Instruction recovery method and system for binary file, electronic equipment and storage medium

Abstract

The invention discloses an instruction recovery method and system for a binary file, electronic equipment and a storage medium. The method comprises the following steps: acquiring an address of a suspected function entry through a data space of the binary file; traversing the program path according to the program control flow path, for a non-traversed part in the program, selecting a next address adjacent to the control flow transfer instruction to continue traversing, and analyzing a first instruction in combination with a predetermined strategy; taking a range between a next address adjacent to the control flow transfer instruction and the address of the first instruction as a function gap, and determining an address of a suspected function entry falling into the function gap as a legal initial address; and disassembling from the legal initial address, and taking the recovered instruction address and the instruction of which the function gap range can be aligned as a recovered second instruction. The correctness of the recognized instruction semantics is ensured, the efficiency of processing the binary file can be improved, and the full-path coverage of the binary file is ensured.

Description

technical field [0001] The present invention relates to the technical field of disassembly, and in particular, to a method, system, electronic device and storage medium for recovering instructions of binary files. Background technique [0002] In the case where the program source code is missing, the binary rewriting technology upgrades the compiled binary file to a higher-level programming language such as assembly language, intermediate representation language (IR), and performs secondary optimization, patching or Security hardening (including binary hardening, profiling, instrumentation, and adding security policies), and the technology of recompiling into binary executables. [0003] The BINCFI technology first uses linear scanning to decode all text segments. For the instructions that have identified errors, find the nearest jump instructions, and take these jump instructions as the end point, and recursively traverse from the starting position of the last decoding. De...

AI Technical Summary

Problems solved by technology

However, its method of constructing input to achieve full coverage of executable files does not guarantee complete coverage

Additionally, dynamic execution also executes duplicate code, which also increases processing overhead in rewrites

[0015] In short, the existing technical means cannot accurately restore all instruction semantics in the binary file, which will affect the correctness of the rewritten executable file

Images