Binary program analysis, storage and query method and system

Abstract

The invention provides a binary program analysis, storage and query method and system. The method comprises the following steps: performing multi-level program semantic analysis on an input binary program file; on the basis of a node and edge attribute mapping rule of the graph database, storing path nodes and associated edges to Neo4j, and then establishing an address hash index; and finally, performing program vulnerability query based on a hybrid query engine, and returning all unverified calling points and upstream data flow paths thereof. According to the method, the whole-process coverage from program analysis to intelligent query is realized by constructing a structured program dependency graph and combining a multi-modal analysis engine and graph database storage optimization; control flow, data flow and symbol constraints can be captured at the same time, and cross-function vulnerability analysis can be carried out; according to the method, the query delay is reduced by 50% by utilizing the associated storage mode of the graph database; complex semantic query can be achieved through the mixed query engine, symbolic execution verification is conducted on the query path, and feasibility of the query path is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of software security and program analysis, and in particular to a binary program analysis, storage and query method and system. Background Art

[0002] The current mainstream technologies in the field of binary program analysis primarily include static analysis tools, dynamic symbolic execution frameworks, and graph database storage solutions. Static analysis tools such as IDA Pro and Ghidra generate control flow graphs (CFGs) and function call graphs from disassembly, supporting basic cross-function data flow analysis. However, these tools rely on manual reverse engineering and cannot automatically associate constraints with dynamic execution paths. Dynamic symbolic execution frameworks such as angr and KLEE explore program paths through symbolic input, generate path constraints, and solve them. However, they suffer from path explosion, making analysis of large-scale programs (such as those containing complex loops or indirect jumps) inefficient.

[0003] In summary, traditional tools handle control flow, data flow, or symbolic execution independently, resulting in fragmented analysis results. IDAPro's CFG fails to reflect the path of variable propagation across functions, while angr's symbolic execution results struggle to correlate with static data dependencies. Storage solutions often use text files or relational databases, making it difficult to efficiently represent the complex topological relationships of program dependency graphs. Data flow tracing requires multi-table joins, resulting in high query latency. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides a binary program analysis, storage and query method and system. The present invention achieves full process coverage from program parsing to intelligent query by constructing a structured program dependency graph, combining a multimodal analysis engine with graph database storage optimization.

[0005] The technical solution of the present invention is: a binary program analysis, storage and query method, comprising the following steps:

[0006] S1), perform multi-level program semantic analysis on the input binary program file;

[0007] S2) Based on the node and edge attribute mapping rules of the graph database, the path nodes and associated edges are stored in Neo4j, and an address hash index is established;

[0008] S3) Perform program vulnerability query based on the hybrid query engine and return all unverified strcpy call points and their upstream data flow paths.

[0009] Preferably, in step S1), a multi-level program semantic analysis is performed on the input binary program file, specifically comprising the following steps:

[0010] S11) Generate a control flow graph using the hybrid CFG generation strategy of the Angr framework, and ensure the completeness and accuracy of the control flow graph by configuring context sensitivity, indirect jump resolution, and cross-function reference tracking;

[0011] S12), perform data dependency analysis based on reachable definition analysis of the Angr framework;

[0012] S13) Start the symbolic execution engine for the critical path, explore the path constraints and extract the logical conditions.

[0013] Preferably, in step S11), the hybrid CFG generation strategy is the fast mode CFGFast or the high-precision simulation execution mode CFGEmulated of the Angr framework.

[0014] Preferably, in step S12), a definition-use chain is established for temporary variables, registers, and memory operations inside and outside each function based on reachable definition analysis of the Angr framework; and the data flow propagation path across basic blocks and functions is tracked.

[0015] Preferably, in step S12), the result is expressed in the form of a data dependency edge, and the edge attributes include information such as variable type, definition location, and usage context.

[0016] Preferably, in step S13), the constraints that may be encountered are explored path by path, and the symbolic constraints corresponding to each path are collected as strings, and the constraints are stored in the corresponding basic block node attributes in SMT-LIB format.

[0017] Preferably, in step S2), the basic block is mapped to a Block node of Neo4j, wherein the node attributes include a hexadecimal address, an instruction sequence, an address of the function to which it belongs, and a constraint list generated by symbolic execution; the control flow edge records the jump type; and the data dependency edge is attached with a variable identifier and a definition location;

[0018] Preferably, in step S2), a batch transaction submission strategy is adopted and combined with Neo4j's MERGE statement to avoid duplicate insertions.

[0019] Preferably, in step S3), the hybrid query engine is a composite query framework that integrates Cypher query, regular expression matching, data flow tracking, and symbolic execution playback.

[0020] Preferably, in step S3), the regular matching filters the instruction sequence or constraint condition through a regular expression.

[0021] Preferably, in step S3), the data flow tracking returns the definition-use chain and path node list by specifying the variable name and maximum depth.

[0022] Preferably, in step S3), the hybrid query engine performs symbolic execution verification on the query path through symbolic execution playback.

[0023] Preferably, in step S3), the hybrid query engine caches the results of high-frequency queries, precompiles the path constraint expressions into SMT-LIB format, and accelerates symbolic execution verification.

[0024] Preferably, the present invention further provides a binary program analysis, storage and query system, comprising:

[0025] Program parsing module, used to perform multi-level program semantic analysis on the input binary program file;

[0026] The storage module is used to store path nodes and associated edges in Neo4j based on the node and edge attribute mapping rules of the graph database and establish an address hash index;

[0027] The query module is used to perform program vulnerability queries based on a hybrid query engine, returning all unverified strcpy call points and their upstream data flow paths.

[0028] The beneficial effects of the present invention are:

[0029] 1. This invention builds a structured program dependency graph, combines a multimodal analysis engine with graph database storage optimization, and achieves full process coverage from program analysis to intelligent query.

[0030] 2. The present invention can simultaneously capture control flow, data flow, and symbolic constraints, and can perform cross-function vulnerability analysis;

[0031] 3. This invention reduces query latency by 50% by leveraging the associative storage model of graph databases;

[0032] 4. The present invention can realize complex semantic queries through a hybrid query engine and perform symbolic execution verification on the query path to ensure its feasibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of the process of the present invention;

[0034] Figure 2 It is a structural framework diagram of the system of the present invention. DETAILED DESCRIPTION

[0035] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings:

[0036] Example 1

[0037] like Figure 1As shown, this embodiment provides a binary program analysis, storage, and query method, including the following steps:

[0038] S1) Perform multi-level program semantic analysis on the input binary program file; specifically, the steps include:

[0039] S11) Use the Angr framework to load the target binary file, prohibit automatic loading of external libraries, and ensure that the analysis focuses on the target program itself; initialize the global configuration, including analysis path, control flow graph type, data dependency analysis, symbolic execution, log level and other parameters;

[0040] S12) Use the hybrid CFG generation strategy of the Angr framework to generate the control flow graph, and ensure the completeness and accuracy of the control flow graph by configuring context sensitivity, indirect jump resolution, and cross-function reference tracking; for example, when resolving indirect calls (such as call rax), combine VEX intermediate language simulation execution to resolve potential jump targets.

[0041] In this embodiment, the hybrid CFG generation strategy is the fast mode CFGFast or the high-precision simulation execution mode CFGEmulated of the Angr framework.

[0042] Among them, context sensitivity includes levels 1-3.

[0043] S12) Track the data flow of temporary variables, registers, and memory operations based on reachable definition analysis; construct data dependency edges across basic blocks through definition-use chains, and attach variable types (such as memory addresses, register aliases) and usage contexts (such as function call parameter passing).

[0044] S13) Start the symbolic execution engine for the critical path, explore the path constraints and extract the logical conditions; in this embodiment, the constraints are stored in the corresponding basic block node attributes in SMT-LIB format to facilitate subsequent path feasibility verification.

[0045] S2) Based on the node and edge attribute mapping rules of the graph database, the path nodes and associated edges are stored in Neo4j, and an address hash index is established;

[0046] In this embodiment, the basic block is mapped to a Neo4j Block node, where the attributes include the hexadecimal address, instruction sequence, address of the function to which it belongs, and the constraint list generated by symbolic execution; the control flow edge records the jump type; the data dependency edge is attached with the variable identifier and definition location;

[0047] A batch transaction submission strategy is adopted, combined with Neo4j's MERGE statement to deduplicate nodes by address attribute, ensuring that the same basic block is not inserted repeatedly; edge relationships are also deduplicated using unique identifiers (such as src_addr_dst_addr_TYPE). This significantly improves the storage efficiency of large-scale programs and enables incremental synchronization of dynamically updated node attributes and edge relationships.

[0048] Newly discovered nodes and edges can be dynamically written in batches, and automatically updated when their attributes change. A hash index with address as the primary key is established to support subsequent efficient address retrieval and path traversal.

[0049] S3) Perform program vulnerability query based on the hybrid query engine and return all unverified strcpy call points and their upstream data flow paths.

[0050] In this embodiment, the hybrid query engine is a composite query framework that integrates Cypher query, regular expression matching, data flow tracking, and symbolic execution playback.

[0051] Wherein, the regular matching filters instruction sequences or constraints through regular expressions.

[0052] The data flow tracing returns the definition-use chain and path node list by specifying the variable name and maximum depth.

[0053] The hybrid query engine performs symbolic execution verification on the query path through symbolic execution playback.

[0054] The hybrid query engine caches the results of high-frequency queries, precompiles path constraint expressions into SMT-LIB format, and accelerates symbolic execution verification.

[0055] Example 2

[0056] like Figure 2 As shown, this embodiment provides a binary program analysis, storage, and query system, including:

[0057] Program parsing module, used to perform multi-level program semantic analysis on the input binary program file;

[0058] The storage module is used to store path nodes and associated edges in Neo4j based on the node and edge attribute mapping rules of the graph database and establish an address hash index;

[0059] The query module is used to perform program vulnerability queries based on a hybrid query engine, returning all unverified strcpy call points and their upstream data flow paths.

[0060] In this embodiment, the program parsing module performs multi-level program semantic analysis on the input binary program file; specifically, the steps include:

[0061] S11) Use the hybrid CFG generation strategy of the Angr framework to generate the control flow graph, and ensure the completeness and accuracy of the control flow graph by configuring context sensitivity, indirect jump resolution, and cross-function reference tracking; for example, when resolving indirect calls (such as call rax), combine VEX intermediate language simulation execution to resolve potential jump targets.

[0062] In this embodiment, the hybrid CFG generation strategy includes a fast mode CFGFast and a high-precision simulation execution mode CFGEmulated.

[0063] Among them, context sensitivity includes levels 1-3.

[0064] S12) Track the data flow of temporary variables, registers, and memory operations based on reachable definition analysis; construct data dependency edges across basic blocks through definition-use chains, and attach variable types (such as memory addresses, register aliases) and usage contexts (such as function call parameter passing).

[0065] S13) Start the symbolic execution engine for the critical path, explore the path constraints and extract the logical conditions; in this embodiment, the constraints are stored in the SMT-LIB format to the corresponding basic block node to facilitate subsequent path feasibility verification.

[0066] In this embodiment, the storage module maps the basic block to a Neo4j Block node, where the attributes include the hexadecimal address, instruction sequence, address of the function to which it belongs, and the constraint list generated by symbolic execution; the control flow edge records the jump type; the data dependency edge is attached with a variable identifier and definition location;

[0067] A batch transaction submission strategy is adopted, combined with Neo4j's MERGE statement to avoid duplicate insertions, significantly improving the storage efficiency of large-scale programs and enabling incremental synchronization of dynamically updated node attributes and edge relationships.

[0068] In this embodiment, the hybrid query engine is a composite query framework that integrates Cypher query, regular expression matching, data flow tracking, and symbolic execution playback.

[0069] Wherein, the regular matching filters instruction sequences or constraints through regular expressions.

[0070] The data flow tracing returns the definition-use chain and path node list by specifying the variable name and maximum depth.

[0071] The hybrid query engine performs symbolic execution verification on the query path through symbolic execution playback.

[0072] The hybrid query engine caches the results of high-frequency queries, precompiles path constraint expressions into SMT-LIB format, and accelerates symbolic execution verification.

[0073] Example 3

[0074] This embodiment uses the method of embodiment 1 to analyze, store and query the ELF program containing the buffer overflow vulnerability, as follows:

[0075] Input parsing: load binary files and build initial CFG;

[0076] Data dependency expansion: Identify the source of the strcpy function's parameters and trace the path of user input from the read system call to the target buffer;

[0077] Symbolic execution verification: Inject symbolic variables (such as input_length) into the critical path to verify whether input_length > buffer_size;

[0078] Storage and indexing: Write the path nodes (address range 0x401000-0x402000) and associated edges into Neo4j and create an address hash index;

[0079] Vulnerability query: Execute a Cypher query to return all strcpy call sites and their upstream data flow paths that do not verify the input length.

[0080] The above embodiments and descriptions are only for explaining the principles and best embodiments of the present invention. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and improvements, which shall fall within the scope of the invention to be protected.

Claims

1. A binary program analysis, storage and query method, characterized in that: The steps include: S1), perform multi-level program semantic analysis on the input binary program file; S2) Based on the node and edge attribute mapping rules of the graph database, the path nodes and associated edges are stored in Neo4j, and an address hash index is established; S3) Perform program vulnerability query based on the hybrid query engine and return all unverified strcpy call points and their upstream data flow paths.

2. A binary program analysis, storage and query method according to claim 1, characterized in that: In step S1), a multi-level program semantic analysis is performed on the input binary program file, specifically including the following steps: S11) Generate a control flow graph using the hybrid CFG generation strategy of the Angr framework, and ensure the completeness and accuracy of the control flow graph by configuring context sensitivity, indirect jump resolution, and cross-function reference tracking; S12), perform data dependency analysis based on reachable definition analysis of the Angr framework; S13) Start the symbolic execution engine for the critical path, explore the path constraints and extract the logical conditions.

3. A binary program analysis, storage and query method according to claim 2, characterized in that: In step S11), the hybrid CFG generation strategy is the fast mode CFGFast or the high-precision simulation execution mode CFGEmulated of the Angr framework.

4. A binary program analysis, storage and query method according to claim 2, characterized in that: In step S12), a definition-use chain is established for each function's internal and external temporary variables, registers, and memory operations based on reachable definition analysis of the Angr framework; Tracing the data flow propagation path across basic blocks and functions, the results are expressed in the form of data dependency edges.

5. A binary program analysis, storage and query method according to claim 1, characterized in that: In step S2), the basic block is mapped to a Neo4j Block node, where the attributes include the hexadecimal address, instruction sequence, address of the function to which it belongs, and the constraint list generated by symbolic execution; the control flow edge records the jump type; and the data dependency edge is attached with the variable identifier and definition location.

6. A binary program analysis, storage and query method according to claim 5, characterized in that: In step S2), a batch transaction submission strategy is adopted, and Neo4j's MERGE statement is combined to deduplicate nodes by address attributes, and unique identifiers are used to deduplicate edge relationships; Newly discovered nodes and edges can be dynamically written in batches, automatically updated when their attributes change, and a hash index with address as the primary key is established.

7. A binary program analysis, storage and query method according to claim 1, characterized in that: In step S3), the hybrid query engine is a composite query framework that integrates Cypher query, regular expression matching, data flow tracking, and symbolic execution playback.

8. A binary program analysis, storage and query method according to claim 7, characterized in that: In step S3), the regular matching filters the instruction sequence or constraint condition through the regular expression; The data flow tracing returns the definition-use chain and path node list by specifying the variable name and maximum depth; The hybrid query engine performs symbolic execution verification on the query path through symbolic execution playback; The hybrid query engine caches the results of high-frequency queries, precompiles path constraint expressions into SMT-LIB format, and accelerates symbolic execution verification.

9. A binary program analysis, storage and query system, characterized by: The system is used for the method according to any one of claims 1 to 8, and the system comprises: Program parsing module, used to perform multi-level program semantic analysis on the input binary program file; The storage module is used to store path nodes and associated edges in Neo4j based on the node and edge attribute mapping rules of the graph database and establish an address hash index; The query module is used to perform program vulnerability queries based on a hybrid query engine, returning all unverified strcpy call points and their upstream data flow paths.

10. A binary program analysis, storage and query system according to claim 9, characterized in that: The program parsing module performs multi-level program semantic analysis on the input binary program file, specifically including the following steps: S11) Generate a control flow graph using the hybrid CFG generation strategy of the Angr framework, and ensure the completeness and accuracy of the control flow graph by configuring context sensitivity, indirect jump resolution, and cross-function reference tracking; S12), analyzing and tracking the data flow of temporary variables, registers and memory operations based on reachable definitions; S13) Start the symbolic execution engine for the critical path, explore the path constraints and extract the logical conditions.

Images