Dual-buffer-based probabilistic disassembly and parallel optimization method and system

Abstract

The application discloses a kind of probability disassembly parallel optimization method and system based on double buffering.Thereby, binary program is modeled as the super-set instruction graph containing conflict edge and control flow edge;Using graph coloring algorithm, conflict node is colored and grouped, so that the node in the same color group is connected without conflict edge;Double buffering structure of probability array is constructed, and conflict-free parallel reading and writing are realized by reading and writing separation;Each color group is serially scheduled according to color group order, and multi-thread parallel execution of probability propagation update is performed in the same color group node, and the reading buffer and writing buffer pointers are switched after the current color group update;Parallel determination mechanism is used to detect node convergence state, and if there is a non-converged node, iteration continues;After all nodes converge, the probability of each super-set instruction being a real instruction is calculated in parallel and output.The application eliminates data competition by double buffering reading and writing separation, and meets the serial constraint of occlusion instruction by graph coloring grouping, which significantly improves parallel efficiency while ensuring zero false negative and low false positive accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer science and technology, specifically to a probabilistic disassembly parallel optimization method and system based on double buffering. Background Technology

[0002] Binary disassembly is a core preliminary step in binary analysis, security hardening, and vulnerability remediation, and its accuracy and efficiency directly determine the reliability of downstream tasks. Probabilistic disassembly, as a novel disassembly technique, achieves the advantages of zero false negatives (no missing real instructions) and low false positives (low probability of data being misidentified as instructions) on the basis of superset disassembly through a confidence propagation algorithm. It effectively solves the accuracy defects of traditional linear scan disassembly and traversal disassembly, and has become a research hotspot in current disassembly technology.

[0003] The core logic of probabilistic disassembly is to perform probabilistic inference on the graph structure composed of superset instructions, calculating the probability that each superset instruction is a real instruction and the probability that its corresponding address is a data byte. Since the number of superset instructions in binary programs (especially large firmware and system images) is enormous, the time consumed by single-threaded iterative execution of belief propagation is extremely long, which cannot meet the needs of real-time analysis. Therefore, parallel optimization becomes the key to improving the efficiency of probabilistic disassembly.

[0004] Existing parallel optimization attempts for probabilistic disassembly are mainly based on the idea of ​​graph computing frameworks, using multi-threaded parallel updates of the superset instruction graph. However, it is difficult to balance efficiency and accuracy. On the one hand, the global probability array is a shared resource for multiple threads, and read-write conflicts are prone to occur during parallel updates. Existing solutions use atomic operations or mutexes to solve this, but in high-conflict scenarios, this leads to frequent spin retries or lock contention, drastically increasing parallel overhead and failing to leverage the parallel advantages of multi-core CPUs. On the other hand, superset instructions with overlapping physical addresses (occlusion relationships) must be updated serially to ensure probability normalization constraints. Existing parallel scheduling mechanisms struggle to efficiently distinguish between parallelizable and serializable nodes, easily leading to errors in parallel updates of occluded instructions and increasing the false positive rate. Furthermore, traditional convergence determination uses a single thread to traverse all nodes, which becomes a performance bottleneck for parallel optimization when the number of superset instructions is large. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a probabilistic disassembly parallel optimization method and system based on double buffering, which solves the core problems in existing probabilistic disassembly parallel optimization such as data contention, high parallel overhead, and difficulty in meeting occlusion instruction constraints. While ensuring zero false negatives and low false positives accuracy, it significantly improves the parallel efficiency of probabilistic disassembly.

[0006] This invention is achieved through the following technical solution: In a first aspect, this application provides a probabilistic disassembly parallel optimization method based on double buffering, comprising the following steps: Step 1: Based on the code space of the input binary program, decode each address to generate superset instructions, and construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges; Step 2: Extract the conflict subgraph from the superset instruction graph, use a graph coloring algorithm to color the conflict subgraph, and divide the nodes into different color groups according to the coloring results, so that nodes in the same color group are connected without conflicting edges. Step 3: Construct a double-buffered structure for storing the probability array. The double-buffered structure includes a read buffer and a write buffer. Read and write separation enables conflict-free parallel read and write operations by multiple threads. Step 4: Perform serial scheduling on each color group in the order of color groups. Nodes in the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. After the current color group is updated, the read buffer and write buffer pointers are switched. Step 5: Use a parallel decision mechanism to detect the convergence status of each node. If there are non-converged nodes, return to step 4 to continue iterating. Step 6: After all nodes have converged, calculate the probability that each superset instruction is a real instruction in parallel and output the probability disassembly result.

[0007] Preferably, the construction of the superset instruction graph in step 1 specifically includes: Traverse the code space of the input binary program, call the instruction decoder address by address to decode, generate all possible superset instructions, and add the valid superset instructions as nodes to the node set. Iterate through all nodes in the node set, and for any two nodes whose address ranges overlap, construct a conflict edge; Parse the opcode of each superset instruction to determine the target address of the control flow, and construct forward and reverse control flow edges between the node and the target node; Construct a superset instruction graph based on the node set and edge set, and preprocess the graph by deleting invalid nodes and their associated edges, removing duplicate edges, and constructing a neighbor index table for each node.

[0008] Preferably, step 2 uses a graph coloring algorithm to color the conflict subgraph, specifically including: Extract the subgraph containing only conflicting edges and corresponding nodes from the superset instruction graph to obtain the conflicting subgraph; Sort the nodes in the conflict subgraph from highest to lowest number of conflicting neighbors; Iterate through the sorted nodes in sequence, collect the color set of the colored conflicting neighbors, and find the unused color value starting from the smallest color number to assign to the current node; Based on the coloring results, nodes with the same color value are grouped into the same color group, generating a color-node set mapping table.

[0009] Preferably, step 3, which involves constructing a double-buffered structure for storing the probability array, specifically includes: Create two probability arrays of the same length as the number of nodes, which will serve as read buffers and write buffers for the data byte probability array and the actual instruction probability array, respectively. Atomic pointers are used to store read buffer pointers and write buffer pointers separately to ensure the atomicity of pointer switching and memory visibility in a multi-threaded environment; Create an unbounded concurrent queue as a global work queue, and add node identifiers containing prior hint probabilities to the queue as initial active nodes; Create an atomic boolean array of the same length as the number of nodes to mark whether a node is active.

[0010] Preferably, in step 4, nodes within the same color group are updated in parallel using multiple threads, with each thread performing at least one of the following probability propagation operations: Forward hint propagation: Read the old probability value and prior hint value of the node from the read buffer, calculate the new probability value and write it to the write buffer, traverse the forward control flow neighbors, update the neighbor probability value and mark the active node; Local propagation in occlusion space: Read the old probability values ​​of conflicting neighbors of a node from the read buffer, take the minimum value to calculate the new probability value of the current node, and write it to the write buffer; Reverse invalidity propagation: When a node is determined to be an invalid data byte, the predecessor node in the reverse control flow is traversed, the predecessor probability value is updated, and the active node is marked.

[0011] Preferably, when using multi-threaded parallel updates, each thread adopts a hierarchical lock-free queue mechanism: each thread maintains a local queue, pops active nodes from the global work queue and adds them to the local queue, and writes the active nodes in the local queue back to the global work queue after processing.

[0012] Preferably, step 5 employs a parallel decision-making mechanism to detect the convergence status of each node, specifically including: The nodes are divided into multiple blocks equally according to their identifiers, and the number of blocks is equal to the number of worker threads. Each worker thread traverses all nodes within its block, checks whether the node's active flag is true, and whether the probability change of nodes in the read buffer and write buffer exceeds a preset threshold. If all nodes within a block satisfy the condition that the active flag is false and the probability change does not exceed the threshold, then the block is marked as convergent; otherwise, it is marked as false. Atomic reduction operations are used to summarize the convergence flags of all blocks. If all blocks are true, then all nodes are considered to have converged.

[0013] Preferably, in the parallel determination mechanism, convergence is determined when all nodes satisfy the condition that the active flag is false and the probability change does not exceed a preset threshold; if convergence is not achieved after reaching the preset maximum number of iterations, the iteration is forcibly stopped.

[0014] Preferably, step 6, which involves parallel calculation of the probability that each superset instruction is a real instruction, specifically includes: Start multiple worker threads and process the nodes in each color group in parallel; The probability of reading data bytes from a node from the read buffer and the probability of reading data bytes from its conflicting neighbors; If the data byte probability of a node is represented as a data byte, then the actual instruction probability is the preset minimum value; otherwise, the actual instruction probability is calculated based on the data byte probabilities of the node and its conflicting neighbors. Write the calculated true instruction probabilities to the write buffer. After all nodes have been processed, switch the buffer pointer and output the true instruction probability results for each superset instruction.

[0015] Secondly, this application provides a probabilistic disassembly parallel optimization system based on double buffering, comprising: The graph construction module is used to decode each address based on the code space of the input binary program to generate superset instructions, and construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges. The graph coloring module is used to extract conflicting subgraphs in the superset instruction graph. It uses a graph coloring algorithm to color the conflicting subgraphs and divides the nodes into different color groups based on the coloring results, so that nodes in the same color group are connected without conflicting edges. The double-buffer management module is used to construct a double-buffer structure for storing probability arrays. The double-buffer structure includes a read buffer and a write buffer, and achieves conflict-free parallel read and write by multi-threading through read-write separation. The parallel scheduling module is used to perform serial scheduling of each color group in the order of color group. Nodes in the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. After completing the update of the current color group, the read buffer and write buffer pointers are switched. The convergence determination module is used to detect the convergence status of each node using a parallel determination mechanism. If there are non-converged nodes, the parallel scheduling module is triggered to continue the iteration. The results output module is used to calculate the probability that each superset instruction is a real instruction in parallel after all nodes have converged, and output the probability disassembly results.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: This application proposes a probabilistic disassembly parallel optimization method based on double buffering. By combining double buffering technology with graph coloring and wavefront parallel scheduling, it resolves the contradiction between data contention and occlusion constraints in existing parallel schemes. Specifically, the binary program is first modeled as a superset instruction graph containing conflicting edges and control flow edges. A graph coloring algorithm is used to group conflicting nodes, connecting conflict-free edges within the same color group, thereby transforming the serial constraint of occlusion instructions into serial execution between color groups and parallel execution within color groups. Then, a double buffering structure is constructed to achieve read-write separation of the probability array. During multi-threaded parallel updates, data is read from the read buffer and written to the write buffer, completely eliminating data contention. Finally, a parallel decision mechanism is used to replace single-threaded convergence decision, eliminating performance bottlenecks. This method employs double-buffered read-write separation to avoid the overhead of atomic operations and mutexes, reducing parallel overhead by 40%-60% compared to existing solutions. Graph coloring grouping strictly satisfies the serial constraint of occlusion instructions, maintaining the accuracy characteristics of zero false negatives and low false positives in the original probability disassembly. Layered lock-free queues and parallel convergence determination enable a speedup of more than 14 times for 16 threads, reducing processing time from 10 minutes to less than 1 minute. It can be extended to distributed graph computing frameworks and adapted to GB-level large firmware processing. The engineering implementation is lightweight and can seamlessly connect to downstream tasks such as binary rewriting, reducing binary size overhead by more than 30% after rewriting.

[0017] This application also proposes a double-buffered probabilistic disassembly parallel optimization system, an electronic device, and a computer storage medium, which possess all the advantages of the aforementioned double-buffered probabilistic disassembly parallel optimization method. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 The flowchart shows the probabilistic disassembly parallel optimization method based on double buffering according to the present invention. Figure 2 This is a block diagram of the probabilistic disassembly parallel optimization system based on double buffering according to the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] See Figure 1 A probabilistic disassembly parallel optimization method based on double buffering includes the following steps: Step 1: Based on the code space of the input binary program, decode each address using an instruction decoder to generate a superset instruction set. Construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges. The graph is preprocessed to obtain a graph structure for probabilistic inference.

[0023] in, For a set of nodes, It is an edge set.

[0024] Specifically, it includes the following processes: S1.1 Traverse the code space of the input binary program, starting from the beginning address of the code segment, call the instruction decoder address by address to decode and generate all possible superset instructions.

[0025] For each address, if decoding is successful and the instruction is valid, it is treated as a valid superset instruction and added to the node set as a node. If decoding fails, skip that address.

[0026] Each superset instruction node records the following attributes: globally unique identifier, instruction starting physical address, instruction length, prior hint probability, validity flag, color value, list of conflicting neighbors, list of forward control flow neighbors, and list of reverse control flow neighbors. Node set The size is equal to the number of effective superset instructions.

[0027] S1.2 Traversing the Node Set For any two nodes A and B, if the address ranges of A and B overlap, then construct a conflicting edge between A and B and add the conflicting edge to the edge set. Conflict edges are used to represent the mutual exclusion relationship between two superset instructions due to overlapping physical addresses, meaning that neither can be a real instruction at the same time.

[0028] S1.3. Parse the opcode of each superset instruction to determine its control flow target address (such as the target address of a jump instruction, the return address of a function call, etc.). Construct a forward control flow edge between the node and the target node, and simultaneously construct a reverse control flow edge based on the reverse relationship. Add both the forward and reverse control flow edges to the edge set. Control flow edges are used to represent execution dependencies between instructions and guide the direction of probability propagation.

[0029] S1.4, Based on the node set and edge set Forming a superset instruction graph For the completed superset instruction graph Preprocessing is performed to remove invalid nodes and their associated edges, remove duplicate edges, and build a neighbor index table for each node to store the identifiers of conflicting neighbors, forward control flow neighbors, and reverse control flow neighbors respectively. An array is used to store the index table to achieve a neighbor lookup with constant time complexity.

[0030] By modeling the binary program as a graph structure containing conflict edges and control flow edges, the spatial constraints and temporal dependencies between superset instructions are fully preserved. The construction of conflict edges lays the foundation for subsequent occlusion constraint processing, while the construction of control flow edges provides a clear propagation path for probability propagation. Preprocessing operations remove invalid nodes and redundant edges, improving the regularity of the graph structure and creating favorable conditions for subsequent parallel updates.

[0031] In some embodiments, the instruction decoder may employ instruction set decoders of different architectures such as x86 / ARM to adapt to different target platforms.

[0032] In some embodiments, the neighbor index table can be implemented using a hash table, which is suitable for scenarios where the number of node neighbors is sparse.

[0033] Step 2: Based on the superset instruction graph constructed in Step 1, extract the conflict subgraph, and color the nodes using a greedy coloring algorithm. According to the coloring results, divide the nodes into different color groups so that nodes in the same color group can be updated in parallel, while nodes in different color groups are updated serially, satisfying the serial constraint of occlusion instructions.

[0034] Specifically, it includes the following processes: S2.1 Extract a subgraph containing only conflicting edges and their corresponding nodes from the superset instruction graph constructed in step 1, ignoring control flow edges, to obtain the conflicting subgraph. .

[0035] S2.2, Conflict Subgraph The nodes are sorted from highest to lowest according to the number of conflicting neighbors (i.e., node degree), and nodes with higher degrees are colored first to reduce the number of colors required.

[0036] S2.3. Iterate through the sorted nodes in sequence. For each node, collect the color set of its colored conflicting neighbors. Starting from color number 0, find the smallest unused color value and assign it to the current node. Record the node color.

[0037] S2.4. Based on the coloring results, nodes with the same color value are grouped into the same color group, and a color-node set mapping table is generated to ensure that there are no conflicting edges connecting nodes within the same color group.

[0038] This step uses graph coloring to assign conflicting nodes to different color groups, thus decoupling conflict constraints. The greedy coloring algorithm processes nodes in descending degree order, prioritizing color assignment to nodes with more constraints, which helps minimize the number of colors. The colored node groups satisfy the scheduling rule of "parallel processing for nodes of the same color, serial processing for nodes of different colors," ensuring both the serial update constraints of occlusion instructions and maximizing the parallelism for subsequent parallel updates. The number of colors is typically controlled between 4 and 8, matching the number of CPU cores, effectively utilizing multi-core parallel capabilities.

[0039] In some embodiments, the greedy coloring algorithm can be replaced by a backtracking coloring algorithm in order to achieve a smaller number of colors.

[0040] In some embodiments, a genetic algorithm can be used for coloring, which is suitable for scenarios with a large number of nodes and where a globally optimal grouping effect is required.

[0041] Step 3: Based on the number of superset instruction nodes, construct a probability array for storing data bytes. and the true instruction probability array The double-buffered structure initializes the read buffer OldBuffer and the write buffer NewBuffer respectively, and initializes the lock-free work queue, adding nodes with prior hint probabilities as the initial active nodes to the queue.

[0042] Specifically, it includes the following processes: S3.1. Create two probability arrays with the same length as the number of instruction nodes in the superset, and use them as data byte probability arrays respectively. and the true instruction probability array The read buffer and write buffer are configured. The D array is initialized to 0.0 (initial value of data byte probability), and the P array is initialized to 0.0 (initial value of actual instruction probability).

[0043] S3.2. Use atomic pointers to store the read buffer pointer and write buffer pointer separately to ensure the atomicity of pointer switching and memory visibility in a multi-threaded environment. Assign the two initialized probability arrays to the read buffer pointer and write buffer pointer respectively.

[0044] S3.3. Create an unbounded concurrent queue as a global work queue. Traverse all superset instruction nodes and add the node identifiers containing prior hint probabilities (hint values ​​are not 0) to the queue as initial active nodes to trigger the first round of parallel updates.

[0045] S3.4. Create an atomic boolean array of the same length as the number of nodes, initialized to false, to mark whether a node is an active node and prevent nodes from being added to the queue repeatedly.

[0046] This step achieves read-write separation of the probability array through a double-buffered structure. The read buffer is used only for reading, and the write buffer is used only for writing, completely eliminating the risk of data contention caused by multiple threads simultaneously reading and writing to the same memory address, without the need for atomic operations or mutex locks. The combined use of a lock-free work queue and an active marker array ensures contention-free distribution and deduplication of active nodes, providing an efficient scheduling foundation for subsequent parallel iterative updates.

[0047] In some embodiments, a circular buffer can be used instead of a double buffer to support the cyclic use of multiple versions of data.

[0048] In some embodiments, a multi-buffered (three or more buffers) structure can be used to support finer-grained read-write separation.

[0049] In some embodiments, the work queue can adopt a hierarchical structure that combines thread-local queues and global queues to reduce contention for the global queue.

[0050] Step 4: Based on the color grouping results in Step 2, schedule each color group in sequence according to color order. Nodes within the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. Perform forward hint propagation, local propagation of occlusion space, and reverse invalidity propagation. After completing the update of the current color group, atomically switch the read buffer and write buffer pointers.

[0051] Specifically, it includes the following processes: S4.1 The main thread of the scheduler processes each color group in ascending order of color value. After each color group is processed, the next color group is processed to ensure the correctness of the occlusion constraint.

[0052] S4.2 For the color group currently being processed, start multiple worker threads. Each thread initializes a local queue (lock-free) to store active nodes to be processed.

[0053] S4.3 The worker thread pops active nodes from the global lock-free work queue and adds them to the local queue to achieve load balancing.

[0054] S4.4 The worker thread retrieves a node from the local queue and reads the node's old probability value from the read buffer. Calculate the new probability value of the node using the prior hint value. , change the new probability value Write to the corresponding location in the write buffer. Traverse the node's forward control flow neighbors, calculate the new probability value of the neighbors, and if the probability change exceeds a preset threshold, mark the neighbor as an active node and add it to the local queue.

[0055] S4.5 The worker thread reads the old probability values ​​of all conflicting neighbors of the node from the read buffer, takes the minimum value, and calculates the new probability value of the current node. Write to the write buffer. If the probability change exceeds the threshold, mark the current node as an active node and add it to the local queue.

[0056] S4.6, The worker thread reads the old probability value of the node from the read buffer. If a node is determined to be an invalid data byte, then its reverse control flow predecessor node is traversed, the new probability value of the predecessor node is calculated, and if the probability change exceeds the threshold, the predecessor node is marked as an active node and added to the local queue.

[0057] S4.7 After the current color group is processed, each worker thread writes the active nodes in its local queue to the global work queue for use in the next iteration.

[0058] S4.8 Atomic swap of read buffer pointer and write buffer pointer causes the next iteration to read data from the new read buffer and write data to the new write buffer, while clearing the write buffer to the default value.

[0059] This step ensures the update order of occlusion instructions through serial scheduling of color groups, satisfying the probability normalization constraint; multi-threaded parallelism within the same color group fully utilizes the computing power of multi-core CPUs; double-buffered read-write separation avoids multi-threaded read-write conflicts and eliminates atomic operation overhead; hierarchical lock-free queues reduce global queue contention; and the three-step propagation logic fully implements the belief propagation algorithm based on probability disassembly. This design makes the parallel efficiency nearly linear, and the speedup increases significantly with the number of threads.

[0060] In some embodiments, a dynamic load balancing strategy can be adopted to dynamically adjust the node allocation based on the processing speed of each thread.

[0061] In some embodiments, a batch update strategy can be adopted to merge updates of multiple nodes and reduce the number of buffer switches.

[0062] In some embodiments, a prefetching strategy can be adopted to pre-fetch neighbor node data that may be needed into the cache, thereby reducing memory access latency.

[0063] Step 5: Based on the iterative update results of Step 4, the superset instruction nodes are divided into multiple node blocks according to the identifier. Each thread detects the active state and probability change of the nodes in its block in parallel, generates a block convergence mark, and obtains the global convergence result through atomic reduction.

[0064] Specifically, it includes the following processes: S5.1 Divide the superset instruction nodes into equal parts based on their identifier IDs. Each block, It equals the number of worker threads, and each block contains approximately the same number of nodes.

[0065] S5.2 Each worker thread traverses all nodes within its block, checking two conditions: first, whether the node's active flag is true; second, whether the absolute value of the probability change of nodes in the read buffer and write buffer exceeds a preset threshold. .

[0066] S5.3 If all nodes in a block satisfy the condition that the active flag is false and the probability change does not exceed the threshold, then the block is marked as convergent as true; otherwise, it is false.

[0067] S5.4. Use atomic reduction operations to summarize the convergence flags of all blocks. If all blocks are true, then global convergence is determined and the iteration stops; otherwise, return to step 4 to continue the next round of parallel updates.

[0068] S5.5 Set the maximum number of iterations. If the maximum number of iterations is reached and the solution still fails to converge, the iteration will be forcibly stopped to ensure the feasibility of the solution.

[0069] This step replaces the traditional single-threaded convergence determination with multi-threaded parallel determination, eliminating the performance bottleneck in the convergence determination stage. The node partitioning strategy ensures load balancing, and atomic reduction operations achieve efficient global state aggregation. The dual detection mechanism of activity marking and probability change considers both the immediate state of the node and the stability of the probability value, guaranteeing the accuracy of the convergence determination.

[0070] In some embodiments, a dynamic block partitioning strategy can be adopted to adaptively adjust the block size according to the node density.

[0071] In some embodiments, asynchronous reduction can be used to reduce thread synchronization waiting time.

[0072] In some embodiments, an early exit mechanism may be employed, which terminates the current detection round early once an unconverged block is detected.

[0073] Step 6: Based on the final data byte probabilities in the read buffer after convergence in Step 5, calculate the true instruction probabilities in parallel by color group, write the calculation results to the write buffer, switch pointers, and output the probability that each superset instruction is a true instruction.

[0074] Specifically, it includes the following processes: S6.1 Start multiple worker threads and process the nodes in each color group in parallel according to the color grouping results in step 2.

[0075] S6.2, the probability D of a worker thread reading a node's data bytes from the read buffer and the probability of its conflicting neighbors' data bytes.

[0076] S6.3, For each node, if (Data bytes), then the probability of the actual instruction. Otherwise, calculate the conflicting neighbors. The sum is obtained .

[0077] S6.4, the calculated Write to the corresponding location in the write buffer.

[0078] S6.5 After all node calculations are completed, the read buffer and write buffer pointers of the P buffer are switched atomically.

[0079] S6.6 Read the final result of the P buffer, output the identifier, physical address and probability value of each superset instruction as a real instruction, and complete the probabilistic disassembly parallel optimization.

[0080] By computing normalized probabilities in parallel, multi-core computing resources are fully utilized. Grouping by color in parallel avoids synchronization dependencies between conflicting nodes, ensuring the correctness of the calculation results. A double-buffered structure continues to play a role in the result output stage, ensuring the consistency of probability values ​​during calculation and retrieval. The final output probability results provide an accurate instruction reliability reference for downstream tasks such as binary rewriting and vulnerability detection.

[0081] In some embodiments, parallel tasks can be directly divided by node identifiers, simplifying the scheduling logic.

[0082] In some embodiments, a streaming output method can be used to output results while calculating, thereby reducing memory usage.

[0083] In some embodiments, filtered results with probability thresholds can be output, only outputting real instructions with probabilities higher than preset values, thereby improving the processing efficiency of downstream tasks.

[0084] The core concept of this application's probabilistic disassembly parallel optimization method based on double buffering lies in combining double buffering technology with graph computation and parallel scheduling: First, superset instructions are modeled as a graph structure containing conflict edges and control flow edges, and the serial constraints of occluded instructions are resolved through graph coloring and grouping; the read-write separation characteristic of double buffering is used to achieve conflict-free parallel updates of the probability array, completely eliminating data races; combined with wavefront parallel scheduling and parallel convergence determination techniques, efficient parallel optimization of probabilistic disassembly is achieved. This invention significantly improves the parallel efficiency of probabilistic disassembly while ensuring zero false negatives and low false positives accuracy.

[0085] Example 1 This embodiment provides a probabilistic disassembly parallel optimization method based on double buffering, the system structure of which is as follows: Figure 2 As shown, it includes a graph construction module, a graph coloring module, a double buffer management module, a parallel scheduling module, a probability update module, a convergence determination module, and a result output module.

[0086] Example Environment Configuration This embodiment is implemented in Rust and is compatible with the x86 architecture. The hardware environment is: Intel Core i9-13900K CPU (16 cores, 32 threads), 32GB RAM, and 1TB hard drive; the software environment is: Arch Linux operating system, Rust version 1.93.0. The input binary program is in ELF format (3MB in size), and the convergence threshold is... Maximum number of iterations: 50; number of worker threads: 16.

[0087] S1. Convert the input binary program into a graph structure G=(V,E) that can be used for probabilistic inference. The specific implementation is as follows: First, the ELF binary file is read, the code segment address range is parsed, and each address in the code segment is traversed (from the start address to the end address). The instruction decoder (reusing the instruction decoding logic of the BAP framework) is called to decode each address, generate a superset of instructions, and filter invalid instructions (invalidInstr(i)=true, i.e., addresses that cannot be decoded into valid x86 instructions).

[0088] Then, a node is created for each valid superset instruction. The node ID is a consecutive integer (starting from 0). The node attributes are assigned as follows: addr is the physical address of the instruction start, len is the x86 instruction length (1~15 bytes), hint is the control flow convergence hint (1 / 255) or register def-use hint (1 / 16), valid=true, color is initialized to usize::MAX, and the conflict neighbor list, forward control flow neighbor list, and reverse control flow neighbor list are initialized to empty.

[0089] Next, construct the edge set E, and use the sorted two-pointer method to construct conflicting edges: traverse all nodes, and for any two nodes A and B, if the address range of A... Address range of B If overlap exists, a conflict edge is constructed between A and B. The opcode of each instruction (such as JMP, CALL, JE, etc.) is parsed to determine the control flow target address, and forward and reverse control flow edges are constructed.

[0090] Finally, graph preprocessing is performed, including deleting invalid nodes and their associated edges, removing duplicate edges, and constructing a neighbor index table for each node (stores the IDs of conflicting neighbors, forward control flow neighbors, and reverse control flow neighbors). The index table is stored using an array. Search.

[0091] S2. Group conflicting nodes using a greedy coloring algorithm to ensure that nodes in the same color group are not connected by conflicting edges. The specific implementation is as follows: First, extract the conflict subgraph, keeping only the conflicting edges and their corresponding nodes, ignoring the control flow edges.

[0092] Then, the nodes are sorted in descending order of the number of conflicting neighbors (degree). For example, if node 0 has 4 conflicting neighbors and node 1 has 3 conflicting neighbors, then node 0 will be colored first.

[0093] Next, initialize the node color array (length = number of nodes), with an initial value of usize::MAX, and the color group mapping table is initially empty. Then, iterate through the sorted nodes and perform a greedy coloring process: for the current node, collect the color set of its colored conflicting neighbors, and starting from color number 0, find the smallest unused color value to assign to that node.

[0094] The example coloring process is as follows: None of the conflicting neighbors of node 0 are colored, so it is assigned color 0 and added to color group 0; Node 1's conflicting neighbor is Node 0 (color 0), so it is assigned color 1 and added to color group 1; Node 2's conflicting neighbor is Node 0 (color 0), so it is assigned color 1 and added to color group 1; And so on, ultimately generating color groups 0 to 7 (under x86 architecture, the number of colors is usually 4 to 8).

[0095] Finally, output a color-node set mapping table. For example, color 0 corresponds to nodes [0,5,9,...], and color 1 corresponds to nodes [1,2,6,...]. Ensure that there are no conflicting edges connecting nodes within the same color group.

[0096] S3. Initialize the double-buffered structure of the probability array and the lock-free work queue to lay the foundation for conflict-free parallel read and write operations. The specific implementation is as follows: First, define a DoubleBuffer generic structure, containing old_ptr(AtomicPtr) <Vec <t>>)、new_ptr(AtomicPtr<Vec <t>>)、phantom(PhantomData <t>).

[0097] Then, initialize the double buffer of the data byte probability array D: create two Vec arrays with a length equal to the number of nodes. <f64>The initial value is 0.0. It is converted to a raw pointer using Box::into_raw and assigned to old_ptr and new_ptr as read and write buffers, respectively. Similarly, the double buffer of the real instruction probability array P is initialized with an initial value of 0.0.

[0098] Next, initialize the lock-free work queue: create a ConcurrentQueue. <u64>(Unbounded queue) Iterate through all nodes and add the node IDs with non-zero hint values ​​(such as nodes containing control flow convergence hints) to the queue as the initial active nodes.

[0099] Finally, initialize the active tag array: create Arc <Vec <atomicbool>>, with a length equal to the number of nodes, and an initial value of false, is used to mark whether a node is an active node, preventing nodes from being added to the queue repeatedly.

[0100] S4. Using a wavefront parallel scheduling mechanism, the nodes in each group are updated in parallel according to their color group order. The specific implementation is as follows: First, start the CrossBeam thread pool and process each color group sequentially (0-7) according to color order. For color group 0, start 16 worker threads. Each thread pops an active node from the global work queue and adds it to its local queue (VecDeque). <u64>).

[0101] Then, three probability propagation operations are performed: Forward hint propagation: The thread reads the old probability value of the node from the read buffer of the D buffer. And hint value, calculate (like ,but Write the data to the corresponding location in the write buffer. Traverse the node's forward control flow neighbors and calculate the neighbors'... Write to the write buffer, if The active flag of a neighbor is set to true using a CAS atomic operation, and the neighbor is added to the local queue.

[0102] Occlusion-based local propagation: A thread reads all conflicting neighbors of a node from its read buffer. Take the minimum value Calculate the current node Write to the write buffer. If Mark the node as active and add it to the local queue.

[0103] Reverse invalidation propagation: Threads read nodes ,like (The node is determined to be an invalid data byte), traverse its reverse control flow predecessor node, if the predecessor , will the front drive Set as Write to the write buffer, mark the predecessor as active, and add it to the local queue.

[0104] After completing the three propagation operations, the thread writes the active nodes from the local queue to the global work queue. Once the current color group is processed, the `swap_buffers()` method is called to atomically swap the read and write buffer pointers of the D buffer, and then clear the write buffer. Color groups 1 through 7 are processed sequentially using the above steps to complete one iteration.

[0105] S5. By using multi-threaded parallel detection of the convergence status of each node block, the global convergence can be efficiently determined. The specific implementation is as follows: First, the valid nodes are divided into 16 blocks on average according to their IDs (the number of nodes in each block is approximately equal to the total number of nodes divided by 16), and each thread processes one block.

[0106] Then, the thread iterates through all nodes within its block, checking two conditions: first, whether the node's active flag is true; and second, the absolute value of the probability change between the read buffer and the write buffer. Is it greater than the threshold of 0.001? If there are nodes in the block that are marked as active (true) or whose probability changes exceed the threshold, then the convergence flag for that block is false; otherwise, it is true.

[0107] Next, the AND reduction operation of AtomicBool is used to summarize the convergence flags of all blocks. If all blocks are true, global convergence is determined and the iteration stops; otherwise, return to step S4 to continue the next round of iterations until the maximum number of iterations, 50, is reached.

[0108] S6. After global convergence, calculate the true instruction probability in parallel and output the final disassembly result. The specific implementation is as follows: First, 16 threads are started to process nodes in color-coded groups. Each thread reads the data bytes of a node from the read buffer of the D buffer, along with the probability D of the node and the D value of its colliding neighbors.

[0109] Then, calculate the probability of the actual instruction: if the node ,but Otherwise, calculate ,get .

[0110] The calculated Write to the corresponding location in the write buffer of the P buffer.

[0111] After all nodes have been processed, the read and write buffer pointers of the P buffer are atomically switched. Finally, the get_final() method is called to extract the final result of the P buffer, and the ID, physical address, and actual instruction probability value of each node are output, completing the probabilistic disassembly parallel optimization.

[0112] In some embodiments, the graph coloring algorithm may employ a backtracking coloring algorithm or a genetic coloring algorithm in addition to a greedy coloring algorithm, as long as it can achieve the grouping effect of conflicting nodes having different colors and non-conflicting nodes having the same color.

[0113] In some embodiments, the dual-buffered structure may employ not only dual buffering, but also circular buffering or multiple buffering (three or more buffers), as long as read-write separation and conflict-free parallel read-write can be achieved.

[0114] In some embodiments, in addition to using the crossbeam thread pool, the parallel framework can also use OpenMP or MPI to achieve multi-threaded or multi-process parallelism, adapting to different parallel computing scenarios.

[0115] In some embodiments, the method can be extended to a distributed environment: the superset instruction graph is stored in blocks and deployed on the Pregel distributed graph computing framework, each node is responsible for the parallel update of local graph blocks, and buffer pointers and probability results are synchronized through a consistency protocol to adapt to GB-level large firmware processing.

[0116] In some embodiments, the convergence threshold and the maximum number of iterations can be dynamically adjusted according to the compiler type (GCC / VS) and optimization level (O0 / O3) of the binary program to improve adaptability.

[0117] This embodiment implements a double-buffered probabilistic disassembly parallel optimization, significantly improving the parallel efficiency of probabilistic disassembly while maintaining zero false negatives and low false positives. Experimental results show that for a 3MB binary program, the processing time is reduced from 10 minutes in the original single-threaded algorithm to less than 1 minute (16 threads), with a near-linear speedup (16 threads speedup ≥ 14), and the false positive rate remains at around 3.7%, consistent with the single-threaded algorithm.

[0118] The present invention has the following significant beneficial effects: 1. Completely eliminate data contention and reduce parallel overhead: This invention employs a double-buffering mechanism to separate read and write operations for the probability array. The read buffer is used only for read operations, and the write buffer is used only for write operations. During multi-threaded parallel updates, there is no need to use CAS atomic operations or mutexes, fundamentally eliminating the data contention problem. Compared to existing solutions that suffer from frequent CAS spin retries or mutex-induced thread blocking in high-conflict scenarios, this invention avoids a sharp increase in parallel overhead. Experimental data shows that using the parallel optimization scheme of this invention reduces parallel overhead by 40% to 60% compared to existing solutions.

[0119] 2. Strictly satisfying occlusion instruction constraints to ensure disassembly accuracy: This invention combines a graph coloring algorithm to rationally group superset instructions, assigning conflicting nodes with overlapping physical addresses to different color groups. This allows nodes within the same color group to be updated in parallel, and nodes between different color groups to be updated serially, strictly satisfying probability normalization constraints. This design completely retains the core logic of the original probabilistic disassembly algorithm, ensuring that the zero false negative (no real instruction omission) characteristic remains unaffected, while controlling the false positive rate to around 3.7%, consistent with the original single-threaded algorithm. This avoids the problem of increased false positive rates caused by parallel update errors of occlusion instructions in existing parallel schemes.

[0120] 3. Significantly Improved Parallel Efficiency and Convergence Speed: This invention designs a hierarchical lock-free work queue (combining a global queue and thread-local queues), reducing lock contention in the global queue and achieving conflict-free distribution of active nodes. Simultaneously, a parallel convergence determination mechanism is employed, dividing nodes into blocks and having multiple threads detect convergence status in parallel, eliminating the performance bottleneck of a single thread traversing all nodes for convergence determination. Experimental results show that for a 3MB binary program, the processing time is reduced from 10 minutes with a single thread to less than 1 minute (16 threads), with a near-linear speedup (16 threads speedup ≥ 14), significantly improving efficiency compared to existing parallel solutions.

[0121] 4. High scalability and adaptability to large-scale binary programs: The parallel scheduling mechanism of this invention supports dynamic load balancing, and the number of worker threads can be dynamically adjusted according to the number of CPU cores, fully leveraging the parallel advantages of multi-core CPUs. Furthermore, this invention can be extended to distributed graph computing frameworks (such as Pregel / GraphX). By storing the superset instruction graph in blocks across multiple computing nodes, each node processes its local graph blocks in parallel. A consensus protocol synchronizes buffer pointers and probability results, improving efficiency by 2-3 times compared to existing solutions when processing GB-level large firmware files, effectively solving the problem of low efficiency in processing large binary programs.

[0122] 5. Lightweight implementation and good compatibility with downstream tasks: The double-buffered structure used in this invention is simple, and the graph coloring algorithm has low time complexity, requiring no complex hardware modifications and can be implemented using general-purpose programming languages ​​(such as Rust / C++). Furthermore, this invention completely retains the core logic of the original probabilistic disassembly (three-step propagation, probability normalization), without requiring modification of the original disassembly algorithm, and can directly and seamlessly connect to downstream tasks such as binary rewriting, vulnerability detection, and malware analysis. Experiments show that the rewritten binary size overhead is reduced by more than 30% compared to existing parallel solutions, and runtime efficiency is improved by 3%~5%.

[0123] 6. Strong adaptability and support for multi-scenario deployment: This invention can dynamically adjust the convergence threshold and maximum number of iterations based on the compiler type (GCC / VS) and optimization level (O0 / O3) of the binary program, improving the algorithm's adaptability to different target programs. Furthermore, this invention supports both single-machine multi-core CPU deployment and distributed cluster deployment modes, flexibly adapting to the analysis needs of binary programs of varying sizes, from MB-level embedded firmware to GB-level system images.

[0124] Example 2 A probabilistic disassembly parallel optimization system based on double buffering includes: The graph construction module is used to decode each address based on the code space of the input binary program to generate superset instructions, and construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges. The graph coloring module is used to extract conflicting subgraphs in the superset instruction graph. It uses a graph coloring algorithm to color the conflicting subgraphs and divides the nodes into different color groups based on the coloring results, so that nodes in the same color group are connected without conflicting edges. The double-buffer management module is used to construct a double-buffer structure for storing probability arrays. The double-buffer structure includes a read buffer and a write buffer, and achieves conflict-free parallel read and write by multi-threading through read-write separation. The parallel scheduling module is used to perform serial scheduling of each color group in the order of color group. Nodes in the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. After completing the update of the current color group, the read buffer and write buffer pointers are switched. The convergence determination module is used to detect the convergence status of each node using a parallel determination mechanism. If there are non-converged nodes, the parallel scheduling module is triggered to continue the iteration. The results output module is used to calculate the probability that each superset instruction is a real instruction in parallel after all nodes have converged, and output the probability disassembly results.

[0125] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0126] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0127] An electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the probabilistic disassembly parallel optimization method based on double buffering as described in any of the above embodiments.

[0128] Another electronic device provided in this application embodiment may further include: an input port connected to a processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processor's processing results to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes, but is not limited to, Mobile High Definition Link (HML), Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), and wireless connection (including Wi-Fi, Bluetooth, Bluetooth Low Energy, and IEEE 802.11s-based communication technology).

[0129] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the probabilistic disassembly parallel optimization method based on double buffering as described in any of the above embodiments.

[0130] For descriptions of relevant parts of the double-buffered probabilistic disassembly parallel optimization system, electronic device, and computer-readable storage medium provided in this application's embodiments, please refer to the detailed descriptions of the corresponding parts in the double-buffered probabilistic disassembly parallel optimization method provided in this application's embodiments; they will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0131] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention. < / atomicbool> < / t> < / t> < / t>

Claims

1. A probabilistic disassembly parallel optimization method based on double buffering, characterized in that, Includes the following steps: Step 1: Based on the code space of the input binary program, decode each address to generate superset instructions, and construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges; Step 2: Extract the conflict subgraph from the superset instruction graph, use a graph coloring algorithm to color the conflict subgraph, and divide the nodes into different color groups according to the coloring results, so that nodes in the same color group are connected without conflicting edges. Step 3: Construct a double-buffered structure for storing the probability array. The double-buffered structure includes a read buffer and a write buffer. Read and write separation enables conflict-free parallel read and write operations by multiple threads. Step 4: Perform serial scheduling on each color group in the order of color groups. Nodes in the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. After the current color group is updated, the read buffer and write buffer pointers are switched. Step 5: Use a parallel decision mechanism to detect the convergence status of each node. If there are non-converged nodes, return to step 4 to continue iterating. Step 6: After all nodes have converged, calculate in parallel the probability that each superset instruction is a real instruction, and output the probability disassembly result.

2. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, The construction of the superset instruction graph in step 1 specifically includes: Traverse the code space of the input binary program, call the instruction decoder address by address to decode, generate all possible superset instructions, and add the valid superset instructions as nodes to the node set. Iterate through all nodes in the node set, and for any two nodes whose address ranges overlap, construct a conflict edge; Parse the opcode of each superset instruction to determine the target address of the control flow, and construct forward and reverse control flow edges between the node and the target node; Construct a superset instruction graph based on the node set and edge set, and preprocess the graph by deleting invalid nodes and their associated edges, removing duplicate edges, and constructing a neighbor index table for each node.

3. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, Step 2 involves using a graph coloring algorithm to color the conflict subgraph, specifically including: Extract the subgraph containing only conflicting edges and corresponding nodes from the superset instruction graph to obtain the conflicting subgraph; Sort the nodes in the conflict subgraph from highest to lowest number of conflicting neighbors; Iterate through the sorted nodes in sequence, collect the color set of the colored conflicting neighbors, and find the unused color value starting from the smallest color number to assign to the current node; Based on the coloring results, nodes with the same color value are grouped into the same color group, generating a color-node set mapping table.

4. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, Step 3, which involves constructing a double-buffered structure to store the probability array, specifically includes: Create two probability arrays of the same length as the number of nodes, which will serve as read buffers and write buffers for the data byte probability array and the actual instruction probability array, respectively. Atomic pointers are used to store read buffer pointers and write buffer pointers separately to ensure the atomicity of pointer switching and memory visibility in a multi-threaded environment; Create an unbounded concurrent queue as a global work queue, and add node identifiers containing prior hint probabilities to the queue as initial active nodes; Create an atomic boolean array of the same length as the number of nodes to mark whether a node is active.

5. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, In step 4, nodes within the same color group are updated in parallel using multiple threads, with each thread performing at least one of the following probability propagation operations: Forward hint propagation: Read the old probability value and prior hint value of the node from the read buffer, calculate the new probability value and write it to the write buffer, traverse the forward control flow neighbors, update the neighbor probability value and mark the active node; Local propagation in occlusion space: Read the old probability values ​​of conflicting neighbors of a node from the read buffer, take the minimum value to calculate the new probability value of the current node and write it to the write buffer; Reverse invalidity propagation: When a node is determined to be an invalid data byte, the predecessor node in the reverse control flow is traversed, the predecessor probability value is updated, and the active node is marked.

6. The probabilistic disassembly parallel optimization method based on double buffering according to claim 4, characterized in that, When using multi-threaded parallel updates, each thread adopts a hierarchical lock-free queue mechanism: each thread maintains a local queue, pops active nodes from the global work queue and adds them to the local queue, and writes the active nodes in the local queue back to the global work queue after processing.

7. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, Step 5 employs a parallel decision-making mechanism to detect the convergence status of each node, specifically including: The nodes are divided into multiple blocks equally according to their identifiers, and the number of blocks is equal to the number of worker threads. Each worker thread traverses all nodes within its block, checks whether the node's active flag is true, and whether the probability change of nodes in the read buffer and write buffer exceeds a preset threshold. If all nodes within a block satisfy the condition that the active flag is false and the probability change does not exceed the threshold, then the block is marked as convergent; otherwise, it is marked as false. Atomic reduction operations are used to summarize the convergence flags of all blocks. If all blocks are true, then all nodes are considered to have converged.

8. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, In the parallel determination mechanism, convergence is determined when all nodes satisfy the condition that the active flag is false and the probability change does not exceed a preset threshold; if convergence is not achieved after reaching the preset maximum number of iterations, the iteration is forcibly stopped.

9. The probabilistic disassembly parallel optimization method based on double buffering according to claim 1, characterized in that, Step 6, which involves parallel calculation of the probability that each superset instruction is a real instruction, specifically includes: Start multiple worker threads and process the nodes in each color group in parallel; The probability of reading data bytes from a node from the read buffer and the probability of reading data bytes from its conflicting neighbors; If the data byte probability of a node is represented as a data byte, then the actual instruction probability is the preset minimum value; otherwise, the actual instruction probability is calculated based on the data byte probabilities of the node and its conflicting neighbors. Write the calculated true instruction probabilities to the write buffer. After all nodes have been processed, switch the buffer pointer and output the true instruction probability results for each superset instruction.

10. A probabilistic disassembly parallel optimization system based on double buffering, characterized in that, include: The graph construction module is used to decode each address based on the code space of the input binary program to generate superset instructions, and construct a superset instruction graph with superset instructions as nodes and conflict relationships and control flow relationships between instructions as edges. The graph coloring module is used to extract conflicting subgraphs in the superset instruction graph. It uses a graph coloring algorithm to color the conflicting subgraphs and divides the nodes into different color groups based on the coloring results, so that nodes in the same color group are connected without conflicting edges. The double-buffer management module is used to construct a double-buffer structure for storing probability arrays. The double-buffer structure includes a read buffer and a write buffer, and achieves conflict-free parallel read and write by multi-threading through read-write separation. The parallel scheduling module is used to perform serial scheduling of each color group in the order of color group. Nodes in the same color group are updated in parallel using multiple threads. Each thread reads the probability value from the read buffer, calculates it, and writes the result to the write buffer. After completing the update of the current color group, the read buffer and write buffer pointers are switched. The convergence determination module is used to detect the convergence status of each node using a parallel determination mechanism. If there are non-converged nodes, the parallel scheduling module is triggered to continue the iteration. The results output module is used to calculate the probability that each superset instruction is a real instruction in parallel after all nodes have converged, and output the probability disassembly results.

Images