Method and device for removing junk instructions

Abstract

The present invention provides a method and device for removing junk instructions, the method comprising: disassembling a binary program to be analyzed, identifying the predecessor node and the successor node of the assembly code, and obtaining an instruction code block; judging whether a stack error prompt and a jump failure record appear in the disassembly; based on the appearance of the stack error prompt, traversing the instruction code block according to the predecessor node and the successor node, judging whether the stack information of each function meets the characteristics of a normal compiler, and recording the stack junk instructions that do not meet the characteristics of a normal compiler; based on the appearance of the jump failure record, traversing the instruction code block according to the predecessor node and the successor node, determining the jump junk instructions and non-jump instructions, so as to determine the target address of the jump junk instruction; correcting the corresponding function according to the recorded stack junk instructions that do not meet the characteristics of a normal compiler, and correcting the jump pointing according to the target address of the jump junk instruction. The present invention accelerates the rate of security analysis malicious application or code detection.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for removing junk instructions. Background Art

[0002] In recent years, with the development of technology, the usage rate of mobile devices has greatly increased, and the number of applications for different mobile operating systems has increased exponentially. At present, some applications have appeared on the market, mainly obtaining users' personal information in illegal ways for sale, and these applications often have strengthened a lot of protection to avoid reverse analysis.

[0003] When conducting security analysis on the above applications, the readability of static code is very high, and it is usually necessary to check the code generated by binary decompilation. However, in order to avoid reverse analysis, malicious applications add junk instructions, so that reverse analysis can only see the assembly code, and the true intention of the static analysis code cannot be analyzed. Even the execution status of some codes can only be obtained when the application is running, which increases the difficulty of security analysis. When conducting security analysis on binaries, security analysts need to spend more time and energy on code forensics. Summary of the invention

[0004] The present invention provides a method and device for removing junk instructions, which are used to solve the defect in the prior art that malicious applications add junk instructions so that reverse analysis cannot directly statically analyze the intent of the code, thereby enhancing the efficiency and accuracy of malware security analysis.

[0005] The present invention provides a method for removing junk instructions, comprising: disassembling a binary program to be analyzed, and identifying a predecessor node and a successor node in the assembly code obtained by the disassembly to obtain an instruction code block; judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly to determine whether a junk instruction exists; determining whether a stack junk instruction exists based on the appearance of a stack error prompt, traversing the instruction code block according to the predecessor node and the successor node, judging whether the stack information of each function meets the characteristics of a normal compiler, and recording the stack junk instructions that do not meet the characteristics of the normal compiler; determining whether a jump junk instruction exists based on the appearance of a jump failure record, traversing the instruction code block according to the predecessor node and the successor node, determining a jump junk instruction and a non-jump instruction, and obtaining a target address of the jump junk instruction according to the jump junk instruction and the non-jump instruction; correcting a corresponding function according to the recorded stack junk instruction that does not meet the characteristics of the normal compiler; and / or correcting a jump direction according to the target address of the jump junk instruction.

[0006] According to a method for removing junk instructions provided by the present invention, it is determined whether the stack information of each function meets the characteristics of a normal compiler program, including: determining the stack creation and stack recovery based on the stack information of each function; and determining whether the stack creation and stack recovery of each function match. If they match, it meets the characteristics of a normal compiler program.

[0007] According to a method for removing junk instructions provided by the present invention, the junk stack instructions that do not conform to the characteristics of the normal compiler include mismatched stack creation and reclaim stacks, and the corresponding function is corrected according to the recorded junk stack instructions that do not conform to the characteristics of the normal compiler, including: according to the mismatched stack creation and reclaim stack, retaining the stack creation at the head of the function stack and retaining the reclaim stack at the tail of the function stack, clearing the remaining recorded stack creation and / or reclaim stack to correct the corresponding function and remove the junk stack instructions in the function.

[0008] According to a method for removing junk instructions provided by the present invention, the instruction code block is traversed according to the predecessor node and the successor node to determine jump junk instructions and non-jump instructions, and the target address of the jump junk instruction is obtained according to the jump junk instructions and non-jump instructions, including: according to the predecessor node and the successor node, the instruction code block is traversed to determine jump junk instructions and non-jump instructions; according to the predecessor node of the jump junk instruction and the successor node of the previous jump junk instruction, the target address of the jump junk instruction is obtained.

[0009] According to a method for removing junk instructions provided by the present invention, a jump direction is corrected according to a target address of the jump junk instruction, including: according to the target address of the jump junk instruction, converting the jump junk instruction into a target jump instruction to correct the jump direction.

[0010] According to a method for removing junk instructions provided by the present invention, before correcting the corresponding function according to the recorded junk stack instructions that do not conform to the characteristics of the normal compiled program; and / or correcting the jump direction according to the target address of the jump junk instruction, the method further includes: executing the instruction code block to obtain a code execution path; determining a code instruction block having a fork instruction and not being executed according to the code execution path;

[0011] When the corresponding function is corrected according to the recorded stack junk instructions that do not conform to the characteristics of the normal compiler program; and / or the jump direction is corrected according to the target address of the jump junk instruction, it also includes: according to the code instruction block with fork instructions and not executed, the assembly code is correspondingly deleted.

[0012] According to a method for removing junk instructions provided by the present invention, the binary program to be analyzed is disassembled, and the predecessor node and the successor node in the assembly code obtained by the disassembly are identified to obtain an instruction code block, including: disassembling the binary program to be analyzed to obtain the assembly code; converting the assembly code into microcode; identifying the predecessor node and the successor node in the microcode, and storing them as an instruction code block.

[0013] The present invention also provides a junk instruction removal device, comprising: a disassembly module, which disassembles a binary program to be analyzed, and identifies a predecessor node and a successor node in the assembly code obtained by the disassembly to obtain an instruction code block; a junk instruction judgment module, which judges whether a stack error prompt appears in the disassembly, and judges whether a jump failure record appears in the disassembly, so as to determine whether there is a junk instruction; a stack judgment module, which determines the existence of a stack junk instruction based on the occurrence of a stack error prompt, traverses the instruction code block according to the predecessor node and the successor node, determines whether the stack information of each function meets the characteristics of a normal compiler, and records the stack junk instructions that do not meet the characteristics of the normal compiler; an address determination module, which determines the existence of a jump junk instruction based on the occurrence of a jump failure record, traverses the instruction code block according to the predecessor node and the successor node, determines jump junk instructions and non-jump instructions, and obtains the target address of the jump junk instruction according to the jump junk instruction and the non-jump instruction; a junk instruction correction module, which corrects the corresponding function according to the recorded stack junk instruction that does not meet the characteristics of the normal compiler; and / or corrects the jump direction according to the target address of the jump junk instruction.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned methods for removing junk instructions are implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned junk instruction removal methods are implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any one of the above-mentioned junk instruction removal methods are implemented.

[0017] The junk instruction removal method and device provided by the present invention disassemble the binary program so as to determine whether a stack error prompt appears in the disassembly to determine whether there is a stack junk instruction, and if it is determined that there is a stack junk instruction, based on traversing the instruction code block, determine whether the stack information of the function meets the normal compiler characteristics, so as to record the stack junk instructions that do not meet the normal compiler characteristics, so as to facilitate the subsequent correction of the function to remove the stack junk instruction; and by determining whether a jump failure record appears, determine whether there is a jump junk instruction, and if there is a jump junk instruction, based on traversing the instruction code block, determine the jump junk instruction and the non-jump instruction, so as to determine the target address of the jump junk instruction, so as to facilitate the subsequent correction of the jump pointing to remove the jump junk instruction, thereby realizing the removal of junk instructions in static analysis, more conveniently determining the execution logic of the binary code, accelerating the rate of security analysis malicious application or code detection, and facilitating the detection personnel to analyze its algorithm and its function. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is one of the flow charts of the method for removing junk instructions provided by the present invention;

[0020] Figure 2 This is the second flow chart of the method for removing junk instructions provided by the present invention;

[0021] Figure 3 This is the third flow chart of the method for removing junk instructions provided by the present invention;

[0022] Figure 4 It is a structural schematic diagram of the device for removing waste instructions provided by the present invention;

[0023] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Figure 1 A flowchart of a method for removing junk instructions is described, the method comprising:

[0026] S11, disassembling the binary program to be analyzed, and identifying the predecessor node and the successor node in the disassembled assembly code to obtain an instruction code block;

[0027] S12, judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly, so as to determine whether there is a junk instruction;

[0028] S13, based on the stack error prompt, determine that there are stack waste instructions, traverse the instruction code block according to the predecessor node and the successor node, determine whether the stack information of each function meets the normal compiler characteristics, and record the stack waste instructions that do not meet the normal compiler characteristics;

[0029] S14, based on the jump failure record, determine that there is a jump instruction, traverse the instruction code block according to the predecessor node and the successor node, determine the jump instruction and the non-jump instruction, and obtain the target address of the jump instruction according to the jump instruction and the non-jump instruction;

[0030] S15, correcting the corresponding function according to the recorded stack junk instructions that do not conform to the characteristics of the normal compiler program, and correcting the jump direction according to the target address of the jump junk instruction.

[0031] It should be noted that the step numbers "S1N" in this specification do not represent the order of the method for removing junk instructions. Figure 2-Figure 3 The waste instruction removal method of the present invention is described.

[0032] Step S11, disassemble the binary program to be analyzed, and identify the predecessor node and the successor node in the assembly code obtained by the disassembly to obtain an instruction code block.

[0033] In this embodiment, reference Figure 2 , disassemble the binary program to be analyzed, and identify the predecessor node and the successor node in the assembly code obtained by the disassembly to obtain an instruction code block, including: disassembling the binary program to be analyzed to obtain the assembly code; converting the assembly code into microcode (microcode); identifying the predecessor node and the successor node in the microcode, and storing them as an instruction code block.

[0034] It should be noted that when disassembling the binary program to be analyzed, it is necessary to use the corresponding instruction set for disassembly according to the bit number of the application architecture of the binary program to be analyzed. The bit number refers to the data width of the general packet radio service (General Packet Radio service, GPRs) of the central processing unit (Central Processing Unit, CPU). For example, when 32 bits are used, the arm32 instruction set is used, and when 64 bits are used, the arm64 instruction set is used.

[0035] In addition, when disassembling the binary program to be analyzed, you can use unicorn for disassembly. Unicorn is a lightweight multi-platform, multi-architecture CPU simulation framework based on QEMU (an open source virtual machine emulator) and focuses on CPU simulation. Unicorn includes the following features: Multi-platform support: Unicorn supports emulation of multiple CPU architectures including x86, x86_64, ARM, ARM64 (Aarch64), MIPS, MIPS64, SPARC and M68K; Multi-architecture support: For some CPU architectures, Unicorn supports emulation of multiple different hardware architectures. For example, for ARM and MIPS, it can emulate 32-bit and 64-bit hardware; Accurate simulation: Unicorn provides precise control over the CPU state, including registers and memory, so that it can be used for complex reverse engineering and binary analysis tasks; Rich API: Unicorn provides a rich API that allows users to query and modify the CPU state during simulation, as well as stop simulation under specific conditions. These APIs are available in multiple languages, including Python, Ruby, Java and Go; Event callbacks: Users can register callback functions to handle specific events, such as reading / writing memory, executing instructions, changing CPU state, etc., so that Unicorn can be used to create dynamic binary analysis tools.

[0036] Step S12, judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly, so as to determine whether there is a junk instruction.

[0037] It should be noted that the jump failure record may be "JUMPOUT" or the like, which is not further limited here; the junk instruction includes at least one of a stack junk instruction and a jump junk instruction.

[0038] It should be noted that some malware will add stack flower instructions in the middle of binary functions, such as stack recovery and stack creation. When the stack is recovered, a judgment that is always false is added, but it is not executed during normal operation. At this time, when performing disassembly linear scanning, it is easy to use the added recovery stack as the end of the function, resulting in assembly errors. Therefore, it is necessary to determine whether a stack error prompt appears during disassembly to determine whether there are stack flower instructions.

[0039] In addition, since the malware will add jump instructions, such as BL instructions, to complete the function jump, but its jump value must be calculated when the instructions are dynamically executed, it is necessary to determine whether there is a jump failure record in the disassembly to determine whether there is a jump instruction, so as to facilitate the subsequent static analysis to determine the target address of the jump instruction, so as to convert the instruction into a target jump instruction for jumping. It should be added that the jump instruction can be a BL instruction, and the target jump instruction can be a B instruction.

[0040] Step S13, based on the stack error prompt, determine whether there are stack junk instructions, traverse the instruction code block according to the predecessor node and the successor node, determine whether the stack information of each function meets the normal compiler characteristics, and record the stack junk instructions that do not meet the normal compiler characteristics.

[0041] It should be noted that the normal compiler features include a pair of matching allocation stack and deallocation stack. Figure 3 , judging whether the stack information of each function meets the normal compiler program characteristics, including: determining the stack allocation and stack recovery according to the stack information of each function; judging whether the stack allocation and stack recovery of each function match, if they match, it meets the normal compiler program characteristics.

[0042] Accordingly, the recorded stack waste instructions that do not conform to the normal compiler characteristics include mismatched stack creation and stack deallocation.

[0043] Step S14, based on the jump failure record, determine whether there is a jump waste instruction, traverse the instruction code block according to the predecessor node and the successor node, determine the jump waste instruction and the non-jump instruction, and obtain the target address of the jump waste instruction according to the jump waste instruction and the non-jump instruction.

[0044] In this embodiment, continue to refer to Figure 3, according to the predecessor node and the successor node, traverse the instruction code block, determine the jump junk instruction and the non-jump instruction, and obtain the target address of the jump junk instruction according to the jump junk instruction and the non-jump instruction, including: according to the predecessor node and the successor node, traverse the instruction code block to determine the jump junk instruction and the non-jump instruction; according to the predecessor node of the jump junk instruction and the successor node of the previous jump junk instruction, obtain the target address of the jump junk instruction to ensure that the static analysis can find the variable of the real jump function during disassembly to avoid the failure of decompilation.

[0045] It should be noted that unicorn can be used to load and run the instruction code block to calculate the target address of the jump instruction.

[0046] In an optional embodiment, for a code block that cannot be decompiled and contains a relative jump instruction, unicorn can be used to calculate the address of the absolute jump, and the absolute jump pointing can be corrected based on the calculated address.

[0047] Step S15, correcting the corresponding function according to the recorded stack junk instructions that do not conform to the characteristics of a normal compiled program; and / or correcting the jump direction according to the target address of the jump junk instruction.

[0048] Specifically, according to the recorded stack junk instructions that do not conform to the characteristics of a normal compiler program, the corresponding function is corrected, including: according to the recorded mismatched stack creation and stack recovery, the stack creation at the head of the function stack is retained, and the stack recovery at the tail of the function stack is retained, and the remaining recorded stack creation and / or stack recovery are cleared to correct the corresponding function and remove the stack junk instructions in the function.

[0049] In addition, the jump direction is corrected according to the target address of the jump junk instruction, including: according to the target address of the jump junk instruction, the jump junk instruction is converted into a target jump instruction to correct the jump direction.

[0050] In an optional embodiment, before correcting the corresponding function based on the recorded stack junk instructions that do not conform to the characteristics of a normal compiler program; and / or correcting the jump direction based on the target address of the jump junk instruction, it also includes: executing the instruction code block to obtain the code execution path; based on the code execution path, determining the code instruction block with fork instructions that have not been executed to determine the existence of expanded junk instructions.

[0051] It should be added that the instruction code block can be dynamically executed through Unicorn to obtain the microcode execution path. In addition, by using Unicorn dynamic simulation technology, some codes can be executed in the static analysis environment to remove some unnecessary codes and then obtain the real execution code, which is convenient for static analysis.

[0052] Accordingly, when the corresponding function is corrected according to the recorded stack junk instructions that do not conform to the characteristics of a normal compiler program; and / or when the jump direction is corrected according to the target address of the jump junk instruction, it also includes: according to the code instruction block with fork instructions that has not been executed, the assembly code is deleted accordingly to remove the expanded junk instructions.

[0053] In an optional embodiment, according to the recorded stack junk instructions that do not conform to the characteristics of the normal compiler program, the corresponding function is corrected; and / or, after the jump direction is corrected according to the target address of the jump junk instruction, it includes: assembling the corrected instructions to obtain the analyzed binary code.

[0054] In summary, the embodiment of the present invention disassembles the binary program so that it is convenient to determine whether there is a stack error prompt in the disassembly to determine whether there is a stack waste instruction, and in the case of determining that there is a stack waste instruction, based on traversing the instruction code block, determine whether the stack information of the function meets the normal compiler characteristics, so as to record the stack waste instructions that do not meet the normal compiler characteristics, and facilitate the subsequent correction of the function to remove the stack waste instructions; and by determining whether there is a jump failure record, it is determined whether there is a jump waste instruction, and in the case of a jump waste instruction, based on traversing the instruction code block, determine the jump waste instruction and the non-jump instruction, so as to determine the target address of the jump waste instruction, so as to facilitate the subsequent correction of the jump pointing to remove the jump waste instruction, thereby realizing the removal of waste instructions in static analysis, more conveniently determining the execution logic of the binary code, accelerating the rate of security analysis malicious application or code detection, and facilitating the detection personnel to analyze its algorithm and its function.

[0055] The following is a description of the junk instruction removal device provided by the present invention. The junk instruction removal device described below and the junk instruction removal method described above can be referenced to each other.

[0056] Figure 4 A schematic diagram of the structure of a device for removing junk instructions is shown, the device comprising:

[0057] The disassembly module 41 disassembles the binary program to be analyzed, and identifies the predecessor node and the successor node in the disassembled assembly code to obtain an instruction code block;

[0058] A junk instruction judging module 42 is used to judge whether a stack error prompt appears in the disassembly, and whether a jump failure record appears in the disassembly, so as to determine whether there is a junk instruction;

[0059] The stack judgment module 43 determines the existence of stack waste instructions based on the stack error prompt, traverses the instruction code block according to the predecessor node and the successor node, judges whether the stack information of each function meets the normal compiler program characteristics, and records the stack waste instructions that do not meet the normal compiler program characteristics;

[0060] The address determination module 44 determines the presence of a jump instruction based on the jump failure record, traverses the instruction code block according to the predecessor node and the successor node, determines the jump instruction and the non-jump instruction, and obtains the target address of the jump instruction according to the jump instruction and the non-jump instruction;

[0061] The junk instruction correction module 45 corrects the corresponding function according to the recorded junk stack instructions that do not conform to the characteristics of the normal compiled program; and / or corrects the jump direction according to the target address of the jump junk instruction.

[0062] In this embodiment, the disassembly module 41 includes: a disassembly unit, which disassembles the binary program to be analyzed to obtain assembly code; a conversion unit, which converts the assembly code into microcode; and a storage unit, which identifies the predecessor node and the successor node in the microcode and stores them as instruction code blocks.

[0063] It should be noted that the junk instructions include at least one of stack junk instructions and jump junk instructions.

[0064] It should be noted that some malware will add stack flower instructions in the middle of binary functions, such as stack recovery and stack creation. When the stack is recovered, a judgment that is always false is added, but it is not executed during normal operation. At this time, when performing disassembly linear scanning, it is easy to use the added recovery stack as the end of the function, resulting in assembly errors. Therefore, it is necessary to determine whether a stack error prompt appears during disassembly to determine whether there are stack flower instructions.

[0065] Accordingly, the stack determination module 43 includes: an information determination unit, which determines the stack allocation and stack recovery according to the stack information of each function; and a matching determination unit, which determines whether the stack allocation and stack recovery of each function match. If they match, it meets the normal compiler characteristics.

[0066] In addition, since malware will add jump junk instructions, such as BL instructions, to complete the function jump, but its jump value must be calculated when the junk instruction is dynamically executed, it is necessary to determine whether there is a jump failure record in the disassembly to determine whether there is a jump junk instruction, so as to facilitate the subsequent static analysis to determine the target address of the jump junk instruction and convert the junk instruction into a target jump instruction for jumping.

[0067] Accordingly, the address determination module 44 includes: an instruction determination unit, which traverses the instruction code block according to the predecessor node and the successor node to determine the jump junk instruction and the non-jump instruction; an address determination unit, which obtains the target address of the jump junk instruction according to the predecessor node of the jump junk instruction and the successor node of the previous jump junk instruction, so as to ensure that the static analysis can find the variables of the real jump function during disassembly, thereby avoiding the failure of decompilation.

[0068] In an optional embodiment, the address determination module 44 is further used to: for a code block that cannot be decompiled and contains a relative jump instruction, unicorn can be used to calculate the address of the absolute jump, and the absolute jump pointing can be corrected according to the calculated address.

[0069] The junk instruction correction module 45 includes: a first correction unit, which reserves the creation stack at the head of the function stack and the recovery stack at the tail of the function stack according to the recorded mismatched creation stack and recovery stack, and clears the remaining recorded creation stack and / or recovery stack to correct the corresponding function and remove the junk stack instructions in the function.

[0070] The junk instruction correction module 45 further includes: a second correction unit, which converts the jump junk instruction into a target jump instruction according to the target address of the jump junk instruction, so as to correct the jump direction.

[0071] In an optional embodiment, the device further includes: a path determination module, which corrects the corresponding function according to the recorded stack junk instructions that do not conform to the characteristics of a normal compiled program; and / or, before correcting the jump pointing according to the target address of the jump junk instruction, executes the instruction code block to obtain the code execution path; and an expanded junk instruction determination module, which determines, according to the code execution path, a code instruction block with a fork instruction that has not been executed to determine the existence of an expanded junk instruction.

[0072] Correspondingly, the junk instruction correction module 45 further includes: a third correction unit, which deletes the assembly code accordingly according to the code instruction block having the fork instruction and not being executed, so as to remove the expanded junk instructions.

[0073] In an optional embodiment, the device includes: an assembly module, which corrects the corresponding function according to the recorded stack junk instructions that do not conform to the characteristics of the normal compiler program; and / or, after correcting the jump pointing according to the target address of the jump junk instruction, assembles the corrected instructions to obtain the analyzed binary code.

[0074] In summary, the embodiment of the present invention disassembles the binary program through the disassembly module, so that the subsequent junk instruction judgment module can judge whether a stack error prompt appears in the disassembly to determine whether there is a stack junk instruction, and when it is determined that there is a stack junk instruction, the stack judgment module is used to determine whether the stack information of the function meets the normal compiler characteristics, so as to record the stack junk instructions that do not meet the normal compiler characteristics, so that the subsequent junk instruction correction module can correct the function to remove the stack junk instructions; and by judging whether a jump failure record appears, it is determined whether there is a jump junk instruction, and when there is a jump junk instruction, the address determination module is used to determine the jump junk instruction and the non-jump instruction, so as to determine the target address of the jump junk instruction, so that the subsequent junk instruction correction module can correct the jump pointing to remove the jump junk instruction, thereby realizing the removal of junk instructions in static analysis, more conveniently determining the execution logic of the binary code, accelerating the rate of security analysis malicious application or code detection, and facilitating the detection personnel to analyze its algorithm and its function.

[0075] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor (processor) 51, a communication interface (Communications Interface) 52, a memory (memory) 53 and a communication bus 54, wherein the processor 51, the communication interface 52, and the memory 53 communicate with each other through the communication bus 54. The processor 51 can call the logic instructions in the memory 53 to execute the method for removing junk instructions, which includes: disassembling the binary program to be analyzed, and identifying the predecessor node and the successor node in the assembly code obtained by the disassembly to obtain an instruction code block; judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly to determine whether there is a junk instruction; determining that there is a stack junk instruction based on the appearance of the stack error prompt, traversing the instruction code block according to the predecessor node and the successor node, judging whether the stack information of each function meets the characteristics of a normal compiler, and recording the stack junk instructions that do not meet the characteristics of the normal compiler; determining that there is a jump junk instruction based on the appearance of the jump failure record, traversing the instruction code block according to the predecessor node and the successor node, determining jump junk instructions and non-jump instructions, and obtaining the target address of the jump junk instruction according to the jump junk instruction and the non-jump instruction; correcting the corresponding function according to the recorded stack junk instruction that does not meet the characteristics of the normal compiler; and / or correcting the jump direction according to the target address of the jump junk instruction.

[0076] In addition, the logic instructions in the above-mentioned memory 53 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0077] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the junk instruction removal method provided by the above methods, which includes: disassembling the binary program to be analyzed, and identifying the predecessor node and the successor node in the assembly code obtained by the disassembly to obtain an instruction code block; judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly to determine whether there is a junk instruction; based on the appearance of the stack error prompt, determining that there is a stack junk instruction, according to The predecessor node and the successor node traverse the instruction code block, determine whether the stack information of each function meets the normal compiler characteristics, and record the stack flower instructions that do not meet the normal compiler characteristics; based on the jump failure record, determine the existence of jump flower instructions, traverse the instruction code block according to the predecessor node and the successor node, determine jump flower instructions and non-jump instructions, and obtain the target address of the jump flower instruction according to the jump flower instructions and non-jump instructions; according to the recorded stack flower instructions that do not meet the normal compiler characteristics, correct the corresponding function; and / or correct the jump direction according to the target address of the jump flower instruction.

[0078] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the junk instruction removal method provided by the above-mentioned methods, the method comprising: disassembling the binary program to be analyzed, and identifying the predecessor node and the successor node in the assembly code obtained by the disassembly to obtain an instruction code block; judging whether a stack error prompt appears in the disassembly, and judging whether a jump failure record appears in the disassembly to determine whether there is a junk instruction; determining that there is a stack junk instruction based on the appearance of the stack error prompt, and traversing the predecessor node and the successor node according to the predecessor node and the successor node. The method comprises the following steps: traversing the instruction code block to determine whether the stack information of each function meets the normal compiler characteristics, and recording the stack flower instructions that do not meet the normal compiler characteristics; determining the existence of jump flower instructions based on the jump failure record, traversing the instruction code block according to the predecessor node and the successor node, determining jump flower instructions and non-jump instructions, and obtaining the target address of the jump flower instruction according to the jump flower instructions and non-jump instructions; correcting the corresponding function according to the recorded stack flower instructions that do not meet the normal compiler characteristics; and / or correcting the jump direction according to the target address of the jump flower instruction.

[0079] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0080] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for removing junk instructions, characterized in that: include: Disassemble the binary program to be analyzed, and identify the predecessor node and the successor node in the disassembled assembly code to obtain the instruction code block; Determine whether there is a stack error prompt in the disassembly, and whether there is a jump failure record in the disassembly to determine whether there are junk instructions; Based on the stack error prompt, determine that there are stack waste instructions, traverse the instruction code block according to the predecessor node and the successor node, determine whether the stack information of each function meets the normal compiler program characteristics, and record the stack waste instructions that do not meet the normal compiler program characteristics; Based on the occurrence of the jump failure record, it is determined that there is a jump garbled instruction, according to the predecessor node and the successor node, the instruction code block is traversed to determine the jump garbled instruction and the non-jump instruction, and according to the jump garbled instruction and the non-jump instruction, the target address of the jump garbled instruction is obtained; According to the recorded stack junk instructions that do not conform to the characteristics of the normal compiled program, the corresponding function is corrected; and / or, the jump direction is corrected according to the target address of the jump junk instruction; in, According to the predecessor node and the successor node, the instruction code block is traversed to determine a jump instruction and a non-jump instruction, and according to the jump instruction and the non-jump instruction, a target address of the jump instruction is obtained, including: According to the predecessor node and the successor node, the instruction code block is traversed to determine the jump instructions and non-jump instructions. Obtaining a target address of the jump instruction according to a predecessor node of the jump instruction and a successor node of the previous jump instruction; Correcting the jump direction according to the target address of the jump instruction includes: According to the target address of the jump instruction, the jump instruction is converted into a target jump instruction to correct the jump direction; Before correcting the corresponding function according to the recorded stack junk instruction that does not conform to the characteristics of the normal compiler program; and / or correcting the jump direction according to the target address of the jump junk instruction, the method further includes: Execute the instruction code block to obtain the code execution path, According to the code execution path, determining a code instruction block having a fork instruction and not being executed; When the corresponding function is corrected according to the recorded stack junk instruction that does not conform to the characteristics of the normal compiler program; and / or the jump direction is corrected according to the target address of the jump junk instruction, it also includes: According to the code instruction block having the fork instruction and not being executed, the assembly code is deleted accordingly; and The binary program to be analyzed is disassembled, and the predecessor node and the successor node in the assembly code obtained by the disassembly are identified to obtain the instruction code block, including: Disassemble the binary program to be analyzed to obtain the assembly code. Convert the assembly code to microcode, Predecessor nodes and successor nodes in the microcode are identified and stored as instruction code blocks.

2. The method for removing junk instructions according to claim 1, characterized in that: Determine whether the stack information of each function meets the normal compiler program characteristics, including: According to the stack information of each function, determine the stack to be opened and the stack to be recovered; Determine whether the stack allocation and stack recovery of each function match. If they match, it meets the normal compiler characteristics.

3. The method for removing junk instructions according to claim 2, characterized in that: The stack waste instructions that do not conform to the characteristics of the normal compiler include mismatched stack creation and stack recovery, and the corresponding function is corrected according to the recorded stack waste instructions that do not conform to the characteristics of the normal compiler, including: According to the mismatched development stack and recovery stack, the development stack of the function stack head is retained, and the recovery stack of the function stack tail is retained, and the remaining recorded development stacks and / or recovery stacks are cleared to modify the corresponding function and remove the stack waste instructions in the function.

4. A device for removing a waste instruction, characterized in that: include: The disassembly module disassembles the binary program to be analyzed, identifies the predecessor node and the successor node in the disassembled assembly code, and obtains the instruction code block; A junk instruction judgment module is used to judge whether a stack error prompt appears in the disassembly, and whether a jump failure record appears in the disassembly, so as to determine whether there is a junk instruction; A stack judgment module, based on the stack error prompt, determines the existence of stack waste instructions, traverses the instruction code block according to the predecessor node and the successor node, judges whether the stack information of each function meets the normal compiler program characteristics, and records the stack waste instructions that do not meet the normal compiler program characteristics; An address determination module, based on the occurrence of a jump failure record, determines that there is a jump garbled instruction, traverses the instruction code block according to the predecessor node and the successor node, determines the jump garbled instruction and the non-jump instruction, and obtains the target address of the jump garbled instruction according to the jump garbled instruction and the non-jump instruction; A junk instruction correction module, which corrects the corresponding function according to the recorded junk stack instructions that do not conform to the characteristics of the normal compiled program; and / or corrects the jump direction according to the target address of the jump junk instruction; in, According to the predecessor node and the successor node, the instruction code block is traversed to determine a jump instruction and a non-jump instruction, and according to the jump instruction and the non-jump instruction, a target address of the jump instruction is obtained, including: According to the predecessor node and the successor node, the instruction code block is traversed to determine the jump instructions and non-jump instructions. Obtaining a target address of the jump instruction according to a predecessor node of the jump instruction and a successor node of the previous jump instruction; Correcting the jump direction according to the target address of the jump instruction includes: According to the target address of the jump instruction, the jump instruction is converted into a target jump instruction to correct the jump direction; Before correcting the corresponding function according to the recorded stack junk instruction that does not conform to the characteristics of the normal compiler program; and / or correcting the jump direction according to the target address of the jump junk instruction, the method further includes: Execute the instruction code block to obtain the code execution path, According to the code execution path, determining a code instruction block having a fork instruction and not being executed; When the corresponding function is corrected according to the recorded stack junk instruction that does not conform to the characteristics of the normal compiler program; and / or the jump direction is corrected according to the target address of the jump junk instruction, it also includes: According to the code instruction block having the fork instruction and not being executed, the assembly code is deleted accordingly; and The binary program to be analyzed is disassembled, and the predecessor node and the successor node in the assembly code obtained by the disassembly are identified to obtain the instruction code block, including: Disassemble the binary program to be analyzed to obtain the assembly code. Convert the assembly code to microcode, Predecessor nodes and successor nodes in the microcode are identified and stored as instruction code blocks.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the junk instruction removal method according to any one of claims 1 to 3 are implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the junk instruction removal method according to any one of claims 1 to 3 are implemented.

Images