Analysis function imparting method, analysis function imparting device, and analysis function imparting program

An analysis-function-providing method executed by an analysis-function-providing device, the analysis-function-providing method comprising:

• first analyzing a virtual machine of a script engine, and acquiring a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next;
• second analyzing an instruction set architecture that is a system of instructions of the virtual machine and acquiring a branch virtual machine instruction that is a virtual machine instruction that causes branch;
• and
• providing an analysis function to the script engine by applying a hook including processing of constructing a virtual machine branch trace associated with the virtual program counter before and after execution of a branch virtual machine instruction, detecting an instruction sequence in which a repetition mode satisfies a predetermined condition, and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter that is architecture information obtained by the first analyzing and the second analyzing.

An analysis-function-providing device comprising:

• processing circuitry configured to:
• analyze a virtual machine of a script engine and acquire a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next and a conditional branch flag that is an area for holding a flag as to whether or not branch is made at a time of conditional branch in an execution state;
• and
• provide an analysis function to the script engine by applying a hook including processing of detecting an instruction sequence a number of times of repeated execution of which is greater than or equal to a threshold and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter and the conditional branch flag that are architecture information obtained by analysis of the virtual machine.