Instruction recovery method and system for binary files, electronic device and storage medium

Abstract

A binary file instruction recovery method, system, electronic device and storage medium, the method obtains the address of the suspected function entry through the data space of the binary file; traverses the program path according to the program control flow path, for the part not traversed in the program, the next address adjacent to the control flow transfer instruction is selected to continue the traversal, and the first instruction is analyzed combined with the predetermined strategy; the range between the next address adjacent to the control flow transfer instruction and the address of the first instruction is taken as the function gap, and the address of the suspected function entry falling into the function gap is determined as the legal starting address; starting from the legal starting address, the instructions whose addresses can be aligned with the function gap range are taken as the recovered second instructions. The correctness of the identified instruction semantics is guaranteed, and the efficiency of processing the binary file and the full path coverage of the binary file can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of disassembly, in particular to a binary file instruction recovery method and system, an electronic device and a storage medium. BACKGROUND

[0002] In the case of missing program source code, binary rewriting technology is a technology that improves the compiled binary file to a higher programming language such as assembly language or intermediate representation (IR), and performs secondary optimization, repair or security enhancement (including binary enhancement, Profiling, patching and adding security policies), and then compiles it into a binary executable file again.

[0003] The BINCFI technology first decodes all text segments using linear scanning. For the instructions that are incorrectly identified, the nearest jump instruction is found, and these jump instructions are used as the end point. The decoding is recursively traversed from the start position of the last decoding to verify whether there will be errors again. If there are errors again, the technology selects the jump instruction closest to the error position again, and again uses the selected instruction as the end point instruction, and decodes from the start position again until no new error decoding occurs.

[0004] Secondwrite uses a speculative execution decoding method to decode the unrecognized area of the executable file. It believes that if the recognized area is data, the generated instructions after decoding will not be executed by the rewritten binary file, and if it is an instruction, it can ensure that the rewritten binary file executes the instruction in the unrecognized area. Therefore, its method guarantees coverage.

[0005] The MULTIVERSE technology decodes each offset position in the text segment to recover the instruction semantics. When encountering 1) illegal instruction encoding; 2) already decoded offset length; 3) end of bytecode sequence, stop decoding and start decoding from the next byte offset, until all byte offsets are iterated, and then map all recognized assembly instructions addresses in a mapping table for easy lookup of appropriate instructions when the rewritten binary program runs.

[0006] BinRec uses dynamically executed instructions as legal instructions for instruction semantic recovery. This technology uses symbolic execution, specific inputs and fuzz testing to construct multiple inputs to cover as many paths of the binary program as possible. This technology can accurately decode binary instructions on the execution path.

[0007] Defects of BINCFI technology:

[0008] BINCFI considers that the mixed data in the instruction will cause the generation of incorrect instructions, so it bypasses the mixed data by identifying the upper and lower bounds of the incorrect instructions, thereby realizing accurate instruction semantic recovery. However, the method of marking the correctly decoded instructions by searching for control flow transfer instructions is not accurate. Because there are some data that will not be decoded incorrectly, which leads to the fact that the technology cannot accurately recover the instruction semantics. Therefore, the technology cannot guarantee the correctness of the identified instructions.

[0009] The defects of the SecondWrite technology are as follows:

[0010] The SecondWrite forcibly performs instruction semantic recovery on the area that it does not identify. It considers that if the recovered area is data, it will not be executed by the rewritten executable file, and if it is an instruction, it can be directly executed. However, it ignores the fact that the data decoded as instructions may affect the decoding of normal instructions. Therefore, the technology cannot guarantee the correctness of the instruction semantic recovery.

[0011] The defects of the MULTIVERSE technology are as follows:

[0012] The MULTIVERSE identifies all possible legal instructions by taking each byte in the binary file as the starting address of an instruction. Although this technology can completely recover all correct instruction semantics, it will also generate a large number of redundant illegal instructions, increasing the space loss of the rewritten binary file.

[0013] The defects of the BinRec technology are as follows:

[0014] BinRec ensures the correctness of instruction semantic recovery by directly decoding the bytes encountered during execution as instructions. However, the method of constructing input to achieve full coverage of the executable file cannot guarantee complete coverage. In addition, dynamic execution will also execute repeated code, which will increase the processing overhead in rewriting.

[0015] In summary, existing technology cannot accurately recover all instruction semantics in the binary file, which will affect the correctness of the rewritten executable file. SUMMARY

[0016] The purpose of the present application is to provide a binary file instruction recovery method, system, electronic device and storage medium, and some embodiments can be used to solve the defect that it is difficult to accurately recover the instruction semantics in the binary rewriting technology in the prior art, to realize accurate recovery of all legal instruction semantics in the binary file, and to meet various needs of binary program rewriting.

[0017] The binary file instruction recovery method provided by the present application comprises:

[0018] acquiring the address of the suspected function entry through the data space of the binary file;

[0019] traversing the program path according to the program control flow path, for the part not traversed in the program, selecting the next address immediately next to the control flow transfer instruction to continue the traversal, and analyzing the first instruction in combination with a predetermined strategy;

[0020] taking the range between the next address immediately next to the control flow transfer instruction and the address of the first instruction as a function gap, and determining the address of the suspected function entry falling into the function gap as a legal starting address;

[0021] starting disassembling from the legal starting address, and taking the instruction capable of being aligned with the recovered instruction address and the function gap range as a recovered second instruction.

[0022] According to the binary file instruction recovery method provided by the application, the address of the suspected function entry is acquired through the data space of the binary file, and the method comprises the following steps:

[0023] performing a load operation on each offset address of the data space of the binary file to obtain the memory value of each offset address;

[0024] taking the memory value falling into the code space range of the binary file as the address of the suspected function entry.

[0025] According to the binary file instruction recovery method provided by the application, the disassembling is started from the legal starting address, and the method comprises the following steps:

[0026] performing linear scanning decoding from the legal starting address within the function gap range to recover the instruction.

[0027] According to the binary file instruction recovery method provided by the application, the first instruction is analyzed in combination with a predetermined strategy, and the method comprises the following steps:

[0028] the address of the first instruction is determined through register def-use relationship analysis, illegal jump target determination and bad instruction identification.

[0029] According to the binary file instruction recovery method provided by the application, the program path is traversed according to the program control flow path, and the method comprises the following steps:

[0030] for the unexplored region of the binary file, the next address immediately next to the control flow transfer instruction is taken as an entry address to perform the traversal.

[0031] The application further provides a binary file instruction recovery system, and the system comprises:

[0032] The function entry acquisition module acquires the address of the suspected function entry through the data space of the binary file.

[0033] The first disassembly module traverses the program path according to the program control flow path, and for the part not traversed in the program, the next address adjacent to the control flow transfer instruction is selected to continue the traversal, and the first instruction is analyzed according to a predetermined strategy.

[0034] The matching module takes the range between the next address adjacent to the control flow transfer instruction and the address of the first instruction as a function gap, and determines the address of the suspected function entry falling into the function gap as a legal starting address.

[0035] The second disassembly module disassembles from the legal starting address, and takes the instruction that can be aligned with the function gap range as the recovered second instruction.

[0036] The application further provides an electronic device, including a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the binary file instruction recovery method according to any one of the above.

[0037] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executable on a processor to implement the steps of the binary file instruction recovery method according to any one of the above.

[0038] The application further provides a computer program product, which includes a computer program, and the computer program is executable on a processor to implement the steps of the binary file instruction recovery method according to any one of the above.

[0039] The binary file instruction recovery method, system, electronic device and storage medium provided by the application can accurately recover all legal instruction semantics in a binary file through a practical method, ensure the correctness of the identified instruction semantics, improve the efficiency of processing the binary file and ensure full path coverage of the binary file. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0041] Figure 1A flowchart of the instruction recovery method of the binary file provided by the present application is shown in the figure;

[0042] Figure 2 A principle diagram of the instruction recovery method of the binary file provided by the present application is shown in the figure;

[0043] Figure 3 A function entry address storage space distribution diagram provided by the present application is shown in the figure;

[0044] Figure 4 A structure diagram of the instruction recovery system of the binary file provided by the present application is shown in the figure;

[0045] Figure 5 A physical structure diagram of an electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0047] The binary file instruction recovery method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings and specific embodiments and application scenarios.

[0048] Figure 1 A flowchart of the instruction recovery method of the binary file provided by the present application is shown in the figure, Figure 2 A principle diagram of the instruction recovery method of the binary file provided by the present application is shown in the figure, as shown in Figure 1 and 2 The present application provides a binary file instruction recovery method, which comprises the following steps:

[0049] Step 100: obtaining the address of a suspected function entry through the data space of a binary file;

[0050] It should be noted that the binary file is an executable file, and the executable file in the ELF format is taken as an example. Each executable file comprises a data segment (.data) and a code segment (.text), which correspond to the data space and the code space, respectively;

[0051] Step 200: traversing the program path according to the program control flow path, for the part of the program that has not been traversed, selecting the next address immediately after the control flow transfer instruction to continue the traversal, and analyzing the first instruction in combination with a predetermined strategy;

[0052] It should be noted that the program path is traversed according to the program control flow path, that is, recursively from the starting address of the executable file;

[0053] Step 300, taking the range between the immediately next address of the control flow transfer instruction and the address of the first instruction as a function gap, determining the address of the suspected function entry falling into the function gap as a legal starting address;

[0054] Optionally, the range between the immediately next address (i.e. fall-through address) of the control flow transfer instruction and the legal first instruction address identified in step 200 is identified as an overestimated function gap.

[0055] Step 400, starting from the legal starting address, disassembling, and taking the instruction that can be aligned with the recovered instruction address and the function gap range as the recovered second instruction.

[0056] The embodiment can accurately recover all legal instruction semantics in the binary file by providing a practical method, ensures the correctness of the identified instruction semantics, and can improve the efficiency of processing the binary file and ensure full path coverage of the binary file. The identification scheme of the overestimated function gap is combined with the address of the suspected function entry, so that the false positive of the screened entry is low, and the instruction semantics in the binary file can be accurately recovered without complex identification calculation process. Therefore, the false positive rate of the scheme is very low, and compared with other technologies, it brings very low processing overhead and space overhead.

[0057] Further, in another embodiment, the embodiment provides a binary file instruction recovery method, which obtains the address of the suspected function entry through the data space of the binary file, comprising:

[0058] Performing a load operation on each offset address of the data space of the binary file to obtain the memory value of each offset address;

[0059] Taking the memory value falling into the code space range of the binary file as the address of the suspected function entry.

[0060] It should be noted that the present application classifies the function entry addresses according to the storage space and the calculation generation mode by deconstructing the executable file, and respectively stores the function addresses in the code space and the function addresses in the data space. Figure 3 The function entry address storage space distribution diagram provided by the present application is as follows: Figure 3As shown, the function entry address value in the code space can be directly decoded in the control flow traversal, but the function entry address value in the data space cannot be accurately obtained due to the uncertain storage space position. Therefore, the present application performs a load operation on each offset address in the data segment of the executable file, and screens out the addresses of the suspected function entries whose memory values are in the code space range. For a 32-bit operating system, the byte width of the load is 4 bytes, and for a 64-bit operating system, the byte width of the load is 8 bytes.

[0061] The present embodiment creatively proposes the load operation on each offset in the data space, so that all potential function entry addresses in the data space can be identified, and the losslessness of the entry address identification is ensured.

[0062] Further, in another embodiment, the present embodiment provides a binary file instruction recovery method, which starts from the legal start address and includes:

[0063] In the function gap range, the instructions are recovered by linear scanning decoding from the legal start address.

[0064] It should be noted that the linear scanning is a disassembly algorithm, and windbg is an example of using this disassembly algorithm, and the specific steps are as follows:

[0065] A. The position pointer lpStart points to the start of the code segment;

[0066] B. Start matching instructions from the lpStart position, and obtain the instruction length n;

[0067] C. If B is successful, disassemble (Intel style or AT&T style) n data after lpStart; if it fails, exit;

[0068] D. The position pointer lpStart is assigned as lpStart+n, that is, the end of the previous instruction;

[0069] E. Determine whether lpStart exceeds the end of the code segment, and if it does, end. If it does not, enter B process.

[0070] The present embodiment recovers the instructions by linear scanning decoding from the legal start address in the function gap range.

[0071] Further, in another embodiment, the present embodiment provides a binary file instruction recovery method, which analyzes the first instruction in combination with a predetermined strategy, including:

[0072] The address of the first instruction is determined by register def-use relationship analysis, illegal jump target determination and bad instruction identification.

[0073] It should be noted that the def-use relationship is a conventional relationship, and any executable file generated by a compiler has this relationship, the register def-use relationship refers to that when a register is used as an operand of an instruction, there must be an initialization assignment operation on the register; the illegal jump target determination refers to judging whether the jump is illegal according to whether the address of the jump target is within the address range of the code space; the bad instruction refers to that the recovered instruction is illegal, and the disassembler uses the word bad to indicate.

[0074] The embodiment determines the address of the legal first instruction by register def-use relationship analysis, illegal jump target determination and bad instruction identification, and the present application only needs to perform semantic behavior analysis on a small part of instructions (the first instruction) and does not need to analyze the semantics of all the recovered instructions, so that the scheme of the present application reduces the processing overhead of other technologies.

[0075] Further, in another embodiment, the present application provides a binary file instruction recovery method, which traverses the program path according to the program control flow path, comprising:

[0076] For the unexplored area of the binary file, the next address adjacent to the control flow transfer instruction is taken as an entry address for traversal.

[0077] Optionally, for the unexplored area of the executable file, the next address adjacent to the control flow transfer instruction (fall-through address) is forcibly taken as a new entry address for traversal.

[0078] The embodiment takes the next address adjacent to the control flow transfer instruction as an entry address for traversal, and realizes the coverage of the instruction decoding of the unexplored area.

[0079] The binary file instruction recovery system provided by the present application is described below, and the binary file instruction recovery system described below can be correspondingly referred to the binary file instruction recovery method described above.

[0080] Figure 4 The structure diagram of the binary file instruction recovery system provided by the present application is shown in Figure 4 The present application also provides a binary file instruction recovery system, which comprises:

[0081] The function entry acquisition module acquires the address of the suspected function entry from the data space of the binary file.

[0082] The first disassembling module traverses the program path according to the program control flow path, for the part not traversed in the program, the next address adjacent to the control flow transfer instruction is selected to continue the traversal, and the first instruction is analyzed according to a predetermined strategy;

[0083] The matching module takes the range between the next address adjacent to the control flow transfer instruction and the address of the first instruction as a function gap, and determines the address of the suspected function entry falling into the function gap as a legal starting address;

[0084] The second disassembling module starts disassembling from the legal starting address, and takes the instruction capable of being aligned with the function gap range as the recovered second instruction.

[0085] The embodiment can accurately recover all legal instruction semantics in a binary file, ensure the correctness of the identified instruction semantics, improve the efficiency of processing the binary file, and ensure full path coverage of the binary file.

[0086] The application can accurately recover all legal instruction semantics in a binary file, can perfectly cope with various requirements of binary program rewriting, and realizes two instruction semantic recovery modes: 1) converting the instruction into an architecture-independent IR, which can reduce the difficulty of binary analysis technology; 2) converting the binary stream into an assembly instruction, which has the characteristics of low space overhead. In the experiment, an approximate ideal reference environment is constructed, in which the application can completely recover all legal instructions in the binary file, and the error recognition rate of the instruction is not more than 1%. Compared with the same type of specific technology, the number of illegal instructions generated by decoding the binary file is greatly reduced, and the processing efficiency is improved.

[0087] The application executes the rewritten program and the original program respectively, and adopts a default parameter configuration. The experimental results show that the results output by the rewritten program and the results output by the original version program are the same, and their behaviors in the execution process are also consistent. Therefore, the application effectively solves the problem of binary rewriting instruction semantic recovery, and realizes the accuracy and integrity of the rewriting technology.

[0088] Figure 5 An entity structure schematic diagram of an electronic device provided by the application is shown in Figure 5As shown, the electronic device can include a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 complete mutual communication through the communications bus 840. The processor 810 can invoke a logical instruction in the memory 830 to execute an instruction recovery method of a binary file, which includes:

[0089] Obtaining an address of a suspected function entry through a data space of the binary file;

[0090] Traversing a program path according to a program control flow path, for a part not traversed in the program, selecting a next address immediately following a control flow transfer instruction to continue traversing, and analyzing a first instruction according to a predetermined strategy;

[0091] Taking a range between the next address immediately following the control flow transfer instruction and an address of the first instruction as a function gap, and determining an address of a suspected function entry falling into the function gap as a legal starting address;

[0092] Starting disassembly from the legal starting address, and taking an instruction that can be aligned with the recovered instruction address and the function gap range as a recovered second instruction.

[0093] In addition, the logical instruction in the memory 830 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0094] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the instruction recovery method of a binary file provided by the above-mentioned methods, which includes:

[0095] Obtain the address of the suspected function entry from the data space of the binary file;

[0096] Traverse the program path according to the program control flow path, for the part not traversed in the program, select the next address of the control flow transfer instruction to continue the traversal, and analyze the first instruction in combination with a predetermined strategy;

[0097] Take the range between the next address of the control flow transfer instruction and the address of the first instruction as a function gap, and determine the address of the suspected function entry falling into the function gap as a legal starting address;

[0098] Start disassembling from the legal starting address, and take the instruction that can be aligned with the function gap range and the recovered instruction address as a recovered second instruction.

[0099] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned provided binary file instruction recovery method, and the method comprises:

[0100] Obtain the address of the suspected function entry from the data space of the binary file;

[0101] Traverse the program path according to the program control flow path, for the part not traversed in the program, select the next address of the control flow transfer instruction to continue the traversal, and analyze the first instruction in combination with a predetermined strategy;

[0102] Take the range between the next address of the control flow transfer instruction and the address of the first instruction as a function gap, and determine the address of the suspected function entry falling into the function gap as a legal starting address;

[0103] Start disassembling from the legal starting address, and take the instruction that can be aligned with the function gap range and the recovered instruction address as a recovered second instruction.

[0104] The apparatus embodiments described above are only schematic, wherein the units shown as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, may be located in one place or distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0105] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0106] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for recovering instructions from a binary file, characterized in that, The method includes: Obtain the address of the suspected function entry point by examining the data space of the binary file; Traverse the program path according to the program control flow path. For the parts of the program that have not been traversed, select the next address immediately adjacent to the control flow transfer instruction to continue traversing, and analyze the first instruction in combination with the predetermined strategy. The range between the address immediately following the control flow transfer instruction and the address of the first instruction is used as the function gap, and the address of the suspected function entry point falling into the function gap is determined as the legal starting address; Disassembly begins from a valid starting address, and instructions whose addresses and function gap ranges can be aligned are used as the second instruction to be recovered. The step of obtaining the address of a suspected function entry point through the data space of a binary file includes: Load the memory value at each offset address in the data space of the binary file. The memory value falling within the code space range of the binary file is used as the address of the suspected function entry point; The first instruction is derived by combining a predetermined strategy, including: The address of the first instruction is determined by analyzing the register def-use relationship, identifying illegal jump targets, and recognizing bad instructions. The data space is the data segment of the binary file, and the code space is the code segment of the binary file.

2. The binary file instruction recovery method according to claim 1, characterized in that, The disassembly starting from a valid starting address includes: Within the function gap range, the instruction is recovered by performing a linear scan decoding from a valid starting address.

3. The binary file instruction recovery method according to claim 1, characterized in that, The process of traversing the program path according to the program control flow path includes: For unexplored regions of a binary file, the next address immediately following the control flow transfer instruction is used as the entry address for traversal.

4. A binary file instruction recovery system, characterized in that, The system includes: A function entry point acquisition module, which obtains the address of a suspected function entry point through the data space of a binary file; The first disassembly module traverses the program path according to the program control flow path. For the untraversed parts of the program, it selects the next address immediately adjacent to the control flow transfer instruction to continue traversing and analyzes the first instruction in combination with a predetermined strategy. The matching module uses the range between the address immediately following the control flow transfer instruction and the address of the first instruction as a function gap, and determines the address of the suspected function entry point falling into the function gap as a valid starting address. The second disassembler module starts disassembling from a valid starting address and takes the instructions whose addresses and function gap ranges can be aligned as the recovered instructions as the recovered second instructions. The step of obtaining the address of a suspected function entry point through the data space of a binary file includes: Load the memory value at each offset address in the data space of the binary file. The memory value falling within the code space range of the binary file is used as the address of the suspected function entry point; The first instruction is derived by combining a predetermined strategy, including: The address of the first instruction is determined by analyzing the register def-use relationship, identifying illegal jump targets, and recognizing bad instructions. The data space is the data segment of the binary file, and the code space is the code segment of the binary file.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the instruction recovery method for binary files as described in any one of claims 1-3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the instruction recovery method for binary files as described in any one of claims 1-3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the instruction recovery method for binary files as described in any one of claims 1-3.

Images