Static analysis-based Pascal-like binary program structured information extraction method

Abstract

The invention relates to a static analysis-based Pascal-like binary program structured information extraction method, which specifically comprises the following steps of: (1) preliminarily reading basic attributes in a binary file compiled by a Pascal-like by a script and other tools, (2) finding all functions for creating class objects through an obtained construction characteristic function and a control flow analysis technology, and (3) extracting the structured information of the Pascal-like binary program. (3) recursively identifying a member object definition relationship in a binary file and an inheritance relationship between classes by taking a basic object address as a base address and combining a data analysis technology, (4) confirming a corresponding construction function name and a corresponding parameter type and name by combining a result of script automatic generation, and (5) searching a corresponding class interface according to an analysis result, and performing classification and classification on the corresponding construction function. And the code restoration logic is consistent with the original binary file behavior. Accurate restoration of class structures, interfaces and functions is achieved, and therefore the efficiency and accuracy of reverse analysis are improved.

Description

Technical Field

[0001] The present invention relates to an information extraction method, specifically to a Pascal-like binary program structured information extraction method based on static analysis, and in particular to a Pascal-like compiled binary code restoration method based on IDAPython script. The method is oriented to malicious code analysis scenarios and is used to improve the reverse analysis efficiency of complex compiled binary codes. The method belongs to the field of reverse engineering and software security analysis. Background Art

[0002] With the development of computer technology and the widespread use of programming languages, programming languages ​​evolved from Pascal (such as Pascal-like languages) are still widely used in embedded development and specific application scenarios. Many traditional software and malware are still developed using such programming languages. However, due to its compilation characteristics, binary files generated by Pascal-like languages ​​face many challenges in the reverse analysis process. In particular, such binary codes contain a large number of virtual function pointers, and the class and interface structure information is highly abstract, making it difficult for reverse engineers to quickly and accurately understand its logic and behavior, which brings great difficulties to malicious code and virus analysis.

[0003] When security researchers are conducting vulnerability discovery or malware analysis, they usually need to perform reverse analysis on the relevant binaries to extract malicious behavior features or possible vulnerability details by understanding the contextual meaning of the program. In the traditional binary code reverse process, security researchers often use existing binary static analysis tools (such as IDA Pro) to assist in the analysis. Although static analysis tools such as IDA can provide basic decompilation and analysis functions, they have limited support for binary files generated by complex compiled languages ​​(especially structures such as virtual function tables and class inheritance relationships), resulting in incomplete and inaccurate restoration results. This limitation is particularly evident in Pascal-like compiled binaries, which brings great difficulties to malware security analysis and other tasks.

[0004] Among the existing solutions, there are many structured information extraction tools, such as IDR, which are used to perform certain analysis on binaries compiled by Pascal-like languages, thereby assisting security researchers in analysis. However, the implementation of such tools is not complete. They only use the built-in information of such languages, such as built-in variable types, and cooperate with the structured information in the binary program to perform limited restoration of a few interface signatures. The information of the structured analysis of such analysis solutions is not sufficient, and it cannot achieve a good auxiliary analysis effect, especially it cannot locate custom type information, including but not limited to class: function signature, parameter meaning, structure information, etc., resulting in very limited analysis results.

[0005] Existing methods are highly dependent on the integrity of the symbol table or manual intervention, and lack versatility and automation. Therefore, how to restore the class and interface structure in the Pascal-like compiled binary through automation technology, especially through virtual function optimization and data flow analysis to improve the efficiency and accuracy of restoration, has become a focus of reverse engineering and malicious code analysis. Summary of the invention

[0006] The present invention is aimed at the technical problems existing in the prior art and provides a method for extracting structured information of Pascal-like binary programs based on static analysis. The application proposes a solution based on IDAPython script, which can automatically process the class structure, interface implementation and member variable restoration in Pascal-like compiled binaries, effectively improve the analysis efficiency and the accuracy of code understanding, and provide a new technical means for reverse engineering and malicious code analysis.

[0007] Glossary

[0008] Pascal-like languages: refers to a family of languages ​​related to Pascal that support object-oriented programming, including Pascal, Delphi, and Object Pascal. These languages ​​retain the original concise syntax of Pascal and introduce object-oriented features, such as the concepts of class and interface, to support complex software design and modular development.

[0009] Compared with traditional low-level languages ​​(such as C++), compilers of Pascal-like languages ​​retain more symbolic information and structured compilation information when generating binary code, such as function names, class names, and some interface implementations. However, since Pascal-like languages ​​make extensive use of advanced features such as interface inheritance and virtual function tables, the binary files they generate are still very challenging to reverse engineer.

[0010] Virtual function is a mechanism in object-oriented programming to support runtime polymorphism. In a class, a virtual function is bound to a specific instance of an object through a virtual function table (VTable), thereby implementing the function of dynamically dispatching function calls based on the object type. At the compiled binary level, the call path of a virtual function is abstracted as an indirect access to the virtual function table pointer.

[0011] An interface is a special type of abstraction that defines the behavior of a class. The specific implementation is provided by the class that implements the interface. Interfaces are widely used in Pascal-like languages ​​to support multiple inheritance and modular design.

[0012] In reverse engineering, the presence of virtual functions and interfaces significantly increases the difficulty of program flow analysis. Since the call path of virtual functions depends on the dynamic dispatch logic at runtime, it is difficult for reverse analysis tools to accurately restore the call chain without symbol information. In addition, the implementation of interfaces usually introduces a large number of indirect calls and complex inheritance relationships, making the control flow of binary programs difficult to track.

[0013] IDR (Interactive Delphi Reconstructor): is an interactive Delphi reconstructor, aimed at companies or individuals engaged in anti-virus software development, a decompiler for executable files (EXE) and dynamic link libraries (DLL) written in Delphi, helping to recover lost program source code.

[0014] IDA (Interactive Disassembler): is a powerful binary disassembly and analysis tool, widely used in the field of reverse engineering. It can restore binary files to assembly code, provide rich static analysis functions, and help users understand program structure and logic.

[0015] IDA Python: It is a script extension interface provided by IDA, which allows users to use Python programming language to perform more efficient automated analysis of binary files. Through IDA Python, users can access the assembly code, symbol information and control flow of binary files. Read data at a specified address; flexibly extract and operate the data structure of the corresponding address in memory; dynamically define and create structures based on analysis results, and restore the data layout of the program; automatically perform repetitive tasks through scripting, quickly locate key points, and improve reverse engineering efficiency.

[0016] Constructor CreateClass: The present invention discovered in analyzing the Pascal-like code that this type of programming language uses a function called CreateClass to create objects after generating binary. This creation function and its parent function may include a class description address in the parameters.

[0017] Class description address: This address is described as TargetAddress in the present invention. This address records all information of a class, including member variables, virtual function definitions, parent class definitions, interface definitions, etc.

[0018] In order to achieve the above-mentioned purpose, the technical solution of the present invention is as follows: a method for extracting structured information of a Pascal-like binary program based on static analysis, which automatically analyzes key symbols and control flows in Pascal-like binary files, parses and restores class member variables, interface addresses and their associated functions, and reconstructs class inheritance relationships and interface structures based on data segment information, thereby generating pseudocode that is close to the original source code.

[0019] A method for extracting structured information from a Pascal-like binary program based on static analysis, the method comprising the following steps:

[0020] (1) The script and other tools are used to preliminarily read the basic properties of the binary file compiled by the Pascal class, including the definition of some basic properties and common basic information.

[0021] (2) By obtaining the construction feature function and combining it with control flow analysis technology, find all functions that create class objects and confirm the basic object address required to build the class;

[0022] (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table;

[0023] (4) Combined with the results of the automatic script generation, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into a relatively complete C++ code, including the function name, member variables, and dynamically restore the corresponding parameter type.

[0024] (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior.

[0025] The specific method of step (1) is as follows:

[0026] (1.1) Use common analysis tools (Idr.exe) or use public program signature methods to parse the Pascal basic types used in the current binary program;

[0027] (1.2) Import the parsed input into IDA to reduce some redundant analysis content.

[0028] The method for constructing the feature function obtained in step (2) is as follows:

[0029] (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass, and by analyzing the control flow, confirm the address of its parent function or other indirect functions that call this function.

[0030] (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs:

[0031] (2.3) Traverse RawAddrs, use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs.

[0032] The specific method of step (3) is as follows:

[0033] (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, take BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty;

[0034] (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, trace back to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass.

[0035] (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses, where InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for continued use in the later stage;

[0036] (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and preliminarily construct the function;

[0037] (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable

[0038] (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class;

[0039] (3.7) After completing all the analysis, mark the current address as the analyzed class.

[0040] (3.8) Backtrack the subclasses until the class analysis on all processes is completed.

[0041] The specific method of step (4) is as follows:

[0042] (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type

[0043] (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved.

[0044] (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to obtain a complete function definition.

[0045] The specific method of step (5) is as follows:

[0046] (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName

[0047] (5.2) Find the jump table jmp_table, and according to the definition, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code (5.3) Construct a new structure object according to InterfaceName, and set the converted jmp_table as a member in it.

[0048] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for extracting structured information of a Pascal-like binary program based on static analysis is implemented.

[0049] A computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the Pascal-like binary program structured information extraction method based on static analysis.

[0050] Compared with the prior art, the present invention has the following advantages: through the proposed analysis method and steps, the present invention can effectively parse the key information related to the class in the binary file generated by the Pascal class compilation, including function signatures, parameter meanings, class structure members and interface information, etc. Using this information, malware analysts can more easily understand the behavior logic of related malware, which is convenient for better extraction of behavior details.

[0051] The present invention realizes the restoration from binary code to nearly original source code, greatly reducing the difficulty and time cost of reverse analysis; based on the traditional tool methods (such as IDA Pro and IDR) that can only extract interface information and a small number of function names, this solution can not only extract richer structured information in the program through in-depth analysis based on control flow and data segments, but also fully restore the inheritance relationship of the class, class member attributes and virtual function table structure. Using these two technologies, it is possible to optimize the content of manual intervention in software analysis in existing solutions, automatically build virtual function tables and class relationships, thereby greatly saving time costs and improving analysis efficiency.

[0052] This solution automatically extracts and reconstructs the structural information of the class by analyzing the control flow and data segments of the binary file based on the IDAPython script, and transforms the traditional analysis process that relies on manual operations into an efficient automated method. The present invention can analyze programs on different platforms. In actual scenarios, most malware written in Pascal-like languages ​​may run on multiple platforms. By utilizing the compatible analysis capabilities of the IDAPython script, the analysis capabilities of Pascal-like software on different platforms can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A function before script analysis is used;

[0054] Figure 2 For the structured class definition;

[0055] Figure 3 This is the structured function definition;

[0056] Figure 4 It is the structured interface definition;

[0057] Figure 5 This is the result obtained after control flow analysis of the constructor ClassCreate;

[0058] Figure 6 To record the process of recording all valid class addresses TargetAddr;

[0059] Figure 7 The process of class analysis and class creation for recursion;

[0060] Figure 8 The result obtained after analysis. DETAILED DESCRIPTION

[0061] In order to deepen the understanding of the present invention, the present embodiment is described in detail below with reference to the accompanying drawings.

[0062] Example 1: See Figure 1-Figure 8 , the figure shows the analysis process for an existing Pascal-like binary program. Before implementing the invention ( Figure 1 )back( Figure 8 ), the program readability is greatly improved. The implementation method is described below. A method for extracting structured information of a Pascal-like binary program based on static analysis, which automatically analyzes key symbols and control flows in Pascal-like binary files, parses and restores class member variables, interface addresses and their associated functions, and reconstructs class inheritance relationships and interface structures based on data segment information, thereby generating pseudocode close to the original source code. The method includes the following steps:

[0063] (1) Using scripts and other tools, the basic properties of the binary file compiled by Pascal are preliminarily read, including the definition of some basic properties and common basic information;

[0064] (2) By obtaining the construction feature function and combining it with control flow analysis technology, find all functions that create class objects and confirm the basic object address required to build the class;

[0065] (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table;

[0066] (4) Combined with the results of the automatic script generation, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into a relatively complete C++ code, including the function name, member variables, and dynamically restore the corresponding parameter type.

[0067] (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior;

[0068] The specific method of step (1) is as follows:

[0069] (1.1) Use common analysis tools (such as IDR) or public program signatures to parse the basic Pascal types used in the current binary program;

[0070] (1.2) Import the parsed input into IDA to reduce some redundant analysis content;

[0071] The method for constructing the feature function obtained in step (2) is as follows:

[0072] (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass, and by analyzing the control flow, confirm the address of its parent function or other Pascal built-in basic functions for creating classes, such as indirect calls to this function;

[0073] (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs:

[0074] (2.3) Traverse RawAddrs, use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs:

[0075] The specific method of step (3) is as follows:

[0076] (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, take BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty;

[0077] (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, trace back to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass

[0078] (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses, where InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for continued use in the later stage;

[0079] (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and preliminarily construct the function;

[0080] (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable

[0081] (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class;

[0082] (3.7) After completing all the analysis, mark the current address as the analyzed class.

[0083] (3.8) Backtrack the subclasses until the class analysis on all processes is completed.

[0084] The specific method of step (4) is as follows:

[0085] (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type

[0086] (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved.

[0087] (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to get the complete function definition.

[0088] The specific method of step (5) is as follows:

[0089] (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName

[0090] (5.2) Find the jump table jmp_table, and according to the definition, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code

[0091] (5.3) Construct a new structure object based on InterfaceName and set the converted jmp_table as a member in it.

[0092] Embodiment 2:

[0093] In order to better illustrate the steps of the Pascal-like binary program structure information extraction method based on static analysis, we first introduce the key data types and structures extracted from binary programs. Figure 2 , 3 As shown in Figure 4, these key data include class definitions, function definitions, interface definitions, etc. Each type of information occupies a different level in the analysis:

[0094] Function definition: contains information such as the function's return value, parameter name and type, and is used to build the program's functional module.

[0095] Class definition: describes the class's member variables, virtual function table, and inheritance relationships to facilitate restoration of the object-oriented structure.

[0096] Interface definition: stores the interface's UUID, jump table, and interface name, which are used to determine the interface's function binding.

[0097] To explain the implementation process of this method in detail, the extraction and processing of key data in each step are introduced next.

[0098] 1. Analysis of Pascal basic types

[0099] First, use common binary analysis tools (such as IDR) or public program signatures to parse Pascal basic types, and import the parsing results into IDA. This process reduces redundant analysis content and lays the foundation for subsequent analysis.

[0100] 2. Constructing feature functions

[0101] Based on the known Pascal built-in function CreateClass, such as Figure 5 As shown, the address of its parent function or other indirect call base function is confirmed through control flow analysis. After traversing these addresses:

[0102] 1. Extract the data segment address from the passed parameter and record it as RawAddrs;

[0103] 2. Verify that each address in RawAddrs is a valid class base address and store the valid addresses as BaseAddrs.

[0104] The above steps can be referred to as Figure 6 .

[0105] 3. Recursive analysis of class structure

[0106] like Figure 7 As shown, for each BaseAddr, the class analysis and construction is completed recursively:

[0107] 1. Find the parent address ParentAddr and verify its existence;

[0108] 2. If the parent class exists, recursively analyze until the base class is found;

[0109] 3. Extract the class interface definition, member variable address, class name and virtual function address, and gradually build the complete class structure NewClass;

[0110] 4. If there is an inheritance relationship between classes, the class is supplemented and constructed based on the member variables of the parent class;

[0111] 5. Mark the classes that have completed analysis and backtrack to the subclasses until all classes are analyzed.

[0112] 4. Extraction and renaming of function signatures

[0113] like Figure 3 As shown in the figure, the specific process of extracting the function signature includes:

[0114] 1. Traverse all function definition addresses FuncAddr and confirm the return value type and parameter name;

[0115] 2. Verify whether the parameter type is defined. If the type is not defined, the parsing is completed by recursive analysis of the class structure.

[0116] 3. Associate the parsed function with the class name, update the function signature, and rename the remaining member variables.

[0117] 5. Extraction and processing of interface definitions

[0118] like Figure 4 As shown, when analyzing the interface, first extract the interface's UUID, jump table address jmp_table, and interface name InterfaceName:

[0119] 1. According to the definition of jmp_table, parse the jump address and control flow information stored in it;

[0120] 2. Construct a new structure object to store the jmp_table content and other member variables of the interface to describe the interface functions.

[0121] After the script is finished running, you can see the analyzed content as follows Figure 8 At this point, most of the program logic is very clear, and the virtual function table has been made public. At this point, it is easy to confirm the next calling function by adding the address and offset.

[0122] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. A method for extracting structured information from Pascal-like binary programs based on static analysis, characterized in that: The method comprises the following steps: (1) The script and other tools are used to preliminarily read the basic properties of the binary file compiled by the Pascal class, including the definition of some basic properties and common basic information. (2) By obtaining the construction feature function and combining it with control flow analysis technology, find all functions that create class objects and confirm the basic object address required to build the class. (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table. (4) Combined with the results of the script's automatic generation, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into relatively complete C++ codes, including function names and member variables, and dynamically restore the corresponding parameter types. (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior.

2. The method for extracting structured information from a Pascal-like binary program based on static analysis according to claim 1, characterized in that: The specific method of step (1) is as follows: (1.1) Use the common analysis tool IDR or the public program signature method to parse the Pascal basic types used in the current binary program; (1.2) Import the parsed input into IDA to reduce some redundant analysis content.

3. The method for extracting structured information from a Pascal-like binary program based on static analysis according to claim 1, characterized in that: The method for constructing the feature function obtained in step (2) is as follows: (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass, and by analyzing the control flow, confirm the address of its parent function or other indirect functions that call this function. (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs: (2.3) Traverse RawAddrs, use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs.

4. The method for extracting structured information from a Pascal-like binary program based on static analysis according to claim 1, characterized in that: The specific method of step (3) is as follows: (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, take BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty; (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, trace back to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses, where InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for continued use in the later stage; (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and preliminarily construct the function; (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class; (3.7) After all analysis is completed, mark the current address as the analyzed class. (3.8) Backtrack the subclasses until the class analysis on all processes is completed.

5. The method for extracting structured information from a Pascal-like binary program based on static analysis according to claim 1, characterized in that: The specific method of step (4) is as follows: (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved. (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to obtain a complete function definition.

6. The method for extracting structured information from a Pascal-like binary program based on static analysis according to claim 1, characterized in that: The specific method of step (5) is as follows: (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName (5.2) Find the jump table jmp_table, and according to the definition, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code (5.3) Construct a new structure object based on InterfaceName and set the converted jmp_table as a member in it.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for extracting structural information of a Pascal-like binary program based on static analysis as described in any one of claims 1 to 6 above is implemented.

8. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by a processor, the method for extracting structured information of a Pascal-like binary program based on static analysis as described in any one of claims 1 to 6 is implemented.

Images