Large binary firmware parameter number identification method under simplified instruction set

Abstract

The invention discloses a large-scale binary firmware parameter number identification method under a simplified instruction set, which is used for carrying out static analysis on the whole large-scalebinary firmware, and comprises the following steps of: firstly, extracting a calling relationship of a function, and designing a function parameter number identification method based on a voting mechanism according to the calling relationship of the function and a parameter transfer rule; and identifying the number of parameters of the functiond, so that subsequent function prototype recovery isfacilitated. According to the method, the executable code of the whole binary firmware is statically analyzed to obtain the global function call relationship, each function call is analyzed to obtainthe number of the parameters of the sub-function, and the most accurate number of the function parameters is obtained according to the voting mechanism, so that the influence of compiler optimizationis avoided, the accuracy of function parameter number recognition is improved, and the method has good applicability.

Description

technical field [0001] The invention belongs to the technical field of binary firmware parameter analysis, and in particular relates to a method for identifying the number of large binary firmware parameters under a simplified instruction set. Background technique [0002] Binary analysis is of great significance in security research, and its applications in security analysis mainly include: binary code audit, control flow integrity analysis, taint analysis, symbolic execution, vulnerability repair, code reuse, vulnerability mining, etc. In a high-level language, information such as the function name, the number of parameters of the function, the parameter type, and the return value of the function can effectively help understand the function of the function. After the source code is compiled by the compiler, information such as data type, data structure, semantics and control structure in the high-level language C / C++ is lost, which has caused many obstacles for researchers...

AI Technical Summary

Problems solved by technology

However, because dynamic analysis cannot obtain comprehensive information, the recognition effect is poor

[0005] Khaled et al. proposed a method for rewriting binary programs under the x86 instruction set, and proposed a recovery method for function prototypes. This method analyzes the parameters of functions by improving VSA (Value Set Analysis), which is better for small applications. But it is less effective for large binary programs, and it is not stated whether it is suitable for RISC

[0006] radare2 is the latest binary analysis tool. It has powerful analysis functions and supports disassembly of languages ​​with different architectures. In the "aaa" command, it realizes the function of analyzing binary functions. When analyzing, it is found that the recognition effect of the number of function parameters is relatively poor

Images