Analysis function imparting method, analysis function imparting device, and analysis function imparting program

An analysis function providing device comprising:

• processing circuitry configured to:
• analyze a virtual machine of a script engine, and acquire a hook point that is a part where an analysis code is inserted by applying a hook, and a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next;
• analyze an instruction set architecture that is a system of instructions of the virtual machine and acquire a branch virtual machine instruction that is a virtual machine instruction that causes branch;
• and
• provide an analysis function by applying a hook, to the hook point of the script engine, the hook including processing of, when an exception has occurred, changing a destination pointed by the virtual program counter to a head of a basic block immediately after a basic block in which the exception has occurred on a basis of the virtual program counter and the branch virtual machine instruction that are architecture information obtained by analysis.

A non-transitory computer-readable recording medium storing therein an analysis function providing program that causes a computer to execute a process comprising:

• first analyzing a virtual machine of a script engine, and acquiring a hook point that is a part where an analysis code is inserted by applying a hook, and a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next;
• second analyzing an instruction set architecture that is a system of instructions of the virtual machine and acquiring a branch virtual machine instruction that is a virtual machine instruction that causes branch;
• and
• providing an analysis function by applying a hook, to the hook point of the script engine, the hook including processing of, when an exception has occurred, changing a destination pointed by the virtual program counter to a head of a basic block immediately after a basic block in which the exception has occurred on a basis of the virtual program counter and the branch virtual machine instruction that are architecture information obtained by analysis.