Reverse restoration method and device for confusion program, medium and product

Abstract

The invention discloses a reverse restoration method and device for a confusion program, a medium and a product, and relates to the technical field of anti-confusion and financial science and tech, and the method comprises the steps: obtaining a target confusion program, sequentially detecting and restoring Boolean value operation, a confusion character string array, a confusion attribute name and indirect function confusion call existing in the target confusion program. Obtaining a first reverse reduction program; detecting redundant codes in the first reverse reduction program through static analysis and dynamic analysis, and removing the detected redundant codes in the first reverse reduction program to obtain a second reverse reduction program; and performing control flow flattening reverse restoration processing on the second reverse restoration program to obtain a target reverse restoration program corresponding to the target obfuscation program, and restoring the original execution path of the code, thereby solving the problem of vulnerability concealment caused by code obfuscation, enhancing the high-risk vulnerability detection rate and the attack surface coverage capability, and improving the security of the high-risk vulnerability. And the reliability and the effectiveness of depth reversal of the target confusion program are improved.

Description

Technical Field

[0001] This invention relates to the fields of anti-obfuscation and financial technology, and in particular to a method, apparatus, medium and product for reversing obfuscation procedures. Background Technology

[0002] In the fintech field, program code carries a large amount of core business logic. To protect core assets in various financial scenarios, code obfuscation, by transforming code into a form that is difficult to read but whose functionality remains unchanged, increases the difficulty of analyzing and stealing core logic and has become a common method for ensuring the security of program code in the fintech field.

[0003] Security penetration testing of obfuscated code primarily utilizes browser developer tools to trace the code execution flow by setting breakpoints, thereby capturing runtime variables and stack information to achieve reverse analysis of the obfuscated code.

[0004] However, this dynamic debugging method is susceptible to anti-debugging measures, causing the debugging process to pause indefinitely and making reverse engineering difficult. When dealing with complex obfuscated logic such as control flow flattening, testers must manually trace the code execution path, reducing analysis efficiency. Furthermore, this method has strong environment dependencies, making it impossible to directly debug obfuscated code in environments such as headless browsers. This significantly limits its applicability, reduces the reliability and effectiveness of reverse engineering obfuscated logic, lowers the detection rate of high-risk vulnerabilities hidden in obfuscated programs, and diminishes the security verification effectiveness of penetration testing. Summary of the Invention

[0005] This invention provides a method, device, medium, and product for reverse engineering obfuscated programs, in order to solve the problems of low reliability and effectiveness of reverse engineering obfuscated programs, low detection rate of hidden high-risk vulnerabilities in obfuscated programs, and poor security verification effect of penetration testing.

[0006] According to one aspect of the present invention, a method for reversing obfuscation programs is provided, comprising:

[0007] Obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls present in the target obfuscated program, and obtain the first reverse restoration program;

[0008] Redundant code is detected in the first reverse engineering program through static and dynamic analysis, and the detected redundant code is removed in the first reverse engineering program to obtain the second reverse engineering program.

[0009] The second reverse restoration program is subjected to control flow flattening reverse restoration processing to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0010] According to another aspect of the present invention, a reverse engineering apparatus for obfuscated programs is provided, comprising:

[0011] The first reverse module is used to obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names and obfuscated indirect function calls in the target obfuscated program, and obtain the first reverse restoration program;

[0012] The second reverse module is used to detect redundant code in the first reverse restoration program through static and dynamic analysis, and remove the detected redundant code in the first reverse restoration program to obtain the second reverse restoration program.

[0013] The flattened reverse module is used to perform control flow flattening reverse restoration on the second reverse restoration program to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the reverse engineering method of the obfuscated program according to any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the reverse restoration method of the obfuscated program according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the method as described in any embodiment of the present invention.

[0018] The technical solution of this invention obtains a target obfuscated program, sequentially detects and restores Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls to obtain a first reverse engineering program. This restores the obfuscation's masking of code logic, clearly revealing hidden branch judgments, key strings, true attribute associations, and actual function functionalities. Through static and dynamic analysis, redundant code is detected and removed from the first reverse engineering program to obtain a second reverse engineering program. This simplifies the code structure, eliminates invalid content, improves analysis efficiency, and reduces logical misjudgments. The second reverse engineering program undergoes control flow flattening reverse engineering to obtain the target reverse engineering program. This restores the obfuscated program to a linear execution flow, reconstructing the original code execution path. This solves the vulnerability concealment problem caused by code obfuscation, improves the detection rate of high-risk vulnerabilities and attack surface coverage, enhances the reliability and effectiveness of deep reverse engineering of the target obfuscated program, and improves the security verification effect of penetration testing.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a method for reversing an obfuscated program according to Embodiment 1 of the present invention;

[0022] Figure 2 This is a flowchart of another method for reversing an obfuscated program according to Embodiment 2 of the present invention;

[0023] Figure 3 This is a flowchart of another method for reversing an obfuscated program according to Embodiment 3 of the present invention;

[0024] Figure 4 This is a schematic diagram illustrating the reverse engineering of an obfuscation procedure applicable to an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of the structure of a reverse restoration device for an obfuscated program provided in Embodiment 4 of the present invention;

[0026] Figure 6This is a schematic diagram of the structure of an electronic device that implements the reverse restoration method of the obfuscation program according to embodiments of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] Example 1

[0030] Figure 1 This is a flowchart of a method for reversing obfuscated programs according to Embodiment 1 of the present invention. This embodiment is applicable to the situation of reversing obfuscated programs. The method can be executed by a device for reversing obfuscated programs. The device for reversing obfuscated programs can be implemented in hardware and / or software and is generally configured in electronic devices.

[0031] Correspondingly, such as Figure 1 As shown, the method includes:

[0032] S110. Obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names and obfuscated indirect function calls in the target obfuscated program, and obtain the first reverse restoration program.

[0033] In this embodiment of the invention, the target obfuscated program can be specifically understood as: a current processing program that has undergone code obfuscation processing, such as Boolean value operation transformation, string encoding, meaningless attribute names, and indirect function calls, resulting in hidden logic that is difficult to analyze directly, but whose functionality is consistent with the original program. Boolean value operation can be specifically understood as: an obfuscated form that masks simple Boolean judgments through bitwise operations or conditional transformations. Obfuscated string array can be specifically understood as: an obfuscated form that hides key strings through encoding (such as hexadecimal encoding) and stores them in an array.

[0034] Obfuscating attribute names can be understood as replacing the actual attribute names of an object with meaningless characters, thus masking the obfuscated form of the association between the object and the attribute. Obfuscating indirect function calls can be understood as indirectly calling functions through methods such as function name encoding and dynamic indexing, instead of directly calling them, thus hiding the obfuscated form of the function's true association. The first reverse engineering program can be understood as: a program that sequentially restores the reverse engineering results obtained after four types of obfuscation: Boolean value operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls.

[0035] Specifically, the target obfuscated program is obtained and identified in a fixed detection order, including Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls. For each obfuscation type, the matching obfuscation features of the current obfuscation category are identified first, the obfuscated program of the current obfuscation category is reverse-processed, and then the obfuscated program of the next obfuscation category is detected and restored.

[0036] For example, Boolean operation obfuscation can detect the existence of bitwise operations masking simple judgments. Combining the essential characteristics of Boolean true and false, it restores complex operations to intuitive Boolean judgments through logical operations. Obfuscating string arrays can detect the existence of encoded hidden key strings. It restores the encoded obfuscated strings to readable original strings through encoding / decoding tools or manual calculation. Obfuscating attribute names can detect the existence of meaningless replacements of real attribute names. It collects the calling context of attributes through code analysis tools, infers the true semantics by analyzing the source of attribute assignments and the purpose of values, and then replaces meaningless character combinations with intuitive attribute names. Obfuscating indirect function calls can detect the existence of dynamic indirect function calls. It obtains the real function names corresponding to parameters by statically parsing the mapping function logic and restores the indirect call form to a direct function call.

[0037] After detecting and restoring the four types of obfuscation, the first reverse restoration procedure is obtained.

[0038] S120. Redundant code is detected in the first reverse engineering program through static and dynamic analysis, and the detected redundant code is removed in the first reverse engineering program to obtain the second reverse engineering program.

[0039] In this embodiment of the invention, static analysis can be specifically understood as: an analysis method that identifies redundancy only by parsing static information such as code structure and syntax rules (e.g., abstract syntax trees and module dependencies) without running the code. An abstract syntax tree can be specifically understood as: a tree-like representation of the source code's syntax structure. It strips away irrelevant details such as spaces and comments, focusing on the logical relationships and hierarchical structure of program elements such as variables, functions, expressions, and control flow. Dynamic analysis can be specifically understood as: an analysis method that identifies redundancy by running the code and recording dynamic behavioral data such as code execution trajectory and coverage.

[0040] Redundant code can be specifically understood as code that has no practical function in the program and does not affect the execution of functions, such as unreferenced variables or functions, unreachable branches, and unexecuted modules; it can also be understood as dead code. The second reverse engineering process can be specifically understood as the reverse engineering process obtained after removing the redundant code detected in the first reverse engineering process.

[0041] Specifically, in the static analysis phase, redundancy is identified by parsing the code structure (e.g., generating an abstract syntax tree based on the first reverse engineering process), such as code that has no practical function, including unreferenced variables, unreachable branches, and unexecuted modules. In the dynamic analysis phase, redundancy is identified by running the code and recording its behavior. The two phases complement each other to ensure comprehensive detection.

[0042] The identified redundant code is removed from the first reverse engineering process to obtain the second reverse engineering process.

[0043] S130. Perform control flow flattening reverse restoration processing on the second reverse restoration program to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0044] In this embodiment of the invention, control flow flattening can be specifically understood as: a technique that obfuscates program logic through a state machine-driven approach, breaking down the originally linear execution flow into a state-driven branching structure, disrupting the intuitiveness of the code logic, and making the execution path difficult to trace. Control flow flattening reverse engineering can be specifically understood as: the reverse operation of control flow flattening obfuscation, restoring the disrupted execution flow to its original linear and coherent logical order by identifying features such as state mechanisms and branch associations within the obfuscation. The target reverse engineering program can be specifically understood as: a program with the same functionality as the initial target obfuscated program, but with clear code logic, an intuitive execution flow, and eliminated obfuscation, which can be directly used for vulnerability analysis and functional profiling in penetration testing.

[0045] Specifically, the second reverse engineering program undergoes control flow flattening reverse engineering. For example, an abstract syntax tree is generated based on the second reverse engineering program. By parsing the abstract syntax tree, the state variables, branch structures, and state transition logic used to drive the flow are identified, and the correspondence between states and branches in the obfuscation is determined. The complete state sequence is extracted, and the initial values, update rules, and branch execution conditions of all states are sorted out through static analysis. According to the branch logic corresponding to the state sequence, the code that was originally scattered in different branch blocks is recombined into a coherent code block according to the actual execution order. At the same time, redundant state judgments used for control flow obfuscation, such as empty branches used only for jumps and repeated state updates, are removed. The control flow flattening reverse engineering is completed, and the target reverse engineering program corresponding to the target obfuscation program is obtained.

[0046] The technical solution of this invention obtains a target obfuscated program, sequentially detects and restores Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls to obtain a first reverse engineering program. This restores the obfuscation's masking of code logic, clearly revealing hidden branch judgments, key strings, true attribute associations, and actual function functionalities. Through static and dynamic analysis, redundant code is detected and removed from the first reverse engineering program to obtain a second reverse engineering program. This simplifies the code structure, eliminates invalid content, improves analysis efficiency, and reduces logical misjudgments. The second reverse engineering program undergoes control flow flattening reverse engineering to obtain the target reverse engineering program. This restores the obfuscated program to a linear execution flow, reconstructing the original code execution path. This solves the vulnerability concealment problem caused by code obfuscation, improves the detection rate of high-risk vulnerabilities and attack surface coverage, enhances the reliability and effectiveness of deep reverse engineering of the target obfuscated program, and improves the security verification effect of penetration testing.

[0047] Example 2

[0048] Figure 2 This is a flowchart of another method for reverse restoration of an obfuscated program provided in Embodiment 2 of the present invention. This embodiment is a refinement of the above embodiment of "sequentially detecting and restoring the Boolean operations, obfuscated string arrays, obfuscated attribute names and obfuscated indirect function calls existing in the target obfuscated program to obtain the first reverse restoration program".

[0049] Correspondingly, such as Figure 2 As shown, the method includes:

[0050] S210. Obtain the target obfuscation program. When there are Boolean operations in the target obfuscation program, perform obfuscation and reverse processing on each Boolean operation to obtain the first intermediate stage restoration program.

[0051] In this embodiment of the invention, the first intermediate stage restoration program can be specifically understood as: processing the intermediate results after Boolean value operations. If the target program has obfuscated Boolean value operations, then it is the restored program; otherwise, it is directly equivalent to the target obfuscated program.

[0052] Specifically, the target obfuscated program is obtained, and the presence of Boolean operations in the target obfuscated program is detected. This can be done by using preset regular expressions to identify non-intuitive expressions such as ! 0x0 and ! ! []. If obfuscated Boolean operations are present, they are reverse-engineered according to Boolean conversion rules (e.g., non-zero numbers and non-empty arrays are converted to true, and 0 is converted to false) to obtain the first intermediate stage restoration program. If such operations are not present, the target obfuscated program is directly used as the first intermediate stage restoration program.

[0053] In a specific example, since any non-zero number (including negative numbers) is converted to a Boolean value of true (representing "true") and 0 is converted to a Boolean value of false (representing "false"), following the above principle, the obfuscated ! 0x0 can be replaced with true, ! 0x1 with false, ! ! [] with true, and ! [] with false. Here, 0x represents hexadecimal; ! represents logical NOT, which negates false and returns true, and negates true and returns false; [] represents an empty array, which is converted to a Boolean value of true. All objects or arrays, regardless of whether they are empty, default to true.

[0054] S220. When at least one string obfuscation feature is identified in the first intermediate stage restoration program, after calculating the actual index of the obfuscated string array corresponding to the string obfuscation feature, the matching obfuscated string array is statically restored according to the actual index to obtain the second intermediate stage restoration program.

[0055] In this embodiment of the invention, string obfuscation features can be specifically understood as: identifiers indicating that a string has been obfuscated, such as functions containing large arrays and index offset calculations in a program, which serve as the basis for identifying string obfuscation. The actual index can be specifically understood as: the index value pointing to the position of the actual character in the obfuscated string array, obtained by calculating the index offset. The second intermediate stage restoration program can be specifically understood as: processing the intermediate results after string obfuscation; if string obfuscation exists, it is the statically restored program; if not, it is equivalent to the first intermediate stage restoration program.

[0056] Specifically, when at least one string obfuscation feature is identified in the first intermediate stage restoration program, such as features including functions containing large arrays and index offset calculations, the actual index of the obfuscated string array is obtained through index offset calculation (e.g., parsing expressions of the form i+3). Static restoration is then performed on the matched obfuscated string arrays based on the actual index. For example, if the character extracted from the large array based on the actual index is an encoded character (e.g., \x65, where \x is a fixed prefix indicating that the following characters are hexadecimal numbers and 65 is a hexadecimal value), it is statically restored to the original readable string (e.g., 'eq') according to preset rules and replaced. After static restoration of all matched obfuscated string arrays based on the actual index, the second intermediate stage restoration program is obtained.

[0057] If no features are found, the first intermediate stage restoration procedure is directly identified as the second intermediate stage restoration procedure.

[0058] Optionally, based on the above embodiments, calculating the actual index of the obfuscated string array corresponding to the string obfuscation feature may include:

[0059] The obfuscated string array is extracted by matching the array declaration in the target obfuscator using a first regular expression that matches the string obfuscation features.

[0060] The offset value is extracted by matching the binary operation pattern in the target obfuscator using a second regular expression that matches the string obfuscation features;

[0061] The call parameter values ​​of the call function are extracted by matching the called function in the target obfuscator with a third regular expression that matches the string obfuscation features.

[0062] The actual index of the obfuscated string array corresponding to the obfuscated string feature is calculated based on the call parameter value and the offset value.

[0063] In this embodiment of the invention, the first, second, and third regular expressions can be specifically understood as: regular expressions used to match array declarations, binary operation patterns, and function calls, respectively, used to locate and extract key information needed to calculate the actual index. The binary operation pattern can be specifically understood as: code forms involving offset calculations (e.g., d = d - 0x65), from which the offset value (e.g., 0x65) is extracted using the second regular expression. Here, d is a variable used in the code to calculate the index, and 0x65 is a hexadecimal value. The call parameter value can be specifically understood as: parameters passed when calling a function (e.g., 100 in a0f(100,...)), extracted from the function call using the third regular expression, which is the basic data for calculating the actual index. Here, a0f is a function name in the obfuscation program.

[0064] Specifically, by matching the first regular expression with the string obfuscation features, the array declaration in the target obfuscation program is matched, and the obfuscated string array is extracted. The array declaration (e.g., var arr = ['\x65', '\x71', ...]) is matched, and the obfuscated string array `arr` is extracted to determine the storage medium for the string. Here, `arr` is an array variable name, `\x` indicates that the following is a hexadecimal number, and 65 and 71 are hexadecimal values.

[0065] The first regular expression can be: ` / var\s+(\w+)\s*=\s*$([^$]+)$ / g`, where ` / ` represents the start and end separator of the regular expression, used to define the scope of the regular expression; `var` represents matching the keyword `var` in the obfuscator, used to locate variable declaration statements; `\s+` represents matching one or more whitespace characters (spaces or tabs, etc.), corresponding to the space before the variable name (such as the space between `var` and `arr` in `var arr`); `(\w+)` represents a capturing group, used to match one or more letters, numbers, or underscores (`\w` is equivalent to `AZ`, `az`, 0-9), used to extract variable names (such as `var`). `arr = [...]` matches zero or more whitespace characters, corresponding to the space between the variable name and the equals sign (e.g., the space between `arr` and `=` in `var arr = [...]`); `=` matches "=", corresponding to the assignment operator; `$` is a special separator used to indicate the boundary of the matching array, existing in pairs as the separator between the beginning and end of the array; `([^$]+)` represents a capturing group, `[^$]` matches any character except `$`, and `+` matches one or more times, used to extract the contents of the array (e.g., specific elements in `['\x65','\x71']`); ` / g` is the global matching modifier for regular expressions, indicating that all matches that conform to the rule are found in the target string, rather than just the first one.

[0066] The offset value (e.g., 0x6d) is extracted by matching the binary operation pattern (e.g., d = d - 0x6d) in the target obfuscator using a second regular expression that matches the string obfuscation features.

[0067] The second regular expression can be: / d\s*=\s*d\s*-\s*(0x\w+|\d+) / g, where d represents the character "d" and corresponds to the variable name involved in the offset calculation in the code (usually an intermediate variable used for index adjustment); (0x\w+|\d+) represents the capture group used to extract the offset value, which contains two possible numerical forms: 0x\w+ represents matching a hexadecimal number (such as 0x6d or 0xff), where 0x is a hexadecimal prefix and \w+ represents matching one or more letters or numbers; \d+ represents matching a decimal number (such as 109 or 255) and \d+ represents one or more digits; | represents logical OR, which means matching either of the two forms.

[0068] By matching the called function (e.g., a0f(100,b)) in the target obfuscator with a third regular expression that matches the string obfuscation features, the call parameter value of the called function, such as 100, is extracted as the base index value.

[0069] The third regular expression can be: / a0f$([^,]+),\s*[^)]+$ / g, where a0f matches "a0f", corresponding to a specific function name used in the obfuscated code for processing strings or index calculations (which can be set to the corresponding form of other key functions in the string obfuscation logic); ([^,]+) represents a capture group used to extract the value of the first parameter of the function. [^,] matches any character except a comma, + matches one or more times to ensure the complete content of the first parameter is captured (e.g., the parameter is a variable name, number, or expression); , matches the literal comma ",", corresponding to the separator between function parameters (used to distinguish the first parameter from subsequent parameters); [^)]+ matches any character except the closing bracket ")" one or more times, used to match other parameters of the function (which may be non-core parameters, used only for auxiliary location).

[0070] Finally, the actual index of the obfuscated string array corresponding to the obfuscated string feature is calculated based on the call parameter value and the offset value. For example, the actual index is calculated as: actual index = parameter value - offset value. When the call parameter value is 100 and the offset value is 0x6d, which is 109 in decimal, the actual index obtained is -9, which is used to locate the corresponding character in the obfuscated string array, such as arr[-9]. The negative array index can represent the index taken from the last element of the array in reverse order.

[0071] Understandably, the first, second, and third regular expressions are not fixed. Each part of the expression (including the matching keyword, variable name, delimiter, character range, and modifiers) can be flexibly adjusted to other matching forms based on the actual string obfuscation characteristics encountered. For example, if the array declaration in the obfuscated code uses `let` instead of `var`, the first regular expression can change `var` to `let`; if the offset calculation variable uses `i` instead of `d`, the second regular expression can replace `d` with `i`; if the key function name is not `a0f` but `b1g`, the third regular expression can adjust `a0f` to `b1g`. This adapts to different obfuscation modes, ensuring accurate extraction of the array, offset, and parameter values ​​needed to calculate the actual index.

[0072] By using the first, second, and third regular expressions that match the string obfuscation features, the obfuscated string array, the offset value in the binary operation mode, and the call parameter value of the called function are matched and extracted from the target obfuscated program, respectively. Then, based on the call parameter value and the offset value, the actual index of the obfuscated string array is calculated, clarifying the real string position. This lays the foundation for subsequent obfuscation reverse engineering. The feature-based matching method can adapt the regular expressions to different obfuscation forms, enhancing the flexibility and universality of reverse engineering. Ultimately, the ambiguous string references are transformed into clear index locations, making the semantics of the obfuscated strings visible, improving code readability, and increasing the efficiency of subsequent penetration testing and vulnerability analysis.

[0073] S230. When at least one attribute name obfuscation feature is identified in the second intermediate stage restoration program, after inferring the actual function of the obfuscated attribute name based on the parameters and return value of the obfuscated attribute name corresponding to the attribute name obfuscation feature, the obfuscated attribute name is obfuscated and restored according to the actual function to obtain the third intermediate stage restoration program.

[0074] In this embodiment of the invention, the attribute name obfuscation feature can be specifically understood as: an identifier of obfuscated attribute names, such as using a 4-6 character meaningless alphanumeric combination (e.g., ncIVP or TTTfI) as the attribute name, which is the basis for identifying attribute name obfuscation. The parameters and return values ​​can be specifically understood as: the input data and output results passed when calling the obfuscated attribute name (e.g., obj.ncIVP(2,3) returns 5, where obj represents object), which is the core basis for inferring the actual function of the attribute. The actual function can be specifically understood as: the real business logic behind the obfuscated attribute name that can be analyzed through parameters and return values ​​(e.g., ncIVP actually corresponds to an addition operation). The third intermediate stage restoration program can be specifically understood as: processing the intermediate results after attribute name obfuscation; if attribute name obfuscation exists, it is the restored program; if not, it is equivalent to the second intermediate stage restoration program.

[0075] Specifically, the second intermediate-stage restoration program first determines whether it contains attribute name obfuscation features. For example, it uses regular expressions to identify if there are attribute names containing a preset number of alphanumeric combinations. If such features exist, the parameters of the obfuscated attribute names (e.g., ncIVP accepts two numbers) and the return value (e.g., returns the sum of two numbers) are analyzed to infer their actual function (e.g., addition operation). Then, meaningless attribute names are replaced with intuitive ones (e.g., replacing ncIVP with add), completing the obfuscation restoration. After obfuscating and restoring all matching obfuscated attribute names based on their actual function, the third intermediate-stage restoration program is obtained. If no features exist, the second intermediate-stage restoration program is directly identified as the third intermediate-stage restoration program.

[0076] Optionally, based on the above embodiments, inferring the actual function of the obfuscated attribute name according to the parameters and return value of the obfuscated attribute name corresponding to the attribute name obfuscation feature may include:

[0077] Obtain obfuscated attribute names that match the obfuscation features and determine the attribute type of the obfuscated attribute names through static or dynamic analysis;

[0078] Based on the attribute type, parameters, and return value of the obfuscated attribute name, infer the actual function of the obfuscated attribute name;

[0079] Accordingly, based on the actual functionality, the obfuscated attribute names are obfuscated and then restored, including:

[0080] Rename the obfuscated attribute names based on their actual functionality;

[0081] Based on the actual function, inline calls are made to obfuscate and restore the matched obfuscated attribute names.

[0082] In this embodiment of the invention, inline call obfuscation restoration can be understood as: directly replacing indirect calls that use obfuscated attribute names (such as obj.ncIVP(a,b)) with their implementation logic (such as a+b), thus eliminating unnecessary indirect operations. The attribute types for obfuscated attribute names include functions and constants.

[0083] Specifically, the obfuscated attribute names that match the obfuscation features can be obtained. For example, in the second intermediate stage of the restoration process, obfuscated attribute names that match the obfuscation features (4-6 alphanumeric characters) can be found using the matching regular expression, such as ncIVP and TTTfI.

[0084] During static analysis, an abstract syntax tree (AST) of the second intermediate stage reconstructed program is generated using static analysis tools. The type of the node value corresponding to the obfuscated attribute name is examined. If the value is a FunctionExpression or ArrowFunctionExpression node, it is determined to be a function type; if the value is a Literal (e.g., string or number) or Identifier (referenced constant) node, it is determined to be a constant type. For example, in the AST, ncIVP:(a,b) => a+b corresponds to a function node (this function represents receiving two parameters a and b and returning their sum), and TTTfI:“token” corresponds to a string literal node (indicating that the string "token" stored in TTTfI is its actual content). This determines the attribute type of the obfuscated attribute name.

[0085] Alternatively, during dynamic analysis, a second intermediate-stage restoration program can be run in a controlled environment. Debugging tools or hook functions can be used to monitor the property access behavior of the object containing the obfuscated property name. When the program accesses the obfuscated property name, the type of its value is detected using methods such as the `typeof` operator (used to determine the basic type of a variable, returning a string representing the type). If it returns `function`, it is determined to be a function type; if it returns a basic type or reference type such as `string`, it is determined to be a constant type. This determines the property type of the obfuscated property name.

[0086] If the attribute type of the obfuscated attribute name is a function, then its actual function (such as addition operation) can be inferred by combining the parameters (such as inputting two numbers) and the return value (such as outputting the sum of two numbers).

[0087] If the attribute type of the obfuscated attribute name is constant, its actual meaning (such as "user token") is inferred from its stored value (such as the string "token123");

[0088] Accordingly, the obfuscated attribute names are renamed according to the actual function. For example, when ncIVP represents addition, it is replaced with add; when TTTfI represents user token, it is replaced with userToken, so that the attribute names directly reflect the function. The obfuscated attribute names are then inlined to restore the obfuscation based on the actual function. For example, obj.ncIVP(a,b) is directly replaced with a+b or add(a,b), eliminating the logical obfuscation caused by indirect calls and simplifying the code.

[0089] Understandably, the actual function of an obfuscated attribute name can be inferred based on its attribute type, parameters, and return value. This inference can be made using a pre-defined mapping table, which contains the correspondence between parameters, return values, stored value characteristics, actual functions, and meanings. This mapping can be adjusted according to specific obfuscation features, such as adding or modifying matching rules for specific format parameters or values. Correspondingly, renaming and inline deobfuscation restoration of matched obfuscated attribute names can also be performed based on this mapping table.

[0090] By determining the attribute type of obfuscated attribute names through static or dynamic analysis, a classification basis is provided for subsequent function inference, avoiding deviations in function inference due to type misjudgment. Combining attribute type, parameters, and return value, the actual function is inferred, transforming the true logic of obfuscated attributes from a hidden state into an understandable functional description, providing key semantic information for code reverse engineering. Obfuscated attribute names are renamed according to actual functions, allowing attribute names to directly reflect functions, eliminating obfuscation barriers at the naming level, reducing the cognitive cost of manual analysis, and eliminating logical jumps and concealment caused by inline calls through inline call restoration, simplifying code hierarchy, making the operation logic directly presented, improving code readability and debuggability, and improving the efficiency and accuracy of subsequent reverse engineering restoration.

[0091] S240. After parsing the third intermediate stage restoration program into the first abstract syntax tree, when a node of type call is identified in the first abstract syntax tree, the identified node is used as a call expression, and the function name of the call expression is determined.

[0092] Specifically, the code parsing tool parses the third intermediate stage program into a first abstract syntax tree. All nodes in the first abstract syntax tree are traversed, and nodes of type call type (such as CallExpression function call type) are selected. These correspond to function call statements in the code (such as B['ncIVP'](...), a dynamic call format where B represents the body of the function call, ['ncIVP'] represents accessing the property of object B, where 'ncIVP' is an obfuscated property name (i.e., a meaningless combination of characters), (...) represents the parameter list of the function call, and ... represents the actual parameters passed in, which is the input data when the function is executed). The content of this node is then determined as the call expression.

[0093] The `callee` attribute is the core property of a function call expression (CallExpression node), used to represent the function or method being called. When a function call occurs in the code, the abstract syntax tree parses it into a CallExpression node, and the `callee` attribute describes the content of the called part within that node.

[0094] For each calling expression, access its corresponding callee property, analyze its called part, such as B['ncIVP'], extract the called function name (such as ncIVP) from it, and thus determine the function name of the calling expression.

[0095] Optionally, based on the above embodiments, determining the function name of the calling expression may include:

[0096] When the called content of the call expression is a direct call, the function name of the called content is used as the function name of the call expression;

[0097] When the called content of the call expression is an indirect call, the indirect call variables and / or property references are analyzed by automated analysis tools to determine the actual calling function of the indirect call, and the function name of the actual calling function is used as the function name of the call expression.

[0098] Specifically, when the called content of the calling expression is a direct call, such as add(1,2), that is, when the type of callee in the first abstract syntax tree is Identifier (identifier node) to indicate a direct call, the name of the node (i.e. the function name of the called content) can be directly taken as the function name of the calling expression (such as add).

[0099] When the called content of the calling expression is an indirect call, such as B['ncIVP'](2,3), that is, in the first abstract syntax tree, the type of callee is MemberExpression (member expression node) indicating an indirect call. The structure of the member expression node can be analyzed by automated analysis tools to determine the variables it contains (such as B) and the properties corresponding to the variables (such as 'ncIVP'). Through data flow analysis, the source of the variables (such as the definition of variable B and the object that the variable points to containing the ncIVP property) and the actual calling function corresponding to the property (such as B being assigned the value {ncIVP:function(a,b){return a+b}}, that is, B points to an object containing the ncIVP property. Further analysis reveals that the actual function corresponding to the ncIVP property is an addition function, and its actual function name is add).

[0100] Finally, the actual function name obtained from the analysis (such as add corresponding to the addition function) is used as the function name of the call expression. For example, B['ncIVP'](2,3) is restored to add(2,3) which directly reflects the function.

[0101] By using the function name of the directly called content as the function name of the call expression, efficiency losses caused by over-processing can be avoided, while preserving the intuitiveness of the direct call logic and laying the foundation for subsequent code analysis. For indirect calls, automated analysis tools can be used to trace the source of variables and attribute references, locate the actual calling function, and extract its function name. This enables reverse engineering of obfuscated code that masks the real function, breaking the obfuscated code's purpose of hiding the call stack and preventing the integrated development environment from tracing it. It exposes the true logic of indirect calls, establishing a clear association between the function name of all call expressions and the actual functionality, thus improving the efficiency and accuracy of subsequent reverse engineering of obfuscated code.

[0102] S250. Based on the function name of the call expression, perform obfuscation restoration on the indirect function obfuscation call of the first abstract syntax tree.

[0103] Specifically, the nodes in the first abstract syntax tree that represent obfuscated indirect function calls are converted into call forms that directly reflect the function's functionality, i.e., the function names of the call expressions corresponding to the nodes of obfuscated indirect function calls, thereby restoring a clear call chain.

[0104] S260. Based on the first abstract syntax tree after obfuscation and deobfuscation are completed, form the first reverse deobfuscation program.

[0105] Specifically, the first abstract syntax tree after obfuscation is converted into executable code, i.e., the first reverse engineering program, is used by code parsing tools.

[0106] Understandably, if no node for the call type (CallExpression) is identified in the first abstract syntax tree, it indicates that there is no function call in the code, or that no indirect call obfuscation that needs to be handled is identified in the first abstract syntax tree. In this case, no additional call restoration operation is required, and the third intermediate stage restoration program of the preceding stage can be directly used as the first reverse restoration program.

[0107] S270. Redundant code is detected in the first reverse engineering program through static and dynamic analysis, and the detected redundant code is removed in the first reverse engineering program to obtain the second reverse engineering program.

[0108] S280. Perform control flow flattening reverse restoration processing on the second reverse restoration program to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0109] The technical solution of this invention involves obtaining a target obfuscated program. When Boolean operations exist in the target obfuscated program, these operations are obfuscated and reverse-processed to restore hidden branch conditions, resulting in a first intermediate-stage restoration program. When string obfuscation features are identified, the obfuscated string array is statically restored by calculating the actual index to clarify the business semantics, forming a second intermediate-stage restoration program. When attribute name obfuscation features are identified, the actual function of the obfuscated attribute name is inferred and restored based on parameters and return values, restoring the object operation logic to obtain a third intermediate-stage restoration program. This is then parsed into an abstract syntax tree. By identifying call type nodes, determining call expressions and their function names, indirect function calls are restored, clarifying function functionality, and forming a first reverse restoration program. The entire process combines static restoration and abstract syntax tree analysis, eliminating reliance on the runtime environment. Key information can be directly calculated based on code features to locate call expression nodes, reducing manual intervention, shortening reverse processing time, and ensuring restoration accuracy. By detecting and removing redundant code in the first reverse engineering program through static and dynamic analysis, a second reverse engineering program is obtained. The second reverse engineering program is then subjected to control flow flattening reverse engineering to obtain the target reverse engineering program. This solves the vulnerability concealment problem caused by code obfuscation, improves the detection rate of high-risk vulnerabilities and attack surface coverage, enhances the reliability and effectiveness of deep reverse engineering of the target obfuscated program, and improves the security verification effect of penetration testing.

[0110] Example 3

[0111] Figure 3 This is a flowchart of another method for reverse engineering an obfuscated program provided in Embodiment 3 of the present invention. This embodiment is a refinement of the "detection of redundant code in the first reverse engineering program through static analysis and dynamic analysis" in the above embodiment.

[0112] Correspondingly, such as Figure 3 As shown, the method includes:

[0113] S310. Obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names and obfuscated indirect function calls in the target obfuscated program, and obtain the first reverse restoration program.

[0114] S320. During the static analysis process, the first reverse engineering program is parsed into a second abstract syntax tree using a static analysis tool. The nodes of the second abstract syntax tree are traversed to identify unreferenced elements and unreachable branches are identified through control flow analysis. Unreferenced elements and unreachable branches are treated as redundant code.

[0115] Specifically, during the static analysis process, the first reverse engineering procedure is parsed into a second abstract syntax tree (ABST) using static analysis tools. The nodes of the ABST are traversed, and information such as the feature name, type (e.g., variable, function, and module), and definition location (e.g., line number or node path) of each defined node can be recorded in the table. For reference-type nodes such as variable access, function calls, and module exports, if the node references an already defined feature, the reference relationship of the corresponding feature in the table is set to true. After traversing all nodes in the ABST, the table is traversed, and features with false reference relationships are selected as unreferenced features.

[0116] The second abstract syntax tree (BST) is parsed using static analysis tools to generate a control flow graph. The code is divided into basic blocks, and jump relationships are established. Reachability is marked starting from the program entry block; initially, only the entry block is reachable. Reachability is then propagated by iteratively traversing the control flow graph. The reachability of the target block is determined based on branch conditions. If the condition is always true or there is no conditional jump, the target block is marked as reachable; otherwise, it is not marked. Finally, all remaining unreachable basic blocks are collected, and their corresponding BST nodes (such as code blocks or expression statements) are the unreachable branches.

[0117] Unreferenced elements and unreachable branches are treated as redundant code.

[0118] S330. The module packaging and building tool generates a dependency graph based on the first reverse engineering program and identifies unreferenced modules, treating them as redundant code.

[0119] Specifically, dependency analysis is performed on the first reverse engineering program using module packaging and building tools. This scans all import and export relationships between modules, traces module reference chains, and generates a visual dependency graph. Each node in the graph represents a module, and edges represent reference relationships between modules. In the dependency graph, if a module is never referenced by any other module through an import statement (i.e., it is an isolated node with no incoming edges), it is considered an unreferenced module. Since such modules do not participate in the actual program execution logic and only increase code size and analysis complexity, they are marked as redundant code.

[0120] S340. During the dynamic analysis process, test cases are run against the first reverse engineering program, and a code coverage report is generated through test assistance tools, and / or the actual execution trajectory of the program is recorded through performance analysis tools.

[0121] S350. Identify unexecuted code based on the code coverage report and treat the unexecuted code as redundant code, and / or identify unexecuted code that does not appear in the execution trajectory based on the actual execution trajectory and treat the unexecuted code as redundant code.

[0122] Specifically, in the dynamic analysis, test cases are designed and run for the first reverse engineering program. Test support tools record the execution of each statement and branch during program runtime, ultimately generating a code coverage report. Performance analysis tools are used to track and record the actual execution trajectory of the program, including function call order and branch jump paths.

[0123] From the code coverage report, filter out code with a coverage rate of 0, i.e., statements, functions, or branches that were never executed during the test case execution; these are identified as redundant code. From the actual execution path, identify all code segments that did not appear, such as functions that were never called and conditional branches that were never entered; these are also identified as redundant code.

[0124] S360. Review and remove the global state modification code in the redundant code, take the remaining redundant code as the redundant code detected from the first reverse engineering program, and remove the detected redundant code in the first reverse engineering program to obtain the second reverse engineering program.

[0125] It is understandable that even if the code that modifies global state is determined not to be executed during the analysis process, it may still be triggered through other paths or executed in specific scenarios, and affect the external environment of the program, such as modifying global variables, manipulating the document object model, initiating network requests, and reading and writing local storage. Therefore, it cannot be removed as redundant code.

[0126] Specifically, the filtered redundant code undergoes further review, and code with side effects that modify the global state is removed. The remaining redundant code, confirmed to have no side effects and not to be executed, is considered the final removable redundant code detected from the first reverse engineering process.

[0127] Finally, in the first reverse engineering process, these removable redundant codes are removed. For example, a code inspection tool scans the code to automatically identify and repair unreferenced elements in the redundant code. Then, the tree-shaking optimization function in the module packaging and building tool is used to automatically filter out unreferenced modules in the redundant code based on the pre-generated dependency graph. Finally, a code compression tool is used to further remove unreachable branches and complete code compression.

[0128] Building upon this foundation, a testing and verification phase can be added. By running a complete test suite, the core functionality of the program can be checked for proper operation. If the program has already been deployed, key indicators in the production environment (such as interface response time and error rate) can be monitored to ensure that the program's performance and reliability are not affected after removing redundant code. After successful testing and verification, the program with redundant code removed will be used as the second reverse engineering program.

[0129] S370. Perform control flow flattening reverse restoration processing on the second reverse restoration program to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0130] Optionally, based on the above embodiments, performing control flow flattening reverse restoration processing on the second reverse restoration program may include:

[0131] Identify the state array and corresponding state index variables in the second reverse engineering process, and determine the initial value and change mode of the state index variables;

[0132] Based on the initial value and change pattern of the state index variable, and in conjunction with the state array, determine the execution order of each branch block in the second reverse restoration program;

[0133] Identify the control flow keywords for each branch block, and combine the branch blocks in sequence according to the control flow keywords and the execution order of each branch block;

[0134] Identify the dynamic obfuscation function that includes the encrypted string in the second reverse engineering process, and calculate the real string of the encrypted string of the dynamic obfuscation function;

[0135] Substitute the real string into the corresponding dynamic obfuscation function, determine the function of the dynamic obfuscation function based on its execution logic, and determine the corresponding dynamic function based on the real string and the function of the dynamic obfuscation function.

[0136] Convert the bitwise operations in the second reverse recovery program into the results after operations are performed according to the meaning of the operators;

[0137] The character operation keywords in the second reverse restoration program are located to determine the target string and the position of the operation character, and the positioning character is determined based on the target string and the position of the operation character.

[0138] By tracing back the branch conditions associated with the positioning character, the branch judgment rules for the positioning character are obtained;

[0139] Based on the loop structure in the second reverse restoration program, the traversal method of character processing is determined, and the loop flow of character processing is obtained.

[0140] Based on the loop flow of character processing, branch judgment rules, and the determination operation of locating characters, the string processing logic is combined in the execution order to obtain the intermediate restoration result for the string processing logic in the second reverse restoration program;

[0141] Identify the character encoding features in the intermediate reconstruction results, match the character encoding features with known encoding rules, and determine the target encoding type used in the intermediate reconstruction results;

[0142] Based on the branching logic of the encoding range in the intermediate restoration results, determine the triggering conditions and corresponding triggering operations for each branch;

[0143] Based on the loop structure in the intermediate restoration results, the traversal method of encoding conversion is determined, and the loop flow of encoding conversion is obtained;

[0144] Based on the loop flow of encoding conversion, the triggering conditions of each branch, the corresponding triggering operation and the target encoding type, the string encoding conversion logic is combined in the execution order to complete the obfuscation and restoration of the string processing logic in the second reverse restoration program;

[0145] Replace the conditional statements based on dynamic functions with the corresponding original conditional statement operators;

[0146] The restored code blocks are combined in the order of execution to complete the reverse restoration of the control flow flattening.

[0147] In this embodiment of the invention, the state array can be specifically understood as an array that stores ordered execution logic (such as the content of a case branch block), and its elements typically correspond to different execution steps or branch blocks of the program. The state array may be encrypted or dynamically generated; that is, the array elements may be garbled strings or encrypted, requiring the actual values ​​to be obtained through string decryption or dynamic execution restoration (such as calling a decryption function or simulating the execution of initialization logic).

[0148] The state index variable can be understood as a variable used to locate the currently executing element in the state array. Its value determines the access position in the state array, thus determining the program's execution order. The initial value can be understood as the initial value of the state index variable, which is the basis for determining the initial execution steps of the program. The change method can be understood as the update rule of the state index variable during program execution (such as auto-increment and conditional assignment), which determines the switching logic of subsequent execution steps.

[0149] Specifically, in the second reverse engineering process, the state array carrying the execution logic can be located and identified based on the characteristics of the state array, such as the array elements being mostly functions, code block strings, or executable expressions, defined in the global scope (external definition), or existing directly in the form of array literals.

[0150] Based on the characteristics of state index variables, such as their function as access indices for state arrays, their values ​​changing according to fixed rules (e.g., auto-incrementing or conditional assignment), and their combination with branching or looping statements, the state index variables used to access the array are located and identified. State arrays and state index variables together constitute the program's state-driven mechanism.

[0151] Further analysis is then conducted on the state index variable. This involves locating the declaration node of the state index variable to extract the value of the initialization expression, or locating the first assignment statement of the state index variable to determine its initial value. All assignment nodes of the state index variable are traced, recording the type of the assignment expression (e.g., increment, conditional judgment, or function call) to determine the mode of change. Alternatively, the relationship between the assignment logic and the program execution flow (e.g., whether the index is updated after each execution of a state array element) is analyzed to summarize its change patterns and determine the mode of change.

[0152] In this embodiment of the invention, the execution order of the branch blocks can be specifically understood as: the order in which each branch block in the program is executed logically, which is the execution path of the state-driven mechanism.

[0153] Specifically, the starting point of execution is first determined by the initial value of the state index variable. If the initial value is 0, the execution starts from the branch block corresponding to index 0 of the state array. Then, the switching rule of subsequent indices is determined according to the change method, such as auto-increment. If the state index variable increments sequentially from 0 to n, the branch blocks from branch block 0 to branch block n are executed in the order of the elements of the state array. Finally, the execution order of all branch blocks is determined.

[0154] Understandably, if there is no explicit state array in the program, that is, the branch block logic is not centrally stored in the array, the actual execution order of each branch block can be directly obtained through dynamic debugging, such as running the program and tracing the branch execution trajectory, thereby completely restoring the execution order of all branch blocks of the state-driven logic.

[0155] In this embodiment of the invention, control flow keywords can be specifically understood as keywords that affect the program execution path, including loop control keywords (such as continue and break, which control the execution flow within a loop) and function control keywords (such as the return keyword, which directly terminates the execution of the current function or program). Specifically, continue means skipping the remaining logic of the current branch block and directly entering the next branch block in the execution order; break means exiting the current branch block, but if there is an outer loop, it will return to the beginning of the outer loop to continue executing the next branch block; return means directly terminating the current function or program, completely interrupting the execution of subsequent branch blocks.

[0156] Specifically, in each branch block of the second reverse engineering program, loop control keywords and function control keywords are identified. Based on the execution order of the branch blocks previously deduced through state index variables, the subsequent execution direction is determined by combining the specific functions of different control keywords. Finally, according to the execution order of the branch blocks and the function of the control keywords, the originally scattered branch blocks are connected and combined according to the actual execution logic to form a coherent and understandable complete code flow, thus restoring the original control logic of the program.

[0157] Understandably, special attention needs to be paid to the scope of variable declarations. Since the switch statement does not create an independent scope, variables declared with var (variable) inside the switch (such as var A) are still visible outside the switch. Therefore, when chaining and combining branch blocks according to the actual execution logic, these variables need to be treated as global variables in the same scope (relative to the switch) to avoid logical breaks caused by scope misjudgment.

[0158] In this embodiment of the invention, the dynamic obfuscation function for the encrypted string can be understood as: generating an encrypted string through dynamic calculation (such as function calls or mapping conversions) to hide the obfuscated form of the real function name. The form can be an object [function call], such as g[bm(0xff)](a,b), where bm(0xff) is the logic for generating the encrypted string. The real string can be understood as: the original string obtained after the encrypted string has been calculated or converted (e.g., the result of bm(0xff) is eq (representing a comparison of whether two parameters are equal)), which is the true identifier of the dynamic obfuscation function. The execution logic of the dynamic obfuscation function can be understood as: the function's parameter processing, internal operations, and return value characteristics, used to determine the function's actual function (such as comparison and concatenation functions).

[0159] Specifically, in the second reverse engineering process, dynamic obfuscation functions containing encrypted strings are identified. Taking a dynamic obfuscation function in the form of g[bm(hex)] as an example, where bm is a mapping function that converts hexadecimal numbers to strings (which can be implemented based on a key table or simple mapping logic), the nodes in the abstract syntax tree corresponding to the second reverse engineering process whose attribute is function call are identified. If the parameter of the function call is a hexadecimal literal (such as 0xff or 0x123), it meets the characteristics of bm(hex) and is marked as a candidate dynamic obfuscation function. The function name (such as bm) of the function call in the candidate dynamic obfuscation function is traced, and the definition logic of the function is analyzed to verify whether it maps numbers to strings (such as checking whether it includes array access and character conversion operations). Combined with the logic of the mapping function, its return value for hexadecimal parameters is simulated (such as whether bm(0xff) returns a string). It is verified whether the return value is used as an object attribute in the function call (such as whether g[return value] is called). If so, it is determined to be a dynamic obfuscation function containing encrypted strings.

[0160] By calculating the logic for generating the encrypted string (such as parsing the conversion process of the bm function to 0xff), the corresponding real string is obtained (e.g., the result of bm(0xff) is eq). The real string is then substituted into the dynamic obfuscation function to convert it from g[bm(0xff)](a,b) to the explicit form g['eq'](a,b). The actual function's functionality is then analyzed by combining this with the function's execution logic (such as the handling of parameters a and b, and whether the return value indicates equality). For example, g.eq is a function that compares whether a and b are equal.

[0161] Finally, based on the actual string and function functionality, the explicit dynamic function form corresponding to the dynamic obfuscation function is determined (e.g., g.eq(a,b)), eliminating the dynamic obfuscation of function calls and restoring a clear function call relationship.

[0162] Understandably, if a function object (such as g) is a utility object with a fixed method name, it can be replaced in batches by creating a mapping table.

[0163] In this embodiment of the invention, bitwise operations can be specifically understood as operations that operate on binary bits, such as AND (&), OR (|), XOR (^), left shift (<<) and right shift (>>), etc., which are used in obfuscated code to hide the actual operation logic.

[0164] Specifically, in the second reverse engineering process, the abstract syntax tree of the program is traversed to filter out nodes with bitwise operator attributes in binary expressions. Key information such as operator type, left and right operands, and code location is extracted to identify bitwise operation expressions. The actual function of each bitwise operation is directly understood based on its meaning. For example, 0x3f&D represents a masking operation on D (keeping the lower 6 bits) through a bitwise AND operation, and D>>6 essentially divides D by 64 and rounds it down. These bitwise operations are converted into their corresponding actual operation results or equivalent conventional operation forms (e.g., converting D>>6 into the more easily understood Math.floor(D / 64)), eliminating the comprehension barriers caused by bitwise operations, making the code logic more intuitive and understandable, and restoring the program's true computational intent. The Math.floor() function performs a floor function on the representation, that is, it takes the largest integer less than or equal to the parameter within the parentheses.

[0165] In this embodiment of the invention, character operation keywords can be specifically understood as methods for extracting character information from a string, such as charCodeAt indicating the Unicode encoding of a character, and charAt indicating the character at a specified position. Locating a character can be specifically understood as obtaining a specific character from a target string using character operation keywords, such as B.charAt(C) indicating the character at index C in string B. Branch judgment rules can be specifically understood as conditional judgment logic for locating characters, determining the processing method for different characters. Intermediate restoration results can be specifically understood as the staged results obtained after combining string processing logic in the execution order, including loop flow, branch rules, and character operations.

[0166] Character encoding features can be understood as: operations that match specific encoding rules during encoding conversion, such as 0xC0|(code>>6) or encoding range judgment (e.g., code<0x80, indicating whether the Unicode encoding value of the character is less than 0x80, where code represents the Unicode encoding of the character obtained through the charCodeAt character operation keyword). Here, 0xC0|(code>>6) is a characteristic bitwise operation for handling double-byte characters in the 8-bit Unicode Transformation Format (UTF-8). code>>6 means shifting the character encoding right by 6 bits and extracting the high 5 bits. 0xC0 is a hexadecimal constant representing the fixed prefix of the first byte of the UTF-8 double-byte encoding. The | (bitwise OR) operation combines the prefix with the extracted high 5 bits to form the first byte of the UTF-8 double-byte encoding. The target encoding type can be understood as: a known encoding rule that matches the encoding features, such as UTF-8.

[0167] Specifically, in the second reverse engineering process, a code parsing tool locates character operation keywords such as `charCodeAt` and `charAt` based on the abstract syntax tree of the second reverse engineering process, determining the target string, character position, and extracted positioning character (e.g., `B.charAt(C)`). Tracing the branch conditions related to the positioning character, the branch judgment rules for the positioning character are obtained, such as `if(code<128)` indicating whether `code` is less than 128. The character processing traversal method is determined based on the loop structure, such as the start and end conditions of the traversal, and the loop variable change method (e.g., incrementing), forming the loop flow of character processing. The character positioning operations, branch judgment rules, and loop traversal methods extracted during the reverse engineering process are logically linked and combined according to the actual execution sequence of the program to obtain the intermediate reconstruction result of the string processing logic.

[0168] Then, key features related to encoding are extracted from the intermediate restoration results, such as the encoding range threshold, bit operation mode and byte length in the branch conditions. These features are compared with the feature library of known encoding rules that are built in advance. If the features match the features of a certain encoding rule and there is no conflict, the encoding rule can be determined as the target encoding type (such as the processing method of single byte and double byte in UTF-8).

[0169] Based on the branching logic divided by the encoding range (e.g., single-byte processing when the character encoding is less than 128, and double-byte processing when the character encoding is between 128 and 2047), the triggering conditions (encoding range) and corresponding operations (e.g., byte splitting or feature bit concatenation) of each branch are clarified. Based on the loop structure in the intermediate restoration results, the traversal method of encoding conversion is determined, such as the start and end conditions of the traversal, and the way the loop variable changes (e.g., incrementing), forming the loop flow of encoding conversion.

[0170] Finally, based on the loop flow of encoding conversion, the triggering conditions of each branch, the corresponding triggering operation, and the target encoding type, the string encoding conversion logic is combined in the execution order. For example, the string is traversed character by character, and converted into a single or double byte stream according to the UTF-8 rule based on the Unicode encoding range. This completes the obfuscation and restoration of the string processing logic, realizing the connection of all elements in the order of loop traversal, character positioning, branch judgment, and encoding operation, forming a complete logic from input string to output encoded byte stream.

[0171] In this embodiment of the invention, the conditional judgment based on dynamic functions can be understood as follows: the conditional judgment logic is implemented through a dynamically obfuscated function (such as g.eq(a,b)), rather than directly using explicit operators such as === or <. Essentially, it hides the original comparison logic using function calls. The original conditional judgment operators can be understood as the basic comparison operators (such as === strict equality and !== inequality), which are the original forms of conditional judgment.

[0172] Specifically, in the second reverse engineering process, a code decoding tool can identify the conditional judgments implemented through obfuscated dynamic comparison functions based on the abstract syntax tree corresponding to the second reverse engineering process. According to the actual function of these dynamic functions (e.g., g.eq for equality, g.lt for less than), they are directly replaced with the corresponding original conditional judgment operators (e.g., g.eq(a,b) is replaced with a===b, g.lt(x,y) is replaced with x). <y)。

[0173] It can be understood that some conditional expressions may be split into multiple bitwise operations (such as (a&b) === 0) or nested function calls (such as g.and(g.eq(a,b),g.lt(c,d))). It is necessary to combine and analyze these scattered operations to restore the conditional logic expressed as a whole (such as g.and(g.eq(a,b),g.lt(c,d)), corresponding to a === b && c < d), and finally eliminate the confusion of dynamic functions, making the conditional judgment return to an intuitive native form.

[0174] Specifically, after eliminating the confusion of each independent code block in the second reverse reduction program, through control flow analysis, determine the true execution order of all restored code blocks. According to this execution order, recombine and integrate the scattered code blocks to eliminate the fragmented scheduling caused by control flow flattening and restore the original coherent structured execution logic of the program.

[0175] It can be understood that it is also necessary to improve the integrity of function parameters and external dependencies, that is, to clarify the receiving method of the input string (such as function input parameters and global variable passing), the assignment source of the encoding type (such as configuration items or user input), and the definition path of the configuration object (such as external import or internal creation), to avoid logical breaks caused by missing dependencies.

[0176] Finally, through the concatenation of the execution order and the completion of the dependency relationship, all code blocks are integrated into a complete function that can run independently in a logical closed loop, completing the reverse reduction of control flow flattening, and making the program logic return to the original clear and readable form.

[0177] Figure 4 It is a schematic diagram of the reverse reduction of a confusion program applicable to the embodiments of the present invention, as Figure 4As shown, the process sequentially includes Boolean obfuscation reverse engineering, string encoding and dynamic decoding reverse engineering, attribute name obfuscation reverse engineering, indirect function call reverse engineering, dead code injection removal, and control flow flattening reverse engineering. Boolean obfuscation reverse engineering is the initial step; string encoding and dynamic decoding reverse engineering includes: identifying dynamic string encoding features, extracting string arrays, identifying offsets, parsing function calls, and calculating the true index; attribute name obfuscation reverse engineering includes: identifying obfuscated attribute names based on obfuscated attribute features, inferring the true function of obfuscated attributes, deobfuscating code through renaming and inlining calls, and simplifying other unnecessary indirect operations; indirect function call reverse engineering includes: parsing the code into an abstract syntax tree, identifying call expressions, analyzing the `callme` attribute, data flow analysis, restoring the function call chain, and generating readable code; dead code injection removal includes: dead code identification, verification, cleanup, and testing; and control flow flattening reverse engineering includes: identifying state-driven mechanisms, extracting state sequences, parsing each branch block, merging continuous logic, processing dynamic function calls, replacing bitwise operations and arithmetic operations, restoring string processing logic, and reconstructing the complete function.

[0178] By identifying state arrays, state index variables, and their initial values ​​and change patterns, the execution order of each branch block can be accurately traced, laying the foundation for the orderly combination of code blocks. By identifying the dynamic obfuscation function of the encrypted string and calculating the real string, and combining the function execution logic to determine its function and corresponding dynamic function, the obfuscation of function calls can be eliminated, making the logic clearer. Converting bitwise operations into intuitive operation results simplifies code complexity and facilitates understanding of the operation intent. By locating character operation keywords, tracing branch conditions, determining character processing traversal methods, and combining string processing logic, and then matching known encoding rules to determine the target encoding type, the triggering conditions and operations of each branch can be clarified, restoring the complete logic of string processing and encoding conversion. Replacing conditional judgments based on dynamic functions with original operators directly presents the essence of conditional judgments. Finally, by combining all the restored code blocks in the execution order, the logical fragmentation caused by control flow flattening is eliminated, restoring the program to its original form with a clear structure, coherent logic, and ease of understanding and analysis, reducing the difficulty of reverse analysis and improving the accuracy of understanding the program's functions and logic.

[0179] The technical solution of this invention obtains a target obfuscated program, sequentially detects and restores Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls to obtain a first reverse engineering program. In the static analysis stage, the first reverse engineering program is parsed into a second abstract syntax tree using static analysis tools. Nodes are traversed to identify unreferenced elements, and unreachable branches are identified through control flow analysis and treated as redundant code. Dependency graphs are generated using module packaging and building tools to locate unreferenced modules and treat them as redundant code, thus determining static redundancy from the perspective of code structure and module dependencies. In the dynamic analysis stage, test cases are run, and code coverage reports are generated using test auxiliary tools or actual execution trajectories are recorded using performance analysis tools. Based on this, unexecuted code is selected as redundant code, thus identifying redundant code from the perspective of runtime behavior. By reviewing and eliminating pseudo-redundant code that modifies the global state, only truly ineffective redundant content is retained. This not only filters out redundant code that can be safely eliminated but also ensures the integrity of program functionality, avoids reverse engineering risks, simplifies code structure, and improves the efficiency of subsequent control flow flattening and restoration analysis. Redundant code is removed to obtain a second reverse engineering program. The control flow of the second reverse engineering program is then flattened and reverse-engineered to obtain the target reverse engineering program. This solves the vulnerability concealment problem caused by code obfuscation, improves the detection rate of high-risk vulnerabilities and attack surface coverage, enhances the reliability and effectiveness of deep reverse engineering of the target obfuscated program, and improves the security verification effect of penetration testing.

[0180] Example 4

[0181] Figure 5 This is a schematic diagram of a reverse engineering device for an obfuscated program provided in Embodiment 4 of the present invention. Figure 5 As shown, the device includes: a first reverse module 510, a second reverse module 520, and a flat reverse module 530, wherein:

[0182] The first reverse module 510 is used to obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names and obfuscated indirect function calls in the target obfuscated program, and obtain the first reverse restoration program;

[0183] The second reverse module 520 is used to detect redundant code in the first reverse restoration program through static and dynamic analysis, and remove the detected redundant code in the first reverse restoration program to obtain the second reverse restoration program.

[0184] The flattened reverse module 530 is used to perform control flow flattening reverse restoration processing on the second reverse restoration program to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0185] The technical solution of this invention obtains a target obfuscated program, sequentially detects and restores Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls to obtain a first reverse engineering program. This restores the obfuscation's masking of code logic, clearly revealing hidden branch judgments, key strings, true attribute associations, and actual function functionalities. Through static and dynamic analysis, redundant code is detected and removed from the first reverse engineering program to obtain a second reverse engineering program. This simplifies the code structure, eliminates invalid content, improves analysis efficiency, and reduces logical misjudgments. The second reverse engineering program undergoes control flow flattening reverse engineering to obtain the target reverse engineering program. This restores the obfuscated program to a linear execution flow, reconstructing the original code execution path. This solves the vulnerability concealment problem caused by code obfuscation, improves the detection rate of high-risk vulnerabilities and attack surface coverage, enhances the reliability and effectiveness of deep reverse engineering of the target obfuscated program, and improves the security verification effect of penetration testing.

[0186] Based on the above embodiments, the first reverse module 510 is specifically used for:

[0187] When Boolean operations exist in the target obfuscation program, the existing Boolean operations are obfuscated and reversed to obtain the first intermediate stage restoration program;

[0188] When at least one string obfuscation feature is identified in the first intermediate stage restoration program, after calculating the actual index of the obfuscated string array corresponding to the string obfuscation feature, the matching obfuscated string array is statically restored according to the actual index to obtain the second intermediate stage restoration program.

[0189] When at least one attribute name obfuscation feature is identified in the second intermediate stage restoration program, after inferring the actual function of the obfuscated attribute name based on the parameters and return value of the obfuscated attribute name corresponding to the attribute name obfuscation feature, the obfuscated attribute name is obfuscated and restored according to the actual function to obtain the third intermediate stage restoration program.

[0190] After parsing the third intermediate stage restoration program into the first abstract syntax tree, when a node of type call is identified in the first abstract syntax tree, the identified node is used as a call expression, and the function name of the call expression is determined.

[0191] Based on the function name of the call expression, the obfuscated indirect function call in the first abstract syntax tree is obfuscated and restored;

[0192] Based on the first abstract syntax tree after obfuscation and deobfuscation, the first reverse deobfuscation program is formed.

[0193] Based on the above embodiments, the first reverse module 510 is further configured to:

[0194] The obfuscated string array is extracted by matching the array declaration in the target obfuscator using a first regular expression that matches the string obfuscation features.

[0195] The offset value is extracted by matching the binary operation pattern in the target obfuscator using a second regular expression that matches the string obfuscation features;

[0196] The call parameter values ​​of the call function are extracted by matching the called function in the target obfuscator with a third regular expression that matches the string obfuscation features.

[0197] The actual index of the obfuscated string array corresponding to the obfuscated string feature is calculated based on the call parameter value and the offset value.

[0198] Based on the above embodiments, the first reverse module 510 is further configured to:

[0199] Obtain obfuscated attribute names that match the obfuscation features and determine the attribute type of the obfuscated attribute names through static or dynamic analysis;

[0200] Based on the attribute type, parameters, and return value of the obfuscated attribute name, infer the actual function of the obfuscated attribute name;

[0201] Accordingly, based on the above embodiments, the first reverse module 510 is further configured to:

[0202] Rename the obfuscated attribute names based on their actual functionality;

[0203] Based on the actual function, inline calls are made to obfuscate and restore the matched obfuscated attribute names.

[0204] Based on the above embodiments, the first reverse module 510 is further configured to:

[0205] When the called content of the call expression is a direct call, the function name of the called content is used as the function name of the call expression;

[0206] When the called content of the call expression is an indirect call, the indirect call variables and / or property references are analyzed by automated analysis tools to determine the actual calling function of the indirect call, and the function name of the actual calling function is used as the function name of the call expression.

[0207] Based on the above embodiments, the second reverse module 520 is specifically used for:

[0208] During the static analysis process, the first reverse engineering program is parsed into a second abstract syntax tree using static analysis tools. The nodes of the second abstract syntax tree are traversed to identify unreferenced elements and unreachable branches are identified through control flow analysis. Unreferenced elements and unreachable branches are treated as redundant code.

[0209] The module packaging and building tool generates a dependency graph based on the first reverse engineering program and identifies unreferenced modules, treating them as redundant code.

[0210] During the dynamic analysis process, test cases are run against the first reverse engineering program, and code coverage reports are generated through test assistance tools, and / or the actual execution trajectory of the program is recorded through performance analysis tools;

[0211] Identify unexecuted code based on the code coverage report and treat it as redundant code; and / or identify unexecuted code that does not appear in the execution trajectory based on the actual execution trajectory and treat it as redundant code.

[0212] The code that modifies the global state in the redundant code is reviewed and removed. The remaining redundant code is then treated as the redundant code detected in the first reverse engineering process.

[0213] Based on the above embodiments, the flat reverse module 530 is specifically used for:

[0214] Identify the state array and corresponding state index variables in the second reverse engineering process, and determine the initial value and change mode of the state index variables;

[0215] Based on the initial value and change pattern of the state index variable, and in conjunction with the state array, determine the execution order of each branch block in the second reverse restoration program;

[0216] Identify the control flow keywords for each branch block, and combine the branch blocks in sequence according to the control flow keywords and the execution order of each branch block;

[0217] Identify the dynamic obfuscation function that includes the encrypted string in the second reverse engineering process, and calculate the real string of the encrypted string of the dynamic obfuscation function;

[0218] Substitute the real string into the corresponding dynamic obfuscation function, determine the function of the dynamic obfuscation function based on its execution logic, and determine the corresponding dynamic function based on the real string and the function of the dynamic obfuscation function.

[0219] Convert the bitwise operations in the second reverse recovery program into the results after operations are performed according to the meaning of the operators;

[0220] The character operation keywords in the second reverse restoration program are located to determine the target string and the position of the operation character, and the positioning character is determined based on the target string and the position of the operation character.

[0221] By tracing back the branch conditions associated with the positioning character, the branch judgment rules for the positioning character are obtained;

[0222] Based on the loop structure in the second reverse restoration program, the traversal method of character processing is determined, and the loop flow of character processing is obtained.

[0223] Based on the loop flow of character processing, branch judgment rules, and the determination operation of locating characters, the string processing logic is combined in the execution order to obtain the intermediate restoration result for the string processing logic in the second reverse restoration program;

[0224] Identify the character encoding features in the intermediate reconstruction results, match the character encoding features with known encoding rules, and determine the target encoding type used in the intermediate reconstruction results;

[0225] Based on the branching logic of the encoding range in the intermediate restoration results, determine the triggering conditions and corresponding triggering operations for each branch;

[0226] Based on the loop structure in the intermediate restoration results, the traversal method of encoding conversion is determined, and the loop flow of encoding conversion is obtained;

[0227] Based on the loop flow of encoding conversion, the triggering conditions of each branch, the corresponding triggering operation and the target encoding type, the string encoding conversion logic is combined in the execution order to complete the obfuscation and restoration of the string processing logic in the second reverse restoration program;

[0228] Replace the conditional statements based on dynamic functions with the corresponding original conditional statement operators;

[0229] The restored code blocks are combined in the order of execution to complete the reverse restoration of the control flow flattening.

[0230] The obfuscated program reverse engineering device provided in the embodiments of the present invention can execute the obfuscated program reverse engineering method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0231] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0232] In the technical solution disclosed herein, the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0233] In the technical solution disclosed herein, if automated decision-making is involved, a corresponding operation entry will be provided to the user, allowing the user to choose to agree to or reject the automated decision result; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0234] Example 5

[0235] Figure 6 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0236] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0237] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0238] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the reverse engineering of obfuscated programs, i.e.:

[0239] Obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls present in the target obfuscated program, and obtain the first reverse restoration program;

[0240] Redundant code is detected in the first reverse engineering program through static and dynamic analysis, and the detected redundant code is removed in the first reverse engineering program to obtain the second reverse engineering program.

[0241] The second reverse restoration program is subjected to control flow flattening reverse restoration processing to obtain the target reverse restoration program corresponding to the target obfuscation program.

[0242] In some embodiments, the method for reversing obfuscation can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for reversing obfuscation described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method for reversing obfuscation by any other suitable means (e.g., by means of firmware).

[0243] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0244] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0245] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0246] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0247] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0248] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0249] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0250] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for reversing obfuscated programs, characterized in that, include: Obtain the target obfuscated program, sequentially detect and restore the Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls present in the target obfuscated program, and obtain the first reverse restoration program; Redundant code is detected in the first reverse engineering program through static and dynamic analysis, and the detected redundant code is removed in the first reverse engineering program to obtain the second reverse engineering program. The second reverse restoration program is subjected to control flow flattening reverse restoration processing to obtain the target reverse restoration program corresponding to the target obfuscation program.

2. The method according to claim 1, characterized in that, The first reverse engineering process involves sequentially detecting and restoring Boolean operations, obfuscated string arrays, obfuscated attribute names, and obfuscated indirect function calls present in the target obfuscated program, resulting in the following: When Boolean operations exist in the target obfuscation program, the existing Boolean operations are obfuscated and reversed to obtain the first intermediate stage restoration program; When at least one string obfuscation feature is identified in the first intermediate stage restoration program, after calculating the actual index of the obfuscated string array corresponding to the string obfuscation feature, the matching obfuscated string array is statically restored according to the actual index to obtain the second intermediate stage restoration program. When at least one attribute name obfuscation feature is identified in the second intermediate stage restoration program, after inferring the actual function of the obfuscated attribute name based on the parameters and return value of the obfuscated attribute name corresponding to the attribute name obfuscation feature, the obfuscated attribute name is obfuscated and restored according to the actual function to obtain the third intermediate stage restoration program. After parsing the third intermediate stage restoration program into the first abstract syntax tree, when a node of type call is identified in the first abstract syntax tree, the identified node is used as a call expression, and the function name of the call expression is determined. Based on the function name of the call expression, the obfuscated indirect function call in the first abstract syntax tree is obfuscated and restored; Based on the first abstract syntax tree after obfuscation and deobfuscation, the first reverse deobfuscation program is formed.

3. The method according to claim 2, characterized in that, Calculate the actual index of the array of obfuscated strings corresponding to the obfuscated features, including: The obfuscated string array is extracted by matching the array declaration in the target obfuscator using a first regular expression that matches the string obfuscation features. The offset value is extracted by matching the binary operation pattern in the target obfuscator using a second regular expression that matches the string obfuscation features; The call parameter values ​​of the call function are extracted by matching the called function in the target obfuscator with a third regular expression that matches the string obfuscation features. The actual index of the obfuscated string array corresponding to the obfuscated string feature is calculated based on the call parameter value and the offset value.

4. The method according to claim 2, characterized in that, Based on the parameters and return values ​​of the obfuscated attribute name corresponding to the attribute name obfuscation feature, infer the actual function of the obfuscated attribute name, including: Obtain obfuscated attribute names that match the obfuscation features and determine the attribute type of the obfuscated attribute names through static or dynamic analysis; Based on the attribute type, parameters, and return value of the obfuscated attribute name, infer the actual function of the obfuscated attribute name; Accordingly, based on the actual functionality, the obfuscated attribute names are obfuscated and then restored, including: Rename the obfuscated attribute names based on their actual functionality; Based on the actual function, inline calls are made to obfuscate and restore the matched obfuscated attribute names.

5. The method according to claim 2, characterized in that, Determine the function name of the calling expression, including: When the called content of the call expression is a direct call, the function name of the called content is used as the function name of the call expression; When the called content of the call expression is an indirect call, the indirect call variables and / or property references are analyzed by automated analysis tools to determine the actual calling function of the indirect call, and the function name of the actual calling function is used as the function name of the call expression.

6. The method according to claim 1, characterized in that, Redundant code is detected in the first reverse engineering process through static and dynamic analysis, including: During the static analysis process, the first reverse engineering program is parsed into a second abstract syntax tree using static analysis tools. The nodes of the second abstract syntax tree are traversed to identify unreferenced elements and unreachable branches are identified through control flow analysis. Unreferenced elements and unreachable branches are treated as redundant code. The module packaging and building tool generates a dependency graph based on the first reverse engineering program and identifies unreferenced modules, treating them as redundant code. During the dynamic analysis process, test cases are run against the first reverse engineering program, and code coverage reports are generated through test assistance tools, and / or the actual execution trajectory of the program is recorded through performance analysis tools; Identify unexecuted code based on the code coverage report and treat it as redundant code; and / or identify unexecuted code that does not appear in the execution trajectory based on the actual execution trajectory and treat it as redundant code. The code that modifies the global state in the redundant code is reviewed and removed. The remaining redundant code is then treated as the redundant code detected in the first reverse engineering process.

7. The method according to claim 1, characterized in that, The second reverse recovery procedure undergoes control flow flattening reverse recovery processing, including: Identify the state array and corresponding state index variables in the second reverse engineering process, and determine the initial value and change mode of the state index variables; Based on the initial value and change pattern of the state index variable, and in conjunction with the state array, determine the execution order of each branch block in the second reverse restoration program; Identify the control flow keywords for each branch block, and combine the branch blocks in sequence according to the control flow keywords and the execution order of each branch block; Identify the dynamic obfuscation function that includes the encrypted string in the second reverse engineering process, and calculate the real string of the encrypted string of the dynamic obfuscation function; Substitute the real string into the corresponding dynamic obfuscation function, determine the function of the dynamic obfuscation function based on its execution logic, and determine the corresponding dynamic function based on the real string and the function of the dynamic obfuscation function. Convert the bitwise operations in the second reverse recovery program into the results after operations are performed according to the meaning of the operators; The character operation keywords in the second reverse restoration program are located to determine the target string and the position of the operation character, and the positioning character is determined based on the target string and the position of the operation character. By tracing back the branch conditions associated with the positioning character, the branch judgment rules for the positioning character are obtained; Based on the loop structure in the second reverse restoration program, the traversal method of character processing is determined, and the loop flow of character processing is obtained. Based on the loop flow of character processing, branch judgment rules, and the determination operation of locating characters, the string processing logic is combined in the execution order to obtain the intermediate restoration result for the string processing logic in the second reverse restoration program; Identify the character encoding features in the intermediate reconstruction results, match the character encoding features with known encoding rules, and determine the target encoding type used in the intermediate reconstruction results; Based on the branching logic of the encoding range in the intermediate restoration results, determine the triggering conditions and corresponding triggering operations for each branch; Based on the loop structure in the intermediate restoration results, the traversal method of encoding conversion is determined, and the loop flow of encoding conversion is obtained; Based on the loop flow of encoding conversion, the triggering conditions of each branch, the corresponding triggering operation and the target encoding type, the string encoding conversion logic is combined in the execution order to complete the obfuscation and restoration of the string processing logic in the second reverse restoration program; Replace the conditional statements based on dynamic functions with the corresponding original conditional statement operators; The restored code blocks are combined in the order of execution to complete the reverse restoration of the control flow flattening.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the reverse engineering method of the obfuscated program according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method for reversing the obfuscated program as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method for reversing the obfuscated program according to any one of claims 1-7.

Images