CN110764995A

Movatterモバイル変換

Info

Publication number: CN110764995A
Application number: CN201910835048.7A
Authority: CN
Inventors: 朴英敏
Original assignee: Beijing ByteDance Network Technology Co Ltd
Current assignee: Beijing ByteDance Network Technology Co Ltd
Priority date: 2019-09-05
Filing date: 2019-09-05
Publication date: 2020-02-07
Anticipated expiration: 2039-09-05
Also published as: CN110764995B

Abstract

The disclosure provides a method, a device, a medium and an electronic device for detecting file access abnormity. The method comprises the following steps: acquiring first file memory information mapped to a first starting address in a memory mapping table; acquiring first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address; the first file page information is page information corresponding to the first mapping page in the first file memory information; loading the first file page information into the first mapping page, and acquiring loading result information; judging whether the loading result information meets the page missing abnormal condition or not; if yes, prompting abnormal information. The method and the device can quickly locate the abnormal file and obtain the related information of the file.

Description

Method, device, medium and electronic equipment for detecting file access abnormity

Technical Field

The present disclosure relates to the field of software testing, and in particular, to a method, an apparatus, a medium, and an electronic device for detecting file access abnormality.

Background

A process is a running activity of a program with independent functionality with respect to a certain data set. It can apply for and own system resources, and is a dynamic concept and an active entity. It is not just the code of the program but also the current activity, represented by the value of the program counter and the contents of the processing registers.

Multiple processes cannot access the same shared resource at the same time, otherwise time-dependent errors may occur, a phenomenon known as process mutual exclusion. That is, one process is accessing a shared resource and another process to access the shared resource must wait.

If one process reads a file, another process rewrites the file, an exception may occur, and even the process crashes. For such a problem, a common debugging method is to analyze information such as a call stack, a register, a memory, and a log. Since the information is provided to the debugger in the form originally existing in the system, there is a problem that it is difficult to understand and is not intuitive. Therefore, the problem of mutual exclusion of the analysis processes is difficult.

Disclosure of Invention

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

An object of the present disclosure is to provide a method, an apparatus, a medium, and an electronic device for detecting file access abnormality, which can solve at least one of the above-mentioned technical problems. The specific scheme is as follows:

according to a specific implementation manner of the present disclosure, in a first aspect, the present disclosure provides a method for detecting file access abnormality, including:

acquiring first file memory information mapped to a first starting address in a memory mapping table;

acquiring first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address; the first file page information is page information corresponding to the first mapping page in the first file memory information;

loading the first file page information into the first mapping page, and acquiring loading result information;

judging whether the loading result information meets the page missing abnormal condition or not;

if yes, prompting abnormal information.

According to a second aspect, the present disclosure provides an apparatus for detecting file access abnormality, including:

a first start address obtaining unit, configured to obtain a first start address where the first file memory information is mapped to the memory mapping table;

a first file page information obtaining unit, configured to obtain first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address; the first file page information is page information corresponding to the first mapping page in the first file memory information;

the loading unit is used for loading the first file page information into the first mapping page and acquiring loading result information;

the judging unit is used for judging whether the loading result information meets the page missing abnormal condition or not;

and the abnormal information prompting unit is used for prompting abnormal information if the output result of the judging unit is 'yes'.

According to a third aspect, there is provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements a method of detecting file access anomalies as claimed in any one of the first aspect.

According to a fourth aspect thereof, the present disclosure provides an electronic device, comprising: one or more processors; storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement a method of detecting file access anomalies as claimed in any one of the first aspects.

Compared with the prior art, the scheme of the embodiment of the disclosure at least has the following beneficial effects:

Drawings

The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent by referring to the following detailed description when taken in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. It should be understood that the drawings are schematic and that elements and features are not necessarily drawn to scale. In the drawings:

FIG. 1 illustrates a flow diagram of a method of detecting file access anomalies in accordance with an embodiment of the present disclosure;

FIG. 2 shows a schematic diagram of a method of detecting file access anomalies in accordance with an embodiment of the present disclosure;

FIG. 3 illustrates a block diagram of elements of an apparatus to detect file access anomalies in accordance with an embodiment of the present disclosure;

fig. 4 shows an electronic device connection structure schematic according to an embodiment of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the disclosure are for illustration purposes only and are not intended to limit the scope of the disclosure.

It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order, and/or performed in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.

The term "include" and variations thereof as used herein are open-ended, i.e., "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description.

It should be noted that the terms "first", "second", and the like in the present disclosure are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.

It is noted that references to "a", "an", and "the" modifications in this disclosure are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that "one or more" may be used unless the context clearly dictates otherwise.

The names of messages or information exchanged between devices in the embodiments of the present disclosure are for illustrative purposes only, and are not intended to limit the scope of the messages or information.

Alternative embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

A first embodiment provided by the present disclosure is an embodiment of a method for detecting file access anomalies.

The following describes an embodiment of the present disclosure in detail with reference to fig. 1 and fig. 2, where fig. 1 is a flowchart of a method for detecting a file access exception according to an embodiment of the present disclosure; FIG. 2 is a diagram illustrating a method of detecting file access anomalies according to an embodiment of the present disclosure.

Step S100, open the first file to obtain the first file memory information stored in the memory.

The first file memory space is a space for storing the first file memory information in the memory.

The first file memory information refers to information that the opened first file is stored in the memory. For example, in the C language, a specified file is opened by using an open instruction, and a file handle is acquired; the file handle may represent the memory information of the specified file.

Step S101, obtaining the first file memory information mapped to the first start address in the memory mapping table.

Multiple processes cannot access the same shared resource at the same time, otherwise time-dependent errors may occur, a phenomenon known as process mutual exclusion. That is, one process is accessing a shared resource and another process to access the shared resource must wait. Otherwise, an exception may occur, which may even result in a process crash.

Physical memory is divided into fixed-size blocks called frames or page frames, while logical memory is also divided into equally sized blocks called pages or pages.

In order to analyze the problem of mutual exclusion of files in a process, the embodiment of the present disclosure adopts a memory mapping table manner for processing files. That is, a space corresponding to the memory information of the first file, that is, the first mapping space, is reserved in the memory mapping table, the opened file is paged and loaded into the space of the corresponding page of the memory mapping table as required, and the abnormal information of the file operation is obtained according to the loading result.

Step S102, obtaining first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address.

The first mapping page is the page to be loaded in the memory mapping table.

The first file page is a page in the memory information of the first file.

The first file page information is page information corresponding to the first mapping page in the first file memory information. For example, 4 mapping pages including a1, B1, C1, and D1 are reserved in the memory mapping table for the first file memory information, the file pages corresponding to the mapping pages in the first file memory information are 4 mapping pages including a2, B2, C2, and D2, respectively, and when a B1 mapping page to be read in the memory mapping table is present, if mapping page information does not exist in a B1 mapping page of the memory mapping table, information in the B2 file page is loaded into a B1 mapping page of the memory mapping table.

The memory mapping table not only includes the first mapping space, but also includes spaces required by other applications, and the information stored in these spaces is stored in the memory mapping table in units of pages. The page feature information includes page sequence number information in the memory mapping table.

The first starting address is a starting address in a second mapped page. That is, the first starting address is both the first address of the first mapping space in the memory mapping table and the first address of the first mapping page (i.e. the second mapping page) in the first mapping space.

The obtaining of the first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address comprises the following steps:

step S102-21, acquiring first offset information based on second page sequence number information of the second mapping page, first page sequence number information of the first mapping page and a preset page length.

The first offset information refers to address length information from the first start address to a page start address of the first mapped page.

For example, continuing the above example, the second mapping page is the a1 mapping page, the first mapping page is the C1 mapping page, the preset page length is 1k (1k is 1024), the second page number information of the a1 mapping page in the memory mapping table is 5, the first page number information of the C1 mapping page in the memory mapping table is 7, and the first offset information is 2 k.

Step S102-22, obtaining a page start address of the first file page according to the first file memory information and the first offset information.

For example, in the C language, the file handle obtained after the open instruction opens the first file represents the first file memory information, and the lseek instruction can position the read pointer to the position of the first offset information in the first file memory information, that is, the page start address of the first file page.

And S102-23, acquiring first file page information based on the page starting address and the preset page length of the first file page.

For example, continuing the above example, the first document page information is obtained by reading the information of the preset page length from the page start address of the first document page by the read instruction.

Optionally, the embodiment of the present disclosure provides a checking mechanism, that is, only when the read mapping page information is empty, the corresponding file page information is loaded to the mapping page. Before the obtaining of the first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address, the method further includes the following steps:

and step S102-11, reading the third mapping page information.

And S102-12, judging whether the third mapping page information is empty or not.

Step S102-13, if yes, the third mapping page is determined to be the first mapping page.

Step S102-14, if not, stopping loading the page information corresponding to the third mapping page in the first file memory information to the third mapping page.

The steps can prevent the first file memory information from being repeatedly loaded into the memory mapping table.

Step S103, loading the first file page information into the first mapping page, and acquiring loading result information.

For example, the mmap instruction is used to load the first file page information in the first file memory information into the first mapping page in the memory mapping table.

The mmap instruction must be mapped in PAGE _ SIZE (indicating a preset PAGE length), the memory can be mapped only in PAGE unit, and if the address range of integral multiple of non-PAGE _ SIZE is to be mapped, the memory is first aligned, and the memory is forced to be mapped in the SIZE of multiple of PAGE _ SIZE.

And step S104, judging whether the loading result information meets the page fault abnormal condition.

The missing page exception condition comprises: SIGBUS abnormal condition of the system.

For example, the process a opens the C file to obtain the memory information of the C1 file, and the process B also opens the C file to obtain the memory information of the C2 file; when the process B modifies the memory information of the C1 file, the process A reads the memory information of the C1 file mapped in the memory mapping table, and the SIGBUS exception of the system occurs.

The loading result information comprises loading return information and/or loading length information.

The judging whether the loading result information meets the SIGBUS abnormal condition of the system at least comprises one of the following judging modes:

and judging whether the loading return information is not the first initial address or not in a first judgment mode.

For example, when the mmap instruction is adopted, if the load return information is the first start address, the load operation is successful; if the load return information is MAP _ FAILED (i.e., -1), it indicates that the load FAILED.

And judging whether the loading length information is not the preset page length or not in a second judgment mode.

And step S105, if yes, prompting abnormal information.

The exception information includes first path information and/or first file size information of the first file.

The prompt of the abnormal information comprises the following steps:

step S105-1, obtaining first file header mapping information from the memory mapping table based on the first start address.

Each file has a header, which is usually set at the beginning of the file and is different according to the file type, and mainly includes path information and/or file size information of the file.

And step S105-2, acquiring and prompting abnormal information based on the first file header mapping information.

The embodiment of the disclosure can quickly locate the abnormal file and obtain the related information of the file.

Corresponding to the first embodiment provided by the present disclosure, the present disclosure also provides a second embodiment, that is, an apparatus for detecting file access abnormality. Since the second embodiment is basically similar to the first embodiment, the description is simple, and the relevant portions should be referred to the corresponding description of the first embodiment. The device embodiments described below are merely illustrative.

Fig. 3 illustrates an embodiment of an apparatus for detecting a file access exception according to the present disclosure. Fig. 3 is a block diagram of a unit of an apparatus for detecting a file access exception according to an embodiment of the present disclosure.

Referring to fig. 3, the present disclosure provides an apparatus for detecting file access abnormality, including: a get firststart address unit 301, a get first filepage information unit 302, aload unit 303, ajudge unit 304, and a hintexception information unit 305.

A first startaddress obtaining unit 301, configured to obtain a first start address where the first file memory information is mapped to the memory mapping table;

a first file pageinformation obtaining unit 302, configured to obtain first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address; the first file page information is page information corresponding to the first mapping page in the first file memory information;

aloading unit 303, configured to load the first file page information into the first mapping page, and obtain loading result information;

a judgingunit 304, configured to judge whether the loading result information meets an out-of-page exception condition;

a presentingabnormality information unit 305 for presenting abnormality information if the output result of the judgingunit 304 is yes.

Optionally, the abnormal information includes first path information and/or first file size information of the first file;

the promptabnormality information unit 305 includes:

a first file header mapping information obtaining subunit, configured to obtain first file header mapping information from the memory mapping table based on the first start address;

and the abnormal information prompting subunit is used for acquiring and prompting abnormal information based on the first file header mapping information.

Optionally, the page feature information includes page sequence number information in the memory mapping table;

the first starting address is a starting address in a second mapping page;

in theunit 302 for acquiring first file page information, the following are included:

a first offset information obtaining subunit, configured to obtain first offset information based on second page sequence number information of the second mapping page, first page sequence number information of the first mapping page, and a preset page length; wherein the first offset information refers to address length information from the first start address to a page start address of the first mapping page;

a page start address subunit for obtaining a page start address of a first file page according to the first file memory information and the first offset information;

and the acquiring first file page information subunit is used for acquiring first file page information based on the page starting address and the preset page length of the first file page.

Optionally, theunit 302 for acquiring the first file page information further includes:

reading a third mapping page information subunit, configured to read third mapping page information;

a third mapping page information judging subunit, configured to judge whether the third mapping page information is empty;

a first mapping page determining subunit, configured to determine, if an output result of the third mapping page information determining subunit is "yes", that the third mapping page is the first mapping page;

and the loading stopping subunit is configured to, if the output result of the third mapping page information subunit is determined to be "no", stop loading the page information corresponding to the third mapping page in the first file memory information to the third mapping page.

Optionally, in the apparatus, the apparatus further includes:

and the file opening unit is used for opening the first file to obtain the memory information of the first file stored in the memory.

Optionally, the page fault exception condition includes: SIGBUS abnormal condition of the system.

Optionally, the loading result information includes loading return information and/or loading length information;

the judging whether the loading result information meets the SIGBUS abnormal condition of the system at least comprises one of the following judging subunits:

a first judging subunit, configured to judge whether the load return information is not the first start address;

and the second judgment subunit is used for judging whether the loading length information is not the preset page length.

The embodiment of the present disclosure provides a third embodiment, that is, an electronic device, where the electronic device is used in a method for detecting file access abnormality, and the electronic device includes: at least one processor; and a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the one processor to cause the at least one processor to perform the method of detecting a file access exception as described in the first embodiment.

The present disclosure provides a fourth embodiment, which is a computer storage medium for detecting file access abnormality, where the computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the method for detecting file access abnormality as described in the first embodiment.

Referring now to FIG. 4, shown is a schematic diagram of an electronic device suitable for use in implementing embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (e.g., a car navigation terminal), and the like, and a stationary terminal such as a digital TV, a desktop computer, and the like. The electronic device shown in fig. 4 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 4, the electronic device may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 401 that may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)402 or a program loaded from a storage means 408 into a Random Access Memory (RAM) 403. In theRAM 403, various programs and data necessary for the operation of the electronic apparatus are also stored. Theprocessing device 401, theROM 402, and theRAM 403 are connected to each other via abus 404. An input/output (I/O)interface 405 is also connected tobus 404.

Generally, the following devices may be connected to the I/O interface 405:input devices 406 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; anoutput device 407 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like;storage 408 including, for example, tape, hard disk, etc.; and acommunication device 409. The communication means 409 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 illustrates an electronic device having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer readable medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via thecommunication device 409, or from thestorage device 408, or from theROM 402. The computer program performs the above-described functions defined in the methods of the embodiments of the present disclosure when executed by theprocessing device 401.

It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

In some embodiments, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText transfer protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communications network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed network.

The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.

Computer program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including but not limited to an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in the embodiments of the present disclosure may be implemented by software or hardware. Where the name of an element does not in some cases constitute a limitation on the element itself.

The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), systems on a chip (SOCs), Complex Programmable Logic Devices (CPLDs), and the like.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other embodiments in which any combination of the features described above or their equivalents does not depart from the spirit of the disclosure. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.

Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A method for detecting file access anomalies, comprising:

if yes, prompting abnormal information.

2. The method according to claim 1, wherein the exception information comprises first path information and/or first file size information of a first file;

the prompt exception information includes:

acquiring first file header mapping information from the memory mapping table based on the first starting address;

and acquiring and prompting abnormal information based on the first file header mapping information.

3. The method according to claim 1, wherein the page characteristic information comprises page sequence number information in the memory mapping table;

the first starting address is a starting address in a second mapping page;

the obtaining of the first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address includes:

acquiring first offset information based on second page sequence number information of the second mapping page, first page sequence number information of the first mapping page and a preset page length; wherein the first offset information refers to address length information from the first start address to a page start address of the first mapping page;

acquiring a page starting address of the first file page according to the first file memory information and the first offset information;

and acquiring first file page information based on the page starting address and the preset page length of the first file page.

4. The method according to claim 3, further comprising, before said obtaining first offset information based on the second page number information of the second mapped page, the first page number information of the first mapped page, and a preset page length:

reading the third mapping page information;

judging whether the third mapping page information is empty or not;

if yes, the third mapping page is determined to be the first mapping page.

5. The method of claim 1, further comprising, before said obtaining the first file memory information mapped to the first starting address in the memory map table:

and opening the first file to obtain the memory information of the first file stored in the memory.

6. The method of claim 1, wherein the missing page exception condition comprises: SIGBUS abnormal condition of the system.

7. The method of claim 6, wherein the load result information comprises load return information and/or load length information;

judging whether the loading return information is not the first initial address;

and judging whether the loading length information is not a preset page length.

8. An apparatus for detecting file access anomalies, comprising:

9. A computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out the method according to any one of claims 1 to 7.

10. An electronic device, comprising:

one or more processors;

storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to carry out the method of any one of claims 1 to 7.