Monitoring range determination device, monitoring range determination method, and computer readable medium

A monitoring range determination method executed by a monitoring range determination device configured to determine a monitoring range for tamper detection feature calling functions that are embedded with a tamper detection feature in a software to be monitored, the monitoring range determination method comprising:

• an input step of inputting a binary of the software in which the tamper detection feature and the tamper detection feature calling functions are embedded;
• a CFG generation step of generating a control flow graph (CFG) based on the binary;
• and
• a monitoring range determination step of determining the monitoring range for the tamper detection feature calling functions based on the CFG,
• wherein the monitoring range determination step includes
• sequentially selecting the tamper detection feature calling functions on the CFG,
• adding a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule, and
• searching for the tamper detection feature calling function that may be executed next to the added node according to the predetermined rule, and adding the found tamper detection feature calling function to the monitoring range for the selected tamper detection feature calling functions.

A non-transitory computer readable medium storing a program that causes a computer to execute processing of determining a monitoring range for tamper detection feature calling functions that are embedded with a tamper detection feature in a software to be monitored, the program comprising:

• an input step of inputting a binary of the software in which the tamper detection feature and the tamper detection feature calling functions are embedded;
• a CFG generation step of generating a control flow graph (CFG) based on the binary;
• and
• a monitoring range determination step of determining the monitoring range for the tamper detection feature calling functions based on the CFG,
• wherein the monitoring range determination step includes
• sequentially selecting the tamper detection feature calling functions on the CFG,
• adding a node to the monitoring range for the selected tamper detection feature calling functions according to a predetermined rule, and
• searching for the tamper detection feature calling function that may be executed next to the added node according to the predetermined rule, and adding the found tamper detection feature calling function to the monitoring range for the selected tamper detection feature calling functions.