Reverse analysis method for executable binary file format

Abstract

The invention relates to an executable binary file format reverse analysis method, which comprises the following steps of: obtaining the content of an executable binary file, splitting a file structure and repackaging the file structure into component content; collecting method offsets contained in the method component, and cutting the method component by using two adjacent offsets; traversing an instruction for accessing a field variable in the method, and inferring a field type according to the meaning of the instruction; searching a static method and setting the static method as a static state, initializing a method access permission, and linking a method of the interface with a method in the implementation class through an index value; an instruction in the method is executed through stack simulation, the instruction is analyzed to obtain descriptor information of the method, and reverse analysis of the executable binary file is achieved according to the descriptor information of the method. By adopting the executable binary file format reverse analysis method disclosed by the invention, the dependency of a file reverse analysis process on a descriptor component is reduced, a foundation is laid for file format conversion, and the executable binary file format reverse analysis method is wide in application range and high in practicability.

Description

Technical field [0001] The present invention belongs to the field of document analysis techniques, specifically relates to an executable binary file format reverse analysis method. Background [0002] At present, reverse technology has been developed relatively maturely, but it still needs to be adapted to local conditions in the specific application process. When you format convert an executable binary, you need to reverse parse the executable binary file format to restore the file structure. Executable binary structures typically contain constant pool components, class components, method components, export components, descriptor components, and so on. Where the descriptor component records the details of each component, and if the descriptor component exists, the file structure can be restored by reverse engineering. If the descriptor component does not exist, the details of the individual components do not exist, making it more difficult to reverse engineer and make it impossi...

AI Technical Summary

Problems solved by technology

If the descriptor component does not exist, the detailed information of each component does not exist, which increases the difficulty of reverse engineering and cannot directly implement reverse analysis of executable binary files

Images