Reverse analysis method and electronic equipment based on large model

Abstract

The present disclosure provides a reverse analysis method and electronic device based on a large model, the method comprising: responding to a target analysis instruction, obtaining a target reverse task through a large model, splitting the target reverse task into a subtask sequence to be executed step by step, determining the subtask that needs to be executed currently; executing the subtask that needs to be executed currently based on a reverse analysis framework to obtain the current execution result; determining the subtask to be executed next based on the large model according to the current execution result; and outputting the analysis result after the large model and the reverse analysis framework interact multiple times to complete the subtask sequence. The present application can automatically complete the reverse analysis task without excessive involvement of security experts, and the labor cost is low.

Description

Technical Field

[0001] The present disclosure relates to the field of model technology, and in particular to a reverse analysis method and electronic equipment based on a large model. Background Art

[0002] Reverse analysis of binary files requires a lot of effort from security experts. As big model technology matures, the security industry has also begun to try to use big models to assist in reverse analysis of binary files. However, existing technologies are limited to using big models to assist in some small tasks, such as improving the decompilation results of functions, understanding functions and outputting a summary of function behaviors, etc. The problem with these technologies is that the degree of automation is not high. Because existing technologies can only handle small security tasks, such as improving the decompilation results of functions, understanding function semantics, etc., security experts are still required to participate in the whole process to complete the reverse analysis task.

[0003] In the related art, the work of reverse analysis using large models can generally only complete small security tasks. For example, the large model is combined with reverse analysis tools such as Interactive Disassemble Professional (IDA), and the large model is used to improve the analysis results of these reverse analysis tools, or to annotate the analysis results to facilitate security experts to understand. However, the automation level of existing work is not high enough, and security experts are still required to participate in the whole process. This process still requires security experts to invest a lot of energy. Therefore, the implementation method is cumbersome and costly. Summary of the invention

[0004] The present disclosure provides a reverse analysis method and electronic device based on a large model to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present disclosure, a reverse analysis method based on a large model is provided, the method comprising:

[0006] In response to the target analysis instruction, a target reverse task is obtained through the large model, and the target reverse task is split into a subtask sequence to be executed step by step, and a subtask that needs to be executed currently is determined;

[0007] Execute the subtask that needs to be executed based on the reverse analysis framework and obtain the current execution result;

[0008] Determine the subtask to be executed next based on the large model and the current execution result;

[0009] After the large model interacts with the reverse analysis framework for multiple times to complete the subtask sequence, the analysis results are output.

[0010] In one possible implementation, the step of obtaining the target reverse task through the large model and splitting the target reverse task into a sequence of subtasks to be executed step by step includes:

[0011] Pre-configuring a first prompt word of the target reverse task in the large model;

[0012] After the target reverse task is obtained, the target reverse task is split into a subtask sequence to be executed step by step according to the first prompt word.

[0013] In one possible implementation manner, each subtask in the subtask sequence is provided with a corresponding second prompt word; and determining the subtask that currently needs to be executed includes:

[0014] The subtask that needs to be executed currently is determined according to the second prompt word.

[0015] In one possible implementation, the determining of the subtask to be executed next based on the large model according to the current execution result includes:

[0016] The large model determines the subtask to be executed next based on the current execution result and the second prompt word.

[0017] In one possible implementation, it also includes:

[0018] The first prompt word and the second prompt word in the large model are adjusted in a preset time period.

[0019] In one possible implementation, the adjusting the analysis result based on the large model includes:

[0020] The analysis result is adjusted based on the large model to output an analysis result that meets a preset standard.

[0021] In one possible implementation, adjusting the analysis result based on the large model to output an analysis result that meets a preset standard includes:

[0022] Determining the type of the target reverse task;

[0023] If the target reverse task is of the first type, and if the analysis result exceeds a preset number, the analysis result is condensed and the characters of the analysis result before the preset number are output;

[0024] and / or,

[0025] If the target reverse task is of the second type, and if the analysis results exceed a preset number, the analysis results are split and sent multiple times.

[0026] In one possible implementation, the target reverse task includes:

[0027] View strings, view function listing, view cross references, view disassembly, and view decompilation.

[0028] In one possible implementation, the large model includes: a deep learning large language model or a knowledge-enhanced large language model;

[0029] The reverse analysis framework includes: an interactive disassembler, a software reverse engineering framework or a reverse analysis platform.

[0030] According to a second aspect of the present disclosure, a reverse analysis device based on a large model is provided, the device comprising:

[0031] An acquisition module, used to respond to the target analysis instruction, acquire the target reverse task through the large model, split the target reverse task into a subtask sequence to be executed step by step, and determine the subtask that needs to be executed currently;

[0032] The execution module is used to execute the subtask that needs to be executed currently based on the reverse analysis framework and obtain the current execution result;

[0033] A determination module, used to determine the subtask to be executed next based on the large model according to the current execution result;

[0034] The output module is used to output the analysis results after the large model interacts with the reverse analysis framework for multiple times to complete the subtask sequence.

[0035] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0036] at least one processor; and

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present disclosure.

[0039] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the present disclosure.

[0040] The disclosed reverse analysis method and electronic device based on a large model, in this application, after determining the target analysis task, the large model splits the target analysis task into a subtask sequence, and issues an execution instruction to the reverse analysis framework, the reverse analysis framework executes the first subtask in the subtask sequence, obtains the first execution result, the large model determines the next subtask based on the first execution result obtained, the reverse analysis framework executes the next subtask to obtain the next execution result, and so on and so forth, until the last subtask in the subtask sequence is executed, and the analysis result output is obtained. The analysis process in this application does not require the participation of experts, can automatically complete the reverse analysis task, is simple to operate and has low cost.

[0041] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0043] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0044] Figure 1 The schematic diagram shows the implementation process of the reverse analysis method based on the large model in the embodiment of the present disclosure. Figure 1 ;

[0045] Figure 2 The schematic diagram shows the implementation process of the reverse analysis method based on the large model in the embodiment of the present disclosure. Figure 2 ;

[0046] Figure 3 A schematic diagram of the structure of a reverse analysis device based on a large model according to an embodiment of the present disclosure is shown;

[0047] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0048] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0049] At present, existing work on applying big models to the field of reverse analysis focuses on using big models to complete small security tasks, such as combining big models with reverse analysis tools such as IDA, using big models to improve the analysis results of these reverse analysis tools, or annotating the analysis results to facilitate security experts' understanding.

[0050] However, the automation level of existing work is not high enough, and security experts are still required to participate in the whole process. For example, in a specific application scenario, the reverse analysis task is to analyze the communication protocol of a malware. Security experts need to first locate the relevant code by checking string references and other means, and then input the decompilation results of the relevant code into the big model, so that the big model can assist security experts in understanding the code semantics. The security experts then output a report summarizing the analysis results of the communication protocol. This process still requires a lot of effort from security experts. In addition, the existing binary program reverse analysis methods based on big models only focus on small tasks, such as improving the decompilation results of binary functions and analyzing the semantics of binary functions, but cannot directly reverse analyze the entire binary program from the overall perspective. The low degree of automation still requires high labor costs.

[0051] The following describes the large model-based reverse analysis method and electronic device provided by the present application in conjunction with the accompanying drawings.

[0052] like Figure 1 As shown, the present application provides a reverse analysis method based on a large model, comprising:

[0053] S101, in response to the target analysis instruction, obtain the target reverse task through the large model, and split the target reverse task into a subtask sequence to be executed step by step, and determine the subtask that needs to be executed currently

[0054] It is understandable that if Figure 2 As shown, the target analysis instruction in this application is an instruction issued by a security expert, and the target reverse task is obtained through a large model, wherein the target reverse task can be a license verification of cracked software, analysis of the communication protocol between malware and the control end, etc. It can be understood that the security expert in this application only needs to give a specific reverse analysis task, which improves the automation of reverse analysis in this application.

[0055] After the large model obtains the target reverse task, if the reverse analysis process of the target reverse task requires multiple sub-tasks, for example, to analyze the license verification of the cracked software, it is necessary to first obtain sub-task A, then obtain sub-task B, then obtain sub-task C, and finally obtain sub-task D. The execution results of the sub-tasks need to be obtained in sequence to finally obtain the analysis results; therefore, the large model of this application needs to first split the target reverse task into a sequence of sub-tasks to be executed step by step, and then send an instruction to the reverse analysis framework to execute the first sub-task that needs to be executed.

[0056] S102, executing the subtask that needs to be executed currently based on the reverse analysis framework to obtain the current execution result;

[0057] In this application, after receiving the execution instruction of the large model, the reverse analysis framework executes the subtask that needs to be executed currently and obtains the current execution result.

[0058] S103, determining the subtask to be executed next based on the large model and the current execution result;

[0059] In this application, after the large model obtains the execution result of the reverse analysis framework, it determines the next subtask to be executed based on the execution result. The reverse analysis framework then executes the next subtask to obtain the execution result. After that, the large model obtains the execution result of the reverse analysis framework and determines the next subtask to be executed until the last subtask in the subtask sequence is executed.

[0060] S104, after the large model interacts with the reverse analysis framework for multiple times to complete the subtask sequence, output the analysis results.

[0061] After the large model interacts with the reverse analysis framework for multiple times until all subtasks in the subtask sequence are completed, the final execution result of the reverse analysis framework is obtained, and the final execution result is used as the analysis result. It can be understood that in this application, the large model outputs after obtaining the analysis result.

[0062] The reverse analysis method based on the large model provided in this application is mainly used for binary programs. Binary programs, i.e., executable files on the operating system, are generated by the compiler after compiling the source code. It should be noted that the reverse analysis in this application is the process of analyzing the binary to obtain its organizational structure, operating base address or code logic. The large model in this application is a large neural network model used in the field of artificial intelligence. These models have a wide range of application scenarios because of their numerous parameters and complex structures.

[0063] The reverse analysis method based on a large model provided in the present application, after determining the target analysis task, the large model splits the target analysis task into a subtask sequence, and issues an execution instruction to the reverse analysis framework, the reverse analysis framework executes the first subtask in the subtask sequence, obtains the first execution result, the large model determines the next subtask based on the first execution result obtained, the reverse analysis framework executes the next subtask to obtain the next execution result, and so on and so forth, until the last subtask in the subtask sequence is executed, and the analysis result output is obtained. The analysis process in the present application does not require the participation of experts, can automatically complete the reverse analysis task, is simple to operate and has low cost.

[0064] In some optional embodiments, the step of obtaining the target inverse task through the large model and splitting the target inverse task into a sequence of subtasks to be executed step by step includes:

[0065] Pre-configuring a first prompt word of the target reverse task in the large model;

[0066] After the target reverse task is obtained, the target reverse task is split into a subtask sequence to be executed step by step according to the first prompt word.

[0067] Specifically, in this application, the first prompt word of the target reverse task is pre-set in the large model. The target reverse task in this application can be multiple, for example, it can be to view the string, view the function list, view the cross reference, view the disassembly and view the decompilation, etc. Different prompt words are set for each target reverse task. By setting appropriate prompt words, the large model can correctly understand the task proposed by the security expert, and decompose the task into a series of commands to be sent to the reverse analysis framework for execution and to retrieve the results.

[0068] In some optional embodiments, each subtask in the subtask sequence is provided with a corresponding second prompt word; and the determining of the subtask currently to be executed includes:

[0069] The subtask that needs to be executed currently is determined according to the second prompt word.

[0070] In some optional embodiments, determining the subtask to be executed next based on the large model according to the current execution result includes:

[0071] The large model determines the subtask to be executed next based on the current execution result and the second prompt word.

[0072] It is understandable that all subtasks in the subtask sequence are provided with corresponding second prompt words, so that the large model can determine the subtask that needs to be executed currently according to the second prompt word, and the large model can also determine the subtask to be executed in the next step according to the execution result of the previous step and the second prompt word, thereby issuing a command for the reverse analysis framework to execute. It should be noted that the commands that the large model can issue to the reverse analysis framework for execution are predefined in this application to avoid the large model lacking the basic ability to complete the reverse task. The commands that the large model set by the present invention can issue are as follows, including functions frequently used in reverse engineering such as disassembly / decompilation, cross-reference, reading symbol table, and searching HEX. As shown in Table 1.

[0073] Table 1 Reverse task commands

[0074]

[0075] That is to say, the big model prompt words set in this application, the first prompt word prompts the big model that its task is reverse analysis, and the way to achieve this task is to continuously interact with the reverse analysis framework; the second prompt word prompts how the interaction details between the big model and the reverse analysis framework are implemented. The big model can send a series of commands, parse and call the reverse analysis framework to execute commands, and obtain the execution results and return them to the big model, and repeat this process until the reverse analysis task is finally completed.

[0076] For example, as a reverse engineering expert, you will be given a specific reverse engineering task, execute a series of instructions according to the task model, and finally return the instruction execution results to the reverse engineering expert.

[0077] The executed instructions are as follows:

[0078] *ls: List all the strings of the program;

[0079] *refto <addr>: List all codes that reference addr;

[0080] *ls_func: lists all functions and addresses of the program;

[0081] *disasm <addr>:Disassemble the addr function;

[0082] *discom <addr>: Decompile addr function;

[0083] *ls_import: lists all import table functions of the program;

[0084] *ls_export: lists all export table functions of the program;

[0085] *ls_name: lists all symbols of the program;

[0086] If you have completed the analysis task, please reply OK.

[0087] In some optional embodiments, the reverse analysis method based on the large model provided by the present application adjusts the first prompt word and the second prompt word in the large model in a preset time period.

[0088] It should be noted that the output of the large model in this application has a certain degree of randomness, and often some irregular and unprocessable data will be output, and it is necessary to constantly fine-tune the prompt words to cover as many special scenarios as possible. The scenarios fine-tuned in the present invention are as follows:

[0089] Add "Summarize the basic ideas of the solution first, and then solve the problem according to your ideas" in the prompt words. Specific implementation proves that letting the big model list some basic points first, and then letting the big model complete the task according to these points, can improve the quality of the analysis results output by the big model.

[0090] It can be understood that the adjustment of the first prompt word and the second prompt word in the present application is a large model. Regardless of whether it is during or after the analysis of the reverse task, the first prompt word and / or the second prompt word must be adjusted within a preset time period.

[0091] In some optional embodiments, adjusting the analysis result based on the large model includes:

[0092] The analysis result is adjusted based on the large model to output an analysis result that meets a preset standard.

[0093] In some optional embodiments, adjusting the analysis result based on the large model to output an analysis result that meets a preset standard includes:

[0094] Determining the type of the target reverse task;

[0095] If the target reverse task is of the first type, and if the analysis result exceeds a preset number, the analysis result is condensed and the characters of the analysis result before the preset number are output;

[0096] and / or,

[0097] If the target reverse task is of the second type, and if the analysis results exceed a preset number, the analysis results are split and sent multiple times.

[0098] When returning the execution results of the reverse analysis framework to the large model, some adjustments are made to the results. Because the large model has a limit on the length of the context, it is necessary to streamline the results while affecting the analysis quality as little as possible.

[0099] For example: 1) When listing a string, only the first 20 characters of the string are output;

[0100] 2) When disassembling / decompiling a function, if the result is too long, send it in multiple conversations. When returning the result, add instructions to require the big model to do the next step, such as "Please make the next command based on the analysis result." Otherwise, when there are too many conversation rounds, the big model will forget the context and will not issue the next command based on the result.

[0101] As an optional implementation, the large model includes: a deep learning large language model or a knowledge-enhanced large language model;

[0102] The reverse analysis framework includes: an interactive disassembler, a software reverse engineering framework or a reverse analysis platform.

[0103] It is understandable that the large model in this application can adopt the deep learning large language model GPT4 or the knowledge enhanced large language model such as Wenxinyiyan; the reverse analysis framework in this application can adopt the interactive disassembler IDA, the software reverse engineering framework GHIDRA or the reverse analysis platform Radare2, etc. The large model provided in this application can also adopt other large models, and the reverse analysis framework can also adopt other reverse analysis tools, which are not limited in this application.

[0104] The reverse analysis method based on the big model provided in this application requires the binary analysis framework to execute tasks, obtain analysis outputs, and generate the next task; security experts arrange reverse analysis goals for the big model.

[0105] like Figure 3 As shown, the present application provides a reverse analysis device based on a large model, the device comprising:

[0106] The acquisition module 301 is used to respond to the target analysis instruction, acquire the target reverse task through the large model, split the target reverse task into a subtask sequence to be executed step by step, and determine the subtask that needs to be executed currently;

[0107] An execution module 302 is used to execute the subtask that needs to be executed currently based on the reverse analysis framework to obtain the current execution result;

[0108] A determination module 303 is used to determine the subtask to be executed next based on the large model according to the current execution result;

[0109] The output module 304 is used to output the analysis results after the large model interacts with the reverse analysis framework for multiple times to complete the subtask sequence.

[0110] In some optional embodiments, the acquisition module 301 includes:

[0111] A configuration unit, configured to pre-configure a first prompt word of the target reverse task in the large model;

[0112] The splitting unit is used to split the target reverse task into a subtask sequence to be executed step by step according to the first prompt word after acquiring the target reverse task.

[0113] In some optional embodiments, each subtask in the subtask sequence is provided with a corresponding second prompt word; the acquisition module 301 further includes:

[0114] The first determining unit is used to determine the subtask that needs to be executed currently according to the second prompt word.

[0115] In some optional embodiments, the determining module 303 includes:

[0116] The second determining unit is used for the large model to determine the subtask to be executed next based on the current execution result and the second prompt word.

[0117] Some optional embodiments further include:

[0118] The adjustment module is used to adjust the first prompt word and the second prompt word in the large model in a preset time period.

[0119] In some optional embodiments, the output result 304 includes:

[0120] An adjustment unit is used to adjust the analysis result based on the large model to output an analysis result that meets a preset standard.

[0121] In some optional embodiments, the adjustment unit includes:

[0122] Determining the type of the target reverse task;

[0123] If the target reverse task is of the first type, and if the analysis result exceeds a preset number, the analysis result is condensed and the characters of the analysis result before the preset number are output;

[0124] and / or,

[0125] If the target reverse task is of the second type, and if the analysis results exceed a preset number, the analysis results are split and sent multiple times.

[0126] In some optional embodiments, the target reverse task includes:

[0127] View strings, view function listing, view cross references, view disassembly, and view decompilation.

[0128] In some optional embodiments, the large model includes: a deep learning large language model or a knowledge-enhanced large language model;

[0129] The reverse analysis framework includes: an interactive disassembler, a software reverse engineering framework or a reverse analysis platform.

[0130] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0131] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0132] like Figure 4 As shown, the device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0133] A number of components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0134] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above, such as a reverse analysis method based on a large model. For example, in some embodiments, the reverse analysis method based on a large model may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the reverse analysis method based on the large model described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute the large model-based reverse analysis method in any other appropriate manner (eg, by means of firmware).

[0135] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0136] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0137] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0139] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0140] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0141] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0142] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0143] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.< / addr> < / addr> < / addr>

Claims

1. A reverse analysis method based on a large model, characterized in that: The method comprises: In response to the target analysis instruction, a target reverse task is obtained through the large model, and the target reverse task is split into a subtask sequence to be executed step by step, and a subtask that needs to be executed currently is determined; Execute the subtask that needs to be executed based on the reverse analysis framework and obtain the current execution result; Determine the subtask to be executed next based on the large model and the current execution result; After the large model and the reverse analysis framework interact multiple times to complete the subtask sequence, output the analysis results; The target reverse task is obtained through the large model, and the target reverse task is split into a sequence of subtasks to be executed step by step, including: Pre-configuring a first prompt word of the target reverse task in the large model; After obtaining the target reverse task, splitting the target reverse task into a subtask sequence to be executed step by step according to the first prompt word; Each subtask in the subtask sequence is provided with a corresponding second prompt word; and the subtask currently to be executed is determined, including: Determining the subtask that needs to be executed currently according to the second prompt word; The step of determining the subtask to be executed next based on the large model and the current execution result includes: The large model determines the subtask to be executed next based on the current execution result and the second prompt word; Also includes: The first prompt word and the second prompt word in the large model are adjusted in a preset time period.

2. The method according to claim 1, characterized in that The output analysis results include: The analysis result is adjusted based on the large model to output an analysis result that meets a preset standard.

3. The method according to claim 2, characterized in that The adjusting the analysis result based on the large model to output an analysis result that meets a preset standard includes: Determining the type of the target reverse task; If the target reverse task is of the first type, and if the analysis result exceeds a preset number, the analysis result is condensed and the characters of the analysis result before the preset number are output; and / or, If the target reverse task is of the second type, and if the analysis results exceed a preset number, the analysis results are split and sent multiple times.

4. The method according to claim 1, characterized in that The target reverse task includes: View strings, view function listing, view cross references, view disassembly, and view decompilation.

5. The method according to claim 1, characterized in that The large model includes: a deep learning large language model or a knowledge enhanced large language model; The reverse analysis framework includes: an interactive disassembler, a software reverse engineering framework or a reverse analysis platform.

6. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

Images