A Complex Type Refactoring Method Based on Variable Association Tree

Abstract

The invention discloses a complex type reconstruction method based on a variable association tree. The method specifically comprises the following steps: a binary program to be processed is convertedinto an assembler program, and the variable association tree VRT is created for each functional unit in the assembler program; the binary program is converted into an assembler program. Creating a variable address mapping table VAM according to the variable association tree VRT; The final VRT is obtained by updating the attribute information of the node in the variable association tree VRT according to the assembler, and the variable address mapping table VAM is updated at the same time. The variable address mapping table VAM corresponding to the final VRT contains the basic type reconstruction result of the assembler. The operator attribute that identifies the filtered root node is the dereferenced final VRT as the pointer VRT, The complex type of B + C pointer VRT is a structure, and thecomplex type of B + V + C pointer VRT is an array. For B + C pointer VRT and B + V + C pointer VRT, different methods are used to reconstruct the structure and array respectively. This method can realize the rapid and effective complex type reconstruction, and the reconstruction results are more accurate.

Description

technical field [0001] The invention relates to the technical field of software maintenance and safety, in particular to a complex type reconstruction method based on a variable association tree. Background technique [0002] Decompilation is the reverse process of compilation, and its goal is to convert binary code into a high-level language form that is logically and functionally equivalent to it. The structure type of the variable in the source program determines the storage space and usage rules of the variable. However, after the source code is compiled and optimized, the type and debugging information of the program no longer exist, and are replaced by anonymous byte block information. The memory allocation and access forms and their mutual dependencies reflect the type information of variables. With the extensive use of third-party software, for security reasons, more and more software needs to be analyzed to detect whether the software contains vulnerabilities and m...

AI Technical Summary

Problems solved by technology

However, this method cannot avoid the common problem of constraint solving methods, that is, the constraint equation may have no solution or multiple solutions, and this method cannot recover complex variable types.

[0006] In 2007, Ilfak Guilfanov released a decompilation plug-in Hex-Rays for the disassembler IDA Pro, which is a powerful commercial software that can quickly convert 32-bit windows executable programs into source code functions and semantics Valuable C-like code, but can only be used for analysis and not compiled

Although this method can recognize pointers, it generalizes structures, arrays, and pointers without distinction

Images