基于QEMU的龙架构平台插桩软件

doi:10.19678/j.issn.1000-3428.0070725

计算机工程 ›› 2026, Vol. 52 ›› Issue (8): 184-192. doi: 10.19678/j.issn.1000-3428.0070725

基于QEMU的龙架构平台插桩软件

高林萍¹^,*(), 徐伟², 陈曦¹, 穆奕博¹, 张开¹

1. 中国科学技术大学先进技术研究院, 安徽合肥 230026
2. 中国科学技术大学计算机科学与技术学院, 安徽合肥 230026

收稿日期:2024-12-19 修回日期:2025-03-17 出版日期:2026-08-15 发布日期:2025-05-22
通讯作者: 高林萍
作者简介:
高林萍, 女, 硕士, 主研方向为二进制翻译、编译优化
徐伟, 高级实验师、博士
陈曦, 硕士研究生
穆奕博, 硕士研究生
张开, 博士研究生
基金资助:
中国科学院基础与交叉前沿科研B类先导专项(XDB0660000)

An Instrumentation Software for LoongArch Based on QEMU

GAO Linping¹^,*(), XU Wei², CHEN Xi¹, MU Yibo¹, ZHANG Kai¹

1. Institute of Advanced Technology, University of Science and Technology of China, Hefei 230026, Anhui, China
2. School of Computer Science and Technology, University of Science and Technology of China, Hefei 230026, Anhui, China

Received:2024-12-19 Revised:2025-03-17 Online:2026-08-15 Published:2025-05-22
Contact: GAO Linping

摘要/Abstract

摘要：

随着软件规模和复杂性指数级增长, 对程序运行时行为的监控和分析变得越来越困难, 动态二进制插桩(DBI)技术是解决这一问题的有效手段, 现有成熟的二进制插桩软件有Pin、Valgrind等, 主要支持x86、ARM等主流架构, 但在新兴的自主指令集架构上缺乏支持。龙架构(LoongArch)作为我国自主研制的指令集架构, 具有较好的自主性、先进性与兼容性, 但其发展时间较短, 生态环境尚不完善, 特别是在调试工具链方面存在明显短板。为了填补这一空白, 推动龙架构生态的成熟, 推出一款支持龙架构的DBI软件具有重要意义。本文旨在设计并实现一款基于QEMU(Quick Emulator)框架的DBI软件, 以支持龙架构的程序监控与分析。该软件对标Pin, 设计实现了5个基础插桩粒度及相关插桩应用程序编程接口(API), 并在此基础上开发了20多个插桩工具, 供用户直接使用或学习插桩工具的编写。为了提升框架性能, 通过优化条件跳转指令的翻译、基本块链接和插桩内联等方法对框架进行了改进。性能测试结果表明, 优化后的框架在指令级插桩效率上提升了100多倍, 基本块级插桩效率提高了近33倍。

关键词: 动态二进制插桩, Pin, 龙架构, QEMU框架, 插桩应用程序编程接口, 插桩工具

Abstract:

As software scale and complexity grow exponentially, monitoring and analyzing program runtime behavior has become increasingly challenging. Dynamic Binary Instrumentation (DBI) is an effective solution to this problem, with mature tools such as Pin and Valgrind supporting mainstream architectures such as x86 and ARM. However, these tools lack support for emerging domestic instruction set architectures such as LoongArch. LoongArch, a self-developed instruction-set architecture in China, exhibits high levels of autonomy, advancement, and compatibility. However, owing to its relatively short developmental history, the ecosystem remains incomplete, particularly in the debugging toolchain. Developing a dynamic binary instrumentation tool is important to address this gap and promote the maturation of the LoongArch ecosystem. This study aims to design and implement a dynamic binary instrumentation tool based on the Quick Emulator (QEMU) framework to support program monitoring and analysis in LoongArch. The tool, modeled after Pin, implements five fundamental instrumentation granularities and related Application Programming Interfaces (APIs), along with over 20 instrumentation tools for direct use or as learning resources for tool development. To enhance performance, the framework is optimized through improvements in conditional jump instruction translation, basic block linking, and instrumentation inlining. Performance tests demonstrate that the optimized framework achieves improvement of over 100 times in instruction-level instrumentation efficiency and nearly 33 times in basic block-level instrumentation efficiency.

Key words: Dynamic Binary Instrumentation (DBI), Pin, LoongArch, Quick Emulator (QEMU) framework, instrumentation Application Programming Interface (API), instrumentation tool

高林萍, 徐伟, 陈曦, 穆奕博, 张开. 基于QEMU的龙架构平台插桩软件[J]. 计算机工程, 2026, 52(8): 184-192.

GAO Linping, XU Wei, CHEN Xi, MU Yibo, ZHANG Kai. An Instrumentation Software for LoongArch Based on QEMU[J]. Computer Engineering, 2026, 52(8): 184-192.

https://www.ecice06.com/CN/Y2026/V52/I8/184

图/表 11

图1 插桩框架图

Fig.1 Instrumentation framework diagram

图2 插桩运行时序图

Fig.2 Instrumentation runtime sequence diagram

图3 插桩粒度体系

Fig.3 Instrumentation granularity hierarchy

图4 INS_InsertCall的代码实现

Fig.4 The code implementation of INS_InsertCall

图5 BBL_Count的代码结构

Fig.5 The code structure of the BBL_Count

图6 原框架与基本块链接1.0框架执行效率对比

Fig.6 Comparison of execution efficiency between the original framework and the basic block linking 1.0 framework

图7 原框架、基本块链接1.0框架和基本块链接2.0框架测试分数和效率对比

Fig.7 Comparison of testing score and execution efficiency among the original framework, the basic block linking 1.0 framework and the basic block linking 2.0 framework

参考文献 25

1	胡伟武, 汪文祥, 吴瑞阳, 等. 龙芯指令系统架构技术. 计算机研究与发展, 2023, 60 (1): 2- 16.
	HU W W , WANG W X , WU R Y , et al. Loongson instruction set architecture technology. Journal of Computer Research and Development, 2023, 60 (1): 16.
2	GORGOVAN C, CALLAGHAN G, LUJÁN M. Balancing performance and productivity for the development of dynamic binary instrumentation tools: a case study on Arm systems[C]//Proceedings of the 29th International Conference on Compiler Construction. New York, USA: ACM Press, 2020: 132-142.
3	CHEN Z , ZHANG Q , WU J , et al. A source-level instrumentation framework for the dynamic analysis of memory safety. IEEE Transactions on Software Engineering, 2023, 49 (4): 2107- 2127. doi: 10.1109/TSE.2022.3210580
4	AÇıCı K, UĞURLU G. A reverse engineering tool that directly injects shellcodes to the code caves in portable executable files[C]//Proceedings of the International Conference on Theoretical and Applied Computer Science and Engineering (ICTASCE). Ankara, Turkey: IEEE Press, 2023: 42-45.
5	ARIF M, ZHOU R Y, HO H M, et al. Cinnamon: a domain-specific language for binary profiling and monitoring[C]//Proceedings of the IEEE/ACM International Symposium on Code Generation and Optimization (CGO). Seoul, Korea: IEEE Press, 2021: 103-114.
6	BELLARD F. QEMU, a fast and portable dynamic translator[C]//Proceedings of the Annual Conference on USENIX Annual Technical Conference. New York, USA: ACM Press, 2005: 41.
7	HUANG J C . Program instrumentation and software testing. Computer, 1978, 11 (4): 25- 32. doi: 10.1109/C-M.1978.218134
8	BRUENING D, GARNETT T, AMARASINGHE S. An infrastructure for adaptive dynamic optimization[C]//Proceedings of the International Symposium on Code Generation and Optimization. San Francisco, USA: IEEE Press, 2003: 265-275.
9	KIM D , KIM S , RYOU J . Design and implementation of user-level dynamic binary instrumentation on ARM architecture. The Journal of Supercomputing, 2018, 74 (8): 3583- 3595. doi: 10.1007/s11227-016-1777-9
10	NETHERCOTE N , SEWARD J . Valgrind: a framework for heavyweight dynamic binary instrumentation. ACM SIGPLAN Notices, 2007, 42 (6): 89- 100. doi: 10.1145/1273442.1250746
11	PEREIRA R, STELLE G, CARRIBAULT P. Taskgrind: heavyweight dynamic binary instrumentation for parallel programs analysis[C]//Proceedings of the SC24-W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis. Atlanta, USA: IEEE Press, 2025: 214-221.
12	LUK C K , COHN R , MUTH R , et al. Pin: building customized program analysis tools with dynamic instrumentation. ACM SIGPLAN Notices, 2005, 40 (6): 190- 200. doi: 10.1145/1064978.1065034
13	SRIVASTAVA A, EUSTACE A. ATOM: a system for building customized program analysis tools[C]//Proceedings of the ACM SIGPLAN 1994 Conference on Programming Language Design and Implementation. New York, USA: ACM Press, 1994: 196-205.
14	LUECK G, PATIL H, PEREIRA C. PinADX: an interface for customizable debugging with dynamic instrumentation[C]//Proceedings of the Tenth International Symposium on Code Generation and Optimization. New York, USA: ACM Press, 2012: 114-123.
15	BRUENING D. Efficient, transparent, and comprehensive runtime code manipulation[D]. Cambridge, USA: Massachusetts Institute of Technology, 2004.
16	HILL J H, FEIOCK D C. Pin++: an object-oriented framework for writing Pintools[C]//Proceedings of the 2014 International Conference on Generative Programming: Concepts and Experiences. New York, USA: ACM Press, 2014: 133-141.
17	CHATTERJEE N, THAKUR S S, DAS P P. Resource management in native languages using dynamic binary instrumentation (PIN)[M]//CHAKI R, CORTESI A, SAEED K, et al. Advanced computing and systems for security. New Delhi, India: Springer India, 2015: 107-119.
18	ARAFA P, KASHIF H, FISCHMEISTER S. DIME: Time-aware dynamic binary instrumentation using rate-based resource allocation[C]//Proceedings of the International Conference on Embedded Software (EMSOFT). Montreal, Canada: IEEE Press, 2013: 1-10.
19	林昊, 康绯, 光焱. 基于DBI的密钥安全性检测. 网络与信息安全学报, 2017, 3 (11): 50- 58.
	LIN H , KANG F , GUANG Y . Key security detection based on dynamic binary instrumentation. Chinese Journal of Network and Information Security, 2017, 3 (11): 50- 58.
20	陈金宝, 张昱, 李清伟, 等. DBI-Go: 动态插桩定位Go二进制的非法内存引用. 软件学报, 2024, 35 (6): 2585- 2607.
	CHEN J B , ZHANG Y , LI Q W , et al. DBI-go: dynamic binary instrumentation for pinpointing illegal memory references in go binaries. Journal of Software, 2024, 35 (6): 2585- 2607.
21	卢帅兵, 张明, 林哲超, 等. 基于动态二进制翻译和插桩的函数调用跟踪. 计算机研究与发展, 2019, 56 (2): 421- 430.
	LU S B , ZHANG M , LIN Z C , et al. Dynamic binary translation and instrumentation based function call tracing. Journal of Computer Research and Development, 2019, 56 (2): 421- 430.
22	ZENG J Y, FU Y C, LIN Z Q. PEMU: a PIN highly compatible out-of-VM dynamic binary instrumentation framework[C]//Proceedings of the 11th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments. Istanbul Turkey. New York, USA: ACM Press, 2015: 147-160.
23	邹伟, 高峰, 颜运强. 基于QEMU的DBI技术. 计算机研究与发展, 2019, 56 (4): 730- 741.
	ZOU W , GAO F , YAN Y Q . Dynamic binary instrumentation based on QEMU. Journal of Computer Research and Development, 2019, 56 (4): 730- 741.
24	COTA E G, CARLONI L P. Cross-ISA machine instrumentation using fast and scalable dynamic binary translation[C]//Proceedings of the 15th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments. New York, USA: ACM Press, 2019: 74-87.
25	GAN C Y. Research on high-reliability and portable dynamic binary instrumentation for linux syscall[C]//Proceedings of the 3rd International Symposium on Computer Technology and Information Science (ISCTIS). Chengdu, China: IEEE Press, 2023: 725-729.

[1]	王法臻, 崔少辉, 王成. 基于Linux的PXIe可重构仪器设备驱动程序开发[J]. 计算机工程, 2021, 47(4): 166-172.
[2]	郑兵,陈世利,刘蓉. 基于萤火虫算法优化的Gmapping研究[J]. 计算机工程, 2018, 44(9): 22-27.
[3]	张婧,周安民,刘亮,贾鹏,刘露平,贾丽. 基于动态污点分析的栈溢出Crash判定技术[J]. 计算机工程, 2018, 44(4): 168-173,180.
[4]	屈晓旭,杨黎明,苗泉强. Spinal码的CRC辅助多元回溯译码算法[J]. 计算机工程, 2017, 43(12): 120-123,129.
[5]	岳国华,陈鹏. 基于MapInfo数据的嵌入式电子地图快速输出算法[J]. 计算机工程, 2017, 43(1): 93-97.
[6]	沈明玉, 郑立坤. WSN中SPIN路由协议的改进[J]. 计算机工程, 2012, 38(5): 86-88.
[7]	袁开银, 郭瑞, 陆翔升, 吴尽昭. RGPS过程层元模型正确性验证[J]. 计算机工程, 2012, 38(15): 39-42.
[8]	孙践知, 韩忠明, 陈丹, 李越辉. 灾难场景下基于分组策略的机会网络路由算法[J]. 计算机工程, 2011, 37(23): 79-82.
[9]	刘建林, 王震宇, 蒋烈辉, 谢耀滨, 刘絮颖. 基于控制流分析的隐藏代码动态捕获方法[J]. 计算机工程, 2011, 37(21): 23-25.
[10]	伍星;何中市;黄永文. 基于弱监督学习的产品特征抽取[J]. 计算机工程, 2009, 35(13): 199-201.
[11]	陈晓颖;胡熠;陆汝占. 实体关系模板的获取技术[J]. 计算机工程, 2007, 33(21): 199-201.
[12]	汤杨，吴慧中，李栋，肖甫. 一种基于辅助视的 Image Warping 方法[J]. 计算机工程, 2006, 32(7): 40-42.
[13]	张颖江，宋秀丽，邓红耀. 防火墙中软令牌认证模块的设计与实现[J]. 计算机工程, 2006, 32(5): 167-168，204.
[14]	陈大伟，董荣胜，郭云川，古天龙. IKEv2 协议的SPIN 模型检测[J]. 计算机工程, 2006, 32(5): 164-166，246.

选择文件类型/文献管理软件名称

选择包含的内容

基于QEMU的龙架构平台插桩软件

An Instrumentation Software for LoongArch Based on QEMU

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 25

相关文章 14

编辑推荐

Metrics

本文评价

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于QEMU的龙架构平台插桩软件

An Instrumentation Software for LoongArch Based on QEMU

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 25

相关文章 14

编辑推荐

Metrics

本文评价