A memory operation analysis method and device for binary programs without symbol tables

Abstract

The present invention relates to a method, device, electronic device, medium and program for analyzing memory operations of a binary program without a symbol table. The method comprises: detecting whether a function to be analyzed in a target binary program calls a memory operation interface function provided by an operating system; and determining that the function to be analyzed belongs to a target function including memory operations when the function to be analyzed calls the memory operation interface function provided by the operating system. In the present invention, by detecting whether a function to be analyzed in a target binary program without a symbol table calls a memory operation interface function provided by an operating system, when the function to be analyzed calls the memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to a target function including memory operations. It is accurately determined whether the function to be analyzed is a function that performs memory operations. The present invention is independent of databases and cloud data, and realizes convenient and accurate memory operation analysis of binary programs without symbol tables.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device, medium and program for analyzing memory operations of a binary program without a symbol table. Background Art

[0002] The symbol table in the binary program file stores the information required for symbol definition and reference in the program. For example, the symbol table stores global symbols referenced from external files, local symbols of executable files (global variables, local functions), etc. The symbol table can be used to easily identify functions in binary program files. However, it is difficult to identify functions in binary program files without a symbol table.

[0003] In the prior art, binary programs are usually matched and identified based on function signatures: first, a function signature sample library is established, and then the function signatures in the binary program are extracted using methods such as the Fast Identification and Authentication Library Technology (FLIRT), and the extracted function signatures are matched with the function signature sample library to achieve function identification.

[0004] The above-mentioned methods of the prior art require the pre-construction of a remote or local function signature sample library, and there may be a problem of repeated function signatures during the application process (i.e., different functions correspond to the same function signature), making it difficult to accurately identify memory operations. In this regard, the present invention provides a memory operation analysis method, device, electronic device, medium and program for a binary program without a symbol table. Summary of the invention

[0005] The present invention provides a memory operation analysis method, device, electronic device, medium and program for a binary program without a symbol table, so as to solve the defect in the prior art that it is difficult to accurately identify memory operations.

[0006] The present invention provides a memory operation analysis method for a binary program without a symbol table, comprising:

[0007] Detect whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system;

[0008] In a case where the function to be analyzed calls a memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to a target function including a memory operation.

[0009] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, when the target function calls the memory operation interface function provided by the operating system, after determining that the target function belongs to the memory operation function, the method further includes:

[0010] Obtaining a control flow graph of the target binary program; the control flow graph includes a plurality of basic blocks and an execution order between the basic blocks;

[0011] Determine whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph;

[0012] In the case where the target function is a called function corresponding to the calling instruction, determining a jump condition from a previous basic block to a basic block where the calling instruction is located;

[0013] In the case where the variable in the jump condition is obtained according to user input, the correspondence between the user input and the memory operation corresponding to the target function is determined according to the user input, the jump condition and the memory operation corresponding to the target function.

[0014] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, the step of judging whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph comprises:

[0015] Traversing each basic block of the control flow graph, obtaining the called functions corresponding to the calling instructions in each basic block and the called functions of the nested calls, to form a called function set;

[0016] In the case that the target function belongs to the called function set, the target function is determined to be a called function corresponding to a call instruction in a basic block of the control flow graph.

[0017] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, when the target function is the called function corresponding to the calling instruction, determining the jump condition from the previous basic block to the basic block where the calling instruction is located includes:

[0018] Acquire a conditional transfer instruction and a comparison instruction on a line above the conditional transfer instruction in the previous basic block;

[0019] The jump condition is determined according to the conditional transfer instruction and the comparison instruction; wherein the jump condition includes a variable, a comparison value, and a mathematical relationship type between the variable and the comparison value, the variable is a destination operand in the comparison instruction, the comparison value is a source operand in the comparison instruction, and the mathematical relationship type corresponds to the transfer condition of the conditional transfer instruction.

[0020] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, when the variable in the jump condition is obtained according to the user input, before determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes:

[0021] Determine the assignment source of the variable in the jump condition;

[0022] In the case where the value assignment source of the variable in the jump condition is obtained by reading the data with a standard input identifier through a read function, it is determined that the variable in the jump condition is obtained according to user input.

[0023] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, after determining whether the target function is a called function corresponding to the call instruction in the basic block of the control flow graph, the method further includes:

[0024] In the case where the target function is the called function corresponding to the calling instruction, the input parameters of the target function, and the execution order and execution times of the target function in the basic block where the calling instruction is located are determined.

[0025] According to the memory operation analysis method of the unsigned table binary program provided by the present invention, when the variable in the jump condition is obtained according to the user input, after determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes:

[0026] A verification test case and / or an exploit program of the target binary program is generated according to the correspondence between the user input and the memory operation corresponding to the target function.

[0027] According to the memory operation analysis method of the binary program without a symbol table provided by the present invention, before obtaining the control flow chart of the target binary program, the method further includes:

[0028] The target binary program is disassembled to obtain a disassembled file of the target binary program, and the step of obtaining a control flow chart of the target binary program is performed based on the disassembled file of the target binary program.

[0029] The present invention also provides a memory operation analysis device for a binary program without a symbol table, comprising:

[0030] The interface function detection module is used to detect whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system;

[0031] The target function determination module is used to determine that the function to be analyzed is a target function including memory operations when the function to be analyzed calls a memory operation interface function provided by the operating system.

[0032] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, all or part of the steps of the memory operation analysis method for the unsigned table binary program as described above are implemented.

[0033] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, all or part of the steps of the memory operation analysis method of the unsigned table binary program as described in any of the above-mentioned methods are implemented.

[0034] The present invention also provides a computer program product, which includes computer executable instructions, and when the instructions are executed, they are used to implement all or part of the steps of the memory operation analysis method of the unsigned table binary program as described in any of the above.

[0035] The present invention provides a method, device, electronic device, medium and program for analyzing memory operations of a binary program without a symbol table. In this embodiment, by detecting whether the function to be analyzed in the target binary program without a symbol table calls the memory operation interface function provided by the operating system, when the function to be analyzed calls the memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to the target function containing memory operations. It is accurately determined whether the function to be analyzed is a function that performs memory operations. The present invention is independent of databases and cloud data, and realizes convenient and accurate memory operation analysis of binary programs without symbol tables. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 It is one of the flow charts of a method for analyzing memory operation of a binary program without a symbol table provided by the present invention;

[0038] Figure 2 This is a second flow chart of a method for analyzing memory operations of a binary program without a symbol table provided by the present invention;

[0039] Figure 3 is an example of a control flow chart of a binary program provided by the present invention;

[0040] Figure 4 yes Figure 3 Schematic diagram of code instructions in basic block 2;

[0041] Figure 5 yes Figure 3 Schematic diagram of code instructions in basic block 1;

[0042] Figure 6 This is a third flow chart of a method for analyzing memory operations of a binary program without a symbol table provided by the present invention;

[0043] Figure 7 yes Figure 6 Schematic diagram of the process of information extraction;

[0044] Figure 8 yes Figure 6 Schematic diagram of the process of information analysis;

[0045] Fig. 9 It is one of the structural schematic diagrams of a memory operation analysis device for a binary program without a symbol table provided by the present invention;

[0046] Fig.10 This is the second structural schematic diagram of a memory operation analysis device for a binary program without a symbol table provided by the present invention;

[0047] Fig.11 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The symbol table in the binary program file stores the information needed for symbol definitions and references in the program. For example, the symbol table stores global symbols referenced from external files, local symbols of executable files (global variables, local functions), etc. The symbol table can be used to easily identify functions in binary program files. A symbol-less program is one in which the symbol table of the program is removed during compilation, such as when using gcc to compile, with the strip parameter. When reverse engineering a binary program without a symbol table, the original name of the program function cannot be obtained, and accordingly, it is difficult to identify the memory operation of the function.

[0050] In the prior art, binary programs are usually matched and identified based on function signatures. A function signature contains information about a function, including the function name, parameter type, number of parameters, order, and the class and namespace in which it is located. Its main function is to distinguish different functions, so it can be applied to function identification. The prior art establishes a function signature sample library, and then uses methods such as fast library identification and authentication technology (FLIRT) to extract function signatures in binary programs, matches the extracted function signatures with the function signature sample library, realizes function identification, and then replaces the interrupt code in the disassembled file with the function corresponding to the function signature, which facilitates the understanding of the program.

[0051] However, this method requires the establishment of a local or remote function signature sample library in advance, and there may be a problem of duplicate function signatures during the application process (i.e., different functions correspond to the same function signature), making it difficult to accurately identify memory operations. In this regard, the present invention provides a memory operation analysis method, device, electronic device, medium and program for a binary program without a symbol table, which can be separated from databases and cloud data to achieve convenient and accurate memory operation analysis of binary programs without a symbol table.

[0052] Combine the following Figure 1-Figure 11 The present invention describes a method, device, electronic device, medium and program for analyzing memory operations of a binary program without a symbol table.

[0053] Figure 1 This is one of the flow charts of a method for analyzing memory operations of a binary program without a symbol table provided by the present invention, such as Figure 1 As shown, the method includes:

[0054] S11, detecting whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system;

[0055] Specifically, the readability of binary program files is poor, and it is difficult to directly identify memory operations in program files based on binary encoding. The target binary program file can be disassembled first, and memory operations can be identified based on the disassembled file of the target binary program. It should be noted that the target binary program in the present invention refers to the unsigned table binary program to be analyzed. Further, the function to be analyzed can be determined in the disassembled file of the target binary program. A function is a collection of a series of instructions generated to complete a special function that will be repeatedly used. The function to be analyzed is determined in the target binary program by identifying the start node and end node of the function.

[0056] The operating system encapsulates a series of frequently used functions into a library for users to call, including memory operation functions. For example, the memory operation functions provided by the system core library Glibc of the Linux operating system, Glibc provides a series of underlying APIs including IO operations, memory application and release, process management, etc. In the function to be analyzed, it is detected whether the memory operation interface function provided by the operating system is called. The memory operation interface function includes a memory application function (malloc), a memory release function (free), a memory read function (read), and a memory write function (write). If the identifier corresponding to the memory operation interface function is detected in the function to be analyzed, it is determined that the function to be analyzed has called the memory operation interface function corresponding to the identifier.

[0057] It should be noted that the function to be analyzed can directly call the memory operation interface function or call the memory operation interface function through nested calls. If the function to be analyzed nests other functions, it is necessary to detect whether the memory operation interface function is called in the function nested by the function to be analyzed according to the call chain of the function to be analyzed.

[0058] S12: When the function to be analyzed calls a memory operation interface function provided by the operating system, determine that the function to be analyzed belongs to a target function including a memory operation.

[0059] Specifically, if the function to be analyzed calls a memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to a target function including memory operations, and the function to be analyzed implements corresponding memory operations through the memory operation function corresponding to the detected identifier.

[0060] In this embodiment, by detecting whether the function to be analyzed in the target binary program without a symbol table calls the memory operation interface function provided by the operating system, if the function to be analyzed calls the memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to the target function containing memory operations. It is accurately determined whether the function to be analyzed is a function that performs memory operations. The present invention is independent of databases and cloud data, and realizes convenient and accurate memory operation analysis of binary programs without symbol tables.

[0061] In addition, when analyzing and testing a target binary program without a symbol table, or developing an exploit program (for example, developing an exploit program for a heap vulnerability, a heap vulnerability is caused by the content written by the user into the heap block exceeding the size of the heap block itself, causing an overflow, or incorrect application or release operations causing Use after free, fastbinattack, double free and other vulnerabilities.), it is not only necessary to find the location of memory application and release. It is also necessary to understand what kind of user input (external operation) in the target binary program can trigger the application and release of memory, as well as standard input and output. When facing a target binary program without a symbol table, whether the corresponding relationship between user input and memory operation can be automatically identified becomes the basis for successful automated utilization. In this regard, on the basis of the above-mentioned embodiment, the present invention further identifies the corresponding relationship between user input and memory operation, and the specific content is as follows:

[0062] Figure 2 This is a second flow chart of a method for analyzing memory operations of a binary program without a symbol table provided by the present invention, such as Figure 2 As shown, based on any of the above embodiments, in one embodiment, when the target function calls a memory operation interface function provided by the operating system, after determining that the target function belongs to a memory operation function, the method further includes:

[0063] S23, obtaining a control flow chart of the target binary program; the control flow chart includes a plurality of basic blocks and an execution order between the basic blocks;

[0064] Specifically, a control flow graph refers to a method of using a mathematical graph to represent all possible paths that a program may reach during execution. A control flow graph includes multiple basic blocks and the execution order between basic blocks. A basic block is a node in a control flow graph and is a section of code in a program without any jumps. For example, Figure 3 is an example of a control flow chart of a binary program provided by the present invention, such as Figure 3 As shown, the figure includes basic blocks 1 to 8, and the arrowed lines between the basic blocks indicate the execution order between the connected basic blocks. The control flow graph of the target binary program can be generated using a disassembly tool. For example, the IDA tool can be used. IDA (Interactive Disassembler) is a very powerful disassembly tool in the industry. Its powerful static disassembly and reverse debugging functions can take binary code as input and generate a text file containing the assembly language code of the entire or part of the program.

[0065] S24, determining whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph;

[0066] Specifically, it is determined in the basic block whether the basic block calls the target function through a call instruction (call), and the call instruction (call) is detected before the target function is identified. If the call instruction is detected, it is determined that the basic block calls the target function through the call instruction to implement the corresponding memory operation, and the target function is the called function corresponding to the call instruction.

[0067] For example, Figure 4 yes Figure 3 The code instruction diagram in basic block 2 is as follows: Figure 4 As shown, a call instruction (call) is detected in front of the target function "sub_8048981", then it is determined Figure 3 The basic block 2 in the example calls the target function "sub_8048981" through the call instruction, and the target function "sub_8048981" is the called function corresponding to the call instruction.

[0068] S25, when the target function is a called function corresponding to the calling instruction, determining a jump condition from a previous basic block to a basic block where the calling instruction is located;

[0069] Specifically, when the target function is the called function corresponding to the call instruction, a jump condition for jumping from the previous basic block to the basic block where the call instruction is located is determined. Specifically, it can be determined according to the execution order of each basic block in the control flow graph which instruction of the previous basic block is used to jump to the basic block where the call instruction is located.

[0070] For example, Figure 5 yes Figure 3 The code instruction diagram in basic block 1 is as follows: Figure 5 As shown in the figure, according to the last two lines of basic block 1, "cmp eax,2" and "jz short loc_8048A9C", it can be determined that the jump condition is: when basic block 1 determines that "the value of register eax is equal to 2", it jumps to basic block 2. In the code of basic block 1, "cmp" is a comparison instruction, which actually performs a subtraction operation on register "eax" and the value "2". "jz" is a conditional transfer instruction, which specifically executes a jump if it is judged to be "zero" and jumps to "short loc_8048A9C (i.e. basic block 2)" to continue execution. The comparison instruction and the jump instruction realize as a whole: when basic block 1 determines that "the value of register eax is equal to 2", it jumps to basic block 2.

[0071] S26. When the variable in the jump condition is obtained according to user input, determine the correspondence between the user input and the memory operation corresponding to the target function according to the user input, the jump condition and the memory operation corresponding to the target function.

[0072] Specifically, the variables in the jump conditions are further tracked to determine whether the variables in the jump conditions are obtained directly or indirectly based on user input. If it is determined that the variables in the jump conditions are obtained by reading user input data, or the variables in the jump conditions are obtained through the return value of other functions, and the return value is obtained by performing function processing on the user input data, then it is determined that the target function is triggered by the user input. At this time, based on the variables, the jump conditions and the memory operations corresponding to the target function, the correspondence between the user input and the memory operations corresponding to the target function is determined, that is, the user inputs certain data, and the memory operations corresponding to the target function are executed after the judgment of the jump conditions.

[0073] After obtaining the correspondence between the user input and the memory operation corresponding to the target function, the target binary program can be developed and utilized based on this, for example, using systems such as MAZE to automatically utilize the target binary program without a symbol table.

[0074] In this embodiment, by obtaining the control flow chart of the target binary program without a symbol table, it is convenient to understand the basic blocks of the program and the execution order between the basic blocks; by judging whether the target function is the function called by the call instruction in the basic block of the control flow chart, it is determined whether the target binary program implements the corresponding memory operation by calling the target function; by analyzing the jump condition from the previous basic block to the basic block where the call instruction is located, the correspondence between the user input and the memory operation corresponding to the target function is accurately determined, which lays a solid foundation for the development and utilization of binary programs without symbol tables.

[0075] Based on any of the above embodiments, in one embodiment, determining whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph includes:

[0076] Traversing each basic block of the control flow graph, obtaining the called functions corresponding to the calling instructions in each basic block and the called functions of the nested calls, to form a called function set;

[0077] In the case that the target function belongs to the called function set, the target function is determined to be a called function corresponding to a call instruction in a basic block of the control flow graph.

[0078] Specifically, each basic block of the control flow graph is traversed to obtain the called functions directly called by the call instruction in each basic block, and the called functions nested by the call instruction in the called functions are obtained according to the call chain, and these called functions are added to the called function set. In other words, the called functions directly or indirectly called (nested call) in each basic block in the control flow graph are obtained to form the called function set.

[0079] Then, it is determined whether the target function belongs to the called function set. If the target function belongs to the called function set, it is determined that the target function is a called function directly called or nested called by a call instruction in a corresponding basic block in the control flow graph.

[0080] In this embodiment, each basic block of the control flow graph is traversed to obtain a set of called functions, so as to quickly determine whether the target function is a function called to perform a corresponding memory operation.

[0081] Based on any of the above embodiments, in one embodiment, when the target function is a called function corresponding to the calling instruction, determining a jump condition for jumping from a previous basic block to a basic block where the calling instruction is located includes:

[0082] Acquire a conditional transfer instruction and a comparison instruction on a line above the conditional transfer instruction in the previous basic block;

[0083] The jump condition is determined according to the conditional transfer instruction and the comparison instruction; wherein the jump condition includes a variable, a comparison value, and a mathematical relationship type between the variable and the comparison value, the variable is a destination operand in the comparison instruction, the comparison value is a source operand in the comparison instruction, and the mathematical relationship type corresponds to the transfer condition of the conditional transfer instruction.

[0084] Specifically, according to the execution order of each basic block in the control flow chart, the conditional transfer instruction is obtained at the end of the previous basic block of the basic block where the target function is located, and the comparison instruction of the previous line of the conditional transfer instruction is obtained. For the x86 architecture, the conditional transfer instruction can be Jz (judged to be zero jump), jnz (judged to be non-zero jump), Jbe (judged to be unsigned greater than or equal to jump), Jb (judged to be unsigned less than jump), jae (judged to be unsigned greater than or equal to jump), ja (judged to be unsigned greater than jump), etc. It can be understood that for target binary programs applied to other architectures, the conditional transfer instruction includes corresponding other instructions. The conditional transfer instruction is used to execute the corresponding jump when the result of the comparison instruction meets the transfer condition corresponding to the conditional transfer instruction. The comparison instruction compares the relationship between a variable value and a comparison value. For example, in "cmp eax,2", cmp is the operation type (comparison), eax is the destination operand (variable), and 2 is the source operand. The combination of conditional transfer instructions and comparison instructions can determine what kind of jump is implemented: when the mathematical relationship between the variable value and the comparison value meets the transfer condition corresponding to the conditional transfer instruction, the jump is executed.

[0085] For example, still referring to Figure 3-Figure 5 , when it is determined that the target function "sub_8048981" in basic block 2 is the called function corresponding to the call instruction (call), the jump condition from basic block 1 (corresponding to the previous basic block) to basic block 2 (corresponding to the basic block where the target function "sub_8048981" is located) is determined. Specifically, according to the execution order of each basic block in the control flow chart, the conditional transfer instruction "jz short loc_8048A9C" from basic block 1 to basic block 2 is located, and then the comparison instruction "cmp eax,2" on the previous line of the conditional transfer instruction is determined. The comparison instruction "cmp eax,2" subtracts the destination operand "eax" from the source operand "2", and "jz short loc_8048A9C" determines that the result of the subtraction is zero and jumps to "loc_8048A9C" for execution. At this time, the conditional transfer instruction and the comparison instruction are combined to determine the jump condition: if the value of "eax" is equal to "2", it jumps from basic block 1 to basic block 2.

[0086] In this embodiment, the conditional transfer instruction obtained in the previous basic block and the comparison instruction on the previous line of the conditional transfer instruction are combined to accurately determine the jump condition from the previous basic block to the basic block where the target function is located, which facilitates accurate acquisition of the correspondence between the memory operations corresponding to the input and the target function.

[0087] Based on any of the above embodiments, in one embodiment, when the variable in the jump condition is obtained according to user input, before determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes:

[0088] Determine the assignment source of the variable in the jump condition;

[0089] In the case where the value assignment source of the variable in the jump condition is obtained by reading the data with a standard input identifier through a read function, it is determined that the variable in the jump condition is obtained according to user input.

[0090] Specifically, determine the source of the variable assignment in the jump condition, that is, trace the variable in the jump condition. The user's standard input data or standard output data will have a unique identifier. If the variable in the jump condition is traced back to the data with the standard input identifier through the read function, then it can be determined that the variable in the jump condition is obtained based on the user input. For example, the value of the variable in the jump condition is obtained through the following read instruction:

[0091] size_t read(int fd,viod*buf,size_t count);

[0092] Among them, "int fd" is the file descriptor corresponding to the file to be read, "viod*buf" is the buffer area, and "size_t count" is the number of bytes read. The above read instruction is used to read the file corresponding to fd and save the read data to buf, with size_t count as the reading unit. In this regard, if it is detected that "fd" contains a standard input identifier, it is determined that the variable in the jump condition is obtained based on the user input.

[0093] It should be noted that the variable assignment source judgment in the jump condition includes not only detecting the standard input identifier in the data directly read by the variable through the read function, but also detecting the standard input identifier in the data indirectly read by the variable. Figure 5,When determining the assignment source of the variable eax in the jump condition, the instructions in basic block 1 are analyzed. According to the instructions "mov eax, [ebp + var_C]", "lea eax, [ebp + var_C]" and "call sub_804EE90", it can be determined that the value of the variable eax is obtained by the "lea eax, [ebp + var_C]" instruction when the "call sub_804EE90" instruction calls the function "sub_804EE90", and the address parameter of "[ebp + var_C]" is obtained by the "lea eax, [ebp + var_C]" instruction, and the address parameter is passed to "eax" by the "mov eax, [ebp + var_C]" instruction. Then, when the "sub_804EE90" function is detected, it is detected that the "sub_804EE90" function reads the data with the standard input identifier through the read function. At this time, it is determined that the variable eax in the jump condition is obtained according to the user input, that is, the user inputs the standard input data corresponding to the above read function through the input device, and then the binary program triggers the above jump condition and calls the target function to perform the corresponding memory operation.

[0094] In this embodiment, the variable assignment source in the jump condition is accurately determined through the standard input identifier.

[0095] Based on any of the above embodiments, in one embodiment, after determining whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph, the method further includes:

[0096] In the case where the target function is the called function corresponding to the calling instruction, the input parameters of the target function, and the execution order and execution times of the target function in the basic block where the calling instruction is located are determined.

[0097] Specifically, it is determined that the target function is the calling function corresponding to the calling instruction in the basic block of the control flow graph, which means that the basic block calls the target function to perform the corresponding memory operation (memory application / release, memory read / write). At this time, the incoming parameters of the target function (i.e., the source data processed by the target function) and the execution order (memory operation sequence) and execution times (specifically how many times the target function is executed) of the target function in the basic block are further determined, so as to accurately understand the specific memory operation content performed by the basic block calling the target function. This facilitates accurate understanding of the correspondence between the user input and the memory operation corresponding to the target function.

[0098] Based on any of the above embodiments, in one embodiment, when the variable in the jump condition is obtained according to the user input, after determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes:

[0099] A verification test case and / or an exploit program of the target binary program is generated according to the correspondence between the user input and the memory operation corresponding to the target function.

[0100] Specifically, after understanding the corresponding relationship between the user input and the memory operation corresponding to the target function, that is, it is clear what kind of user input will trigger what kind of memory operation after the jump condition of the target binary program is determined. Figure 3 , it is learned that after the user inputs "2", a memory release (free) operation is performed through basic block 2; after the user inputs "3", a memory allocation (malloc) operation is performed through basic block 4. Based on this, verification test cases and / or exploits of the target binary program can be generated.

[0101] Proof of Concept (poc) is a verification test for specific customer applications (programs). Based on the performance requirements and expansion requirements of the system proposed by the user, real data is run on the selected server to actually measure the amount of user data and running time. The amount of data is increased according to the user's future business expansion needs to verify the carrying capacity and performance changes of the system and platform. Exploit refers to the technology of automatically generating exploits that can exploit program vulnerabilities based on the given binary program or poc and source code through static or dynamic program analysis technology.

[0102] Based on the correspondence between user input and memory operations corresponding to the target function, this embodiment further develops the target binary program and generates verification test cases and / or utilization programs for the target binary program, laying the foundation for further development and utilization through the correspondence between user input and memory operations corresponding to the target function.

[0103] Based on any of the above embodiments, in one embodiment, before obtaining the control flow chart of the target binary program, the method further includes:

[0104] A program entry function in the target binary program is detected, and a main function address of the target binary program is determined, so as to obtain a control flow chart of the target binary program according to the main function address of the target binary program.

[0105] Specifically, there are pre-execution steps before the main function (main function) of the binary program is executed. By checking the program entry function (__libc_start_main) that needs to be pre-executed before the main function, the start node of the main function can be easily determined, which is convenient for generating the control flow graph of the target binary program.

[0106] Based on any of the above embodiments, in one embodiment, before obtaining the control flow chart of the target binary program, the method further includes:

[0107] The target binary program is disassembled to obtain a disassembled file of the target binary program, and the step of obtaining a control flow chart of the target binary program is performed based on the disassembled file of the target binary program.

[0108] Specifically, binary program files have poor readability, and it is difficult to directly identify memory operations in program files based on binary encoding. The target binary program file can be disassembled first, and memory operations can be identified based on the disassembled file of the target binary program, and the control flow chart of the target binary program can be obtained. Specifically, a disassembler tool can be used to generate a disassembled file of the target binary program. For example, the IDA tool can be used. IDA (Interactive Disassembler) is a very powerful disassembler tool in the industry. Its powerful static disassembly and reverse debugging functions can take binary code as input and generate a text file containing the assembly language code of the entire or part of the program.

[0109] In this embodiment, the readability of the target binary program is improved by disassembling the target binary program.

[0110] The following introduces a memory operation analysis method of a binary program without a symbol table provided by the present invention through a preferred embodiment.

[0111] Step 1. Analyze the functions to be analyzed of the underlying memory operation interface functions (such as functions in the glibc library) that must be called in the unsigned table binary program (hereinafter referred to as the program), so as to determine the target function that performs the memory operation (malloc, free, read, write functions). And determine the calling position of each target function candidate in the main function (main function) of the unsigned table binary program. The underlying memory operation interface function described in this scheme refers to the brk system call that must be called in the malloc / free function call chain, and the read / write system call that must be called for read and write operations. The difference between malloc and free is that when tracing backwards through brk, the call to the MORECORE function will be traced. When MORECORE is called in malloc, the parameter passed in is non-zero, and when MORECORE is called in free, the parameter passed in is zero.

[0112] Step 2: Determine the address of the main function through the __libc_start_main function that the program must call.

[0113] Step 3: Use binary reverse engineering tools to obtain the binary program CFG, and through static analysis, obtain the number and order of operations of the functions contained in each basic block in the main function, as well as the parameters passed in when called for execution (i.e., the source data processed by the target function).

[0114] Step 4: After binary reverse analysis by the analysis tool, traverse each call instruction in each basic block in the main function to determine whether the callee (called function) belongs to the target function in step 1. If it belongs to the target function, record its order and the passed parameters.

[0115] Step 5: Analyze the judgment conditions of the branch nodes from the call point of the target function backwards, record the conditions related to the user input, and find out what the user input can trigger these operations. These conditional instructions include jz, jnz, jbe, jb, jae, ja, etc. By analyzing the comparison instructions above the conditional instructions, the relevant jump conditions can be obtained.

[0116] Step 6: Track the variables in the jump condition and check whether the variables in the jump condition are associated with the user input through the read operation to determine whether the jump is triggered by the user

[0117] Step 7: Based on the above user input, jump conditions, memory operations, execution order, number of times, and input parameters performed by the target function, analyze what kind of standard input the user uses to trigger the corresponding memory operation.

[0118] Figure 6It is a flow chart of a memory operation analysis method of a binary program without a symbol table provided by the present invention, such as Figure 6 As shown:

[0119] The memory operation analysis method of the unsigned table binary program provided by the present invention first extracts information from the target binary program, identifies the memory operation interface function and the calling relationship, screens and records the calling order and the input parameters of the target function; then analyzes the jump condition of the target binary program to the basic block where the target function is located, determines whether the variable in the jump condition is associated with the user input, and if there is an association, records the input data that triggers the memory operation of the target function.

[0120] Figure 7 yes Figure 6 The flowchart of information extraction is as follows: Figure 7 As shown, first determine the address of each function to be analyzed of the target binary program without a symbol table, then determine the call chain of the function to be analyzed, identify the target function that calls the memory operation interface function provided by the system in the call chain, and then traverse the call instructions in the basic blocks of the target binary program to confirm whether the target function is called through the call instruction. If so, record the number of calls, call order and incoming parameters of the target function in an ordered linked list until the target functions in all basic blocks of the main function (main function) are collected.

[0121] Figure 8 yes Figure 6 The flowchart of information analysis in Figure 8 As shown, according to the extracted information, since the last instruction of each basic block is a jump instruction, the jump conditions of each basic block in the control flow chart are further reverse analyzed, and the variables in each jump condition from the program entry to the basic block where the target function is located are extracted. It is determined whether the variables in the jump condition are associated with the user input. If there is an association, the jump condition is associated with the user input and the memory operation performed by the target function and recorded.

[0122] The present invention aims at the problem of difficulty in automatic analysis or manual analysis due to the excessive proportion of irrelevant code when automatically or manually utilizing a binary program without a symbol table that has vulnerabilities. By statically analyzing the call location of key system calls, the glibc function corresponding to the function generation without a symbol table is determined, thereby determining the basic block of the program that performs the operation. Then, through backward analysis of CFG, it is obtained that if the application and release of heap memory as well as reading and writing are to be triggered, what content the user needs to input respectively and what kind of results will be obtained after triggering these operations. Since the object targeted by this solution is a binary program without a symbol table and is completely based on static analysis technology, this method can be separated from the database, cloud data and program source code, and the analysis can be realized by only requiring the user to provide the files to be analyzed.

[0123] The memory operation analysis device for a binary program without a sign table provided by the present invention is described below. The memory operation analysis device for a binary program without a sign table described below and the memory operation analysis method for a binary program without a sign table described above can be referenced to each other.

[0124] Fig. 9 This is one of the structural schematic diagrams of a memory operation analysis device for a binary program without a symbol table provided by the present invention, such as Fig. 9 As shown, the device comprises:

[0125] The interface function detection module 91 is used to detect whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system;

[0126] The target function determination module 92 is used to determine that the function to be analyzed is a target function including memory operations when the function to be analyzed calls a memory operation interface function provided by the operating system.

[0127] In this embodiment, by detecting whether the function to be analyzed in the target binary program without a symbol table calls the memory operation interface function provided by the operating system, if the function to be analyzed calls the memory operation interface function provided by the operating system, it is determined that the function to be analyzed belongs to the target function containing memory operations. It is accurately determined whether the function to be analyzed is a function that performs memory operations. The present invention is independent of databases and cloud data, and realizes convenient and accurate memory operation analysis of binary programs without symbol tables.

[0128] Fig.10 This is a second structural diagram of a memory operation analysis device for a binary program without a symbol table provided by the present invention, such as Fig. 9 As shown, based on any of the above embodiments, the device further includes:

[0129] A control flow graph acquisition module 101 is used to acquire a control flow graph of the target binary program; the control flow graph includes a plurality of basic blocks and an execution order between the basic blocks;

[0130] A calling judgment module 102 is used to judge whether the target function is a called function corresponding to a calling instruction in a basic block of the control flow graph;

[0131] A jump condition determination module 103, used for determining a jump condition for jumping from a previous basic block to a basic block where the calling instruction is located when the target function is a called function corresponding to the calling instruction;

[0132] The correspondence determination module 104 is used to determine the correspondence between the user input and the memory operation corresponding to the target function according to the user input, the jump condition and the memory operation corresponding to the target function when the variable in the jump condition is obtained according to the user input.

[0133] In this embodiment, by obtaining the control flow chart of the target binary program without a symbol table, it is convenient to understand the basic blocks of the program and the execution order between the basic blocks; by judging whether the target function is the function called by the call instruction in the basic block of the control flow chart, it is determined whether the target binary program implements the corresponding memory operation by calling the target function; by analyzing the jump condition from the previous basic block to the basic block where the call instruction is located, the correspondence between the user input and the memory operation corresponding to the target function is accurately determined, which lays a solid foundation for the development and utilization of binary programs without symbol tables.

[0134] Based on any of the above embodiments, in one embodiment, the calling judgment module 102 includes:

[0135] A first judgment unit is used to traverse each basic block of the control flow graph, obtain the called function corresponding to the call instruction in each basic block and the called function of the nested call, and form a called function set;

[0136] The second judgment unit is used to determine that the target function is a called function corresponding to a call instruction in a basic block of the control flow graph when the target function belongs to the called function set.

[0137] In this embodiment, each basic block of the control flow graph is traversed to obtain a set of called functions, so as to quickly determine whether the target function is a function called to perform a corresponding memory operation.

[0138] Based on any of the above embodiments, in one embodiment, the jump condition determination module 103 includes:

[0139] An instruction acquisition unit, used for acquiring a conditional transfer instruction and a comparison instruction of a line above the conditional transfer instruction in the previous basic block;

[0140] A jump condition determination unit is used to determine the jump condition according to the conditional transfer instruction and the comparison instruction; wherein the jump condition includes a variable, a comparison value, and a mathematical relationship type between the variable and the comparison value, the variable is a destination operand in the comparison instruction, the comparison value is a source operand in the comparison instruction, and the mathematical relationship type corresponds to the transfer condition of the conditional transfer instruction.

[0141] In this embodiment, the conditional transfer instruction obtained in the previous basic block and the comparison instruction on the previous line of the conditional transfer instruction are combined to accurately determine the jump condition from the previous basic block to the basic block where the target function is located, which facilitates accurate acquisition of the correspondence between the memory operations corresponding to the input and the target function.

[0142] Based on any of the above embodiments, in one embodiment, the device further includes:

[0143] A tracing module, used to determine the source of the variable assignment in the jump condition;

[0144] A user input determination module is used to determine whether the variable in the jump condition is obtained according to user input when the value assignment source of the variable in the jump condition is obtained by reading the data with a standard input identifier through a read function.

[0145] In this embodiment, the variable assignment source in the jump condition is accurately determined through the standard input identifier.

[0146] Based on any of the above embodiments, in one embodiment, the device further includes:

[0147] The execution record determination module is used to determine the input parameters of the target function, as well as the execution order and execution times of the target function in the basic block where the calling instruction is located when the target function is the called function corresponding to the calling instruction.

[0148] Based on any of the above embodiments, in one embodiment, the device further includes:

[0149] The utilization module is used to generate a verification test case and / or an utilization program of the target binary program according to the corresponding relationship between the user input and the memory operation corresponding to the target function.

[0150] Based on the correspondence between user input and memory operations corresponding to the target function, this embodiment further develops the target binary program and generates verification test cases and / or utilization programs for the target binary program, laying the foundation for further development and utilization through the correspondence between user input and memory operations corresponding to the target function.

[0151] Based on any of the above embodiments, in one embodiment, the device further includes:

[0152] The main function determination module is used to detect the program entry function in the target binary program and determine the main function address of the target binary program, so as to obtain the control flow chart of the target binary program according to the main function address of the target binary program.

[0153] Based on any of the above embodiments, in one embodiment, the device further includes:

[0154] The target binary program is disassembled to obtain a disassembled file of the target binary program, and the step of obtaining a control flow chart of the target binary program is performed based on the disassembled file of the target binary program.

[0155] In this embodiment, the readability of the target binary program is improved by disassembling the target binary program.

[0156] Fig.11 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.11 As shown, the electronic device may include: a processor 1110, a communication interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communication interface 1120 and the memory 1130 communicate with each other through the communication bus 1140. The processor 1110 may call the logic instructions in the memory 1130 to execute all or part of the steps of the above-mentioned memory operation analysis method for the unsigned table binary program, the method comprising: detecting whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system; and determining that the function to be analyzed belongs to the target function containing the memory operation when the function to be analyzed calls the memory operation interface function provided by the operating system.

[0157] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0158] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute all or part of the steps of the above-mentioned memory operation analysis method for the unsigned table binary program provided by the above-mentioned method, and the method includes: detecting whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system; when the function to be analyzed calls the memory operation interface function provided by the operating system, determining that the function to be analyzed belongs to the target function that contains memory operations.

[0159] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute all or part of the steps of the memory operation analysis method of the unsigned table binary program provided above. The method includes: detecting whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system; in the case that the function to be analyzed calls the memory operation interface function provided by the operating system, determining that the function to be analyzed belongs to the target function that includes memory operations.

[0160] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0161] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A memory operation analysis method for a binary program without a symbol table, characterized in that: include: Detect whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system; In the case where the function to be analyzed calls a memory operation interface function provided by the operating system, determining that the function to be analyzed belongs to a target function including a memory operation; In the case where the target function calls a memory operation interface function provided by the operating system, after determining that the target function belongs to a memory operation function, the method further includes: Obtaining a control flow graph of the target binary program; the control flow graph includes a plurality of basic blocks and an execution order between the basic blocks; Determine whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph; In the case where the target function is a called function corresponding to the calling instruction, determining a jump condition from a previous basic block to a basic block where the calling instruction is located; In the case where the variable in the jump condition is obtained according to user input, the correspondence between the user input and the memory operation corresponding to the target function is determined according to the user input, the jump condition and the memory operation corresponding to the target function.

2. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: The determining whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph includes: Traversing each basic block of the control flow graph, obtaining the called functions corresponding to the calling instructions in each basic block and the called functions of the nested calls, to form a called function set; In the case that the target function belongs to the called function set, the target function is determined to be a called function corresponding to a call instruction in a basic block of the control flow graph.

3. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: When the target function is a called function corresponding to the calling instruction, determining a jump condition for jumping from a previous basic block to a basic block where the calling instruction is located includes: Acquire a conditional transfer instruction and a comparison instruction on a line above the conditional transfer instruction in the previous basic block; The jump condition is determined according to the conditional transfer instruction and the comparison instruction; wherein the jump condition includes a variable, a comparison value, and a mathematical relationship type between the variable and the comparison value, the variable is a destination operand in the comparison instruction, the comparison value is a source operand in the comparison instruction, and the mathematical relationship type corresponds to the transfer condition of the conditional transfer instruction.

4. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: In the case where the variable in the jump condition is obtained according to user input, before determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes: Determine the assignment source of the variable in the jump condition; In the case where the value assignment source of the variable in the jump condition is obtained by reading the data with a standard input identifier through a read function, it is determined that the variable in the jump condition is obtained according to user input.

5. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: After determining whether the target function is a called function corresponding to a call instruction in a basic block of the control flow graph, the method further includes: In the case where the target function is the called function corresponding to the calling instruction, the input parameters of the target function, and the execution order and execution times of the target function in the basic block where the calling instruction is located are determined.

6. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: In the case where the variable in the jump condition is obtained according to user input, after determining the correspondence between the user input and the memory operation corresponding to the target function according to the variable, the jump condition and the memory operation corresponding to the target function, the method further includes: A verification test case and / or an exploit program of the target binary program is generated according to the correspondence between the user input and the memory operation corresponding to the target function.

7. The memory operation analysis method of the unsigned table binary program according to claim 1, characterized in that: Before obtaining the control flow chart of the target binary program, the method further includes: The target binary program is disassembled to obtain a disassembled file of the target binary program, and the step of obtaining a control flow chart of the target binary program is performed based on the disassembled file of the target binary program.

8. A memory operation analysis device for a binary program without a symbol table, comprising: The interface function detection module is used to detect whether the function to be analyzed in the target binary program calls the memory operation interface function provided by the operating system; A target function determination module, used for determining that the function to be analyzed is a target function including memory operations when the function to be analyzed calls a memory operation interface function provided by the operating system; The device also includes: A control flow graph acquisition module, used to acquire a control flow graph of the target binary program; the control flow graph includes a plurality of basic blocks and an execution order between the basic blocks; A calling judgment module, used to judge whether the target function is a called function corresponding to a calling instruction in a basic block of the control flow graph; The jump condition determination module is used to determine the jump condition for jumping from the previous basic block to the basic block where the call instruction is located when the target function is the called function corresponding to the call instruction; A correspondence determination module is used to determine the correspondence between the user input and the memory operation corresponding to the target function according to the user input, the jump condition and the memory operation corresponding to the target function when the variable in the jump condition is obtained according to the user input.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, all or part of the steps of the memory operation analysis method of the unsigned table binary program as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, all or part of the steps of the memory operation analysis method of the unsigned table binary program as described in any one of claims 1 to 7 are implemented.

11. A computer program product comprising computer executable instructions, characterized in that: When executed, the instruction is used to implement all or part of the steps of the memory operation analysis method of the unsigned table binary program as described in any one of claims 1 to 7.

Images