A source code analysis device based on disassembly

Abstract

The present invention provides a source code analysis device based on disassembly, including an input module, an instruction and data separation module and an instruction disassembly module, wherein the input module is used to read the target code into the memory; the instruction and data separation module is used to analyze the target code read by the input module to separate the instruction code and the data; the instruction disassembly module is used to disassemble the instruction code and the data of the target code respectively, and generate an assembly file corresponding to the target code. The source code analysis device first separates the instruction code and the data in the target code, and when using the disassembly tool for disassembly, it can directly perform targeted processing on the instruction code and the data, avoid data from interfering with the instruction code disassembly work, and improve the disassembly efficiency.

Description

Technical Field

[0001] The invention belongs to the technical field of software analysis, and in particular relates to a source code parsing device based on disassembly. Background Art

[0002] Reverse engineering, also known as software reverse engineering, refers to starting from an executable program system, using various computer technologies such as disassembly, system analysis, and program understanding to reversely disassemble and analyze the structure, process, algorithm, code, etc. of the software, and derive the source code, design principles, structure, algorithm, processing process, operation method, and related documents of the software product. It can be simply understood as constructing a new system outline by identifying and analyzing the source code of computer software. It conducts basic analysis on the original system of computer software, and then identifies the components of the system software, and constructs a new and advanced software system by clarifying the relationship between the various components of the software. Usually, people refer to the entire process of reverse analysis of software as software reverse engineering, and the technologies used in this process are collectively referred to as software reverse engineering technology.

[0003] Software reverse engineering technology can be used to explore the loopholes in current software protection, conduct targeted reviews of the protection of existing software achievements, or debug and repair software functions without source code in the production environment. It can also be used to review malicious programs and then restrict malicious behaviors.

[0004] Decompilation technology can be divided into two categories: one is decompilation for virtual machines, that is, decompilation based on bytecodes, and the other is decompilation for real machine instructions, that is, decompilation based on machine codes. The former is decompilation for virtual machines, and the latter is decompilation for real machines.

[0005] Compiling from a high-level language (C++) to the lowest-level language (assembly) is the job of the compiler, but this process is not completely reversible. At present, after a lot of research, people have developed some disassembly tools that can help users disassemble the target code into assembly code or source code to a certain extent, such as ILspy, etc. However, this type of tool cannot separate the instruction code and data in the target code, and requires users to manually separate or directly disassemble all the codes, which will increase the workload of disassembly and reduce the efficiency of disassembly. In addition, this type of tool cannot distinguish between user-defined functions and system library functions, and disassembles the two types of functions indiscriminately, which will also increase the workload of disassembly and even increase the error rate of disassembly. Summary of the invention

[0006] The purpose of the present invention is to provide a source code parsing device based on disassembly in view of the above problems.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A source code analysis device based on disassembly includes an input module, an instruction and data separation module and an instruction disassembly module, wherein:

[0009] Input module, used to read the target code into memory;

[0010] An instruction and data separation module is used to analyze the target code read by the input module to separate the instruction code and data;

[0011] The instruction disassembly module is used to disassemble the instruction code and data of the target code respectively to generate an assembly file corresponding to the target code.

[0012] In the above-mentioned source code parsing device based on disassembly, the input module reads the target code into the memory in the following manner:

[0013] A1. Read several bytes from the target binary format file and store them in the Content object;

[0014] A2. Store the Content object in the Vector container;

[0015] A3. Repeat steps A1 and A2 until the end of the file.

[0016] In the above-mentioned source code analysis device based on disassembly, the instruction and data separation module separates the instruction code and data in the following manner:

[0017] B1. Track the instruction control flow, traverse and identify each instruction;

[0018] B2. Identify the code portion that can be reached by the instruction stream as instruction code, and the rest as data.

[0019] In the above-mentioned source code analysis device based on disassembly, in step B1, the instruction and data separation module tracks the instruction control flow in the following manner:

[0020] B11. Set the PC value to 0;

[0021] B12. Take out a specific Content object from the Vector container;

[0022] B13. Identify the retrieved Content object as a command, and mark the command as having been accessed;

[0023] B14. Determine whether the instruction identified in step B13 is a program end instruction. If so, execute step B15, otherwise execute B16;

[0024] B15. Continue to determine whether the display table is empty. If so, end the tracing. Otherwise, take an Elem element from the display table and determine whether the instruction at the address addr in the Elem element has been accessed. If not, restore the current scene information including the PC value and return to step B12. If yes, determine whether the instruction at the address addr in the next Elem element has been accessed. End the tracing after traversing all Elem elements.

[0025] B16. Further determine whether the instruction identified in B13 is a transfer instruction. If so, update the PC value, display table, and return table according to the specific transfer instruction. Otherwise, increment the PC and return to step B12.

[0026] In the above-mentioned source code parsing device based on disassembly, in step B16, the specific steps of updating the PC value, display table, and return table are as follows:

[0027] If it is an unconditional transfer instruction, the address of the instruction is filled in the segment table, its explicit address is filled in the segment table, and the explicit address is used as the current PC address;

[0028] If it is an unconditional transfer instruction or a subroutine call instruction, the address of the instruction is filled in the segment table, the return address is filled in the return address table, the explicit address is filled in the segment table, and the explicit address is used as the current PC address;

[0029] If it is a return instruction in an unconditional transfer instruction, the return address is found in the return address table according to the "last in, first out" principle, the address of this instruction is filled in the segment table, the return address is filled in the segment table, and the return address is used as the current PC address;

[0030] If it is a binary instruction, the explicit address is filled into the explicit address table, and then the implicit address is used as the current PC address.

[0031] In the above-mentioned source code parsing device based on disassembly, the instruction disassembly module performs disassembly in the following manner:

[0032] C1. Take out the objects from the Vector container one by one, and determine whether the object is instruction code or data according to the separation result of the instruction and data separation module;

[0033] C2. If the object is an instruction code, the instruction code is deassembled into assembly instruction form; if it is data, the data is translated into the value of the data.

[0034] In the above-mentioned source code parsing device based on disassembly, a function identification module for identifying library functions is also included, and the function identification module is used to perform the following steps:

[0035] C3. Normalize the assembly instruction code into an intermediate code;

[0036] C4. Extract library functions and identify system library functions and user-defined functions;

[0037] C5. Restore key information of user-defined functions including name, number of parameters, return value and type.

[0038] In the above-mentioned source code analysis device based on disassembly, in step C4, the library function is extracted by dynamically debugging the intermediate code.

[0039] In the above-mentioned source code analysis device based on disassembly, in step C4, the user-defined function is identified in the following manner:

[0040] D1. Prepare several calling programs that have only one library function call statement and differ only in the parameters of the called function.

[0041] D2. Execute the several calling programs prepared in step D1, and determine the functions with fixed effective operation instructions as user-defined functions.

[0042] In the above-mentioned source code analysis device based on disassembly, the user-defined functions determined in step D2 are checked for addresses, the function with the highest address is selected, and the function and all functions with lower addresses are determined as user-defined functions.

[0043] The advantages of the present invention are:

[0044] 1. The source code parsing device first separates the instruction code and data in the target code, and can directly process the instruction code and data in a targeted manner when using the disassembly tool for disassembly, thereby avoiding interference of data on the instruction code disassembly work and improving the disassembly efficiency;

[0045] 2. Use Vector container to store Content objects, which is convenient for content extraction and marking as well as for subsequent tracking of instruction control flow;

[0046] 3. Tracking the instruction control flow by tracking the PC value can ensure that each instruction is traversed, thereby ensuring the complete separation of instruction code and data and ensuring the separation effect;

[0047] 4. Before processing the assembly file, identify the user-defined function, separate the user-defined function and the system library function, and restore the key information of the user-defined function to facilitate the subsequent source code level code restoration work. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a method flow chart of the source code parsing device based on disassembly of the present invention;

[0049] Figure 2 It is a workflow diagram of an input module in a source code analysis device based on disassembly of the present invention;

[0050] Figure 3 It is a workflow diagram of separating data and instruction codes in the source code parsing device based on disassembly of the present invention;

[0051] Figure 4 The figure is a workflow diagram of an instruction disassembly module in a source code analysis device based on disassembly of the present invention;

[0052] Figure 5 It is a specific processing flow chart of data and instruction codes by the instruction disassembly module in the source code parsing device based on disassembly of the present invention;

[0053] Figure 6 A diagram showing the layout of functions in memory. DETAILED DESCRIPTION

[0054] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0055] like Figure 1 As shown, this embodiment discloses a source code analysis device based on disassembly, including an input module, an instruction and data separation module, and an instruction disassembly module, wherein:

[0056] Input module, used to read the target code into memory;

[0057] An instruction and data separation module is used to analyze the target code read by the input module to separate the instruction code and data;

[0058] The instruction disassembly module is used to disassemble the instruction code and data of the target code respectively to generate an assembly file corresponding to the target code.

[0059] Specifically, a Vector container of a Content object is first defined, and as shown in FIG2 , the input module reads a binary file from an external file in the following manner:

[0060] A1. First, define a Content object, read several bytes from the target binary format file and store them in the Content object; the number of bytes read each time is determined by a person skilled in the art according to the specific situation, such as for the disassembly of 32-bit instructions, 4 bytes can be read each time;

[0061] A2. Store the Content object in the Vector container;

[0062] A3. Repeat steps A1 and A2 until the end of the file.

[0063] Specifically, the instruction and data separation module separates instruction code and data in the following ways:

[0064] B1. Track the instruction control flow, traverse and identify each instruction;

[0065] B2. Identify the code portion that can be reached by the instruction stream as instruction code, and the rest as data.

[0066] Specifically, Figure 3 As shown, in step B1, the instruction and data separation module tracks the instruction control flow in the following manner:

[0067] B11. Set the PC value to 0;

[0068] B12. Take out a specific Content object from the Vector container. For example, when decompiling the instructions of a 32-bit operating system, since each instruction is stored as 4 bytes in a 32-bit operating system, the specific Content object refers to the Content object with the subscript PC / 4, which means that the PC address is divided by 4 and then rounded up, representing the end address of each 4-byte instruction, that is, the starting address of the instruction;

[0069] B13. Identify the retrieved Content object as a command, and mark the command as having been accessed;

[0070] B14. Determine whether the instruction identified in step B13 is a program end instruction. If so, execute step B15, otherwise execute step B16;

[0071] B15. Continue to determine whether the display table is empty. If so, end the tracking. Otherwise, take out an Elem element from the display table. If the display table is not empty, it means that there are Elem instructions pushed into the call chain. These instructions still map the Content object in the Vector container. Therefore, this solution repeats the process during the separation process until there is no Elem element in the display table to achieve a complete separation effect.

[0072] And determine whether the instruction at the address addr in the Elem element has been accessed. If not, restore the current scene information including the PC value and return to step B12, that is, push the data at the address addr to the top of the stack. If yes, determine whether the instruction at the address addr in the next Elem element has been accessed, until all Elem elements are traversed and the tracking is terminated;

[0073] B16. Further determine whether the instruction identified in B13 is a transfer instruction. If so, update the PC value, display table, and return table according to the specific transfer instruction. Otherwise, increment the PC and return to step B12. This step is a loop traversal process, which is used to push the instructions that meet the instruction transfer indication into the return table and display table. The return table is used to record the return address when the program is called; when encountering a double branch instruction, the display address and the locale (the value of each register of the program) are filled into the display table.

[0074] Specifically, in step B16, the specific steps of updating the PC value, displaying the table, and returning the table are as follows:

[0075] If it is an unconditional transfer instruction (B instruction, MOV PC, 0x16), the address of this instruction is filled in the segment table, its explicit address is filled in the segment table, and the explicit address is used as the current PC address;

[0076] If it is an unconditional transfer instruction subroutine call instruction (BL instruction), the address of this instruction is filled in the segment table, the return address is filled in the return address table, the explicit address is filled in the segment table, and the explicit address is used as the current PC address;

[0077] If it is a return instruction (MOV PC, LR) in an unconditional transfer instruction, the return address is found in the return address table according to the "last in, first out" principle, the address of this instruction is filled in the segment table, the return address is filled in the segment table, and the return address is used as the current PC address;

[0078] If it is a binary instruction (BEQ, MOVEQ PC, 0x16, etc.), fill the explicit address into the explicit address table (and save the register value at that time), and then use the implicit address as the current PC address.

[0079] The segment table is to fill in the transfer address of all transfer instructions except conditional transfer into this table, including the address of the instruction and the transfer address. Through the segment table, we can get several code segments, making the code clearer and easier to disassemble. Figure 5 As shown, the instruction disassembly module is disassembled in the following way:

[0080] C1. Take out the objects from the Vector container one by one, and determine whether the object is instruction code or data according to the separation result of the instruction and data separation module;

[0081] C2. If the object is an instruction code, the instruction code is disassembled into assembly instruction form; if it is data, the data is translated into the value of the data. The code is separated first, so that the disassembler can disassemble the instruction code separately and translate the data directly, thereby improving the disassembly efficiency.

[0082] Furthermore, the device further comprises a function identification module for identifying library functions, wherein the function identification module is used to perform the following steps:

[0083] C3. Normalize the assembly instruction code into intermediate code

[0084] (Low2levelIntermediateLanguage, LIL), and build various symbol tables during the conversion process for later use;

[0085] C4. Extract library functions and identify system library functions and user-defined functions through dynamic debugging of intermediate codes; dynamic debugging means making the program run, and dynamic debugging tools such as Ollydbg can be used.

[0086] C5. Restore key information of user-defined functions including name, number of parameters, return value and type.

[0087] The intermediate code is an internal representation of the source program and does not depend on the structure of the target machine. Normalizing the assembly instructions into the intermediate code and then continuing with the subsequent work will help the development and porting (robustness) of the compiler program, and can also help users optimize the code more conveniently.

[0088] The instruction disassembly module can use an assembly tool that can only realize assembly, or an assembly tool that can realize assembly and compilation. The latter is preferred in this scheme. And the function identification module here can be embedded in the assembly tool, or it can be connected to the assembly tool. When the connection method is adopted, the disassembly tool assembles the target code to obtain the assembly file and then outputs the assembly file to the function identification module for function identification. The function identification module then returns the identification result to the disassembly tool, and then the disassembly tool continues to perform control flow analysis and data type analysis on the system library function and the user-defined function respectively to complete the compilation work and obtain the disassembly result at the source code level. Here, the user-defined function and the system library function are separated first, and then the assembly tool is used to perform control flow analysis and data type analysis, which can avoid the influence of user-defined data on the disassembly work, improve the disassembly efficiency and reduce the error rate of disassembly.

[0089] Specifically, in step C4, the user-defined function is identified in the following manner:

[0090] D1. Prepare several calling programs that have only one library function call statement and differ only in the parameters of the called function;

[0091] D2. execute several calling programs prepared by step D1, and determine the function with fixed effective operation instruction as user-defined function. The effective operation instruction here refers to the operation code of the user-defined library function instruction, and the operation code of the user-defined library function instruction is fixed, and the problem of address relocation will not occur in the compilation and linking process, and it will not be affected by different versions of compilers and compilation optimization. So in different calling programs, the effective operation instruction of the same library function is constant, so the user-defined library function can be separated from the system library function by the above steps.

[0092] Furthermore, the user-defined functions determined in step D2 are checked for addresses, the function with the highest address is selected, and the function and all functions with lower addresses are determined as user-defined functions. Figure 6 As shown, the codes of user-defined library functions are stored continuously, and the storage order is consistent with their definition order in the source program. The user-defined library function codes are located at low addresses, and the system library function codes are located at high addresses. Therefore, this method can effectively separate user-defined library functions from system library functions.

[0093] The specific embodiments described herein are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.

[0094] Although the terms such as input module, instruction and data separation module, function identification module, instruction disassembly module, etc. are used more frequently in this article, the possibility of using other terms is not excluded. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional restrictions is contrary to the spirit of the present invention.

Claims

1. A source code analysis device based on disassembly, characterized in that: It includes an input module, an instruction and data separation module and an instruction disassembly module, among which: Input module, used to read the target code into memory by: A1. Read several bytes from the target binary format file and store them in the Content object; A2. Store the Content object in the Vector container; A3. Repeat steps A1 and A2 until the end of the file; The instruction and data separation module is used to analyze the target code read by the input module to separate the instruction code and data: B1. Track the instruction control flow, traverse and identify each instruction: B11. Set the PC value to 0; B12. Take out a specific Content object from the Vector container; B13. Identify the retrieved Content object as a command, and mark the command as having been accessed; B14. Determine whether the instruction identified in step B13 is a program end instruction. If so, execute step B15, otherwise execute B16; B15. Continue to determine whether the display table is empty. If so, end the tracing. Otherwise, take an Elem element from the display table and determine whether the instruction at the address addr in the Elem element has been accessed. If not, restore the current scene information including the PC value and return to step B12. If yes, determine whether the instruction at the address addr in the next Elem element has been accessed. End the tracing after traversing all Elem elements. B16 further determines whether the instruction identified in B13 is a transfer instruction. If so, the PC value, display table, and return table are updated according to the specific transfer instruction. Otherwise, the PC is incremented and returns to step B12. B2. Identify the code part that can be reached by the instruction stream as instruction code, and the rest as data; The instruction disassembly module is used to disassemble the instruction code and data of the target code respectively to generate an assembly file corresponding to the target code.

2. The source code analysis device based on disassembly according to claim 1, characterized in that: In step B16, the specific steps of updating the PC value, displaying the table, and returning the table are as follows: If it is an unconditional transfer instruction, the address of the instruction is filled in the segment table, its explicit address is filled in the segment table, and the explicit address is used as the current PC address; If it is an unconditional transfer instruction or a subroutine call instruction, the address of the instruction is filled in the segment table, the return address is filled in the return address table, the explicit address is filled in the segment table, and the explicit address is used as the current PC address; If it is a return instruction in an unconditional transfer instruction, the return address is found in the return address table according to the "last in, first out" principle, the address of this instruction is filled in the segment table, the return address is filled in the segment table, and the return address is used as the current PC address; If it is a binary instruction, the explicit address is filled into the explicit address table, and then the implicit address is used as the current PC address.

3. The source code analysis device based on disassembly according to claim 2, characterized in that: The instruction disassembly module disassembles in the following ways: C1. Take out the objects from the Vector container one by one, and determine whether the object is instruction code or data according to the separation result of the instruction and data separation module; C2. If the object is an instruction code, the instruction code is deassembled into assembly instruction form; if it is data, the data is translated into the value of the data.

4. The source code analysis device based on disassembly according to claim 3 is characterized in that: Also included is a function identification module for identifying library functions, and the function identification module is used to perform the following steps: C3. Normalize the assembly instruction code into an intermediate code; C4. Extract library functions and identify system library functions and user-defined functions; C5. Restore key information of user-defined functions including name, number of parameters, return value and type.

5. The source code analysis device based on disassembly according to claim 4, characterized in that: In step C4, the library function is extracted by dynamically debugging the intermediate code.

6. The source code analysis device based on disassembly according to claim 5, characterized in that: In step C4, the user-defined function is identified in the following manner: D1. Prepare several calling programs that have only one library function call statement and differ only in the parameters of the called function. D2. Execute the several calling programs prepared in step D1, and determine the functions with fixed effective operation instructions as user-defined functions.

7. The source code analysis device based on disassembly according to claim 6, characterized in that: The user-defined functions determined in step D2 are checked for addresses, the function with the highest address is selected, and the function and all functions with lower addresses are determined as user-defined functions.

Images