Binary code block semantic information automatic capturing method and related device

Abstract

The invention discloses a method for automatically capturing semantic information of a binary code block and a related device, and relates to the technical field of computers.The method comprises the following steps that code disassembling and instruction level analysis are conducted on the binary code block, and a binary stream original instruction sequence is generated; performing semantic intermediate representation conversion and vocabulary overflow standardization on the binary stream original instruction sequence to obtain a binary code standardized instruction sequence; obtaining an instruction data dependency relationship and an instruction control dependency relationship corresponding to the binary code block, and constructing a corresponding binary code program dependency graph; semantic code node embedding is carried out on the binary code program dependency graph to generate a binary code representation vector corresponding to context semantics; and performing automatic semantic capture reasoning on the binary code representation vector corresponding to the context semantics through a pre-trained semantic understanding model to obtain semantic information of the binary code block. According to the method, the semantic information of the binary code block can be efficiently and accurately captured.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computers and relates to a binary code block semantic information automatic capturing method and a related device. BACKGROUND

[0002] With the rapid development of computer technology, the application of binary code in software development is becoming more and more widespread, especially in the fields of embedded systems, operating systems, reverse engineering, etc. As the core part of software execution, binary code carries important logic and functions. At present, binary code analysis methods mostly rely on static analysis tools such as IDA Pro, Ghidra, etc. These tools convert binary code into assembly language for analysis through disassembly technology. These tools have achieved certain results in identifying functions, variables and control flow, but still have some limitations. Especially in the case of complex code logic or encryption protection, the degree of automation is low, and it is difficult to automatically capture the semantic information of binary code, thus it is difficult to automatically infer the semantic meaning between the code instructions in the binary code. SUMMARY

[0003] The application aims to overcome the shortcomings of the prior art and provides a binary code block semantic information automatic capturing method and a related device, which can automatically capture the semantic information of a binary code block.

[0004] To achieve the above-mentioned purpose, the application discloses a binary code block semantic information automatic capturing method, which comprises the following steps:

[0005] The binary code block is subjected to code disassembly to obtain a binary assembly code representation, and the binary code block is subjected to instruction-level analysis based on the binary assembly code representation to obtain a binary stream original instruction sequence;

[0006] The binary stream original instruction sequence is subjected to semantic intermediate representation conversion to obtain a binary instruction semantic intermediate representation, and the binary stream original instruction sequence is subjected to vocabulary overflow standardization based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence;

[0007] The binary code block corresponding instruction data dependency relationship and instruction control dependency relationship are obtained through the binary code standardized instruction sequence, and the corresponding binary code program dependency graph is constructed according to the binary code block corresponding instruction data dependency relationship and instruction control dependency relationship;

[0008] The binary code program dependency graph is semantically code node embedded based on the binary code standardization instruction sequence to generate a binary code representation vector with context semantic correspondence, and the binary code representation vector with context semantic correspondence is automatically captured and inferred in semantics by a pre-trained semantic understanding model to obtain binary code block semantic information.

[0009] The binary code block semantic information automatic capturing method further improves in that:

[0010] Further, the process of code disassembling the binary code block to obtain a binary assembly code representation, and instruction-level parsing the binary code block based on the binary assembly code representation to obtain a binary stream original instruction sequence is:

[0011] The binary code block is preliminarily deconstructed to obtain binary code byte layout and metadata, and the binary code byte layout and metadata are parsed and processed to obtain parsing information data corresponding to each operation code, operand and instruction in the binary code block;

[0012] The parsing information data corresponding to each operation code, operand and instruction in the binary code block is mapped and constructed into a binary structure to obtain a binary code structure unit corresponding to different levels according to a predetermined rule, wherein the binary code structure unit includes an operation code field, an immediate number and a register bit, and a corresponding binary code structure graph is constructed according to the binary code structure unit corresponding to different levels;

[0013] The operation code index analysis of the binary code block is performed based on the binary code structure graph, and a binary operation code index library containing all operation codes and their corresponding memory addresses, operand types is constructed according to the analysis results;

[0014] Each code instruction in the binary code block is disassembled based on the binary operation code index library to generate a binary assembly code representation;

[0015] The binary code block is parsed at an instruction level based on the binary assembly code representation to generate a binary stream original instruction sequence.

[0016] Further, the operation process of disassembling each code instruction in the binary code block based on the binary operation code index library to generate a binary assembly code representation is:

[0017] mapping each code instruction in the binary code block to an instruction behavior control mapping based on a binary opcode index library to analyze an execution influence of each code instruction and a control transfer relationship between each code instruction and other code instructions, and constructing a corresponding binary code inter-instruction control flow graph based on the control transfer relationship;

[0018] obtaining a binary code program control branch number corresponding to each code instruction in the binary code block during program execution, and performing dynamic cache control flow optimization on the binary code inter-instruction control flow graph based on the binary code program control branch number to generate a binary inter-instruction optimized control flow graph;

[0019] mapping an operand corresponding to each code instruction in the binary code block to an operation constraint mapping based on the binary inter-instruction optimized control flow graph, and generating binary code instruction dependency control constraints by analyzing a context relationship, a memory location, and a mutual dependency control constraint between the operand and other code instructions;

[0020] performing code disassembly on each code instruction in the binary code block based on the binary inter-instruction optimized control flow graph and the binary code instruction dependency control constraints to generate a binary assembly code representation.

[0021] Further, the operation process of converting the binary stream original instruction sequence to a semantic intermediate representation based on the binary instruction semantic intermediate representation and normalizing a vocabulary overflow standard of the binary stream original instruction sequence to obtain a binary code standardized instruction sequence is as follows:

[0022] mapping each code instruction to a corresponding instruction syntax pattern based on an instruction syntax pattern mapping of the binary stream original instruction sequence to generate a binary stream instruction syntax pattern mapping table;

[0023] performing instruction syntax function analysis on the binary stream original instruction sequence based on the binary stream instruction syntax pattern mapping table to obtain syntax function identification data of the binary stream code instruction, the syntax function identification data including data transmission, logical operation, and control flow jump;

[0024] performing instruction execution context reasoning based on the syntax function identification data to obtain instruction control execution semantic context information between each binary stream code instruction;

[0025] performing semantic intermediate representation conversion on each code instruction in the binary stream original instruction sequence based on the instruction control execution semantic context information between each binary stream code instruction to obtain a binary instruction semantic intermediate representation;

[0026] Performing out-of-vocabulary standardization on the binary stream raw instruction sequence based on the binary instruction semantic intermediate representation, to obtain a binary code standardized instruction sequence.

[0027] Further, the specific operation of obtaining the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block through the binary code standardized instruction sequence, and constructing a corresponding binary code program dependency graph according to the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block is:

[0028] Performing a piece-by-piece correlation analysis on each code instruction in the binary code standardized instruction sequence, quantifying the data flow dependency and the control flow dependency corresponding to the input, output, and control jump information between each code instruction and other instructions into matrix values, and constructing a binary code instruction correlation matrix according to the matrix;

[0029] Performing instruction data dependency identification on the part of the binary code block involving data transfer based on the binary code instruction correlation matrix, dynamically analyzing registers and memory operations using an inter-instruction interactive data identifier, and tracking the inter-instruction data transmission path, to obtain the instruction data dependency relationship corresponding to the binary code block;

[0030] Performing instruction control dependency analysis on the part of the binary code block involving program control based on the binary code instruction correlation matrix, to identify and analyze the instruction control dependency relationship related to all conditional jumps, loop structures, and exception handling of each code instruction and its preceding and subsequent instructions, to obtain the instruction control dependency relationship corresponding to the binary code block;

[0031] Constructing a binary code program dependency graph according to the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block.

[0032] Further, the specific operation of performing semantic code node embedding on the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with context semantics corresponding, and automatically capturing and reasoning the semantic information of the binary code block through a pre-trained semantic understanding model is:

[0033] Performing semantic code node embedding on the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with context semantics corresponding;

[0034] The binary code representation vector with the context semantic correspondence is captured by a pre-trained semantic understanding model to capture the context semantic change relationship of different binary instructions when the binary instructions are executed in the program, and a context relationship graph between the corresponding binary instructions is constructed according to the context semantic change relationship of the different binary instructions when the binary instructions are executed in the program.

[0035] A semantic reasoning framework is constructed based on the context relationship graph between the binary instructions, and corresponding potential semantic information is derived based on the semantic reasoning framework and the internal logic structure and control flow information in the binary code representation vector with the context semantic correspondence, wherein the potential semantic information includes the actual function, execution condition and semantic relationship between other instructions of each binary code instruction, so that binary code block semantic information is obtained.

[0036] Further, the specific operation of the binary code standardization instruction sequence for the semantic code node embedding of the binary code program dependency graph to generate the binary code representation vector with the context semantic correspondence is as follows:

[0037] The binary code standardization instruction sequence is modularized, and corresponding semantic labels and data flow labels are assigned to each binary code instruction module according to the corresponding syntax rules, calling relationship and data transmission flow to generate semantic hierarchical information flow data corresponding to each binary code instruction module;

[0038] The module adjacent cohesion distribution of different binary code instruction modules in the binary code standardization instruction sequence is evaluated based on the semantic hierarchical information flow data corresponding to each binary code instruction module, and a module cohesion distribution matrix between the binary code instruction modules is obtained.

[0039] The semantic depth dependency of the dependency relationship path between different binary code instruction modules in the binary code program dependency graph is analyzed based on the module cohesion distribution matrix between the binary code instruction modules, and a binary code program multidimensional dependency flow graph is generated according to the analysis result.

[0040] The semantic node embedding context awareness analysis is performed based on the binary code program multidimensional dependency flow graph to generate the binary code representation vector with the context semantic correspondence.

[0041] The application discloses a binary code block semantic information automatic capturing system, which comprises the following steps:

[0042] The parsing module is configured to perform code reverse assembly on the binary code block to obtain a binary assembly code representation, perform instruction-level parsing on the binary code block based on the binary assembly code representation, and obtain a binary stream original instruction sequence.

[0043] The conversion module is configured to perform semantic intermediate representation conversion on the binary stream original instruction sequence to obtain a binary instruction semantic intermediate representation, perform vocabulary overflow standardization on the binary stream original instruction sequence based on the binary instruction semantic intermediate representation, and obtain a binary code standardized instruction sequence.

[0044] The construction module is configured to acquire an instruction data dependency relationship and an instruction control dependency relationship corresponding to the binary code block through the binary code standardized instruction sequence, and construct a corresponding binary code program dependency graph according to the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block.

[0045] The reasoning module is configured to perform semantic code node embedding on the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector corresponding to a context semantic, and perform semantic automatic capture reasoning on the binary code representation vector corresponding to the context semantic through a pre-trained semantic understanding model to obtain binary code block semantic information.

[0046] The application discloses a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the binary code block semantic information automatic capture method when executing the computer program.

[0047] The application discloses a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the binary code block semantic information automatic capture method when executed by a processor.

[0048] The application has the following beneficial effects:

[0049] The binary code block semantic information automatic capturing method and related device provided by the present application, in the specific operation, through the disassembly of the binary code block, the core of the process is to convert the machine code into assembly language instructions through the disassembly tool, these assembly language instructions are closely related to the hardware instruction set architecture (ISA), and the disassembly is the basis of reverse engineering, which can reveal the meaning of each machine instruction in the program execution process, and is helpful to understand the structure and behavior of the program. On this basis, further instruction level analysis is carried out, and through the analysis of the generated assembly code, the specific operation instruction sequence can be extracted. This step is not only a simple code restoration, but more importantly, the syntax and semantics of the instruction are analyzed in detail, and the operation of each instruction on the register, memory and other resources is identified. The key of this step is to reveal the potential problems existing in the program execution process through fine-grained instruction analysis, such as instruction conflict, instruction execution order problem, etc., which lays a foundation for subsequent optimization and analysis, thereby helping to deeply understand the overall structure of the program and the function of each instruction. Secondly, through the semantic intermediate representation conversion of the original instruction sequence of the binary stream, the semantic intermediate representation (SIR) is an abstract representation form that can more accurately describe the program logic and semantics, which is more operable and expressive than the simple assembly code. Through this conversion, the complex and difficult-to-understand binary instructions can be converted into a structured, intermediate-level representation, thereby better reflecting the core logic of the program. Next, based on the semantic intermediate representation, the lexical overflow standardization is carried out, and the lexical overflow refers to the use of instructions or operators beyond the conventional programming specifications, resulting in inconsistent behavior in different platforms and different contexts. Through the standardization processing of the original instruction sequence, these non-standard uses can be eliminated, so that the behavior of the program is consistent in multiple execution environments. The standardized instruction sequence is more in line with the general programming specifications, reduces the uncertainty of the program in the execution process, improves the portability and stability of the code, and the standardized instruction sequence is also easier to be automatically analyzed, thereby helping to improve the efficiency and accuracy of semantic analysis.Then, based on the binary code standardized instruction sequence, the data dependency and control dependency of the instructions are extracted, the data dependency refers to how instructions depend on each other through registers, memory, etc. shared data, and the control dependency focuses on the control flow dependency such as jump, branch, etc. in program execution, through analyzing these dependencies, the execution flow and logical structure of the program can be deeply understood, and the construction of the program dependency graph (PDG) is the core goal of this stage, the program dependency graph represents instructions through nodes and represents dependencies between instructions through edges, which can clearly show the relevance and mutual influence between different parts of the program, through this graphical representation, it can be seen intuitively which instructions are the core, which instructions depend on other instructions, and which instructions affect the execution of subsequent instructions, by analyzing the dependencies between instructions, potential program bottlenecks, parallelism problems and resource conflicts can be found, the construction of the dependency graph not only helps program optimization such as instruction scheduling, parallel processing, etc., but also provides strong support for subsequent code optimization and vulnerability detection. Finally, based on the binary code standardized instruction sequence, semantic code node embedding is performed on the program dependency graph, semantic code node embedding is to map each node of the program to a vector representation in a high-dimensional space, and then realize efficient capture of the semantic information of the binary code, this vector representation not only retains the syntax information of the original instructions, but also contains the semantic information of the program in different contexts, which can more comprehensively describe the functions and mutual relationships of instructions, and through the use of a pre-trained semantic understanding model, the generated binary code representation vector is automatically captured and reasoned, this process automatically reasons the relationships, behaviors and functions of instructions in the program through a deep learning model, thereby obtaining more rich semantic information, these semantic information not only includes the execution results of the code, but also reveals the potential intentions, design patterns and other high-level abstract features of the program, which can understand the high-level functions of the program through semantic reasoning, not just stay at the level of low-level instructions, and can also improve the accuracy of automated analysis, help developers and security researchers more efficiently perform vulnerability detection, code optimization and other tasks, so that the semantic meaning between the code instructions in the program can be automatically inferred. BRIEF DESCRIPTION OF DRAWINGS

[0050] The accompanying drawings, which form a part of this specification, are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification. The embodiments of the application, and their

[0051] Figure 1 is a flowchart of the method of the present application;

[0052] Figure 2 is Figure 1The flowchart of step S1 is shown in the figure;

[0053] Figure 3 For Figure 2 The detailed step flowchart of step S14 is shown in the figure. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0055] Embodiment one

[0056] The binary code block semantic information automatic capturing method comprises the following steps:

[0057] Step S1: code disassembling is performed on the binary code block to generate a binary assembly code representation; instruction-level analysis is performed on the binary code block based on the binary assembly code representation to generate a binary stream original instruction sequence;

[0058] Step S2: semantic intermediate representation conversion is performed on the binary stream original instruction sequence to obtain a binary instruction semantic intermediate representation; lexical overflow standardization is performed on the binary stream original instruction sequence based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence;

[0059] Step S3: the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block are obtained through the binary code standardized instruction sequence, and a corresponding binary code program dependency graph is constructed according to the instruction data dependency relationship and the instruction control dependency relationship corresponding to the binary code block;

[0060] Step S4: semantic code node embedding is performed on the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector corresponding to the context semantics; semantic automatic capturing reasoning is performed on the binary code representation vector corresponding to the context semantics through a pre-trained semantic understanding model to obtain binary code block semantic information.

[0061] Reference Figure 1 The binary code block semantic information automatic capturing method comprises the following steps:

[0062] Step S1: code disassembling is performed on the binary code block to generate a binary assembly code representation; instruction-level analysis is performed on the binary code block based on the binary assembly code representation to generate a binary stream original instruction sequence.

[0063] In the embodiment of the present application, the binary code block is disassembled by combining the linear scan disassembly algorithm with the recursive traversal disassembly algorithm. First, the linear scan algorithm is used to read instructions in byte order from the start address of the binary code block. For each read byte sequence, the opcode is identified according to the pre-constructed opcode table. For example, if the byte sequence 0x8B is read, it is identified as the opcode of the MOV instruction. The opcode table covers all standard opcodes of the target instruction set architecture (such as x86, ARM, etc.) and their corresponding instruction function descriptions. After determining the opcode, the subsequent bytes are read as operands according to the format of the opcode. For the MOV EAX, [EBX+4] instruction, after identifying the 0x8B opcode, the subsequent bytes are read to determine the target operand as the EAX register and the source operand as the memory address [EBX+4] according to the format requirement. For jump instructions such as the JMP instruction, the recursive traversal algorithm is used to jump to the corresponding position for disassembly according to the jump target address, ensuring complete parsing of the entire binary code block. Finally, the binary assembly code representation is generated. Based on the generated binary assembly code representation, the instruction-level parsing is performed, and the syntax analyzer is used to parse the assembly code line by line to decompose each assembly instruction into opcode, operand, and other basic elements. For example, for the ADD EAX, EBX instruction, the syntax analyzer parses it into the opcode ADD, the target operand EAX, and the source operand EBX. In the parsing process, a unique identifier is assigned to each operand, and the position information of the instruction in the code block is recorded. Finally, the binary stream original instruction sequence containing detailed information of the instructions is generated.

[0064] Step S2: performing semantic intermediate representation conversion on the binary stream original instruction sequence to obtain a binary instruction semantic intermediate representation; performing lexical overflow standardization on the binary stream original instruction sequence based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence.

[0065] In this embodiment of the invention, a semantic intermediate representation conversion algorithm based on three-address codes is employed to transform the original instruction sequence. For each original instruction, it is converted into a three-address code form according to its operational semantics. For example, the instruction ADD EAX,EBX is converted to T1 = EAX + EBX, where T1 is a temporary variable used to store the calculation result. During the conversion process, a symbol table is maintained to record information such as the type and scope of variables (including register and memory variables) to ensure the accuracy of the conversion. After the conversion is completed, a binary instruction semantic intermediate representation is obtained. Based on this, the original binary instruction sequence is subjected to lexical overflow standardization. A standard vocabulary library is pre-constructed, which contains all legal opcodes, operand formats, and variable naming rules under the target instruction set architecture. Each instruction in the original instruction sequence is checked, and the opcodes and operands are compared with the standard vocabulary library. If non-standard vocabulary is found in the instruction, such as a user-defined illegal opcode or a variable name that does not conform to the standard, it is corrected according to the standard vocabulary library. For example, the incorrect opcode ADDD is corrected to the standard ADD, and the non-standard variable name var_123! is corrected. The code was corrected to var_123, resulting in a standardized binary code instruction sequence that conforms to the standard.

[0066] Step S3: Obtain the instruction data dependency and instruction control dependency of the binary code block through the binary code standardized instruction sequence, and construct the corresponding binary code program dependency graph based on the instruction data dependency and instruction control dependency of the binary code block.

[0067] In this embodiment of the invention, by employing data flow analysis algorithms and control flow analysis algorithms, the instruction data dependencies and instruction control dependencies corresponding to binary code blocks are obtained. In data flow analysis, a data dependency graph node is created for each variable (register and memory variable) to record the definition and usage information of the variable. For example, for the MOV EAX,[EBX+4] instruction, it is recorded that the EAX register is defined at this instruction, and its value comes from the memory address [EBX+4]. When the ADD EAX,ECX instruction appears subsequently, it is identified that the EAX register is used at this instruction, thereby establishing an edge from the MOV instruction node to the ADD instruction node in the data dependency graph to represent the data dependency relationship. In control flow analysis, a control flow graph is constructed, with nodes representing instruction blocks and edges representing control transfer relationships between instructions. For conditional jump instructions, such as the JZ label, two edges are added to the control flow graph based on the jump condition and target address, corresponding to the cases where the condition is true and false, respectively. For loop instructions, such as the LOOP label, the loop body range is identified, and loop control edges are constructed. By combining the results of data flow analysis and control flow analysis, complete instruction data dependency relationships and instruction control dependency relationships are obtained, and a binary code program dependency graph is constructed accordingly. In the graph, nodes represent instructions, and edges are labeled with data dependency or control dependency types, intuitively displaying the dependency relationships between instructions.

[0068] Step S4: Based on the standardized instruction sequence of binary code, semantic code nodes are embedded into the binary code program dependency graph to generate binary code representation vectors with contextual semantics; semantic automatic capture and reasoning are performed on the binary code representation vectors with contextual semantics through a pre-trained semantic understanding model to obtain the semantic information of binary code blocks.

[0069] In this embodiment of the invention, a graph neural network (GNN) algorithm is used to embed semantic code nodes into the binary code program dependency graph. Semantic labels, opcodes, operands, and other information for each instruction are extracted from the standardized binary code instruction sequence and encoded into initial feature vectors assigned to the corresponding nodes in the dependency graph. For example, for instructions that implement data transmission, a semantic label of "data transmission" is assigned, and the opcode and operand information are encoded into vectors. Using the message passing mechanism of GNN, nodes exchange information and update their own features. After multiple iterative calculations, each node integrates its own semantic information and contextual semantic information to generate a binary code representation vector with corresponding contextual semantics. These vectors are input into a pre-trained semantic understanding model. This model is based on the Transformer architecture and trained on a large binary code dataset. The model processes the input vectors through a multi-head attention mechanism to capture the semantic associations and logical relationships between instructions. For example, for a sequence of instructions that includes conditional judgments and data processing, the model analyzes the impact of conditional judgment instructions on the execution of data processing instructions, infers the execution logic of data processing instructions under different conditions, and combines predefined semantic reasoning rules to reason about the binary code representation vector, deriving the actual function, execution conditions, and semantic relationship of each instruction with other instructions, and finally obtaining detailed and accurate semantic information of binary code blocks, presented in a structured form, providing deep semantic support for binary code analysis.

[0070] Furthermore, as an embodiment of the present invention, reference is made to... Figure 2 As shown, Figure 1 A detailed flowchart of step S1 is shown below. In this embodiment, step S1 includes the following steps:

[0071] Step S11: Perform preliminary deconstruction on the binary code block to parse out its internal binary code byte layout and metadata, and use a custom parser to perform instruction operation parsing on the binary code byte layout and metadata to obtain the parsing information data corresponding to each opcode, operand and instruction within the binary code block.

[0072] In this embodiment of the invention, by inputting binary code blocks into the instruction parsing system, the system first performs preliminary deconstruction, employing a byte-aligned parsing algorithm to scan the binary code blocks in 4-byte units, identifying the boundaries of code segments, data segments, and metadata regions. For example, it determines the file type by detecting specific header identifiers (such as 0x7F0x45 0x4C 0x46 in the ELF file format), and then locates the start and end positions of each segment according to the file format specification. The custom parser built into the instruction parsing system performs instruction operation parsing processing on the binary code byte layout and metadata. The parser adopts a state machine architecture, defining different parsing states based on the opcode length and operand type. For each instruction, the parser first reads the first 1-3 bytes as the opcode and determines the instruction type according to a predefined opcode table. For example, upon reading opcode 0x8B, the parser identifies it as a MOV instruction. Next, it determines the number and type of operands based on the opcode and continues reading subsequent bytes as operands. For immediate operands, the corresponding bytes are directly extracted; for register operands, the values ​​of the corresponding bit fields are parsed. During the parsing process, the instruction parsing system records the starting address, opcode, operand type and value, and offset relationship between instructions for each instruction. For example, for the instruction sequence "0x8B 0x450x08", the parser identifies the opcode 0x8B as the MOV instruction, and the operand 0x45 0x08 as reading data from memory address [EBP+8] into the EAX register. This information is recorded to form the parsing information data.

[0073] Step S12: Construct a binary structure mapping for the parsing information data corresponding to each opcode, operand, and instruction within the binary code block, so as to split it into binary code structure units corresponding to different levels according to predetermined rules, including opcode fields, immediate values, and register bits, and construct the corresponding binary code structure map according to the binary code structure units corresponding to different levels.

[0074] In this embodiment of the invention, binary structure mapping is constructed based on previously obtained parsed information data. Following predefined hierarchical rules, the parsed information data is divided into binary code structure units at different levels, employing a three-layer structure model: the bottom layer is a bit-level structure, including an opcode field, an immediate numeric field, and register bits; the middle layer is an instruction-level structure, composed of opcodes and operands; and the top layer is a program-level structure, consisting of code blocks composed of multiple instructions. Each structure unit is extracted through bit operations. For the opcode field, the opcode byte in the parsed information data is directly extracted; for the immediate numeric field, the length and position of the immediate value are determined according to the operand type, and the corresponding byte is extracted; for register bits, specific fields in the operand field are parsed. For example, for the instruction "MOV EAX,[EBX+4]", the opcode field is 0x8B, the immediate numeric field is 0x04, and the register bits are EAX (0x00) and EBX (0x03). Based on the binary code structure units at different levels, the system constructs a corresponding binary code structure graph, represented as a directed graph, where nodes are structure units and edges represent the compositional relationships between units. For example, an instruction node consists of an opcode node and an operand node, and the operand node can be further decomposed into register nodes and immediate value nodes. This graphical structure clearly demonstrates the hierarchical organization of binary code.

[0075] Step S13: Perform opcode index analysis on binary code blocks based on the binary code structure map to construct a binary opcode index library containing all opcodes and their corresponding memory addresses and operand types.

[0076] In this embodiment of the invention, opcode index analysis is performed based on a constructed binary code structure graph. All opcode nodes in the graph are traversed, and the opcode value, its corresponding memory address, and operand type information are extracted. The system uses a hash table structure to store this information, with the opcode as the key and the memory address and operand type as the value. For each opcode, the system also analyzes its context information, including the instruction's position in the code block and the relationship between preceding and following instructions. For example, for a conditional jump instruction, its jump target address and jump condition are recorded; for a function call instruction, the address of the target function is recorded. Through this analysis, the system constructs a binary opcode index library containing all opcodes and their corresponding memory addresses and operand types. Each record in the index library contains fields such as opcode value, memory address, operand type, instruction type, and context information. For example, a record might be: opcode 0xE9 (corresponding to the JMP instruction), memory address 0x1000, operand type is relative address 0x20, instruction type is unconditional jump, and context information is jump to address 0x1020. In this way, the system establishes a mapping relationship between opcodes and instruction semantics, providing a foundation for subsequent disassembly.

[0077] Step S14: Disassemble each code instruction within the binary code block based on the binary opcode index library to generate a binary assembly code representation.

[0078] In this embodiment of the invention, each code instruction within a binary code block is disassembled based on a previously constructed binary opcode index library. A disassembly strategy combining table lookup and context analysis is employed. For each instruction, the corresponding assembly instruction format is first searched in the index library based on its opcode. For example, for opcode 0x8B and operand EAX,[EBX+4], the index library corresponds to the assembly format "MOV EAX,[EBX+4]". Based on the operand type and value, a specific assembly instruction is generated. For register operands, the register name is used directly; for memory operands, the format "[base address + offset]" is used. Complex instruction formats and operand combinations are also handled. For multi-operand instructions, they are generated according to a specific order and format. For instructions with prefixes, the meaning of the prefix is ​​correctly parsed and reflected in the assembly code. For example, for instructions with the LOCK prefix, assembly code such as "LOCK ADD[EAX],1" is generated. By disassembling all instructions, the system generates a complete binary assembly code representation. This assembly code retains the instruction sequence and operand information of the original binary code, while converting the obscure binary format into an easy-to-understand text format, which facilitates subsequent instruction-level parsing.

[0079] Step S15: Perform instruction-level parsing on the binary code block based on the binary assembly code representation to generate the original instruction sequence of the binary stream.

[0080] In this embodiment of the invention, instruction-level parsing is performed based on the previously generated binary assembly code representation. A parsing architecture combining a lexical analyzer and a syntax analyzer is adopted. First, the assembly code is lexically analyzed and decomposed into tokens. For example, the assembly instruction "MOV EAX,[EBX+4]" is decomposed into tokens such as "MOV", "EAX", "", "[", "EBX", "+", "4", and "]". Then, the syntax analyzer converts the token sequence into an abstract syntax tree (AST) according to predefined syntax rules. For each assembly instruction, a corresponding AST node is constructed. The node types include opcode nodes, operand nodes, register nodes, and immediate value nodes. For example, for the MOV instruction mentioned above, an AST node representing a data transfer operation is constructed, containing source operand nodes and destination operand nodes. By traversing the AST, the opcode and operand information of each instruction are extracted to generate the corresponding original instruction sequence. For each instruction, the opcode and operand are encoded according to a specific format to form a binary stream. For example, for the instruction "MOV EAX,[EBX+4]", it is encoded into the corresponding binary format "0x8B 0x43 0x04". By parsing and encoding all assembly instructions, a complete binary stream original instruction sequence is generated. This sequence is functionally equivalent to the original binary code block, but after parsing and reconstruction, the structure is clearer, which facilitates subsequent semantic analysis and reverse engineering.

[0081] Furthermore, as an embodiment of the present invention, reference is made to... Figure 3 As shown, Figure 2 A detailed flowchart of step S14 is shown in this embodiment. Step S14 includes the following steps:

[0082] Step S141: Based on the binary opcode index library, perform instruction behavior control mapping on each code instruction in the binary code block to analyze the execution impact of each code instruction and its control transfer relationship with other instructions, and construct the corresponding control flow graph between binary code instructions based on the control transfer relationship.

[0083] In this embodiment of the invention, binary code blocks are input into an instruction analysis system. The system constructs a binary opcode index library containing all known opcodes. This index library records the instruction behavior, operand type, and execution impact corresponding to each opcode. The system scans the binary code blocks line by line, performing instruction behavior control mapping for each code instruction. For each instruction, the system first parses its opcode and extracts the corresponding instruction behavior description from the index library. For example, upon encountering opcode 0x8B (representing the MOV instruction in x86 architecture), the system identifies it as a data transfer instruction, records its operation type as data transfer, and analyzes its operand type and number. Next, the instruction analysis system analyzes the control transfer relationships between this instruction and other instructions. If the current instruction is an unconditional jump instruction (such as JMP), the instruction analysis system determines the jump target address and adds an edge from the current instruction to the target instruction in the control flow graph; if it is a conditional jump instruction (such as JZ), two edges are added, corresponding to the conditions being true and false, respectively. Through the analysis of all instructions, the instruction analysis system constructs the corresponding binary code instruction control flow graph. This binary code instruction control flow graph uses nodes to represent instruction blocks and edges to represent control transfer relationships between instructions. The weight of the edges is determined by statistical data on instruction execution frequency. For example, in a loop structure, the edge weight between instructions within the loop body is higher, while the edge weight exiting the loop is lower.

[0084] Step S142: Obtain the number of binary code program control branches corresponding to each code instruction in the binary code block during program execution, and perform dynamic cached control flow optimization on the control flow graph between binary code instructions based on the number of binary code program control branches to generate an optimized control flow graph between binary instructions.

[0085] In this embodiment of the invention, based on a previously constructed control flow graph between binary code instructions, the system counts the number of binary code program control branches in each instruction block. The number of control branches is defined as the sum of the number of conditional jumps and unconditional jumps in the instruction block. For example, an instruction block containing two conditional jump instructions and one unconditional jump instruction has 3 control branches. The system employs a path analysis-based dynamic cache control flow optimization algorithm to optimize the control flow graph according to the number of control branches. For instruction blocks with a high number of control branches, the system predicts their possible execution paths and adjusts the instruction order to improve cache hit rate. Specifically, the system analyzes the historical execution data of each jump instruction and calculates its jump probability. For target instruction blocks with high jump probabilities, the system moves their code closer to the current instruction block to reduce instruction cache misses. The system also performs special processing on loop structures. For loops with a high number of control branches, loop unrolling technology is used to unroll the loop body a fixed number of times (e.g., 3 times) to reduce the number of times loop control instructions are executed and improve instruction execution efficiency. Through these optimization operations, the system generates an optimized control flow graph between binary instructions. This graph significantly improves instruction cache hit rate and execution efficiency while maintaining the original program functionality.

[0086] Step S143: Based on the optimized control flow graph between binary instructions, perform operation constraint mapping on the operands corresponding to each code instruction in the binary code block, so as to generate binary code instruction dependency control constraints by analyzing the context relationship, memory location and mutual dependency control constraints between the operands and other instructions.

[0087] In this embodiment of the invention, the operands corresponding to each code instruction within a binary code block are mapped to operational constraints based on a previously generated optimized control flow graph between binary instructions. First, the contextual relationships of the operands are analyzed to determine their roles and uses during program execution. For example, for a MOV instruction "MOV EAX,[EBX+4]", the system analyzes the source of the value in the EBX register to determine the range of memory addresses it points to. Then, the memory location of the operand and its inter-instruction dependencies are analyzed. For memory operands, read and write operations are tracked to establish memory access dependencies. For example, if one instruction writes to memory address 0x1000, and another instruction reads data from that address, there is a data dependency between these two instructions. Corresponding dependency edges are added to the control flow graph to represent this constraint. Through the analysis of all operands, the system generates binary code instruction dependency control constraints. These constraints are represented in the form of a graph, where nodes represent instructions and edges represent dependencies. The types of edges include data dependencies, control dependencies, and resource dependencies. For example, a data dependency edge means that the execution result of one instruction depends on the output of another instruction; a control dependency edge means that the execution of one instruction depends on the control flow decision of another instruction.

[0088] Step S144: Based on the optimized control flow graph between binary instructions and the binary code instruction dependency control constraints, disassemble each code instruction in the binary code block to generate a binary assembly code representation.

[0089] In this embodiment of the invention, each code instruction within a binary code block is disassembled based on a previously generated optimized control flow graph between binary instructions and binary code instruction dependency control constraints. A semantic analysis-based disassembly algorithm is employed, which considers not only the syntactic structure of the instructions but also their semantic information and dependencies. For each instruction, the corresponding assembly instruction format is first searched in the binary opcode index library based on its opcode and operands. For example, for opcode 0x8B and operands EAX,[EBX+4], the system generates the assembly instruction "MOV EAX,[EBX+4]". Appropriate comments are added to explain the dependencies between instructions based on instruction dependency control constraints. For example, comments are added after an instruction that depends on the result of another instruction to explain this dependency. Complex instruction sequences and control structures are handled; for loop structures, the loop header and loop body are identified, and corresponding assembly code blocks are generated, while comments on loop conditions and jump instructions are added. For function calls, the calling convention and parameter passing method are analyzed to generate correct function call and return instructions. By disassembling all instructions, a complete binary assembly code representation is generated. This assembly code retains the semantic information and control structure of the original binary code. At the same time, through comments and formatting, the readability and understandability of the code are improved, providing strong support for subsequent code analysis and reverse engineering.

[0090] Furthermore, the dynamic caching control flow optimization of the control flow graph between binary code instructions based on the number of control branches in the binary code program includes the following steps:

[0091] Based on the number of control branches in the binary code program, the program jump path is determined for each instruction control flow path in the control flow graph between binary code instructions, so as to obtain the instruction program control jump path corresponding to the binary code instruction during program execution.

[0092] In this embodiment of the invention, by importing the binary code program into the control flow analysis system, the control flow graph between binary code instructions is first extracted. This control flow graph uses nodes to represent instruction blocks and edges to represent control transfer relationships between instructions. Based on the number of control branches in the binary code program, a symbolic execution engine is used to analyze the control flow path of each instruction in the control flow graph. Taking a code segment containing a conditional jump instruction as an example, assuming that the conditional jump instruction has two branches: jump to address A when the condition is met, and jump to address B when the condition is not met, the symbolic execution engine starts from the program entry point, maintains a symbolic expression for each variable, and simulates the program execution process. When a conditional jump instruction is encountered, the two cases of condition being met and not met are calculated according to the symbolic expression, and the corresponding jump target address is recorded respectively. For more complex loop structures, loop unrolling technology is used to unroll the loop body a fixed number of times, such as 3 times, to handle the control transfer inside the loop. In this way, all possible paths in the control flow graph are traversed to determine the possible control jump paths of each instruction during program execution. Finally, a complete set of instruction program control jump paths is generated, providing basic data for subsequent error probability assessment.

[0093] Preferably, the jump error probability is evaluated based on the instruction program control jump path corresponding to the binary code instruction during program execution, and the binary code instruction program jump error probability is obtained.

[0094] In this embodiment of the invention, the jump path is controlled based on a previously obtained instruction program. A combination of static analysis and dynamic statistics is used to evaluate the probability of jump errors. Specifically, firstly, the context information of each jump instruction is analyzed, including the jump condition, operand type, and value range. For conditional jump instructions, the probability of the condition expression being true under different inputs is calculated. For example, for a comparison instruction "if(a>10)", the value distribution of variable a is analyzed. If static analysis shows that the value range of a is usually between 5 and 15, then the probability of the condition being true is about 50%. Historical statistical data of instruction execution is also considered. By analyzing a large number of actual execution trajectories, the actual jump frequency of each jump instruction is statistically analyzed. By combining the results of static analysis and dynamic statistics, the probability of jump errors is calculated for each jump instruction. The probability of jump errors is defined as the probability that the predicted jump direction is inconsistent with the actual execution direction. For example, for a conditional jump instruction, if static analysis predicts its jump probability to be 60%, while historical statistics show that its actual jump probability is 40%, then the jump error probability of this instruction is 20%. By evaluating all jump instructions, the complete binary code instruction program jump error probability distribution can be obtained.

[0095] Preferably, based on the probability of program jump errors in binary code instructions, program cache miss estimation is performed on each instruction control flow path in the control flow graph between binary code instructions to obtain the binary code program cache hit miss rate for each instruction control flow path.

[0096] In this embodiment of the invention, cache miss estimation is performed on each instruction control flow path within the control flow graph based on the previously obtained binary code instruction jump error probability. A cache behavior simulation model is adopted, which considers the structural parameters of the instruction cache (such as cache size, associativity, block size, etc.) and replacement strategy (such as LRU). For each instruction control flow path, the loading and replacement process of instructions in the cache is simulated. When an instruction is executed, it is checked whether the instruction is in the cache. If it is not in the cache, a cache miss occurs, the number of misses is recorded, and the cache content is updated. Instructions with a high jump error probability will increase the uncertainty of the program execution path, thereby increasing the possibility of cache misses. The cache hit miss rate is calculated for each instruction control flow path. The calculation formula is: cache hit miss rate = number of cache misses / total number of instruction executions. For example, if an instruction control flow path experiences 200 cache misses in 1000 simulated executions, then the cache hit miss rate of this path is 20%. By estimating the cache misses of all instruction control flow paths, a complete binary code program cache hit miss rate distribution is obtained, providing a basis for subsequent dynamic cache control flow optimization.

[0097] Preferably, dynamic cache control flow optimization is performed on the corresponding instruction control flow path in the binary code instruction inter-instruction control flow graph based on the binary code program cache hit / miss rate corresponding to each instruction control flow path, so as to generate an optimized binary instruction inter-instruction control flow graph.

[0098] In this embodiment of the invention, dynamic cache control flow optimization is performed on the instruction control flow paths within the control flow graph based on the previously obtained cache hit rate of the binary code program corresponding to each instruction control flow path. A path weight-based optimization strategy is adopted, where the path weight is determined by both the cache hit rate and the instruction execution frequency. First, the weight of each instruction control flow path is calculated using the formula: Path Weight = Cache Hit Rate × Instruction Execution Frequency. For example, if a path has a cache hit rate of 30% and an instruction execution frequency of 20%, then the weight of that path is 6%. Paths with higher weights are prioritized for optimization to minimize cache misses. The optimization method includes instruction weighting... Optimizations such as sorting, loop unrolling, and branch prediction are employed. For instruction sequences with high cache miss rates, frequently executed instructions are moved to adjacent positions to improve cache locality. For loop structures, loop unrolling is performed based on the size of the loop body and execution frequency to reduce cache misses caused by branch jumps. The parameters of the branch predictor are also adjusted, and the prediction strategy is dynamically adjusted according to the jump error probability to improve branch prediction accuracy. By optimizing the control flow paths of all instructions within the control flow graph, an optimized control flow graph between binary instructions is finally generated. This optimized control flow graph significantly reduces the cache miss rate and improves the execution efficiency of the program while maintaining the original program functionality.

[0099] Step S15 includes the following steps:

[0100] Step S151: Divide the binary code block into bit-width segments to obtain each binary basic data block; identify and obtain the structural features corresponding to each basic data block, including opcode, operands and control bits, and perform instruction set mapping on each binary basic data block based on the structural features corresponding to each basic data block to generate the binary code instruction set corresponding to each basic data block.

[0101] In this embodiment of the invention, binary code blocks are input into a bit-width analysis system. A fixed-bit-width segmentation algorithm is used to divide the binary code blocks. For 32-bit architecture binary code, the system segments in 32-bit units; for 64-bit architecture, it segments in 64-bit units. Each segment forms a binary basic data block, recording its start address and length information. A pattern recognition algorithm analyzes the structural features of each binary basic data block. First, it checks whether the first 8-16 bits match a predefined opcode pattern library, which contains opcode features of all known instruction sets. For example, if the first 8 bits are detected as 0x8B, it is identified as the MOV instruction opcode in the x86 architecture. Then, the subsequent bit fields are analyzed, and the operand type and length are determined based on the opcode. Operand information is extracted. For control bits, flag bits at specific positions, such as condition code flags and jump flags, are detected. Based on the identified structural features, instruction set mapping is performed. An instruction template matching algorithm is used to compare the extracted opcode, operands, and control bits with a predefined instruction template. For example, for opcode 0x8B and operand pattern "register, memory address", the instruction template "MOV destination register, source memory address" is matched. Through this mapping, a corresponding binary code instruction set is generated for each binary basic data block, recording the instruction type, operands, and control information.

[0102] Step S152: Perform instruction structure deduction based on the binary code instruction set corresponding to each basic data block, so as to generate the corresponding binary code symbolic instruction structure set by analyzing the corresponding opcode and operand in each basic data block and combining them with the corresponding control bits.

[0103] In this embodiment of the invention, instruction structure deduction is performed based on the previously generated binary code instruction set. A symbolic execution engine analyzes the opcode and operand in each basic data block and generates a symbolic instruction structure by combining control bits. For each instruction, the symbolic execution engine creates symbolic variables for the operands, simulates the instruction execution process, and records the operation results and state changes. For example, for the instruction "MOV EAX,[EBX+4]", the symbolic execution engine creates a symbolic variable S1 to represent the value of memory address [EBX+4]. After executing this instruction, the value of the EAX register is symbolized as S1. For conditional jump instructions, such as "JZ label", the engine analyzes the jump condition ZF flag and generates a symbolic conditional expression. If the ZF flag is true, the jump is to label; otherwise, the next instruction is executed. The symbolic execution results of all instructions are integrated to generate a set of binary code symbolic instruction structures. This set is represented in the form of a graph, where nodes are symbolic operations and states, and edges are dependencies and control flow between operations. For example, when the execution result of one instruction is used as an operand of another instruction, a dependency edge is formed in the graph. This symbolic representation clearly demonstrates the logical structure and data flow of binary code.

[0104] Step S153: Perform instruction-level parsing on the binary code symbolic instruction structure set based on the binary assembly code representation to generate the original binary stream instruction sequence.

[0105] In this embodiment of the invention, instruction-level parsing is performed based on a previously generated set of symbolic binary code instructions and binary assembly code representations. A bidirectional mapping parsing algorithm is employed, referencing both the symbolic instruction structure and the assembly code to ensure the accuracy and completeness of the parsing. First, the binary assembly code is segmented line by line, and the opcode and operands of each assembly instruction are extracted. Then, the corresponding symbolic operation is searched in the symbolic instruction structure set to establish a mapping relationship between assembly instructions and symbolic operations. For example, the assembly instruction "ADD EAX,1" corresponds to the symbolic operation "EAX=EAX+1". Based on the control flow information in the symbolic instruction structure set, the execution order and jump relationships of the instructions are determined. For conditional jumps and loop structures, corresponding jump instructions and loop control instructions are generated. For example, for symbolic conditional jump operations, corresponding jump instructions such as JZ and JNZ are generated, and each instruction is converted into binary format. According to the instruction set specification, the binary encoding method of the opcode and operands is determined, and the assembly instructions and symbolic operations are converted into corresponding binary streams. For example, the assembly instruction "MOV EAX,[EBX+4]" is converted into the binary code "0x8B 0x43 0x04". Through the parsing and conversion of all instructions, the system generates a complete binary stream of original instruction sequences. This sequence is functionally equivalent to the original binary code block, but it has undergone structured parsing and reconstruction, making the structure clearer and facilitating subsequent semantic analysis and reverse engineering.

[0106] Furthermore, step S2 includes the following steps:

[0107] Step S21: Perform instruction syntax pattern mapping on the original binary stream instruction sequence, mapping the opcode, operands, and control bits corresponding to each code instruction to the corresponding instruction syntax pattern, and generating a binary stream instruction syntax pattern mapping table.

[0108] In this embodiment of the invention, the original binary instruction sequence is input into an instruction syntax analysis system. The system pre-stores an instruction syntax pattern library covering common instruction sets. Each instruction syntax pattern in this library explicitly defines the combination form and value range of the opcode, operands, and control bits. A pattern matching algorithm is used to analyze each code instruction sequentially. Taking the instruction "MOV EAX,[EBX+4]" as an example, the system first extracts its opcode "MOV" and searches for a matching pattern in the instruction syntax pattern library to find the syntax pattern template for data transfer instructions. Next, the operands "EAX" and "[EBX+4]" are analyzed, determining that the former is a destination register operand and the latter is a memory addressing operand based on the base address register. These are then filled into the corresponding positions in the template. Simultaneously, the control bits in the instruction are checked (if present) and their status is recorded. In this way, the opcode, operands, and control bits of the instruction are completely mapped to the corresponding instruction syntax pattern. The above operation is performed on all instructions in the original binary stream instruction sequence, and the mapping results of each instruction are organized into a table to generate a binary stream instruction syntax pattern mapping table. This table contains the position of the instruction in the sequence, the corresponding syntax pattern name, the specific value of the opcode, detailed information about the operands, and the status of the control bits, clearly presenting the syntactic structure characteristics of each instruction.

[0109] Step S22: Perform instruction syntax function analysis on the original instruction sequence of the binary stream based on the binary stream instruction syntax mode mapping table to obtain the syntax function identifier data corresponding to the binary stream code instruction, which includes data transmission, logical operation and control flow jump.

[0110] In this embodiment of the invention, the original binary stream instruction sequence is analyzed in the instruction syntax function analysis system based on the previously generated binary stream instruction syntax pattern mapping table. Based on the correspondence between instruction syntax patterns and functions, the syntax function of each instruction is determined. For the instruction with opcode "MOV", the mapping table indicates that its syntax pattern belongs to the data transmission category, and its syntax function is identified as "data transmission". For the instruction "ADD EAX,EBX", the syntax pattern corresponding to the opcode "ADD" indicates that it is an arithmetic operation, further categorized into addition in logical operations, and identified as "logical operation - addition". The instruction "JMP label", with its opcode "JMP", belongs to the control flow jump category, and is identified as "control flow jump - unconditional jump". All instructions in the mapping table are traversed, and each instruction is identified using the above syntax function marking. Finally, the syntax function marking data corresponding to the binary stream code instructions, including data transmission, logical operations, and control flow jumps, is obtained. This data is stored in a table format, with each row corresponding to one instruction, recording the instruction position, syntax function marking, and other information, providing a clear functional classification basis for subsequent instruction execution context reasoning.

[0111] Step S23: Perform instruction execution context reasoning based on the syntax function identifier data corresponding to the binary stream code instruction, which includes data transmission, logical operations, and control flow jumps, to obtain the instruction control execution semantic context information between each binary stream code instruction.

[0112] In this embodiment of the invention, based on previously obtained syntax function identifier data, analysis is performed in the instruction execution context reasoning system. A rule-based and dependency-based reasoning algorithm, combined with the order of instructions in the sequence, is used to reason about the control execution semantic context information between each binary stream code instruction. For example, in an instruction sequence, "MOV EAX,[EBX+4]" is executed first to perform data transfer, storing memory data into register EAX. Subsequently, "ADDEAX,ECX" is executed to perform logical operations, adding data to the data in EAX. Based on the syntax function identifier and instruction order, it is inferred that the execution of the "ADD EAX,ECX" instruction depends on the data transfer result of the previous "MOV EAX,[EBX+4]" instruction; that is, the value of the EAX register is determined by the previous instruction, thus establishing a data dependency between the two instructions. For control flow jump instructions, such as "JZ label", if there are logical operation instructions that affect the zero flag (ZF) before this instruction, the jump condition of the "JZ label" instruction is inferred to be related to the result of the previous logical operation based on the instruction function and control bit state, and its control execution semantic context is determined. By analyzing the entire instruction sequence, detailed instruction control execution semantic context information between each binary stream code instruction is obtained and represented in the form of a directed graph, where nodes are instructions and edges are dependencies and control relationships between instructions.

[0113] Step S24: Based on the instruction control execution semantic context information between each binary stream code instruction, perform semantic intermediate representation transformation on each code instruction in the original binary stream instruction sequence to obtain the binary instruction semantic intermediate representation.

[0114] In this embodiment of the invention, the semantic intermediate representation conversion system converts each code instruction within the original binary stream instruction sequence based on previously obtained instruction control execution semantic context information. A unified semantic intermediate representation format is adopted, which can clearly express the operational semantics, data dependencies, and control relationships of the instructions. Taking the instruction "MOVEAX,[EBX+4]" as an example, it is converted into the semantic intermediate representation form "EAX=LoadMemory([EBX+4])", which clearly indicates that the data at memory address [EBX+4] is loaded into the EAX register. For the instruction "ADD EAX,ECX", it is converted into "EAX=EAX+ECX", which intuitively reflects the addition operation and data flow. During the conversion process, dependency comments between instructions are added based on the semantic context information of the instruction control execution. For example, in the semantic intermediate representation of "ADD EAX,ECX", it is noted that the operation depends on the assignment of EAX by the preceding instruction "MOV EAX,[EBX+4]". This conversion is performed on all instructions to convert the entire binary stream original instruction sequence into a unified format binary instruction semantic intermediate representation. This representation is more convenient for semantic analysis and optimization.

[0115] Step S25: Perform lexical overflow standardization on the original instruction sequence of the binary stream based on the intermediate representation of binary instruction semantics to obtain a binary code standardized instruction sequence.

[0116] In this embodiment of the invention, the previously obtained intermediate semantic representation of binary instructions and the original binary stream instruction sequence are input into a lexical overflow standardization system. The system has a built-in standard vocabulary and a syntax rule library. The standard vocabulary contains all compliant opcodes, operands, and function names, while the syntax rule library covers the grammatical structure and semantic rules of the instruction set. The original binary stream instruction sequence is scanned instruction by instruction, and the opcodes and operands in the instructions are precisely compared with the standard vocabulary. If an instruction contains an opcode variant not defined in the standard vocabulary, or an operand uses a non-standard representation, it is determined to be a lexical overflow. For example, the instruction may contain a custom opcode "MYMOV" or incorrectly spell a register name as "EAXS". For the detected lexical overflow, the system processes it according to the syntax rule library. If the opcode is incorrect, it is replaced with a standard opcode; if the operand representation is non-standard, it is corrected according to the correct format. For example, "MYMOV" is corrected to the standard "MOV", and "EAXS" is corrected to "EAX". After the system has processed all lexical overflows, it reassembles the corrected instructions to generate a standardized binary code instruction sequence. This sequence conforms to the syntax and semantic specifications of the instruction set, laying a solid foundation for subsequent code analysis and application.

[0117] Furthermore, step S25 includes the following steps:

[0118] Step S251: Construct a semantic hierarchy mapping for each instruction semantic operation within the intermediate representation of binary instruction semantics to generate a binary instruction semantic hierarchy map.

[0119] In this embodiment of the invention, by inputting the intermediate semantic representation of binary instructions into the semantic analysis system, the system employs a hierarchical construction algorithm based on syntax trees to construct a semantic hierarchy for each instruction semantic operation. First, the instruction semantic operation is parsed into an abstract syntax tree. The nodes of the tree represent the basic units of the semantic operation, such as opcodes, operands, control conditions, etc., and the edges represent the syntactic relationships between units. Taking the semantic operation of the instruction "MOV EAX,[EBX+4]" as an example, in the constructed abstract syntax tree, the root node is "data transfer operation," which has two child nodes, corresponding to the target operand "EAX" and the source operand "[EBX+4]," respectively. The source operand node is further subdivided into base address register "EBX" and offset "4" child nodes. In this way, each instruction semantic operation is transformed into a tree structure. Next, the system traverses the abstract syntax trees of all instruction semantic operations, extracts common nodes and relationships, and constructs a binary instruction semantic hierarchy graph. The graph is presented in the form of a directed acyclic graph, where nodes are semantic units, and edges represent semantic dependencies and hierarchical progression relationships. For example, the opcode node of a data processing instruction will point to a lower-level arithmetic or logical operation sub-node, forming a semantic hierarchy from high-level operations to specific functions, clearly demonstrating the inherent logical hierarchy of binary instruction semantics.

[0120] Step S252: Obtain the corresponding instruction syntax features and instruction function attributes for each code instruction in the original instruction sequence of the binary stream, and perform instruction semantic deviation analysis between the instruction syntax features and instruction function attributes corresponding to each code instruction based on the binary instruction semantic hierarchy map to obtain the binary code instruction semantic deviation.

[0121] In this embodiment of the invention, the system employs a feature extraction algorithm to extract the corresponding instruction syntax features and instruction function attributes for each code instruction from the original instruction sequence of the binary stream. The instruction syntax features include opcode type, number of operands, operand types (register, memory address, immediate value, etc.), instruction length, etc. Instruction function attributes are determined by analyzing the opcode and operand combinations and combining them with the instruction set specification, such as data transfer, arithmetic operations, logical judgments, flow control, etc., categorized using "ADD". Taking the "EAX, EBX" instruction as an example, its syntax features are: the opcode type is an addition opcode, the number of operands is 2, both of which are register types, and the instruction length is 2 bytes; the function attribute is arithmetic addition. These features and attributes are compared with the previously generated binary instruction semantic hierarchy map. In semantic deviation analysis, the matching degree between the semantic hierarchy location of the instruction in the map and the actual syntax features and function attributes is compared. If an instruction is classified as a data transfer operation in the map, but the actual syntax features show an arithmetic operation opcode, then a semantic deviation is determined. The semantic deviation is quantified by calculating the difference between features and attributes. For example, an opcode type mismatch is recorded as a high deviation, and one less operand is recorded as a medium deviation. Finally, the semantic deviation of the binary code instruction is obtained, providing a basis for subsequent processing.

[0122] Step S253: Perform instruction lexical overflow analysis on each code instruction in the original instruction sequence of the binary stream based on the semantic deviation of the binary code instruction to obtain the semantic lexical overflow part of the binary code instruction.

[0123] In this embodiment of the invention, instruction lexical overflow analysis is performed on each instruction in the original instruction sequence of the binary stream based on previously obtained semantic deviations of binary code instructions. The system pre-establishes a standard instruction vocabulary library, which includes all compliant opcodes, operand representations, and combination rules. For each instruction, the system compares its opcode and operands with the standard instruction vocabulary library. If the instruction contains an opcode form not found in the vocabulary library, or if the operand combination does not conform to the established rules, it is determined to be a semantic lexical overflow. For example, the instruction may contain a custom pseudo-opcode not registered in the standard vocabulary library, or the operand may use an incorrect data type representation (such as incorrectly writing a memory address as an immediate value). Through precise matching and pattern recognition algorithms, these semantic lexical overflow parts are located and extracted. For complex instruction sequences, a segmented scanning method is used to check for overflows segment by segment, ultimately obtaining a complete list of semantic lexical overflow parts of the binary code instructions, clarifying the specific content in the instruction sequence that does not conform to the standard.

[0124] Step S254: Perform dynamic standardization syntax verification on the overflow part of the semantic vocabulary of binary code instructions to obtain a standardized binary code instruction sequence.

[0125] In this embodiment of the invention, dynamic standardized syntax verification is performed on the overflow parts of the semantic vocabulary of the previously obtained binary code instructions. A built-in standardized syntax rule engine is used, which includes rules such as instruction set specifications, syntax format requirements, and vocabulary usage standards. For each overflow part, it is processed according to the rule engine. If the overflow is due to an opcode spelling error, the rule engine automatically corrects it to the correct opcode based on the context and similar opcodes. If the operand combination does not conform to the specification, such as an incorrect memory addressing mode, the rule engine adjusts it according to the correct addressing format. Taking the overflow instruction "MOV EAX,EBX 4" as an example, the rule engine identifies the operand combination error and corrects it to "MOV EAX,[EBX+4]". After verifying and correcting all overflow parts one by one, the processed instructions are integrated with the non-overflowing parts of the original instruction sequence to generate a standardized binary code instruction sequence. This sequence strictly conforms to the instruction set syntax and semantic specifications, providing an accurate and reliable data foundation for subsequent code analysis, compilation optimization, or reverse engineering.

[0126] Furthermore, step S3 includes the following steps:

[0127] Step S31: Perform a line-by-line correlation analysis on each code instruction in the binary code standardized instruction sequence to quantify the data flow dependency and control flow dependency of each code instruction with other instructions in terms of input, output and control jump information into matrix values, and construct the corresponding binary code instruction correlation matrix.

[0128] In this embodiment of the invention, a standardized binary code instruction sequence is input into an instruction association analysis system. A bidirectional analysis algorithm based on data flow and control flow is used to perform line-by-line association analysis on each instruction within the sequence. For each instruction in the instruction sequence, the system first analyzes its input and output operands and control jump information. Taking the instructions "MOV EAX,[EBX+4]" and "ADD EAX,ECX" as examples, the first instruction loads memory data into the EAX register, and its output is the value of the EAX register. The second instruction uses the values ​​of the EAX and ECX registers as inputs for addition. Based on the data transfer relationship between instructions, it is determined that the "ADD EAX,ECX" instruction has a data flow dependency on the "MOV EAX,[EBX+4]" instruction. Regarding control flow, if "JZ" exists... The system analyzes the jump conditions and target address of the "label" instruction, determines its control flow dependency with preceding and following instructions, and quantifies data flow dependency and control flow dependency into matrix values. It stipulates that if instruction i has a data flow dependency on instruction j, element M[i][j] in the matrix is ​​assigned a value of 1, otherwise it is 0; for control flow dependency, if instruction i controls the execution of instruction j, M[i][j] is assigned a value of 2, otherwise it is 0. Following the order of instructions in the sequence, each element of the matrix is ​​calculated and filled sequentially, ultimately constructing the corresponding binary code instruction association matrix. For example, the association matrix obtained after analyzing a sequence containing three instructions might be: This indicates that the first instruction and the second instruction have a data flow dependency, while the remaining instructions have no dependency relationship.

[0129] Step S32: Based on the binary code instruction association matrix, identify the instruction data dependency of the part of the binary code block that involves data transfer, so as to dynamically analyze register and memory operations and trace the data transfer path between instructions using inter-instruction interaction data identifiers, and obtain the instruction data dependency relationship corresponding to the binary code block.

[0130] In this embodiment of the invention, based on a previously constructed binary code instruction association matrix, the data transfer portion of the binary code block is analyzed in the instruction data dependency identification system. Inter-instruction interaction data identifier tracking technology is employed to assign a unique identifier to each register and memory operation. For the instruction "MOV EAX,[EBX+4]", the system assigns identifier R1 to the EAX register and identifier M1 to the memory address [EBX+4]. It records that this instruction transfers data from M1 to R1. When the subsequent instruction "ADD EAX,ECX" is encountered, the system recognizes that it uses R1 (i.e., the EAX register) as input, thus determining that the data transfer path between the two instructions is from M1 to R1 and then participates in the addition operation. By traversing the entire instruction association matrix and performing the above analysis on each instruction involving data operations, and continuously tracking the transfer and changes of identifiers between instructions, the data dependencies between all instructions are identified. For example, if multiple instructions perform read and write operations on the same register, the order of data dependencies can be accurately determined. Finally, these data dependencies are organized into a list, clarifying the data input source and output destination of each instruction, thus obtaining the instruction data dependencies corresponding to the binary code block.

[0131] Step S33: Based on the binary code instruction association matrix, perform instruction control dependency analysis on the part of the binary code block that involves program control, so as to identify and analyze the instruction control dependency relationship between each code instruction and all conditional jumps, loop structures and exception handling of the instructions before and after it, and obtain the instruction control dependency relationship corresponding to the binary code block.

[0132] In this embodiment of the invention, the part of the binary code block involving program control is analyzed in the instruction control dependency analysis system by utilizing the previously generated binary code instruction association matrix. The system first identifies all instructions related to conditional jumps (such as JZ, JNZ), loop structures (such as LOOP), and exception handling. Taking the instructions "CMP EAX,EBX" and "JZlabel" as examples, the "CMP EAX,EBX" instruction compares the values ​​of the EAX and EBX registers and affects the flag bits, while the "JZlabel" instruction determines whether to jump to the label location based on the zero flag bit. Analysis shows that the execution of the "JZ label" instruction depends on the flag bit setting by the "CMP EAX,EBX" instruction, indicating a control dependency between the two. For loop structures, such as the "MOVECX,10" and "LOOP label" instruction sequences, the system identifies that the "LOOP label" instruction controls the loop count based on the value of the ECX register, showing a control dependency with the "MOV ECX,10" instruction that sets the ECX value. Through a depth-first search algorithm, the instruction association matrix is ​​traversed to analyze the program control relationship between each code instruction and its preceding and following instructions, determining all control dependencies. Finally, these relationships are presented in the form of a directed graph, where nodes represent instructions and edges represent the direction of control dependencies, thus obtaining the instruction control dependencies corresponding to the binary code blocks.

[0133] Step S34: Construct the corresponding binary code program dependency graph based on the instruction data dependency relationship and instruction control dependency relationship corresponding to the binary code block.

[0134] In this embodiment of the invention, a binary code program dependency graph is constructed in the program dependency graph construction system based on previously obtained instruction data dependencies and instruction control dependencies. Instructions are represented by nodes, and each node is assigned a unique number and labeled with the instruction's opcode and operand information. For instruction data dependencies, if instruction i and instruction j have a data dependency, the system draws a solid line with an arrow from node i to node j in the graph, and labels the specific content of the data transfer on the line, such as "transfer data from register R1". For instruction control dependencies, if instruction m controls the execution of instruction n, a dashed line with an arrow is drawn from node m to node n, and the control condition is indicated, such as "jump when the zero flag is 1". For example, in an instruction sequence that includes data transfer and conditional jumps, the constructed program dependency graph will have solid edges representing data transfer connecting data-related instruction nodes, and dashed edges representing control dependencies connecting conditional judgment and jump instruction nodes. By integrating all data dependency edges and control dependency edges, a complete binary code program dependency graph is generated. This graph clearly shows the data flow and control execution relationships between instructions in the binary code block, providing an intuitive and comprehensive visualization basis for subsequent code optimization, vulnerability detection, and reverse engineering analysis.

[0135] Furthermore, step S4 includes the following steps:

[0136] Step S41: Based on the binary code standardized instruction sequence, semantic code nodes are embedded into the binary code program dependency graph to generate a binary code representation vector with contextual semantics.

[0137] In this embodiment of the invention, a semantic embedding system is used by inputting a standardized binary code instruction sequence and a binary code program dependency graph into the system. A graph neural network (GNN) algorithm is employed to embed semantic code nodes into each node (i.e., a binary code instruction module) in the binary code program dependency graph. Semantic labels, data flow markers, instruction opcodes, and operands are extracted from the standardized binary code instruction sequence for each instruction module. For example, an instruction module containing data transmission functionality has the semantic label "data loading module" and the data flow marker "unidirectional data transmission from memory to registers." The module contains instructions such as "MOV EAX, [EBX+4]". This information is encoded and converted into vector form as the initial features of the nodes. Based on the structure of the binary code program dependency graph, the message passing mechanism of the graph neural network is used to transmit information between nodes. For each node, feature information from its neighboring nodes is collected and updated in conjunction with its own features. For instance, if an arithmetic operation module node is connected to a data transmission module node, the arithmetic operation module node will receive the data input information transmitted by the data transmission module node and integrate it into its own features. Through iterative computation of multi-layer graph neural networks, each node learns information containing its own semantics and the contextual semantics of surrounding nodes, ultimately generating binary code representation vectors with corresponding contextual semantics. These vectors not only contain the functional semantics of the instruction module itself, but also reflect its contextual association in the entire code program.

[0138] Step S42: Capture the instruction context relationship of the binary code representation vector with context semantics through a pre-trained semantic understanding model, so as to identify and capture the context semantic change relationship corresponding to different binary instructions when they are executed in the program, and construct the context relationship graph between the corresponding binary instructions based on the context semantic change relationship corresponding to different binary instructions when they are executed in the program.

[0139] In this embodiment of the invention, a pre-trained semantic understanding model is input into a previously generated binary code representation vector with corresponding contextual semantics. This model adopts a Transformer architecture and is pre-trained on a large-scale binary code dataset, possessing the ability to understand binary code semantics. After receiving the binary code representation vector, the model performs weighted processing on each element in the vector through a multi-head attention mechanism to capture the contextual semantic changes corresponding to different binary instructions during program execution. Taking an instruction sequence containing conditional judgment and data processing as an example, when a conditional jump instruction is encountered, the model analyzes the impact of the conditional jump instruction on the execution of subsequent data processing instructions based on the representation vectors of the instructions before and after it, identifying whether the condition is met or not, which leads to different data processing paths, thereby capturing the changes in contextual semantics. The model organizes the captured contextual semantic changes, using nodes to represent binary instructions and edges to represent the contextual relationships between instructions, constructing a contextual relationship graph between various binary instructions. The type of edge is distinguished according to the different contextual relationships, such as data dependency edges, control dependency edges, etc. For example, if the input of a data processing instruction depends on the execution result of a preceding conditional judgment instruction, a data dependency edge is added between the nodes corresponding to these two instructions, and the relevant dependency information is labeled. In this way, a complete context relationship graph is generated, which clearly shows the semantic relationship and changes of different binary instructions during program execution.

[0140] Step S43: Construct a corresponding semantic reasoning framework based on the context relationship graph between each binary instruction, and based on this semantic reasoning framework, introduce the internal logical structure and control flow information of the instruction corresponding to the binary code representation vector with context semantics to deduce the corresponding potential semantic information, including the actual function, execution conditions and semantic relationships between other instructions of each binary code instruction, to obtain the semantic information of the binary code block.

[0141] In this embodiment of the invention, a semantic reasoning framework is constructed in the semantic reasoning system based on a previously built context relationship graph between various binary instructions. This framework employs a reasoning approach combining rule-based and machine learning methods, and incorporates a semantic rule library and reasoning algorithm for binary code instructions. Binary code representation vectors with corresponding contextual semantics are input into the semantic reasoning framework, which then extracts the inherent logical structure and control flow information of the instructions from the representation vectors. For example, for a loop-structured instruction module, the loop condition, loop body instructions, and jump information after the loop ends are extracted. By combining contextual relationship graphs and utilizing rules from a semantic rule base, the framework infers binary code instructions. If the graph shows that a data processing instruction is executed under specific conditions, and these conditions are determined by preceding condition judgment instructions, the inference framework, based on the semantic rules of condition judgment and data processing in the rule base, deduces that the actual function of the data processing instruction is to perform specific operations on the data when specific conditions are met. The execution condition is the judgment condition of the preceding condition judgment instruction. Simultaneously, it clarifies the semantic relationships between the instruction and other instructions, such as data dependency and control dependency. Through inference on all binary code instructions, the framework integrates the potential semantic information, including the actual function, execution conditions, and semantic relationships between each binary code instruction and other instructions. This ultimately generates semantic information for binary code blocks. This semantic information is presented in a structured form, including instruction function descriptions, execution condition lists, and semantic relationship graphs, providing a comprehensive and in-depth semantic basis for the analysis, understanding, and application of binary code.

[0142] Furthermore, step S41 includes the following steps:

[0143] The standardized binary code instruction sequence is modularized to assign corresponding semantic tags and data flow markers to each binary code instruction module according to the corresponding syntax rules, calling relationships and data transmission flow, so as to generate semantic hierarchical information flow data corresponding to each binary code instruction module.

[0144] In this embodiment of the invention, a standardized binary code instruction sequence is input into a modular processing system. An algorithm based on syntax rules and functional partitioning is used to process the instruction sequence. First, according to pre-defined syntax rules, such as opcode combinations and operand formats, the instruction sequence is divided into different modules. For example, instructions such as "MOV EAX,[EBX+4]" and "MOV ECX,10" that implement data transmission functions are classified as data transmission modules; instructions containing conditional judgments and jumps, such as "CMP EAX,EBX" and "JZ label," are classified as control flow modules. For each module, its call relationships and data transfer flows are analyzed. If an instruction in one module calls a function or variable defined in another module, the system records this call relationship. Simultaneously, the system tracks the input, output, and transfer paths of data within the module. For example, in a data transfer module, the instruction "MOV EAX,[EBX+4]" transfers memory data to the EAX register, and the subsequent instruction "ADD EAX,ECX" uses the EAX register value as input for computation. The system clearly defines the data transfer flow from memory to registers and then participates in computation. Based on the analysis results, each binary code instruction module is assigned a semantic label and a data flow marker. The semantic label describes the module's function, such as "data loading module" or "conditional judgment module." The data flow marker identifies the direction and processing method of data within the module, such as "unidirectional data transfer from memory to registers" or "logical operations based on register data." Finally, the semantic labels, data flow markers, and instruction information within each module are integrated to generate semantic hierarchical information flow data corresponding to each binary code instruction module.

[0145] Preferably, based on the semantic hierarchical information flow data corresponding to each binary code instruction module, the module adjacency cohesion distribution among different binary code instruction modules within the binary code standardized instruction sequence is evaluated to obtain the module cohesion distribution matrix among each binary code instruction module.

[0146] In this embodiment of the invention, based on previously generated semantic hierarchical information flow data, the cohesion evaluation system assesses different binary code instruction modules within a standardized binary code instruction sequence. An evaluation method based on information entropy and functional relevance is used to calculate the cohesion between modules. For each pair of adjacent modules, the system first analyzes their semantic tags and data flow markers. For example, if the data transmission module provides the data required for the arithmetic operation module and their semantic label display functions are closely related, then they score highly in terms of functional correlation. The degree of data correlation is quantified by calculating the information entropy of the shared data between modules. The lower the information entropy, the more concentrated the data interaction between modules and the stronger the cohesion. According to the order of the modules in the instruction sequence, the cohesion score between each pair of adjacent modules is calculated in turn, and these scores are filled into the module cohesion distribution matrix. The rows and columns of the matrix correspond to different binary code instruction modules. The matrix element M[i][j] represents the cohesion score between module i and module j. For example, if the data transmission module is module 1 and the arithmetic operation module is module 2, and their cohesion score is 0.8, then M[1][2] = 0.8 in the matrix. In this way, the system obtains the complete module cohesion distribution matrix between each binary code instruction module, which intuitively shows the degree of correlation between modules. H(X)=-∑ x∈X p(x)log2p(x), where X is the set of shared data between module i and module j, x is a single data element in set X, p(x) is the probability of data element x appearing in the shared data set, the smaller the information entropy H(X) value, the more concentrated the data distribution and the more stable the data interaction between modules, and α is a weighting coefficient, ranging from 0 to 1, used to adjust the influence of functional relevance and data information entropy on the cohesion score. For example, when α = 0.6, more emphasis is placed on the influence of functional relevance on the result.

[0147] Preferably, semantic deep dependency parsing is performed on the dependency paths between different binary code instruction modules in the binary code program dependency graph based on the module cohesion distribution matrix between each binary code instruction module, so as to generate a multi-dimensional dependency flow graph of the binary code program.

[0148] In this embodiment of the invention, the dependency path between different binary code instruction modules within the binary code program dependency graph is analyzed in the dependency resolution system based on the previously obtained module cohesion distribution matrix. An algorithm combining graph traversal and semantic reasoning is employed, starting from the nodes of the dependency graph (i.e., binary code instruction modules) and performing a depth-first traversal along the dependency edges (data dependencies and control dependencies). During the traversal, the system combines the module cohesion distribution matrix to evaluate the semantic depth of the dependency. For example, if the data transmission module and the arithmetic operation module are connected by a data dependency edge in the dependency graph, and the module cohesion distribution matrix shows high cohesion between the two, the system infers that the dependency between these two modules is not only based on data transmission but also has a strong functional association, constituting a deep dependency. The aforementioned semantic depth analysis is performed on each dependency path, and different weights and attributes are assigned to the dependency edges based on the analysis results. The weights reflect the tightness of the dependency, and the attributes describe the type of dependency (e.g., data-driven, control-driven) and semantic depth (shallow dependency, deep dependency). Finally, the system integrates this information into a dependency graph to generate a multi-dimensional dependency flow graph of the binary code program. This graph not only shows the dependencies between modules, but also reflects the semantic depth differences of the dependencies.

[0149] Preferably, semantic node embedding context-aware analysis is performed based on the multi-dimensional dependency flow graph of the binary code program to generate binary code representation vectors with contextual semantics.

[0150] In this embodiment of the invention, a semantic analysis system is used to input a multi-dimensional dependency flow graph of a previously generated binary code program into the system for context-aware semantic node embedding analysis. The system employs an algorithm combining graph neural networks and an attention mechanism to process each node (i.e., a binary code instruction module) in the dependency flow graph. For each node, the system first extracts its semantic label, data flow markers, and dependency information with neighboring nodes. For example, for a condition judgment module node, the system obtains its "condition judgment" semantic label, data input / output data flow markers, and control dependencies with preceding and following modules. Then, using a graph neural network, the node information and its neighboring node information are aggregated and passed through multiple layers of neural networks to learn the contextual semantics of the node in the entire dependency flow graph. During the aggregation process, an attention mechanism is introduced, assigning different attention weights to different neighboring nodes based on the module cohesion distribution matrix and the semantic depth of the dependencies. For example, neighboring nodes with high cohesion and deep dependencies with the current module receive higher weights during information aggregation to highlight their importance to the semantic understanding of the current module. After network training and information aggregation, the system generates a binary code representation vector with corresponding contextual semantics for each node. This vector contains the semantic information of the node itself as well as its contextual association information in the entire code block. It can accurately reflect the semantic role and function of the binary code instruction module in the code block, providing an effective semantic representation basis for subsequent code understanding, optimization and vulnerability detection.

[0151] Example 2

[0152] The binary code block semantic information automatic capture system of the present invention includes the following steps:

[0153] The parsing module is used to disassemble binary code blocks to obtain binary assembly code representations, and to perform instruction-level parsing on the binary code blocks based on the binary assembly code representations to obtain the original instruction sequence of the binary stream.

[0154] The conversion module is used to perform semantic intermediate representation conversion on the original instruction sequence of the binary stream to obtain a binary instruction semantic intermediate representation, and to perform lexical overflow standardization on the original instruction sequence of the binary stream based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence.

[0155] The construction module is used to obtain the instruction data dependency relationship and instruction control dependency relationship corresponding to the binary code block through the binary code standardized instruction sequence, and to construct the corresponding binary code program dependency graph based on the instruction data dependency relationship and instruction control dependency relationship corresponding to the binary code block;

[0156] The reasoning module is used to embed semantic code nodes into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics. The semantics of the binary code representation vector with contextual semantics are automatically captured and reasoned through a pre-trained semantic understanding model to obtain the semantic information of the binary code block.

[0157] Example 3

[0158] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the automatic capture method for semantic information of binary code blocks. For example, the method includes: disassembling the binary code block to obtain a binary assembly code representation; performing instruction-level parsing on the binary code block based on the binary assembly code representation to obtain a binary stream original instruction sequence; performing semantic intermediate representation transformation on the binary stream original instruction sequence to obtain a binary instruction semantic intermediate representation; performing lexical overflow standardization on the binary stream original instruction sequence based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence; obtaining instruction data dependencies and instruction control dependencies corresponding to the binary code block through the binary code standardized instruction sequence; constructing a corresponding binary code program dependency graph based on the instruction data dependencies and instruction control dependencies corresponding to the binary code block; embedding semantic code nodes into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics; and performing automatic semantic capture and reasoning on the binary code representation vector with contextual semantics using a pre-trained semantic understanding model to obtain the semantic information of the binary code block.

[0159] Example 4

[0160] A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the automatic capture method for semantic information of binary code blocks, for example including: disassembling the binary code block to obtain a binary assembly code representation; performing instruction-level parsing on the binary code block based on the binary assembly code representation to obtain a binary stream original instruction sequence; performing semantic intermediate representation transformation on the binary stream original instruction sequence to obtain a binary instruction semantic intermediate representation; performing lexical overflow standardization on the binary stream original instruction sequence based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence; obtaining instruction data dependencies and instruction control dependencies corresponding to the binary code block through the binary code standardized instruction sequence; constructing a corresponding binary code program dependency graph based on the instruction data dependencies and instruction control dependencies corresponding to the binary code block; embedding semantic code nodes into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics; and performing automatic semantic capture and reasoning on the binary code representation vector with contextual semantics through a pre-trained semantic understanding model to obtain the semantic information of the binary code block. The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the present invention. Any simple modifications, alterations, or equivalent structural changes made to the above embodiments based on the technical essence of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for automatically capturing semantic information of binary code blocks, characterized in that, Includes the following steps: The binary code block is disassembled to obtain a binary assembly code representation. Based on the binary assembly code representation, the binary code block is parsed at the instruction level to obtain the original instruction sequence of the binary stream. The original binary stream instruction sequence is transformed into a semantic intermediate representation to obtain a binary instruction semantic intermediate representation. Based on the binary instruction semantic intermediate representation, the original binary stream instruction sequence is normalized by lexical overflow to obtain a binary code normalized instruction sequence. The instruction data dependency and instruction control dependency of the binary code block are obtained through the binary code standardized instruction sequence, and the corresponding binary code program dependency graph is constructed based on the instruction data dependency and instruction control dependency of the binary code block. Based on the standardized instruction sequence of the binary code, semantic code nodes are embedded in the binary code program dependency graph to generate binary code representation vectors with contextual semantics. Semantic automatic capture and reasoning are then performed on the binary code representation vectors with contextual semantics through a pre-trained semantic understanding model to obtain semantic information of binary code blocks.

2. The method for automatically capturing semantic information of binary code blocks according to claim 1, characterized in that, The process of disassembling the binary code block to obtain a binary assembly code representation, and then performing instruction-level parsing on the binary code block based on the binary assembly code representation to obtain the original instruction sequence of the binary stream is as follows: The binary code block is initially deconstructed to obtain the binary code byte layout and metadata. The binary code byte layout and metadata are then parsed to obtain the parsing information data corresponding to each opcode, operand and instruction within the binary code block. The binary code block is constructed by performing binary structure mapping on the parsing information data corresponding to each opcode, operand, and instruction. The binary code structure unit is split into different levels according to a predetermined rule. The binary code structure unit includes an opcode field, an immediate value, and a register bit. A corresponding binary code structure map is constructed based on the binary code structure unit corresponding to the different levels. Based on the binary code structure map, opcode index analysis is performed on the binary code blocks, and a binary opcode index library containing all opcodes and their corresponding memory addresses and operand types is constructed based on the analysis results. Based on the binary opcode index library, each code instruction within the binary code block is disassembled to generate a binary assembly code representation; Based on the binary assembly code representation, the binary code block is parsed at the instruction level to generate the original instruction sequence of the binary stream.

3. The method for automatically capturing semantic information of binary code blocks according to claim 2, characterized in that, The process of disassembling each code instruction within a binary code block based on the binary opcode index library to generate a binary assembly code representation is as follows: Based on the binary opcode index library, instruction behavior control mapping is performed on each code instruction within the binary code block to analyze the execution impact of each code instruction and its control transfer relationship with other instructions. Based on the control transfer relationship, a corresponding control flow graph between binary code instructions is constructed. The number of binary code program control branches corresponding to each code instruction in the binary code block is obtained when the program is executed, and the control flow graph between the binary code instructions is dynamically cached and optimized based on the number of binary code program control branches to generate an optimized control flow graph between binary instructions. Based on the optimized control flow graph between binary instructions, operation constraint mapping is performed on the operands corresponding to each code instruction in the binary code block. By analyzing the context relationship, memory location and mutual dependency control constraints between the operands and other instructions, binary code instruction dependency control constraints are generated. Based on the optimized control flow graph between binary instructions and the binary code instruction dependency control constraints, each code instruction within the binary code block is disassembled to generate a binary assembly code representation.

4. The method for automatically capturing semantic information of binary code blocks according to claim 1, characterized in that, The process of performing semantic intermediate representation transformation on the original binary stream instruction sequence to obtain a binary instruction semantic intermediate representation, and then performing lexical overflow standardization on the original binary stream instruction sequence based on the binary instruction semantic intermediate representation to obtain a binary code-standardized instruction sequence is as follows: The binary stream original instruction sequence is mapped to an instruction syntax pattern, which maps the opcode, operands and control bits of each code instruction to the corresponding instruction syntax pattern to generate a binary stream instruction syntax pattern mapping table. Based on the binary stream instruction syntax pattern mapping table, the original binary stream instruction sequence is analyzed for instruction syntax function to obtain the syntax function identifier data corresponding to the binary stream code instruction, which includes data transmission, logical operation and control flow jump. Based on the grammatical function identifier data, instruction execution context reasoning is performed to obtain instruction control execution semantic context information between each binary stream code instruction; Based on the instruction control execution semantic context information between the binary stream code instructions, a semantic intermediate representation transformation is performed on each code instruction in the original binary stream instruction sequence to obtain a binary instruction semantic intermediate representation. Based on the binary instruction semantic intermediate representation, the original instruction sequence of the binary stream is lexical overflow normalized to obtain a binary code normalized instruction sequence.

5. The method for automatically capturing semantic information of binary code blocks according to claim 1, characterized in that, The specific steps for obtaining the instruction-data dependencies and instruction-control dependencies corresponding to binary code blocks through the binary code standardized instruction sequence, and constructing the corresponding binary code program dependency graph based on the instruction-data dependencies and instruction-control dependencies corresponding to the binary code blocks are as follows: Each code instruction in the binary code standardized instruction sequence is analyzed for correlation. The data flow dependency and control flow dependency of each code instruction with other instructions in terms of input, output and control jump information are quantified into matrix values. A binary code instruction correlation matrix is ​​constructed based on the matrix. Based on the binary code instruction association matrix, instruction data dependency identification is performed on the parts of the binary code block that involve data transmission. The inter-instruction interaction data identifier is used to dynamically analyze register and memory operations and trace the data transmission path between instructions to obtain the instruction data dependency relationship corresponding to the binary code block. Based on the binary code instruction association matrix, instruction control dependency analysis is performed on the part of the binary code block that involves program control, so as to identify and analyze the instruction control dependency relationship between each code instruction and all conditional jumps, loop structures and exception handling of the instructions before and after it, and obtain the instruction control dependency relationship corresponding to the binary code block. Construct a binary code program dependency graph based on the instruction data dependencies and instruction control dependencies corresponding to the binary code blocks.

6. The method for automatically capturing semantic information of binary code blocks according to claim 1, characterized in that, The specific steps for embedding semantic code nodes into the binary code program dependency graph based on the standardized instruction sequence of the binary code to generate binary code representation vectors with contextual semantics, and then using a pre-trained semantic understanding model to perform automatic semantic capture and reasoning on the binary code representation vectors with contextual semantics to obtain the semantic information of the binary code blocks are as follows: Semantic code nodes are embedded into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics. By using a pre-trained semantic understanding model, the instruction context relationship of the binary code representation vector with context semantics is captured, so as to capture the context semantic change relationship of different binary instructions when they are executed in the program, and construct the context relationship graph between the binary instructions based on the context semantic change relationship of different binary instructions when they are executed in the program. Based on the context relationship graph between the binary instructions, a corresponding semantic reasoning framework is constructed. Based on this semantic reasoning framework, the internal logical structure and control flow information of the corresponding instructions in the binary code representation vector with context semantics are introduced to deduce the corresponding potential semantic information, including the actual function, execution conditions and semantic relationships between other instructions of each binary code instruction, to obtain the semantic information of the binary code block.

7. The method for automatically capturing semantic information of binary code blocks according to claim 1, characterized in that, The specific operation of embedding semantic code nodes into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics is as follows: The standardized binary code instruction sequence is modularized, and each binary code instruction module is assigned a corresponding semantic label and data flow mark according to the corresponding syntax rules, calling relationship and data transmission flow, so as to generate semantic hierarchical information flow data corresponding to each binary code instruction module. Based on the semantic hierarchical information flow data corresponding to each binary code instruction module, the module adjacency cohesion distribution among different binary code instruction modules in the binary code standardized instruction sequence is evaluated to obtain the module cohesion distribution matrix among each binary code instruction module. Based on the module cohesion distribution matrix among the binary code instruction modules, semantic deep dependency parsing is performed on the dependency path between different binary code instruction modules in the binary code program dependency graph, and a multi-dimensional dependency flow graph of the binary code program is generated based on the parsing results. Based on the multi-dimensional dependency flow graph of the binary code program, semantic node embedding context-aware analysis is performed to generate binary code representation vectors with context semantics.

8. A system for automatically capturing semantic information of binary code blocks, characterized in that, Includes the following steps: The parsing module is used to disassemble binary code blocks to obtain binary assembly code representations, and to perform instruction-level parsing on the binary code blocks based on the binary assembly code representations to obtain the original instruction sequence of the binary stream. The conversion module is used to perform semantic intermediate representation conversion on the original instruction sequence of the binary stream to obtain a binary instruction semantic intermediate representation, and to perform lexical overflow standardization on the original instruction sequence of the binary stream based on the binary instruction semantic intermediate representation to obtain a binary code standardized instruction sequence. The construction module is used to obtain the instruction data dependency relationship and instruction control dependency relationship corresponding to the binary code block through the binary code standardized instruction sequence, and to construct the corresponding binary code program dependency graph based on the instruction data dependency relationship and instruction control dependency relationship corresponding to the binary code block; The reasoning module is used to embed semantic code nodes into the binary code program dependency graph based on the binary code standardized instruction sequence to generate a binary code representation vector with contextual semantics. The semantics of the binary code representation vector with contextual semantics are automatically captured and reasoned through a pre-trained semantic understanding model to obtain the semantic information of the binary code block.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the automatic capture method for semantic information of binary code blocks as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the automatic capture method for semantic information of binary code blocks as described in any one of claims 1-7.

Images