Optimized code decompiling method and system based on deep learning

Abstract

The invention relates to an optimized code decompiling method and system based on deep learning. The method comprises the following steps: acquiring a low-level intermediate language LIR and a high-level intermediate language HIR by utilizing a low-level programming language LPL and a high-level programming language HPL to serve as a training data set; training a deep learning model by using the training data set, learning a mapping rule between the LIR and the HIR, and translating the LIR of the LPL to be decompiled into the HIR by using the trained deep learning model; performing data stream recovery and control structure recovery on the HIR obtained by the deep learning model to generate an HPL code; and searching an active code similar to the generated HPL code by utilizing a similarity matching algorithm, and migrating semantic information in the active code into the generated HPL code. According to the method, the LPL can be automatically converted into the HPL, and high accuracy is achieved for optimized and unoptimized binary decompilation.

Description

technical field [0001] The invention belongs to the technical fields of software technology and information security, relates to software reverse engineering technology, and in particular relates to a deep learning-based optimized code decompilation method and system. Background technique [0002] Compilation is usually the translation of a computer program written in a high-level language (such as C / C++) into a low-level language (such as assembly language or machine code), that is, running on the target CPU (such as X86, ARM). Due to differences between the two PLs (programming languages), unnecessary information (eg variable / function names) is often removed. Also, in this process, optimization techniques aim to minimize or maximize certain properties of an executable program, such as reducing the program's execution time, memory usage, storage size, etc. Note that the execution result of the optimized target program should be the same as the unoptimized original program....

AI Technical Summary

Problems solved by technology

However, the known instruction sets are very diverse, and often require significant analyst effort (e.g., several years of development) to summarize the rules

Worse, frequent changes in decompilation rules due to changes in compilation / optimization strategies mean that analysts have to constantly change their previously generated rules

This process is time-consuming and error-prone, as rules are likely to collide (especially with many legacy rules)

Images