154results about "Decompilation/disassembly" patented technology

The invention provides a network security malicious code binary search method and system, and relates to the technical field of data processing, and the method comprises the steps: calculating the multi-dimensional structural similarity between a to-be-detected binary file and each standard binary reference file based on a function level control flow semantic feature vector; determining a finally matched standard binary reference file according to the multi-dimensional structural similarity; performing fine-grained difference analysis on the binary file to be detected and the finally matched standard binary reference file to obtain a fine-grained difference analysis result; and on the basis of a fine-grained difference analysis result, in combination with sensitive data operation behavior feature detection, judging whether the to-be-detected binary file is a maliciously tampered version, and positioning a malicious code injection point. According to the method, the defects that in the prior art, dependence on fixed features is too high, and compilation optimization is sensitive are overcome.

The invention relates to the technical field of data security detection, in particular to a data security-oriented mobile application dynamic and static dual-combination detection method and system. The method comprises the following steps: collecting basic information of a target mobile application from a plurality of heterogeneous data sources, and constructing a basic data set of the mobile application information; performing decompilation and static analysis based on the installation file in the resource library, and outputting a static risk feature vector in combination with the sensitive data operation rule set; dynamically running a target application in the controlled sandbox environment, monitoring network traffic, system calling and file operation behavior sequences, and outputting a dynamic behavior risk feature vector; and fusing the two types of feature vectors, and inputting the fused feature vectors into a risk assessment model to generate a comprehensive data security risk assessment report. According to the method, a comprehensive evaluation system is constructed by fusing static and dynamic risk features, and full-dimension coverage of the security risk of the mobile application is realized.

The invention provides a performance analysis method and device for a cross-architecture semantic equivalence instruction stream and a storage medium, and the method comprises the steps: taking a high-level language program as input, aiming at a plurality of target architectures, generating a multi-dimensional semantic equivalence instruction stream set from a high-level language form to an intermediate representation and then to an assembly code through a compiler; based on semantic equivalence instruction streams of code units with different granularities and compiler debugging information, establishing a mapping relationship between a target region in a source code and an intermediate representation and assembly codes, and forming a cross-hierarchy equivalence region fully-connected graph; and based on the semantic equivalence instruction stream set and the cross-level equivalence region fully-connected graph, automatically embedding a performance monitoring code at the boundary of the target region, and carrying out performance test on the elastic region. According to the method, the accurate performance test of the cross-architecture semantic equivalence instruction stream can be realized.

The invention discloses a contract vulnerability detection method and system based on cross-granularity feature fusion and meta-learning, and relates to the technical field of block chain security, the method comprises the following steps: obtaining a source code and a compiled byte code of a contract to be detected; source code semantic features are extracted from the source code, operation code execution features are extracted from the byte code, and graph structure features are extracted after a program dependency graph is constructed from the source code; performing cross-granularity attention interaction to generate cross-granularity fusion features; performing type-aware feature modulation on the cross-granularity fusion feature and a vulnerability type identifier of the current detection task, training a classifier by adopting a meta-learning strategy, and outputting a vulnerability detection result; and in response to the vulnerability detection result that the vulnerability exists, positioning the vulnerability code position based on the graph-source code attention weight matrix generated in the cross-granularity attention interaction process, thereby solving the problem of poor generalization ability in a rare vulnerability scene with scarce samples.

The invention relates to a malicious software detection method based on multi-feature fusion and interpretability analysis. According to the technical scheme, static features are extracted through'macroscopic-microscopic 'double paths, and a dynamic behavior knowledge graph is constructed in combination with sandbox monitoring, stain analysis and semantic abstraction and converted into feature vectors through graph embedding; multi-modal feature deep interaction and accurate classification are realized through a double-end cross attention-triple fusion-deep classification architecture; a hierarchical interpretable framework is constructed based on cross-modal causal alignment, case reasoning and anti-fact analysis, and a complete decision evidence chain is generated. The method has the advantages that comprehensive representation of the form, semantics and intention of malicious software is achieved, the detection precision and robustness are remarkably improved, meanwhile, the'black box 'dilemma of the model is solved, credible explanation is provided for security analysis, the method is suitable for complex network threat detection scenes, and it is verified through experiments that the method has good application prospects. According to the method, the detection rate of the Windows malicious software is remarkably increased, and the false alarm rate is effectively reduced.

The present invention provides a method and apparatus for recompiling decompiled code, and a storage medium. The method comprises: acquiring decompiled code: acquiring decompiled code generated by decompiling a target program; checking the decompiled code: acquiring error information generated after parsing and semantically checking the decompiled code; verifying the error information: comparing the error information with a preset ignore rule, and ignoring the error information conforming to the preset ignore rule; optimizing the decompiled code: optimizing the decompiled code on the basis of the remaining error information after ignoring; and generating a subsequent program: performing compilation on the basis of the optimized decompiled code to generate a subsequent program. The technical solution in the embodiments of the present invention can shorten the manual repair cycle from decompilation to recompilation, thereby saving a significant amount of time during security analysis of program packages.

The invention provides a key node identification method and device in an industrial control system, equipment and a medium. The key node identification method comprises the steps of performing reverse analysis on firmware codes of control equipment to obtain a control logic configuration file; disassembling the control software firmware code to obtain a software disassembling code; performing code labeling, code slicing and code translation on the software disassembly code to obtain a class C pseudo code; performing code analysis on the class C pseudo code to obtain a software structure configuration file; performing file analysis on the control logic configuration file and the software structure configuration file to obtain a service logic relationship between the control equipment and the control software and a service logic relationship between the control equipment and the field equipment; constructing a business logic map based on the business logic relationship between the control equipment and the control software and the business logic relationship between the control equipment and the field equipment; and identifying a key control link in the service logic map, and carrying out key node positioning on the key control link. Therefore, key nodes are effectively positioned.

Embodiments of the present application provide a code repair method and device, electronic equipment, storage medium and product. The method comprises: extracting binary features of a packed file, inputting a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, performing unpacking processing on the packed file to obtain an unpacked file; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code. The above scheme accurately identifies the target packing type by using the pre-trained convolutional neural network model, automatically performs targeted repair according to the target packing type, can accurately repair the influence of the packing tool on the readability of the code, and thus improves the accuracy of code repair.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

The embodiment of the invention provides an instruction processing method and device, electronic equipment and a readable storage medium. Under the condition that a compiling environment is a simulator environment, if the actual data bit width of an operand corresponding to a to-be-checked instruction is not matched with the general data bit width corresponding to a target architecture, the to-be-checked instruction is not matched with the general data bit width corresponding to the target architecture; if yes, mapping the operand corresponding to the to-be-checked instruction to a first macro assembly function which corresponds to the to-be-checked instruction and is matched with the actual data bit width of the operand corresponding to the to-be-checked instruction, and generating a target pseudo instruction; the target pseudo instruction is used for performing symbol expansion check on an operand corresponding to the to-be-checked instruction; and under the condition that the instruction execution result of the target pseudo instruction is a first result representing that symbol expansion is incorrect, positioning and symbol expansion optimization are performed on the instruction to be checked. Errors introduced by symbol extension are positioned and solved under the condition that the compiling environment is a simulator environment, it is ensured that all potential risks are eliminated in the simulation debugging compiling stage, errors in actual operation are avoided, and the development efficiency is improved.

The invention relates to an industrial control system PLC control logic decompilation method and application thereof, and the method comprises the following steps: carrying out simulation execution on a PLC control application program, realizing memory relocation and variable initialization processing on the control application program, and extracting an executable instruction and corresponding data; converting the extracted executable instruction and data into a unified intermediate representation to obtain an IR instruction; on the basis of a heuristic data flow analysis algorithm, variables in the IR instruction sequence are identified, forward backtracking analysis is carried out starting from the output variables, the accurate dependency relationship between the variables is recorded and constructed step by step, and a complete variable dependency graph is formed; and based on the variable dependency graph, combining branch and loop structure information in a control program, and reconstructing a complete PLC control logic in a structured text language. Compared with the prior art, the method has the advantages that the positioning precision and the recovery efficiency of PLC control logic tampering are improved, and the safety and the maintenance efficiency of an industrial control system are remarkably improved.

The invention discloses a Java decompiling method, device and equipment and a computer readable storage medium. The method comprises the following steps: extracting a class file, a resource file, a configuration file and a static resource by decompressing a Java deployment package; based on a predefined third-party library feature library, utilizing Hash comparison and package name / method signature feature matching to accurately classify the class file into a third-party library or a self-researched code; performing byte code analysis on the self-developed class file to generate structured data, and inputting the structured data into a customized large language model (based on byte code-source code parallel corpus training) to generate an initial source code; the optimization step comprises the steps of correcting errors by a static grammar checker and automatically supplementing annotations by a byte code constant pool; reconstructing a project directory structure based on the package name; a class dependency graph is generated through static call graph analysis; and finally, integrating the initial source code, the dependency graph and the configuration file, automatically generating an interface document, a framework document and a configuration document, and realizing complete reverse engineering of the deployment package.

The invention discloses a version identification method and system for binary software, and belongs to the technical field of computer program detection. The method comprises the following steps: carrying out reverse analysis on a binary file, and extracting a character string and a constant serving as a function return value; performing layered filtering on the character string and the constant to screen out candidate version semantic features possibly containing version semantic information, and extracting a context environment of the candidate version semantic features in a binary file; performing semantic enhancement on the candidate version semantic features in combination with a context environment of the candidate version semantic features in a binary file; and performing version identification on the binary file according to the character string and the enhanced semantic features of the candidate versions to obtain a version identification result of the binary file. According to the method, the identification problem of the binary software multiplexing open source software version can be effectively solved, and the identification accuracy and the recall rate are improved.

The application discloses a patch existence detection method based on key basic blocks, which comprises the following steps: firstly, modeling the semantics of a vulnerability function, a patch function and a target function to be detected into a function static control flow graph, and performing necessary preprocessing to minimize the influence caused by compilation confusion; then, a basic block matching algorithm is proposed, and the basic block matching is performed between the vulnerability function, the patch function and the target function respectively, so as to generate a matching basic block pair set; then, the change degree of a feature basic block related to the patch is analyzed, and the top N feature basic blocks are selected as key basic blocks for effective patch existence test; finally, the key basic blocks of the patch function and the vulnerability function are searched in the target function respectively, and it is judged whether the target function is more similar to the patch function, that is, whether the vulnerability has been patched. Through the above method, it can be quickly and accurately judged whether the vulnerability in a large-scale function to be detected has been patched.

The invention belongs to the technical field of power system security protection, and discloses a binary program vulnerability detection method and related device.The binary program vulnerability detection method comprises the steps that a VEX instruction of a to-be-detected binary program is obtained, and a program dependency graph is generated according to the VEX instruction; disassembling the to-be-detected binary program to obtain an assembly instruction, traversing the program dependency graph based on a preset sensitive operation instruction, and performing operand granularity slicing of the assembly instruction to obtain assembly instruction slices; a pre-trained encoder model is adopted to obtain feature vectors of the assembly instruction slices; and according to the feature vector of the assembly instruction slice, based on a pre-trained vulnerability detection model, obtaining a vulnerability detection result of the assembly instruction slice. According to the method, accurate dependency analysis is carried out around operands, a large number of irrelevant instruction interferences in binary program codes are effectively filtered out, most sensitive operations generating vulnerabilities can be covered based on preset sensitive operation instructions, the noise influence of redundant information on a model is reduced, and the robustness and generalization ability of detection are improved.

The invention relates to the technical field of function name prediction, in particular to a function name prediction method and system based on bidirectional semantic transfer. The method comprises the following steps of: 1, acquiring a target function of a binary file, and extracting a function body and an interprocess control flow diagram of the target function; wherein the target function is a function with a function name to be predicted; step 2, inputting the function body of the target function into a preset bidirectional semantic transfer framework, and obtaining global information of the target function; wherein the bidirectional semantic transfer framework obtains a corresponding sub-function and a parent function according to the target function, obtains an internal semantic database, a sub-function semantic database and a parent function semantic database of the target function by utilizing a large language model, and performs semantic fusion as global information; and 3, taking the global information of the target function as input of the large language model, and generating a function name of the target function in combination with the cue word. According to the method, the function name prediction reasoning capability can be improved.

The invention provides a malicious software detection method based on class distance optimization, and the method comprises the steps: obtaining malicious software sample data, and carrying out the preprocessing of the malicious software sample data; decompiling the preprocessed data to obtain a source code file; selecting byte code features from the source code file, and converting the byte code features into an RGB three-channel image; the RGB three-channel image is expanded by adopting the optimized GAN architecture, and an expanded malicious software sample is obtained; inputting the expanded malicious software sample into a deep neural network to obtain a malicious software family classification result; the generated high-quality malicious software image can be used for data enhancement, so that the model is more stable when facing various malicious software variants, the over-fitting risk is reduced, the reliability of a detection system is improved, the data acquisition cost is reduced, a data set is over-expanded, and the detection accuracy is improved. The deep learning model covers more possible malicious software features in the training process, so that manual intervention is reduced, and the automation level of a detection system is improved.

The application relates to a method, device, equipment and chip for identifying an access position. The method comprises the following steps: in response to an identification request for an access position of a register in a chip, obtaining an assembly text file corresponding to software code of the chip; the assembly text file comprises access records of each register in the chip; based on a to-be-detected register address carried by the identification request, querying a memory access instruction matched with the to-be-detected register address from the assembly text file; and based on the memory access instruction, determining an access position of the to-be-detected register in the software code. The method can improve the identification efficiency of the access position of the register.

The invention discloses a test input generation method and related equipment based on vulnerability characteristics of an industrial control system, and the method comprises the steps: obtaining multi-source data of the industrial control system, carrying out the hierarchical vulnerability characteristic collection of the multi-source data, and obtaining multi-source vulnerability characteristics; carrying out heterogeneous feature association modeling based on multi-source vulnerability features, and then generating a hierarchical vulnerability seed template to obtain a multi-dimensional test template library; performing cooperative monitoring on the execution track and behavior response of the industrial control system to obtain industrial control state features, and performing state fusion modeling based on the industrial control state features to obtain risk levels; and guiding the multi-dimensional test template library to perform multi-dimensional layered variation based on the risk level, and constructing to obtain target test input data. According to the technical scheme, a'feature acquisition-modeling-monitoring-feedback-optimization 'closed-loop system is formed, the comprehensiveness, intelligence and effectiveness of vulnerability testing of the industrial control system are integrally improved, and the method can be widely applied to the technical field of industrial control system security.

The application discloses an Internet of Things malicious code detection system based on a graph neural network, and belongs to the technical field of Internet of Things security and deep learning, and the system comprises a firmware acquisition and preprocessing module, a code attribute graph construction module, a hierarchical graph attention feature learning module, a malicious code detection and classification module and an edge cloud collaborative deployment module. The system uniformly converts different architecture Internet of Things firmware binary codes into architecture-independent intermediate representations, constructs a multi-relation code attribute graph fusing control flow relations, data dependency relations and function call relations, adopts a hierarchical graph attention network from an instruction level, a basic block level to a function level to perform multi-granularity feature learning, realizes binary classification detection and multi-classification family recognition of malicious codes, and realizes lightweight deployment through edge cloud collaboration architecture. The application solves the problems of single code representation mode, insufficient cross-architecture detection generalization ability and detection deployment difficulty under resource-limited conditions in the prior art.

The invention discloses a jump control method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining element information of a target element and a file path corresponding to the target element after jump through responding to an element jump operation of the target element in a code of a target item; under the condition that the file path indicates that the target element comes from a target compiling file of the target project, position information of a target source code element corresponding to the target element is determined in a source code file of the target project based on the element information, and the target compiling file is obtained by compiling at least part of the source code file of the target project; and performing jump control based on the position information of the target source code element. Therefore, when the jump control is carried out on the element, the position of the corresponding source code element can be accurately jumped to instead of only the position of a decompiled file obtained after the target compiled file is decompiled, so that a developer can edit the source code element, and the development efficiency is improved.

The application discloses a decompilation processing method and device, electronic equipment and a storage medium, and relates to the field of computers.The method comprises the following steps: creating three dynamic arrays in the form of class objects, namely a first dynamic array, a second dynamic array and a third dynamic array; traversing each Java Card bytecode, and based on the operation code and the operand of the Java Card bytecode, dynamically filling the Java Card bytecode and the generated Java bytecode information after conversion into the first dynamic array, the second dynamic array and the third dynamic array; and reading the Java Card bytecode in the dynamic array in sequence, and performing linkage address conversion mapping of the Java Card bytecode, so as to realize decompilation processing of the Java Card bytecode.The application can normally process decompilation operations in a scenario where the length of an operation object exceeds the agreed length.

The application discloses an IoT firmware loading base address determination method based on pointer reference addresses, comprising the following steps: S1, dividing a complete file into pieces in a logical manner, and taking the starting position of each file piece as a file pointer locate[i]; S2, reading data with a fixed length from the pointer locate[i] of the current file piece by using a multithreading mechanism, and distinguishing data blocks from code blocks by using entropy values; S3, calculating the information entropy of binary data, adding the entropy values to an entropy value table entropy, and calculating the string address in the firmware file and the string address referenced by the pointer; S4, calculating the number of corresponding pointer reference addresses in the string address table, outputting the obtained result in descending order, and bringing the result into reverse analysis of the firmware to determine the base address. According to the number of pointer reference string addresses, the application realizes the identification of the firmware loading base address, and is suitable for the loading base address identification of firmware of various architectures.

The invention discloses a component calling method and device, equipment, a medium and a product, and the method comprises the steps: analyzing a target component file, and obtaining function feature information of a callable function; constructing an RAG knowledge base; retrieving the RAG knowledge base to obtain semantic information matched with the function feature information; and on the basis of the semantic information and a preset large model, generating executable calling logic, so as to realize calling of the target component in the target component file on the basis of the executable calling logic. Static analysis and dynamic semantic enhancement are combined, semantic understanding and calling packaging of the function interface can be automatically completed, compiling and linkable calling codes are directly output, and the integration efficiency is remarkably improved.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining an observation phase for a process or application on a computing device. During the observation phase, CPU telemetry is determined and used to generate a control flow directed graph. After the control flow directed graph is generated, a monitoring phase may be entered where transfers of instruction pointers are monitored based on the control flow directed graph to identify invalid transfers.

The invention discloses a binary airborne application automatic transplantation method and system based on ARINC 653 simulation, and belongs to the technical field of airborne application transplantation. The method comprises the following steps: constructing a real-time operating system simulation running environment according with an ARINC653 standard; analyzing the binary airborne application; creating a transplantation description file based on the analysis result; and performing automatic transplantation in a simulation running environment based on the created transplantation description file. By means of the method, modification-free automatic transplantation of the binary airborne application can be achieved in the system simulation operation environment meeting the ARINC653 standard, a large number of source codes do not need to be manually modified, the time needed by transplantation is greatly shortened, the transplantation efficiency is improved, and the requirements in the avionics system development and maintenance process can be rapidly responded.

The invention discloses a malicious code identification method and device, equipment and a storage medium, and belongs to the technical field of reverse analysis. The method comprises the following steps: running an unknown sample to obtain a running log of the unknown sample; obtaining a decompilation code corresponding to at least one objective function in the unknown sample; wherein the objective function is a function for calling an operating system API service in the operation process of the unknown sample; and based on the running log and the decompilation code corresponding to the target function, identifying whether the target function contains a malicious code or not. According to the method, dynamic analysis and static analysis are combined, more accurate and effective code information can be provided for malicious code recognition, and the accuracy of malicious code recognition is improved. And malicious code identification is only performed on the target function calling the operating system API service in the unknown sample, so that a large amount of invalid analysis can be avoided, and the malicious code identification efficiency is improved.

The application discloses an Android application gray behavior classification method and system, equipment and a storage medium, including obtaining the function call graph of the APK file, inputting the function call graph into a graph embedding neural network model to obtain a graph embedding vector, performing clustering operation on the graph embedding vector to obtain an APK file cluster, performing real machine testing and decompilation on the files in the APK file cluster to obtain the gray behavior category of the files in the file cluster, realizing more comprehensive extraction of the features of the Android installation package, improving the accuracy of the Android application gray behavior classification, and enhancing the security of the Android application.

The invention discloses an application program packaging method and system, and the method comprises the following steps: S1, receiving a packaging request from a user terminal, and generating a packaging task according to the packaging request; s2, dynamically distributing containerized computing resources for the packaging task; s3, in a container corresponding to the allocated computing resources, executing the packaging task to generate an application program installation package; and S4, storing the application program installation package and providing downloading. According to the application, the bottlenecks of a traditional centralized packaging system in the aspects of expansibility, reliability and efficiency are effectively solved, and the method is particularly suitable for scenes such as game issuing and multi-channel issuing which need large-scale and high-frequency application program packaging.

The invention relates to the technical field of network security and software reverse engineering, and discloses a binary function symbol recovery method based on LLM fusion interprocess context. The method comprises the following steps: firstly, extracting multi-dimensional feature information from a target binary function, wherein the multi-dimensional feature information comprises a function body pseudo code, a call point context code snippet, call chain information and a character string parameter transmitted by a call point; then, the multi-dimensional information is structured and constructed into prompts, the prompts are input into a large language model which is finely adjusted by a specific task for reasoning, and finally candidate function names are generated. The invention further discloses an LLM fine tuning technology fusing the multi-dimensional context information. According to the LLM fine tuning technology, efficient parameter fine tuning is carried out on the basic model by constructing a training sample set containing a function body, a calling context and character string parameters. According to the method, the inter-process context information is systematically introduced, so that the accuracy and semantic fitness of binary function symbol recovery are remarkably improved.