Analysis method and system based on confused PASS in LLVM

Abstract

The invention provides an analysis method and system based on confused PASS in LLVM, and relates to the technical field of software protection. The method comprises the following steps: extracting a target function from a confused binary program, positioning the position of an encrypted character string in the target function, and determining decryption logic according to the position of the encrypted character string; searching a target expression in the target function, identifying expression logic through a mode matching mode, and determining character string encryption algorithm parameters based on decryption logic and the expression logic; constructing a control flow diagram according to the expression logic, identifying control variables in the control flow diagram, and generating a state conversion diagram of the control variables according to an assignment sequence of the control variables; and identifying an identifier of a useless basic block in the target function according to the state transition diagram, and determining obfuscation implementation logic of the obfuscated binary program based on the character string encryption algorithm parameter and the identifier of the useless basic block. According to the technical scheme provided by the invention, reverse derivation of the confusion implementation logic can be realized.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of software protection technology, and more particularly to an analysis method and system based on an obfuscated PASS in LLVM. Background Art

[0002] In the field of software protection, obfuscation technology is widely used to protect binary programs from reverse engineering and unauthorized access. In particular, with the application of obfuscation passes in compilers such as the Low Level Virtual Machine (LLVM), the protection of binary programs has been enhanced. The obfuscation pass can perform a variety of transformations on the original binary program, including string encryption, control flow flattening, false control flow insertion, etc., which makes decompilation and understanding extremely difficult. However, this protection also poses challenges to legitimate security research and software maintenance, because even legitimate users may need to understand and analyze these highly obfuscated binary programs.

[0003] In the prior art, in order to understand highly obfuscated binary programs, deobfuscation methods are commonly used. Deobfuscation methods mainly rely on directly analyzing the obfuscated binary code and trying to restore its original logic. There are three specific approaches: (1) Static analysis: identifying and decrypting strings, restoring control flow, etc. by analyzing the structure and content of binary files. (2) Dynamic analysis: executing binary programs and monitoring their runtime behavior to collect information to help restore to the original binary program. (3) Pattern-based deobfuscation: using known obfuscation patterns, designing special algorithms to automatically remove obfuscation effects. Although these methods can alleviate the impact of obfuscation to a certain extent, they each have limitations: for complex obfuscation techniques, especially those involving high-level control flow transformations or large amounts of useless code insertion, it is difficult to fully understand the structure of the obfuscated code by static analysis alone. Although dynamic analysis can provide more precise information, it usually only covers a limited number of execution paths and may be affected by environmental factors. Pattern-based deobfuscation is highly dependent on a pre-defined obfuscation pattern library and is not very effective when facing new or customized obfuscation strategies.

[0004] Therefore, most existing anti-obfuscation methods focus on eliminating the results of obfuscation, which often results in them being unable to effectively deal with new obfuscation techniques. Obfuscation techniques are constantly evolving, and once new obfuscation methods or updated versions appear, existing anti-obfuscation methods may immediately become ineffective. Therefore, although current anti-obfuscation techniques can help restore some of the original logic of obfuscated code in some cases, they still face significant challenges in combating modern obfuscation techniques due to the above limitations. Summary of the invention

[0005] The embodiments of the present application provide an analysis method and system based on the obfuscation PASS in LLVM, so as to solve the problem of poor binary program analysis effect caused by poor anti-obfuscation accuracy in the prior art.

[0006] In a first aspect, an embodiment of the present application provides an analysis method based on an obfuscated PASS in LLVM, comprising: extracting a target function from an obfuscated binary program, locating a position of an encrypted string in the target function, and determining a decryption logic according to the position of the encrypted string, wherein the decryption logic includes a decryption algorithm parameter; Searching for a target expression in the target function, identifying the expression logic by pattern matching, and determining string encryption algorithm parameters based on the decryption logic and the expression logic, wherein the target expression includes a combination of arithmetic operations, logical operations, and bit operations; Constructing a control flow graph according to the expression logic, identifying control variables in the control flow graph, and generating a state transition graph of the control variables according to the assignment sequence of the control variables; The identifier of the useless basic block in the target function is identified according to the state transition diagram, and the obfuscation implementation logic of the obfuscated binary program is determined based on the string encryption algorithm parameters and the identifier of the useless basic block. The useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

[0007] Optionally, the expression logic includes jump relations between instructions in a basic block, jump relations between basic blocks, strongly connected components and branch structures, and constructing a control flow graph according to the expression logic, identifying control variables in the control flow graph, and generating a state transition graph of the control variables according to an assignment sequence of the control variables, includes: Based on the first instruction sequence in the target expression, divide the first instruction sequence into a plurality of basic blocks according to a preset division rule, count the number of the basic blocks, and use the number of instructions contained in each basic block as the size of the basic block; In each of the basic blocks, searching for jump instructions between instructions to determine the jump relationship between the instructions, traversing all the basic blocks, searching for jump instructions from one basic block to another basic block to determine the jump relationship between the basic blocks; constructing an initial structure diagram based on the number of the basic blocks, the size of the basic blocks, the jump relationship between the instructions, and the jump relationship between the basic blocks; Identify strongly connected components in the initial structure graph, optimize the strongly connected components to obtain an intermediate structure graph, assign a corresponding weight to each edge in the intermediate structure graph to obtain a weighted intermediate structure graph, wherein the strongly connected components are a cyclic structure composed of mutually reachable basic blocks; Identify the branch structure in the weighted intermediate structure graph, and adjust the weights of corresponding edges according to the execution frequencies and path complexities of different branches in the branch structure to obtain a control flow graph; By counting the number of cross-references and sorting the addresses, a main distribution block with the largest number of cross-references in the control flow graph and an address before a preset threshold is determined, an indirect jump instruction or an indirect call instruction in the main distribution block is parsed, and an operand of a register in the indirect jump instruction or the indirect call instruction in the main distribution block is extracted to identify a control variable; Reversely trace the assignment operation of the control variable to locate the initial distribution block that first assigns the control variable; Based on the initial distribution block and the assignment sequence of the control variable, dynamically track all instruction chains that modify the control variable, and record the calculation logic and modification path of the value of the control variable; According to the calculation logic and the modification path, a state transition diagram is generated with basic blocks as nodes and control variable states as edges, wherein the state transition diagram includes a mapping relationship between changes in the values ​​of the control variables and branch jumps.

[0008] Optionally, the identifying the strongly connected components in the initial structure graph, optimizing the strongly connected components to obtain an intermediate structure graph, assigning a corresponding weight to each edge in the intermediate structure graph to obtain a weighted intermediate structure graph includes: The initial structure graph is divided into multiple subgraphs to decompose the depth-first search process of the Tarjan algorithm into multiple subtasks, and multi-threading is used to identify strongly connected components in all subgraphs; Performing a loop reduction operation on each of the strongly connected components, and generating the intermediate structure graph after completing the loop reduction operation on all the strongly connected components; For each edge in the intermediate structure graph, the values ​​of the three dimensions of jump probability, jump path length and jump performance impact are fused to obtain the weight of the edge, so as to obtain a weighted intermediate structure graph.

[0009] Optionally, the loop reduction operation includes: If there is a strongly connected component of a single loop entry basic block, the strongly connected component of the single loop entry basic block is compressed into a single virtual node, where the virtual node is associated with the single loop entry basic block; Alternatively, if there are multiple strongly connected components of loop entry basic blocks, one of the loop entry basic blocks is selected as the main loop head node based on the dominator tree algorithm, and the remaining loop entry basic blocks are deleted.

[0010] Optionally, adjusting the weights of corresponding edges according to the execution frequencies and path complexities of different branches in the branch structure to obtain a control flow graph includes: Based on the static analysis results of the branch structure in the initial structure diagram, the actual execution times of each branch in the branch structure are obtained through dynamic instrumentation, and the execution frequency of each branch is calculated; For each branch path, determine the path complexity based on the number of basic blocks and total number of instructions in the branch, the maximum depth of the data dependency chain in the branch, and the nesting level of strongly connected components in the branch; Inputting the execution frequency and the path complexity into a preset weight calculation model to generate a fusion weight value; The weights of corresponding edges in the weighted intermediate structure graph are adjusted using the fusion weight values ​​to obtain a control flow graph.

[0011] Optionally, identifying the identifier of the useless basic block in the target function according to the state transition diagram includes: From a second instruction sequence consisting of all valid basic blocks in the target function, remove valid instructions related to the string encryption algorithm parameters and control variable calculations to obtain a remaining instruction sequence; Performing reachability analysis on the control flow graph to obtain basic blocks containing the remaining instruction sequence, and screening basic blocks that meet the following conditions: there is no complete path from the function entry to the basic block in the control flow graph, and the jump conditions of all predecessor basic blocks are false in the state transition graph; Dynamic probes are injected into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks. If the actual execution coverage is lower than a preset coverage threshold, the identification of the basic blocks whose actual execution coverage is lower than the preset coverage threshold is used as the identification of useless basic blocks. The preset coverage threshold is obtained by dynamic adjustment based on the obfuscation strength defined in the string encryption algorithm parameters.

[0012] Optionally, injecting a dynamic probe into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks includes: Inserting a first probe before the entry instruction of the filtered basic block to record the number of entries; inserting a second probe before the exit jump instruction of the filtered basic block to record the number of exits; Associating the entry count and the exit count with the corresponding control variable states in the state transition diagram, and recording the following information: the control variable value when triggering the execution of the basic block, and jumping to the predecessor distribution block address of the basic block; The actual execution coverage is calculated based on the ratio of the entry number to the total function call number, where the total function call number is obtained by counting the entry number and the exit number.

[0013] In a second aspect, an embodiment of the present application provides an analysis system based on an obfuscated PASS in LLVM, including: An extraction and positioning module, used to extract a target function from an obfuscated binary program, locate the position of an encrypted string in the target function, and determine a decryption logic according to the position of the encrypted string, wherein the decryption logic includes decryption algorithm parameters; A search and identification module is used to search for a target expression in the target function, identify the expression logic by pattern matching, and determine string encryption algorithm parameters based on the decryption logic and the expression logic, wherein the target expression includes a combination of arithmetic operations, logical operations, and bit operations; A recognition module is constructed to construct a control flow graph according to the expression logic, identify control variables in the control flow graph, and generate a state transition diagram of the control variables according to the assignment sequence of the control variables; The identification and determination module is used to identify the identifier of the useless basic block in the target function according to the state transition diagram, and determine the obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifier of the useless basic block. The useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

[0014] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an analysis method based on an obfuscated PASS in LLVM as described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, an analysis method based on an obfuscated PASS in LLVM as described in any one of the first aspects is implemented.

[0016] In an embodiment of the present application, an analysis method based on an obfuscation PASS in LLVM is provided, including: extracting a target function from an obfuscated binary program, locating the position of an encrypted string in the target function, determining a decryption logic according to the position of the encrypted string, wherein the decryption logic includes decryption algorithm parameters; searching for a target expression in the target function, identifying the expression logic by pattern matching, and determining string encryption algorithm parameters based on the decryption logic and the expression logic, wherein the target expression includes a combination of arithmetic operations, logical operations, and bit operations; constructing a control flow graph according to the expression logic, and identifying control variables in the control flow graph, and generating a state transition graph of the control variables according to an assignment sequence of the control variables; identifying an identifier of a useless basic block in the target function according to the state transition graph, and determining an obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifier of the useless basic block, wherein the useless basic block is an unreachable or invalid code block inserted during the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

[0017] The embodiment of the present application extracts the target function from the obfuscated binary program and locates the position of the encrypted string to determine the decryption logic. The method further analyzes the encryption algorithm parameters, so that analysts can deeply understand the specific working principle of the obfuscated Pass, including the specific encryption algorithm and parameters used. The target expression logic of the combination of arithmetic operations, logical operations and bit operations in the target function is identified by pattern matching, which can work effectively even in complex obfuscation situations. Constructing a control flow graph according to the expression logic and identifying the control variables and their assignment sequences therein to generate a state transition graph helps to reveal the execution process of the binary program, especially the path that becomes difficult to trace after obfuscation, thereby providing a clear view of the structure and behavior of the binary program. The useless basic block identifiers in the target function are identified by the state transition graph. Based on this information, the specific obfuscation strategies and techniques adopted by the obfuscated Pass can be more fully understood, including: how to disrupt the code execution process and how to insert interference code. This method focuses on understanding and analyzing the obfuscation mechanism itself rather than just removing the obfuscation results, so it can better deal with new or customized obfuscation Passes. This analysis method "infers the essence from the phenomenon" and improves the effectiveness and adaptability of anti-obfuscation tools in the face of evolving obfuscation technologies. In summary, this technical solution can not only help analysts gain an in-depth understanding of the working principle of the obfuscation Pass, but also provide support for the development of more efficient and flexible anti-obfuscation tools, ultimately enhancing the analysis capabilities and security assessment capabilities of software protection measures. Furthermore, the embodiments of the present application enhance the analysis capabilities of obfuscated binary programs. By analyzing and optimizing control flow graphs and state transition graphs in detail, it can not only accurately identify and process complex loop structures, branch logic, and changes in control variables, but also dynamically track and record the assignment sequence of control variables and their modification paths, thereby gaining a deeper understanding of the specific implementation details of the obfuscation technology and providing strong support for anti-obfuscation. Specifically, this method accelerates the identification and optimization process of strongly connected components through multi-threading, and adjusts weights based on factors such as jump probability, path length, and performance impact, effectively improving the accuracy and efficiency of constructing control flow graphs and state transition graphs.

[0018] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1A flowchart of an analysis method based on obfuscated PASS in LLVM provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of an analysis system based on an obfuscated PASS in LLVM provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0022] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0024] Figure 1 A flowchart of an analysis method based on obfuscated PASS in LLVM provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes: S11. Extract the target function from the obfuscated binary program, locate the position of the encrypted string in the target function, and determine the decryption logic according to the position of the encrypted string. The decryption logic includes decryption algorithm parameters.

[0025] Among them, the target function is used to determine which parts of the code in the binary program need to be parsed and processed in detail. The location of the encrypted string refers to the specific location of the encrypted string after obfuscation inside the target function, which is used to help locate the data that needs to be decrypted. The embodiment of the present application can locate the position of the encrypted string in the target function by static analysis or other methods. The decryption logic includes the encryption algorithm parameters and the location of the decryption function, which refers to a series of rules and steps required when performing the decryption operation, which is used to restore the encrypted string to a readable form for easy understanding and analysis.

[0026] S12. Search for the target expression in the target function, identify the expression logic through pattern matching, and determine the string encryption algorithm parameters based on the decryption logic and the expression logic. The target expression includes a combination of arithmetic operations, logical operations, and bit operations.

[0027] The target expression may refer to an expression that includes a combination of arithmetic operations, logical operations, and bit operations, and may be related to control flow or data conversion, and is used to identify specific logical patterns, thereby inferring the behavior of the original binary program. The string encryption algorithm parameters are the algorithm parameters used when generating the encrypted string.

[0028] S13. Construct a control flow graph according to the expression logic, identify the control variables in the control flow graph, and generate a state transition graph of the control variables according to the assignment sequence of the control variables.

[0029] Among them. Key variables refer to variables that play a key role in the control flow graph. Changes in key variables will lead to changes in the execution path of the binary program. In the obfuscation implementation logic analysis, they are used to track the decision points and their impacts in the execution process of the binary program. The state transition diagram is a graphical representation based on the state changes of the control variables. It shows how changes in the value of the control variables affect the execution flow of the binary program, and is used to more intuitively display and understand the execution logic of the binary program.

[0030] Optionally, the embodiment of the present application may generate a state transition diagram of the control variables using a variable calculation method.

[0031] S14. Identify the identifiers of useless basic blocks in the target function according to the state transition diagram, and determine the obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifiers of the useless basic blocks.

[0032] Among them, useless basic blocks are unreachable or invalid code blocks inserted by the obfuscation PASS in the underlying virtual machine LLVM during the process of obfuscating binary programs. Useless basic blocks do not participate in the execution of actual program logic. By identifying useless basic blocks, unnecessary interference codes can be identified and eliminated to improve analysis efficiency.

[0033] In step S14, the embodiment of the present application realizes reverse deduction of obfuscation implementation logic through joint analysis of the state transition diagram and string encryption algorithm parameters.

[0034] By executing steps S11 to S14, the embodiment of the present application extracts the target function from the obfuscated binary program, and locates the position of the encrypted string therein to determine the decryption logic, so that analysts can deeply understand the specific working principle of the obfuscated PASS, including the specific encryption algorithm and parameters used, and use pattern matching to identify the target expression logic in the target function, which can operate effectively even in complex obfuscation situations. This process helps to accurately identify the specific details of the application of obfuscation technology, such as the selection and parameter setting of the encryption algorithm, build a control flow graph based on the expression logic, and identify the control variables and their assignment sequences therein to generate a state transition graph, which helps to reveal the execution process of the binary program, especially the path that becomes difficult to track after obfuscation. This step provides a clear view of the structure and behavior of the binary program, and identifies the useless basic block identifiers in the target function through the state transition graph. Based on this information, a more comprehensive understanding of the specific obfuscation strategies and techniques adopted by the obfuscated PASS can be obtained, including how to disrupt the code execution process and how to insert interference code. This analysis method "infers the essence from the phenomenon", which improves the effectiveness and adaptability of anti-obfuscation tools in the face of evolving obfuscation technology. In summary, this technical solution can not only help analysts gain a deeper understanding of the working principle of the obfuscation pass, but also provide support for the development of more efficient and flexible anti-obfuscation tools, ultimately enhancing the analysis and security assessment capabilities of software protection measures.

[0035] In some possible embodiments, the expression logic includes jump relations between instructions in a basic block, jump relations between basic blocks, strongly connected components, and branch structures. S13: constructing a control flow graph according to the expression logic, identifying control variables in the control flow graph, and generating a state transition graph of the control variables according to the assignment sequence of the control variables, including: Step 131: Based on the first instruction sequence in the target expression, divide the first instruction sequence into multiple basic blocks according to a preset division rule, count the number of basic blocks, and use the number of instructions contained in each basic block as the size of the basic block.

[0036] The first instruction sequence refers to the set of continuous instructions initially extracted from the target function without any segmentation. In the binary program analysis scenario, it is used as the basic material for building basic blocks. The preset partitioning rule refers to a set of established standards or conditions for dividing the instruction sequence into basic blocks, such as partitioning based on the location of jump instructions. In the deobfuscation analysis, it helps to clarify the boundaries of each basic block, so as to better understand the program structure.

[0037] Accordingly, step 131 can provide structured data support for subsequent detailed analysis by decomposing the first instruction sequence into multiple basic blocks according to a preset division rule and counting their number and size, thereby helping to quickly locate and understand the functions and effects of each basic block.

[0038] Step 132: In each basic block, search for jump instructions between instructions to determine the jump relationship between instructions, traverse all basic blocks, search for jump instructions from one basic block to another basic block to determine the jump relationship between basic blocks.

[0039] Accordingly, step 132 searches and determines the jump relationships between instructions and basic blocks, which helps to clearly display the control flow within the program and enables researchers to intuitively see the execution path of the program, especially when there is complex jump logic.

[0040] Step 133: construct an initial structure diagram based on the number of basic blocks, the size of the basic blocks, the jump relationship between instructions, and the jump relationship between basic blocks.

[0041] It should be understood that the initial structure diagram is a graphical representation preliminarily constructed based on the number and size of basic blocks, the jump relationship between instructions, and the jump relationship between basic blocks. In the obfuscation implementation logic analysis, it is used to provide a basic framework for program control flow, laying the foundation for subsequent optimization and adjustment.

[0042] Accordingly, step 133 constructs an initial structure diagram based on the collected information, providing a preliminary but comprehensive view of the control flow of the binary program, so that analysts can examine the entire program structure from a macro perspective and prepare for further detailed analysis.

[0043] Step 134, identifying strongly connected components in the initial structure graph, optimizing the strongly connected components to obtain an intermediate structure graph, assigning corresponding weights to each edge in the intermediate structure graph, and obtaining a weighted intermediate structure graph, wherein the strongly connected components are cyclic structures composed of mutually reachable basic blocks.

[0044] It should be understood that a strongly connected component is a loop structure consisting of mutually reachable basic blocks, which is used to indicate that starting from any of these basic blocks, one can return to the starting point through a series of edges. In binary program analysis, identifying strongly connected components helps to discover complex loop structures that may exist in binary programs, which is crucial for understanding and simplifying the code. The weighted intermediate structure graph assigns a numerical value reflecting its importance or frequency of use to each edge on the basis of the intermediate structure graph. In this scenario, it is used to more accurately simulate the actual path selection preference during program execution, making it easier to identify critical paths and potential obfuscation strategies.

[0045] Accordingly, step 134 identifies and optimizes strongly connected components, which can not only remove repeated or unnecessary loop structures, but also simplify the control flow graph, making it easier to understand and analyze, while also improving algorithm efficiency.

[0046] As a possible implementation method, step 134, identifying strongly connected components in the initial structure graph, optimizing the strongly connected components to obtain an intermediate structure graph, assigning a corresponding weight to each edge in the intermediate structure graph, and obtaining a weighted intermediate structure graph, includes: Step a1: Divide the initial structure graph into multiple subgraphs to decompose the depth-first search process of the Tarjan algorithm into multiple subtasks, and use multi-threading to identify strongly connected components in all subgraphs.

[0047] It should be understood that Tarjan's algorithm is an algorithm for finding all strongly connected components in a directed graph in linear time. In binary program analysis scenarios, it is used to efficiently identify loop structures in control flow graphs, which may be part of obfuscation techniques, helping analysts understand the actual execution flow of binary programs. The depth-first search process is an algorithm for traversing or searching a tree or graph. In this process, the branches of the tree are searched as deeply as possible. In this scenario, it is used to explore every corner of the program control flow graph to ensure that no potential strongly connected components are missed, which helps to fully understand the logical structure of the binary program. A subgraph refers to a graph consisting of a portion of vertices and edges selected from the original graph. When processing complex control flow graphs, dividing the graph into multiple subgraphs can facilitate parallel processing and improve computing efficiency, especially in a multi-threaded environment.

[0048] Accordingly, step a1 greatly improves the processing speed and efficiency by dividing the initial structure graph into multiple subgraphs and applying the Tarjan algorithm in a multi-threaded manner to identify strongly connected components, especially when facing large and complex control flow graphs. This method not only speeds up the analysis process, but also makes resource utilization more rational.

[0049] Step a2: perform a loop reduction operation on each strongly connected component, and after completing the loop reduction operation on all strongly connected components, generate an intermediate structure graph.

[0050] It should be understood that the loop reduction operation is a process of simplifying the identified strongly connected components. Through this operation, complex loop structures can be converted into a form that is easier to understand and analyze, which helps to reveal the real logic of the program rather than the obfuscated surface structure.

[0051] Accordingly, step a2: performing loop reduction operations can effectively simplify the control flow graph, especially for those graphs containing complex loop structures. By compressing single-entry loops or selecting the main loop head node based on the dominator tree algorithm, unnecessary details can be reduced, making the graph more concise and clear, making it easier to discover the core logic and control flow patterns of the program.

[0052] Specifically, the loop reduction operation includes: If there is a strongly connected component of a single loop entry basic block, the strongly connected component of the single loop entry basic block is compressed into a single virtual node, and the virtual node is associated with the single loop entry basic block; Alternatively, if there are multiple strongly connected components of loop entry basic blocks, one of the loop entry basic blocks is selected as the main loop head node based on the dominator tree algorithm, and the remaining loop entry basic blocks are deleted.

[0053] It should be understood that a virtual node is an abstract node introduced in a graph to represent a set of one or more actual nodes. The use of virtual nodes in this embodiment can help simplify the control flow graph and make it more intuitive, especially when dealing with complex loop structures with a single entry. The dominator tree algorithm is an algorithm for constructing a dominator tree, which shows the dominator relationship between basic blocks in a program control flow graph. In the case of multiple loop entries, the dominator tree algorithm can be used to select the most appropriate loop head node to optimize the clarity and accuracy of the intermediate structure diagram.

[0054] Step a3: For each edge in the intermediate structure graph, the values ​​of the three dimensions of jump probability, jump path length and jump performance impact are integrated to obtain the weight of the edge, so as to obtain a weighted intermediate structure graph.

[0055] It should be understood that the three dimensions of jump probability, jump path length, and jump performance impact are the criteria used to evaluate the importance or weight of an edge. The jump probability refers to the frequency with which the edge is actually used; the jump path length reflects the distance from the starting point to the end point; and the jump performance impact takes into account the impact of the edge on the overall performance. In the analysis of obfuscation implementation logic, the combination of these three dimensions can help better understand which paths are more critical and which ones may be designed for obfuscation.

[0056] Accordingly, step a3 is the process of assigning weights to each edge in the intermediate structure graph, which is essentially a further refinement of the control flow graph. The weights are determined by combining factors such as jump probability, path length, and performance impact, so that the generated weighted intermediate structure graph can more accurately reflect the actual execution situation, help identify the truly important execution paths, and more accurately locate the application location of the obfuscation strategy, providing strong support for anti-obfuscation work.

[0057] By executing steps a1 to a3, the embodiment of the present application provides a more detailed analysis perspective and enhances the depth of understanding of program behavior.

[0058] Step 135: Identify the branch structure in the weighted intermediate structure graph, adjust the weights of the corresponding edges according to the execution frequency and path complexity of different branches in the branch structure, and obtain a control flow graph.

[0059] It should be understood that the branch structure refers to the part of the control flow graph that represents different execution path choices, usually caused by conditional judgments. During the analysis process, evaluating the execution frequency and path complexity within the branch structure can help determine which paths are more important and which paths may be redundant paths designed for obfuscation.

[0060] Accordingly, step 135 adjusts the edge weights according to the execution frequency and path complexity of different branches in the branch structure, so that the control flow graph can more accurately reflect the actual execution situation and help identify the main execution path and the secondary or obfuscated path.

[0061] As a possible implementation method, according to the execution frequency and path complexity of different branches in the branch structure, the weights of the corresponding edges are adjusted to obtain a control flow graph, including: Step b1, based on the static analysis results of the branch structure in the initial structure diagram, obtain the actual execution times of each branch in the branch structure through dynamic instrumentation, and calculate the execution frequency of each branch. Among them, dynamic instrumentation refers to the technology of inserting code to collect runtime information when the program is running. In the binary program analysis scenario, it is used to obtain the actual execution times of each branch in the branch structure, so as to calculate the execution frequency of each branch and help understand which paths are more frequently used. The execution frequency refers to the number of times a specific branch or path is executed during the program running. By understanding the execution frequency, the most and least commonly used execution paths in the program can be identified, which is crucial to understanding the behavior of binary programs.

[0062] Accordingly, step b1 can obtain not only the theoretical branch structure but also the actual runtime data, including the actual execution times and execution frequencies of each branch, by combining static analysis with dynamic instrumentation technology. This method provides more accurate information than pure static analysis and helps identify the truly important execution paths, rather than relying solely on the code structure itself.

[0063] Step b2: For each branch path, determine the path complexity based on the number of basic blocks and the total number of instructions in the branch, the maximum depth of the data dependency chain in the branch, and the nesting level of the strongly connected components in the branch.

[0064] It should be understood that path complexity is a measure of the complexity of a path, calculated based on multiple factors, such as the number of basic blocks, the total number of instructions, the maximum depth of the data dependency chain, and the nesting level of strongly connected components. A high path complexity means that the path may be more difficult to understand and track, and may also be more likely to become a target of obfuscation. The maximum depth of the data dependency chain refers to the number of operation steps required in a path from an operation to the data source on which it ultimately depends. A higher data dependency chain depth may indicate that the path is more complex, increasing the difficulty of understanding and reverse engineering.

[0065] Accordingly, the process of determining the path complexity in step b2 takes into account multiple factors (the number of basic blocks, the total number of instructions, the depth of the data dependency chain, and the nesting level of strongly connected components), making the path complexity assessment more comprehensive and accurate. Compared with focusing only on the execution frequency, path complexity can reveal those paths that are not executed frequently but have complex structures. These paths are often the key application areas of obfuscation technology.

[0066] Step b3: Input the execution frequency and path complexity into a preset weight calculation model to generate a fusion weight value. The weight calculation model is a preset mathematical model that combines the execution frequency and path complexity to generate a fusion weight value. This model helps to quantify the importance of each edge, so that the control flow graph can better reflect the actual execution situation, making it easier for analysts to identify critical paths and potential obfuscation strategies.

[0067] Accordingly, step b3 uses a preset weight calculation model to combine the execution frequency and path complexity to generate a fusion weight value. This method can comprehensively consider multiple factors and provide a more scientific and reasonable way to evaluate the importance of each edge in the control flow graph. Compared with simple execution frequency or path complexity, the fusion weight value can better reflect the real impact of the edge in actual operation.

[0068] Step b4: Use the fusion weight value to adjust the weight of the corresponding edge in the weighted intermediate structure graph to obtain a control flow graph.

[0069] Correspondingly, step b4 adjusts the weights of the corresponding edges in the weighted intermediate structure graph and optimizes the control flow graph according to the fusion weight values. This process not only improves the accuracy of the control flow graph, but also makes it more reflective of the actual operation of the program.

[0070] By executing steps b1 to b4, the embodiment of the present application optimizes the control flow graph by comprehensively considering multiple factors, thereby more effectively supporting subsequent anti-obfuscation work, such as identifying key paths, discovering the application location of obfuscation strategies, etc. The optimized control flow graph is conducive to in-depth understanding of program logic and improving anti-obfuscation efficiency.

[0071] Step 136: Determine the main distribution block in the control flow graph with the largest number of cross-references and an address before a preset threshold by counting the number of cross-references and sorting the addresses, parse the indirect jump instructions or indirect call instructions in the main distribution block, extract the operands of the registers in the indirect jump instructions or indirect call instructions in the main distribution block, and identify the control variables.

[0072] It should be understood that the main distribution block is one or several basic blocks with the most cross-references in the control flow graph and whose addresses are before the preset threshold, and often contain indirect jump or call instructions. In the deobfuscation analysis, identifying the main distribution block helps to understand the core logic and control flow management mechanism of the program. The operand of the register refers to the data stored in the register, which is used as an operation parameter in the indirect jump or call instruction. In the analysis scenario, it is used to track the source of the control variable and its change process.

[0073] Accordingly, step 136 determines the main distribution block and identifies the control variables by parsing the indirect jump or call instructions therein. This step focuses on the core control logic of the binary program and helps to gain a deeper understanding of the main functions and control mechanisms of the program.

[0074] Step 137: Reversely trace the assignment operation of the control variable to locate the initial distribution block where the control variable is assigned for the first time.

[0075] Accordingly, step 137 reversely tracks the assignment operation of the control variable to find the first assignment point, which is critical for understanding the origin and initial state of the control variable and also provides a starting point for subsequent dynamic tracking.

[0076] Step 138: Based on the initial distribution block and the control variable assignment sequence, dynamically track all instruction chains that modify the control variables, and record the calculation logic and modification path of the control variable values.

[0077] It should be understood that the modification path refers to a chain of instructions that records all the instructions that can cause the value of the control variable to change. In binary program analysis, understanding the modification path helps to reveal how the control variables are manipulated to affect the program behavior, thereby assisting the deobfuscation work.

[0078] Accordingly, step 138 dynamically tracks all instruction chains that modify the control variables based on the initial distribution block and the control variable assignment sequence. This process can record the change trajectory of the control variables in detail and help analysts fully understand the impact of the control variables on program behavior.

[0079] Step 139: Generate a state transition graph with basic blocks as nodes and control variable states as edges according to the calculation logic and the modification path. The state transition graph includes a mapping relationship between changes in the values ​​of the control variables and branch jumps.

[0080] Accordingly, the state transition diagram finally generated in step 139 not only shows the mapping relationship between the change of the control variable value and the branch jump, but also provides a new perspective to understand the execution logic of the program, which is particularly suitable for analyzing highly obfuscated programs because it can highlight those subtle control flow transfer rules.

[0081] By executing steps 131 to 139, the embodiment of the present application ensures the systematicness and accuracy of the analysis process, thereby improving the overall analysis effect. These steps work together to achieve a deep understanding and accurate analysis of the obfuscated binary program.

[0082] In some possible embodiments, S14, identifying the identifier of the useless basic block in the target function according to the state transition diagram, includes: Step 141: Remove valid instructions related to string encryption algorithm parameters and control variable calculation from the second instruction sequence composed of all valid basic blocks in the target function to obtain a remaining instruction sequence.

[0083] It should be understood that the second instruction sequence refers to an instruction sequence consisting of all valid basic blocks extracted from the target function. In the binary program analysis scenario, it is a basic data set used to further screen and identify useless basic blocks. The remaining instruction sequence is the instruction sequence remaining after removing the valid instructions related to string encryption algorithm parameters and control variable calculations from the second instruction sequence. It is used to help focus on code segments that are not directly involved in core logic processing, and helps identify potential useless or confusing basic blocks.

[0084] Accordingly, step 141 removes the instructions related to the string encryption algorithm parameters and the control variable calculation from the second instruction sequence to obtain the remaining instruction sequence. This process effectively narrows the focus, so that the subsequent analysis is more focused on the part that may not be involved in the actual logic processing. This method improves the efficiency and accuracy of identifying useless basic blocks.

[0085] Step 142: Perform reachability analysis on the control flow graph to obtain the basic blocks containing the remaining instruction sequences, and filter the basic blocks that meet the following conditions: there is no complete path from the function entry to the basic block in the control flow graph, and the jump conditions of all predecessor basic blocks are false in the state transition graph.

[0086] It should be understood that reachability analysis is a technique for determining whether there is a path between nodes in a control flow graph. In this scenario, it is used to find out which basic blocks in the control flow graph are reachable from the function entry, thereby identifying unreachable basic blocks and treating them as possible useless basic blocks.

[0087] Accordingly, step 142 performs reachability analysis on the control flow graph and screens basic blocks that meet specific conditions, which can accurately identify basic blocks that will not be accessed in the normal execution process. Compared with the method that only relies on static analysis, this method combines the information of the actual execution path to ensure the reliability of the identification result.

[0088] Step 143: Inject dynamic probes into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks. If the actual execution coverage is lower than a preset coverage threshold, the identification of the basic blocks whose actual execution coverage is lower than the preset coverage threshold is used as the identification of useless basic blocks. The preset coverage threshold is obtained by dynamically adjusting the obfuscation strength defined in the string encryption algorithm parameters.

[0089] It should be understood that dynamic probes are code snippets inserted when a program is running to collect execution information at a specific location. By injecting dynamic probes, the actual execution coverage of specific basic blocks can be monitored, which is crucial to verifying whether these basic blocks are actually used. The preset coverage threshold is a threshold obtained by dynamically adjusting the obfuscation strength defined in the string encryption algorithm parameters, which is used to determine whether a basic block is a useless basic block. If the actual execution coverage of a basic block is lower than this threshold, it is considered useless.

[0090] Accordingly, step 143 can verify whether these basic blocks are really unused by injecting dynamic probes into the screened basic blocks and monitoring their actual execution coverage. This method not only provides theoretical possibility analysis, but also confirms the status of the basic blocks through actual running data, increasing the credibility of identifying useless basic blocks.

[0091] As a possible implementation, step 143, injecting dynamic probes into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks, includes: Step c1, inserting a first probe before the entry instruction of the filtered basic block to record the number of entries; inserting a second probe before the exit jump instruction of the filtered basic block to record the number of exits.

[0092] It should be understood that the first probe is a code snippet inserted before the entry instruction of the filtered basic block, which is used to record the number of times the basic block is entered. In the binary program analysis scenario, it is used to help track the actual usage frequency of a specific basic block, so as to determine whether it is a useless basic block. The second probe is a code snippet inserted before the exit jump instruction of the filtered basic block, which is used to record the number of times the basic block is exited, to help further confirm the actual execution of the basic block, and to calculate the actual execution coverage in combination with the entry number.

[0093] Step c2: associate the entry times and exit times with the corresponding control variable states in the state transition diagram, and record the following information: the control variable value when the basic block is triggered to execute, and the address of the predecessor distribution block of the basic block to be jumped to.

[0094] It should be understood that the control variable state refers to the value of the control variable at a certain moment, which determines the branch and jump behavior of the binary program. By associating with the control variable state, the specific conditions that trigger the execution of the basic block and its context information can be better understood. The predecessor distribution block address refers to the address of the basic block executed before jumping to the current basic block. Recording this information helps to build a more detailed execution path diagram, which is convenient for analyzing the dependencies and execution flow between basic blocks.

[0095] Step c3: Calculate the actual execution coverage based on the ratio of the number of entries to the total number of function calls. The total number of function calls is obtained by counting the number of entries and the number of exits.

[0096] It should be understood that the actual execution coverage is an indicator calculated based on the ratio of the number of entries to the total number of function calls, reflecting the proportion of the screened basic blocks that are actually executed during the entire function execution process. This indicator is of great significance for evaluating the importance of basic blocks.

[0097] By executing steps c1 to c3, the embodiment of the present application can accurately record the number of entries and exits of each basic block by inserting probes at the entrance and exit of the screened basic blocks, providing direct runtime data support, making the judgment of the actual use of the basic block more accurate and reliable. Compared with methods that rely only on static analysis or theoretical speculation, dynamic probes provide verification means in a real operating environment, ensuring the credibility of the identification results. By associating the data recorded by the probe with the state of the control variable in the state transition diagram, not only can the execution number of the basic block be tracked, but also the specific conditions (such as the value of the control variable) when the execution of the basic block is triggered and the information of the predecessor distribution block can be obtained. The association analysis helps to fully understand the role and influence of the basic block in the program execution process. Compared with simply recording the number of executions, this method increases the understanding of the execution context, so that analysts can not only know whether the basic block is executed, but also understand why it is executed, which improves the depth and accuracy of the analysis. The actual execution coverage is calculated based on the ratio of the number of entries to the total number of function calls, providing a quantitative indicator to measure the importance and frequency of use of basic blocks, which is crucial for determining whether a basic block is a useless basic block, because low coverage often means that the basic block may be an invalid code deliberately inserted for obfuscation. Compared with relying solely on static analysis or simple probe recording, this method provides a more scientific and reasonable standard to evaluate the value of basic blocks by calculating coverage, making the process of identifying useless basic blocks more systematic and precise. In summary, steps C1 to C3 not only provide direct runtime data support, but also enhance the understanding of the actual usage of basic blocks through correlation analysis and coverage calculation. These specific steps focus more on in-depth analysis using real-time data provided by dynamic probe technology, thereby improving the accuracy and reliability of identifying useless basic blocks.

[0098] Step 144, associate the remaining instruction sequence with the marking result, generate an instruction-identifier mapping table, traverse all other functions in the obfuscated binary program, and identify useless basic blocks in other functions that are similar to the useless modules in the target function based on the isomorphism analysis of the control flow graph and the state transition graph, and form an identifier set with the identifiers of similar useless basic blocks and the identifiers of useless basic blocks.

[0099] It should be understood that the instruction-identifier mapping table is a data structure that records each instruction and its corresponding identifier (such as whether it is a useless basic block), which helps to systematically manage and analyze each basic block in the binary program and facilitates subsequent processing and optimization. Isomorphism analysis refers to the process of comparing two graph structures to determine whether they have the same topological properties. In this scenario, it is used to identify patterns in other functions that are similar to the marked useless basic blocks, thereby expanding the scope of useless basic blocks.

[0100] Accordingly, step 144 generates an instruction-identification mapping table and applies the method to other functions of the entire program, identifying similar useless basic blocks through isomorphism analysis, and realizing extended application from local to global. This method is not limited to the analysis of a single function, but can also be extended to the entire program, greatly improving the comprehensiveness and depth of the anti-obfuscation work.

[0101] By executing steps 141 to 144, the embodiment of the present application utilizes actual operation data and graph structure similarity to improve the accuracy and coverage of identifying useless basic blocks, thereby providing technical support for in-depth understanding and simplification of obfuscated programs.

[0102] The embodiment of the present application provides an exemplary process of the analysis method of the obfuscated PASS in LLVM. It should be understood that LLVM has modular functions, so the embodiment of the present application can be divided into four modules: String Localization and Decryption Analysis Module (SLDAM), Complex Expression Analysis Module (CEAM), Control Flow Analysis and Basic Block Dispatching Mechanism Analysis Module (CFABBDMAM) and Useless Basic Block Identification Module (UBBIM), which conducts in-depth analysis of the minimum functional complete function (i.e. the above-mentioned target function) and gradually derives the obfuscation implementation logic of the obfuscated Pass in LLVM. Among them, the complex expression is an exemplary target expression. The input, output and processing process of the above four modules themselves, as well as the interaction process between the modules are as follows: The input of the string location and decryption analysis module is: the binary program obfuscated by LLVM (i.e. the above-mentioned obfuscated binary program), and the output is the location of the encrypted string, the location of the decryption function, and the decryption algorithm. The processing process of this module includes: (1) String location: statically analyze the data segment to find suspicious byte sequences. Identify string operation functions (such as `strcpy`, `strcmp`), track the data flow through cross-references, and find possible encrypted strings. Analyze the initialization logic and locate the string decryption function called before the normal process. (2) Decryption process analysis: trace back to find the decryption function through the calling relationship of the string operation function. Reverse the assembly code of the decryption function, identify key operations, and deduce the decryption algorithm. Write a decryption script to automatically decrypt the string.

[0103] The input of the complex expression analysis module is: a code snippet containing a complex expression, and the output is: the logic and implementation principle of the complex expression. The processing process of this module includes: (1) Expression recognition: focus on operation-intensive code and identify instruction sequences containing a large number of arithmetic, logical, and bit operations. Use pattern matching to identify common complex expression patterns. Use data flow analysis to track the source and destination of variables to assist in understanding the logic of the expression. (2) Expression implementation method derivation: analyze instructions one by one and understand the role of each instruction. Convert the instruction sequence into a mathematical expression and simplify it. Try to replace it with a simpler equivalent code and test whether the program behavior changes.

[0104] The input of the control flow analysis and basic block distribution method parsing module is: the control flow graph of the binary program, and the output is: the initial distribution block, the key distribution variables (i.e. the control variables mentioned above) and the basic block execution sequence. The processing process of this module is as follows: (1) Control flow graph construction and analysis: Use the disassembly tool to generate the control flow graph. Analyze the structure of the control flow graph to determine the number, size, jump relationship, loop and branch of the basic blocks. (2) Identification of the initial distribution block and key distribution variables: In the function, the module with the most cross-references and the relatively front address is the main distribution block. Analyze the instructions such as "jmp reg" or "call reg" in the main distribution block to find the key distribution control variables. The basic block to which the key distribution control variables are initially assigned is the initial distribution block. (3) Analysis of the calculation method of the distribution control variables: Track all instructions that modify the key distribution control variables. According to the variable calculation method, build a state transition graph. According to the value of the initial distribution block and the state transition graph, deduce the basic block execution sequence.

[0105] The input of the useless basic block identification module is: the minimum functional complete function, the binary program, and the output is: the identification of useless basic blocks. The processing process of this module includes: (1) Fixed feature instruction collection: In the basic blocks that have been determined in the minimum function, the collection of instruction sequences after removing useful instructions is the feature, such as the calculation process of the simplest control distribution. Manual review to eliminate false positives. (2) Useless basic block identification: Search for basic blocks containing fixed feature instructions in the binary program. Combined with control flow analysis, verify whether it is an unreachable block or a false branch. (3) Optionally, useless basic block removal: Modify the jump instruction to point to the next valid basic block. Delete useless code. It should be noted that sufficient testing should be carried out when removing.

[0106] The interaction between modules is as follows: The minimum functional complete function is used as the starting point of the analysis. Specifically: The four modules all use the minimum functional complete function as the analysis object, and extract obfuscation features through in-depth analysis. The string positioning and decryption analysis module provides information for the other three modules: The string positioning and decryption analysis module locates the decryption function, which provides important clues for understanding complex expressions and control flow obfuscation, because the decryption function usually contains complex calculations and control flow operations. The control flow analysis and basic block distribution method parsing module and the useless basic block identification module verify each other: The basic block distribution method identified by the control flow analysis and basic block distribution method parsing module can be used to verify whether the useless blocks identified by the useless basic block module are really unreachable.

[0107] This embodiment has the following advantages: (1) Instead of directly removing obfuscation, the implementation logic of the obfuscated Pass in LLVM is reversely deduced by analyzing the features of the obfuscated code. (2) The minimum functional complete function is used as the entry point: it is highly targeted and can effectively reduce the complexity of the analysis and improve the efficiency of the analysis.

[0108] (3) In-depth obfuscation internal mechanism: not only focusing on the results of obfuscation, but also focusing on the obfuscation process, can provide a deeper understanding of LLVM obfuscation technology. (4) Extraction of obfuscation features: This embodiment can extract the behavioral characteristics of various obfuscation passes, providing a data basis for subsequent research and development of automated anti-obfuscation tools. (5) Guidance on obfuscation pass development: By understanding the implementation logic of the obfuscation pass, the embodiment of this application can guide developers to improve the obfuscation pass and improve the security of the code.

[0109] Figure 2 A schematic diagram of the structure of an analysis system based on the obfuscation PASS in LLVM provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the system includes: The extraction and positioning module 21 is used to extract the target function from the obfuscated binary program, locate the position of the encrypted string in the target function, and determine the decryption logic according to the position of the encrypted string. The decryption logic includes decryption algorithm parameters.

[0110] The search and identification module 22 is used to search for the target expression in the target function, identify the expression logic through pattern matching, and determine the string encryption algorithm parameters based on the decryption logic and the expression logic. The target expression includes a combination of arithmetic operations, logical operations and bit operations.

[0111] The construction identification module 23 is used to construct a control flow graph according to the expression logic, identify the control variables in the control flow graph, and generate a state transition diagram of the control variables according to the assignment sequence of the control variables.

[0112] The identification and determination module 24 is used to identify the identifier of the useless basic block in the target function according to the state transition diagram, and determine the obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifier of the useless basic block. The useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

[0113] Figure 2 The analysis system based on the obfuscation PASS in LLVM can be performed Figure 1 The implementation principle and technical effect of the analysis method based on the obfuscated PASS in LLVM described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the analysis system based on the obfuscated PASS in LLVM in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0114] In one possible design, Figure 2 The analysis system based on the obfuscation PASS in LLVM of the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32 .

[0115] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0116] The processing component 32 is used to: extract the target function from the obfuscated binary program, locate the position of the encrypted string in the target function, determine the decryption logic according to the position of the encrypted string, and the decryption logic includes the decryption algorithm parameters; search for the target expression in the target function, identify the expression logic by pattern matching, and determine the string encryption algorithm parameters based on the decryption logic and the expression logic, and the target expression includes a combination of arithmetic operations, logical operations and bit operations; construct a control flow graph according to the expression logic, and identify the control variables in the control flow graph, and generate a state transition diagram of the control variables according to the assignment sequence of the control variables; identify the identifier of the useless basic block in the target function according to the state transition diagram, and determine the obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifier of the useless basic block, and the useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

[0117] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0118] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as random access memory (RAM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0119] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0120] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0121] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0122] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0123] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment is based on the analysis method of the obfuscation PASS in LLVM.

[0124] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0125] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An analysis method based on obfuscation PASS in LLVM, characterized in that: include: Extracting a target function from the obfuscated binary program, locating a position of an encrypted string in the target function, and determining a decryption logic according to the position of the encrypted string, wherein the decryption logic includes a decryption algorithm parameter; Searching for a target expression in the target function, identifying the expression logic by pattern matching, and determining string encryption algorithm parameters based on the decryption logic and the expression logic, wherein the target expression includes a combination of arithmetic operations, logical operations, and bit operations; Constructing a control flow graph according to the expression logic, identifying control variables in the control flow graph, and generating a state transition graph of the control variables according to the assignment sequence of the control variables; The identifier of the useless basic block in the target function is identified according to the state transition diagram, and the obfuscation implementation logic of the obfuscated binary program is determined based on the string encryption algorithm parameters and the identifier of the useless basic block. The useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

2. The method according to claim 1, characterized in that The expression logic includes the jump relationship between instructions in the basic block, the jump relationship between basic blocks, the strongly connected components and the branch structure. The control flow graph is constructed according to the expression logic, and the control variables in the control flow graph are identified. According to the assignment sequence of the control variables, a state transition diagram of the control variables is generated, including: Based on the first instruction sequence in the target expression, divide the first instruction sequence into a plurality of basic blocks according to a preset division rule, count the number of the basic blocks, and use the number of instructions contained in each basic block as the size of the basic block; In each of the basic blocks, searching for jump instructions between instructions to determine the jump relationship between the instructions, traversing all the basic blocks, searching for jump instructions from one basic block to another basic block to determine the jump relationship between the basic blocks; constructing an initial structure diagram based on the number of the basic blocks, the size of the basic blocks, the jump relationship between the instructions, and the jump relationship between the basic blocks; Identify strongly connected components in the initial structure graph, optimize the strongly connected components to obtain an intermediate structure graph, assign a corresponding weight to each edge in the intermediate structure graph to obtain a weighted intermediate structure graph, wherein the strongly connected components are a cyclic structure composed of mutually reachable basic blocks; Identify the branch structure in the weighted intermediate structure graph, and adjust the weights of corresponding edges according to the execution frequencies and path complexities of different branches in the branch structure to obtain a control flow graph; By counting the number of cross-references and sorting the addresses, a main distribution block with the largest number of cross-references in the control flow graph and an address before a preset threshold is determined, an indirect jump instruction or an indirect call instruction in the main distribution block is parsed, and an operand of a register in the indirect jump instruction or the indirect call instruction in the main distribution block is extracted to identify a control variable; Reversely trace the assignment operation of the control variable to locate the initial distribution block that first assigns the control variable; Based on the initial distribution block and the assignment sequence of the control variable, dynamically track all instruction chains that modify the control variable, and record the calculation logic and modification path of the value of the control variable; According to the calculation logic and the modification path, a state transition diagram is generated with basic blocks as nodes and control variable states as edges, wherein the state transition diagram includes a mapping relationship between changes in the values ​​of the control variables and branch jumps.

3. The method according to claim 2, characterized in that The identifying of the strongly connected components in the initial structure graph, optimizing the strongly connected components to obtain an intermediate structure graph, assigning a corresponding weight to each edge in the intermediate structure graph to obtain a weighted intermediate structure graph includes: The initial structure graph is divided into multiple subgraphs to decompose the depth-first search process of the Tarjan algorithm into multiple subtasks, and multi-threading is used to identify strongly connected components in all subgraphs; Performing a loop reduction operation on each of the strongly connected components, and generating the intermediate structure graph after completing the loop reduction operation on all of the strongly connected components; For each edge in the intermediate structure graph, the values ​​of the three dimensions of jump probability, jump path length and jump performance impact are fused to obtain the weight of the edge, so as to obtain a weighted intermediate structure graph.

4. The method according to claim 3, characterized in that The loop reduction operation includes: If there is a strongly connected component of a single loop entry basic block, the strongly connected component of the single loop entry basic block is compressed into a single virtual node, where the virtual node is associated with the single loop entry basic block; Alternatively, if there are multiple strongly connected components of loop entry basic blocks, one of the loop entry basic blocks is selected as the main loop head node based on the dominator tree algorithm, and the remaining loop entry basic blocks are deleted.

5. The method according to claim 2, characterized in that: The step of adjusting the weights of corresponding edges according to the execution frequencies and path complexities of different branches in the branch structure to obtain a control flow graph includes: Based on the static analysis results of the branch structure in the initial structure diagram, the actual execution times of each branch in the branch structure are obtained through dynamic instrumentation, and the execution frequency of each branch is calculated; For each branch path, determine the path complexity based on the number of basic blocks and total instructions in the branch, the maximum depth of the data dependency chain in the branch, and the nesting level of strongly connected components in the branch; Inputting the execution frequency and the path complexity into a preset weight calculation model to generate a fusion weight value; The weights of corresponding edges in the weighted intermediate structure graph are adjusted using the fusion weight values ​​to obtain a control flow graph.

6. The method according to claim 1, characterized in that Identify the useless basic blocks in the target function according to the state transition diagram, including: From a second instruction sequence consisting of all valid basic blocks in the target function, remove valid instructions related to the string encryption algorithm parameters and control variable calculations to obtain a remaining instruction sequence; Performing reachability analysis on the control flow graph to obtain basic blocks containing the remaining instruction sequence, and screening basic blocks that meet the following conditions: there is no complete path from the function entry to the basic block in the control flow graph, and the jump conditions of all predecessor basic blocks are false in the state transition graph; Dynamic probes are injected into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks. If the actual execution coverage is lower than a preset coverage threshold, the identification of the basic blocks whose actual execution coverage is lower than the preset coverage threshold is used as the identification of useless basic blocks. The preset coverage threshold is obtained by dynamic adjustment based on the obfuscation strength defined in the string encryption algorithm parameters.

7. The method according to claim 6, characterized in that Injecting dynamic probes into the filtered basic blocks to monitor the actual execution coverage of the filtered basic blocks, including: Inserting a first probe before the entry instruction of the filtered basic block to record the number of entries; inserting a second probe before the exit jump instruction of the filtered basic block to record the number of exits; Associating the entry count and the exit count with the corresponding control variable states in the state transition diagram, and recording the following information: the control variable value when triggering the execution of the basic block, and jumping to the predecessor distribution block address of the basic block; The actual execution coverage is calculated based on the ratio of the entry number to the total function call number, where the total function call number is obtained by counting the entry number and the exit number.

8. An analysis system based on obfuscation PASS in LLVM, characterized in that: include: An extraction and positioning module, used to extract a target function from an obfuscated binary program, locate the position of an encrypted string in the target function, and determine a decryption logic according to the position of the encrypted string, wherein the decryption logic includes decryption algorithm parameters; A search and identification module is used to search for a target expression in the target function, identify the expression logic by pattern matching, and determine string encryption algorithm parameters based on the decryption logic and the expression logic, wherein the target expression includes a combination of arithmetic operations, logical operations, and bit operations; A recognition module is constructed to construct a control flow graph according to the expression logic, identify control variables in the control flow graph, and generate a state transition diagram of the control variables according to the assignment sequence of the control variables; The identification and determination module is used to identify the identifier of the useless basic block in the target function according to the state transition diagram, and determine the obfuscation implementation logic of the obfuscated binary program based on the string encryption algorithm parameters and the identifier of the useless basic block. The useless basic block is an unreachable or invalid code block inserted in the process of obfuscating the binary program by the obfuscation PASS in the underlying virtual machine LLVM.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an analysis method based on an obfuscated PASS in LLVM as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, an analysis method based on an obfuscated PASS in LLVM as described in any one of claims 1 to 7 is implemented.

Images