Large binary firmware parameter number identification method under simplified instruction set

A technology that simplifies instruction sets and firmware parameters. It is applied in software maintenance/management, program code conversion, reverse engineering, etc. It can solve problems such as poor recognition effect, unexplained simplification of instruction sets, and poor processing of large binary programs. The effect of accuracy

CN112068883AActive Publication Date: 2020-12-11PLA STRATEGIC SUPPORT FORCE INFORMATION ENG UNIV PLA SSF IEU
7 Cites 2 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Publication Date
2020-12-11

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a large-scale binary firmware parameter number identification method under a simplified instruction set, which is used for carrying out static analysis on the whole large-scalebinary firmware, and comprises the following steps of: firstly, extracting a calling relationship of a function, and designing a function parameter number identification method based on a voting mechanism according to the calling relationship of the function and a parameter transfer rule; and identifying the number of parameters of the functiond, so that subsequent function prototype recovery isfacilitated. According to the method, the executable code of the whole binary firmware is statically analyzed to obtain the global function call relationship, each function call is analyzed to obtainthe number of the parameters of the sub-function, and the most accurate number of the function parameters is obtained according to the voting mechanism, so that the influence of compiler optimizationis avoided, the accuracy of function parameter number recognition is improved, and the method has good applicability.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention belongs to the technical field of binary firmware parameter analysis, and in particular relates to a method for identifying the number of large binary firmware parameters under a simplified instruction set. Background technique

[0002] Binary analysis is of great significance in security research, and its applications in security analysis mainly include: binary code audit, control flow integrity analysis, taint analysis, symbolic execution, vulnerability repair, code reuse, vulnerability mining, etc. In a high-level language, information such as the function name, the number of parameters of the function, the parameter type, and the return value of the function can effectively help understand the function of the function. After the source code is compiled by the compiler, information such as data type, data structure, semantics and control structure in the high-level language C / C++ is lost, which has caused many obstacles for researchers...

Examples

Embodiment 1

[0038] Embodiment 1: This embodiment aims to make up for the poor recognition effect of existing methods, and provides a method for identifying the number of parameters suitable for binary programs under a large reduced instruction set. By performing static analysis on large binary programs, the function calls are extracted Relationships and parameter passing, and identify the number of parameters based on the voting mechanism by analyzing all calls, thereby identifying the number of parameters of the binary function.

[0039] The overall flowchart of the Findargs method is as follows figure 1 As shown, by performing static analysis on large-scale streamlined binary files and identifying the number of function parameters, static analysis is more comprehensive than dynamic analysis, so the combination of the proposed Findargs has a higher accuracy rate. The processing flow is: first extract the binary executable instructions according to the header information of the executable...