Linux的內(nèi)核錯誤跟蹤技術(shù)[J];電子技術(shù)應(yīng)用;2008年09期

2 王澤東;劉宇;朱隨江;劉寶旭;潘林;;采用行為分析的單機木馬防護系統(tǒng)設(shè)計與實現(xiàn)[J];計算機工程與應(yīng)用;2011年11期

3 劉紅;;嵌入式系統(tǒng)技術(shù)發(fā)展趨勢淺析[J];中國建設(shè)教育;2006年10期

4 羅亞麗;周安民;吳少華;胡勇;丁怡;;一種基于行為分析的程序異常檢測方法[J];計算機應(yīng)用;2008年10期

5 徐庚保;曾蓮芝;;數(shù)字仿真[J];計算機仿真;2009年09期

6 涂剛,陽富民,胡貫榮;嵌入式操作系統(tǒng)綜述[J];計算機應(yīng)用研究;2000年11期

7 李云華;;Linux內(nèi)核調(diào)試新秀SystemTap[J];程序員;2010年03期

8 郝東白;郭林;黃皓;;基于Hook的程序異常行為檢測系統(tǒng)設(shè)計與實現(xiàn)[J];計算機工程與設(shè)計;2007年18期

9 江泓;何恩;;行為分析技術(shù)及其在可信網(wǎng)絡(luò)中的應(yīng)用前景[J];信息安全與通信保密;2009年02期

10 王兆菊;龔龍慶;;面向SoC的系統(tǒng)級設(shè)計語言[J];計算機技術(shù)與發(fā)展;2007年11期

，

本文編號：2404726