Code reverse analysis method, system, electronic device, medium and product

Abstract

The embodiment of the present invention provides a code reverse analysis method, system, electronic device, medium and product, the method comprising: the analysis system can first obtain the target code fragment to be analyzed in the executable code. Then retrieve the related code fragment associated with the target code fragment, wherein the related code fragment may include a first code fragment similar to the target code fragment and with known functions, and / or a second code fragment in the executable code that has a calling relationship with the target code fragment. Finally, the above-mentioned target code fragment and the related code fragment are input into a large model, so that the large model outputs the reverse analysis result of the target code fragment. In the above method, the retrieved related code fragment can be used as auxiliary information to help the large model understand the target code fragment, so that the large model can understand the target code fragment more accurately and output a reverse analysis result with higher readability.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a code reverse analysis method, system, electronic equipment, medium and product. Background Art

[0002] Software reverse analysis refers to the use of tools to decompile compiled software codes, that is, to decompile binary codes with specific functions into assembly codes, and to disassemble and analyze the structure, process, algorithm, etc. of the obtained assembly codes. Users can understand the internal working principles of software codes with the help of the analysis results output by the tools.

[0003] However, in practice, the analysis results obtained through reverse engineering often have the disadvantage of poor readability. Therefore, how to ensure the readability of the analysis results has become a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a code reverse analysis method, system, electronic device, medium and product to ensure the readability of the code reverse analysis result.

[0005] In a first aspect, an embodiment of the present invention provides a code reverse analysis method, comprising:

[0006] Obtain the target code fragment to be analyzed in the executable code;

[0007] Retrieving related code snippets associated with the target code snippet, the related code snippets comprising a first code snippet and / or a second code snippet, the similarity between the first code snippet and the target code snippet meeting a requirement, the second code snippet comprising a code snippet in the executable code having a calling relationship with the target code snippet, and the first code snippet having a function identifier;

[0008] The target code fragment and the related code fragment are input into a large model, so that the large model outputs a reverse analysis result of the target code fragment.

[0009] In a second aspect, an embodiment of the present invention provides a code reverse analysis system, including: a retrieval module and a large model;

[0010] The retrieval module is used to obtain a target code segment to be analyzed in the executable code; retrieve related code segments associated with the target code segment, wherein the related code segments include a first code segment and / or a second code segment, wherein the similarity between the first code segment and the target code segment meets the requirement, the second code segment includes a code segment in the executable code that has a calling relationship with the target code segment, and the first code segment has a function identifier;

[0011] The large model is used to output the reverse analysis result of the target code fragment according to the input target code fragment and the related code fragment.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor and a memory, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the code reverse analysis method described in the first aspect. The electronic device may also include a communication interface for communicating with other devices or communication networks.

[0013] In a fourth aspect, an embodiment of the present invention provides a non-temporary machine-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor can at least implement the code reverse analysis method as described in the first aspect.

[0014] In a fifth aspect, an embodiment of the present invention provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, the processor can implement the code reverse analysis method as described in the first aspect above.

[0015] In the code reverse analysis method provided by the embodiment of the present invention, the analysis system can first obtain the target code fragment to be analyzed in the executable code. Then, the related code fragment associated with the target code fragment is retrieved, wherein the related code fragment may include a first code fragment similar to the target code fragment and having a function identifier, and / or a second code fragment in the executable code that has a calling relationship with the target code fragment, and the function of the first code fragment is described by the function identifier of the fragment. Finally, the above-mentioned target code fragment and the related code fragment are input into the large model, so that the large model outputs the reverse analysis result of the target code fragment.

[0016] In the above method, since the function of the first code snippet retrieved by the system is known, the first code snippet can be used as auxiliary information to help the large model understand the function of the target code snippet. At the same time, the retrieved second code snippet can be used as context information of the target code snippet to assist the large model in understanding the target code snippet. In summary, the retrieval of related code snippets can enable the large model to understand the target code snippet more accurately, thereby outputting reverse analysis results with higher readability and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A flowchart of a code reverse analysis method provided by an embodiment of the present invention;

[0019] Figure 2 A schematic diagram of an operation interface provided by a code analysis system provided by an embodiment of the present invention;

[0020] Figure 3 A flowchart of a method for retrieving related code snippets provided by an embodiment of the present invention;

[0021] Figure 4 A schematic diagram of the structure of a code reverse analysis system provided by an embodiment of the present invention;

[0022] Figure 5 A schematic diagram of the structure of another code reverse analysis system provided by an embodiment of the present invention;

[0023] Figure 6 A flowchart of another code reverse analysis method provided by an embodiment of the present invention;

[0024] Figure 7 A schematic diagram of the structure of another code reverse analysis system provided by an embodiment of the present invention;

[0025] Figure 8 A schematic diagram of the structure of a code reverse analysis device provided by an embodiment of the present invention;

[0026] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0029] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0030] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to identifying", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is identified" may be interpreted as "when determining" or "in response to determining" or "when identifying (stated condition or event)" or "in response to identifying (stated condition or event)", depending on the context.

[0031] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0032] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0033] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the case where there is no conflict between the embodiments, the following embodiments and the features in the embodiments can be combined with each other. In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0034] Figure 1The flowchart of a code reverse analysis method provided by an embodiment of the present invention. The method provided by an embodiment of the present invention can be executed by an analysis system. Figure 1 As shown, the method may include the following steps:

[0035] S101, obtaining a target code segment to be analyzed in an executable code.

[0036] In scenarios such as software security and malicious code analysis, there is a need for software reverse analysis. To meet this need, executable code can be obtained first. Optionally, the executable code can be a binary code or other types of code formed after compilation.

[0037] After the executable code is obtained, the target code segment that needs to be reverse analyzed can be further selected. Optionally, the target code segment can be any segment in the executable code, and the target code segment can be all or part of the statements in the executable code that implement a specific function. Optionally, the analysis system can provide Figure 2 The operation interface shown in the figure may include a first display area for displaying executable code and a second display area for displaying reverse analysis results. The user may select a target code segment in the first display area. After selecting the target code segment, the user may also use the function button in the toolbar on the operation interface to start the analysis of the target code segment, or may also use the menu bar that pops up after the interactive device such as the mouse and keyboard responds to the interactive operation to start the analysis of the target code segment. Optionally, the menu bar may be displayed in a floating manner on the first display area.

[0038] S102, retrieving related code snippets associated with the target code snippet, the related code snippets include a first code snippet and / or a second code snippet, the similarity between the first code snippet and the target code snippet meets the requirement, the second code snippet includes a code snippet in the executable code that has a calling relationship with the target code snippet, and the first code snippet has a function identifier.

[0039] S103, inputting the target code fragment and the related code fragments into the large model, so that the large model outputs the reverse analysis result of the target code fragment.

[0040] Then, the analysis system can further retrieve related code snippets associated with the target code snippet. The related code snippets may include a first code snippet that is similar to the target code snippet and meets the requirements, and / or a second code snippet in the executable code that has a calling relationship with the target code snippet. The first code has a function identifier, that is, the function of the first code snippet is known. The calling relationship between the second code snippet and the target code snippet can reflect the interaction mode between the target code snippet and the second code snippet. The specific retrieval process of the related code snippets can refer to the description in the following related embodiments.

[0041] It can be seen that the retrieved related code snippets can describe the functions of the target code snippets from different perspectives. Therefore, the related code snippets can also be used as auxiliary analysis information.

[0042] Finally, the target code snippet to be analyzed and the related code snippet as auxiliary analysis information can be input into the big model together, so that the big model can reverse analyze the target code snippet based on the auxiliary analysis information, and finally output the reverse analysis result of the target code snippet. The reverse analysis of the target code snippet by the big model can include generating comment text for the target code snippet, modifying the function signature in the target code snippet, renaming the local variables in the target code snippet, etc.

[0043] Among them, the relevant code snippets as auxiliary analysis information are also prompts for inputting the big model. Since the big model used in the embodiments of the present invention has a powerful generation capability, in order to enable the big model to better understand what it is going to output, that is, to better guide the big model to generate output that meets the requirements, optionally, based on the auxiliary analysis information, the prompt information for inputting the big model can also include a requirement description text. In the code reverse analysis scenarios of the embodiments of the present invention, the requirement description text can be: "You are a code analysis engineer and you need to reverse analyze the following code first."

[0044] In this embodiment, the analysis system may first obtain the target code fragment to be analyzed in the executable code. Then, the related code fragment associated with the target code fragment is retrieved, wherein the related code fragment may include a first code fragment similar to the target code fragment and having a function identifier, and / or a second code fragment in the executable code having a calling relationship with the target code fragment, and the function of the first code fragment is described by the function identifier of the fragment. Finally, the above target code fragment and the related code fragment are input into the large model, so that the large model outputs the reverse analysis result of the target code fragment.

[0045] In the above method, since the function of the first code snippet retrieved by the system is known, the first code snippet can be used as auxiliary information to help the large model understand the function of the target code snippet. At the same time, the retrieved second code snippet can be used as context information of the target code snippet to assist the large model in understanding the target code snippet. In summary, the retrieval of related code snippets can enable the large model to understand the target code snippet more accurately, thereby outputting reverse analysis results with higher readability and accuracy.

[0046] Before inputting the target code snippet and the related code snippet into the large model, in order to ensure the normal output of the large model, it is optionally possible to first determine whether the total length of the data input into the large model exceeds the preset length upper limit corresponding to the large model. If it exceeds the preset length upper limit, the target code snippet and / or the related code snippet can also be reduced in length according to the preset length upper limit, and the reduction result is finally input into the large model.

[0047] A reduction method: Without changing the function of the code snippet, the code snippet can be reduced in length using a deep learning model. This reduction method can be applied to the target code snippet and / or related code snippets. Optionally, this reduction processing method can usually be applied to related code snippets, and of course can also be applied to the target code snippet. Another reduction method: the first code snippet and / or the second code snippet in the related code snippet can be directly deleted.

[0048] In this embodiment, the reduction process can satisfy the reduction result required by the large model input, thereby ensuring that the large model can normally output the reverse analysis result of the target code fragment.

[0049] In practice, for any code snippet that needs to be analyzed, the analysis system can Figure 1 In the embodiment shown, the code snippet is retrieved as a keyword so that the large model can perform code reverse analysis based on the retrieved content. The code snippet as a keyword and the retrieved related code snippets associated with the code snippet can also form a code snippet group.

[0050] It is easy to understand that within a historical period, the large model can analyze at least one historical code snippet, and then at least one code snippet group can be obtained, and this at least one group of code snippets can also constitute the historical search results within the historical period. Optionally, any code snippet group in the historical search results can also be stored in the form of a key-value pair. Among them, the code snippet can be used as a key, and the related code snippets associated with the code snippet can be used as a value. Optionally, the historical search results can also be stored in the cache of the analysis system.

[0051] In addition, considering that the cache capacity of the analysis system is limited, when the cache is full, optionally, a preset algorithm can be used to clear the code snippet group to release the space in the cache. Optionally, the LFU (Least Frequently Used) algorithm can be used to release the least frequently used code snippet group snippet in the cache; the LRU (Least Recently Used) algorithm can also be used to release the least recently used code snippet group snippet in the cache.

[0052] Based on the above introduction to historical search results, an embodiment of the present invention can provide an optional related code snippet retrieval method, the overall idea of ​​which can be: after obtaining the target code snippet, you can first search in the historical search results cached locally in the analysis system. If the related code snippet associated with the target code snippet is retrieved in the cache, the related code snippet associated with the target code snippet is directly obtained from the cache. If it is not retrieved in the cache, then start the real-time retrieval of the related code snippet.

[0053] In the above method, the caching of historical search results can improve the retrieval efficiency of code-related code snippets, and can also further improve the analysis efficiency of target code snippets.

[0054] The specific implementation process of the above overall idea can be introduced in detail below.

[0055] Figure 3 A flowchart of a method for retrieving relevant code snippets provided by an embodiment of the present invention, that is, Figure 1 An optional implementation of step S102 in the embodiment shown. Figure 3 As shown, the method may include the following steps:

[0056] S201, determine whether the target code snippet is included in the historical search results, if so, execute step S202, otherwise execute steps S203 to S204.

[0057] S202: Acquire relevant code snippets associated with the target code snippet from the code snippet group including the target code snippet.

[0058] S203: Determine a first code snippet in an offline first code library, where the code snippet in the first code library has a function identifier.

[0059] S204: According to the calling relationship between different functions in the executable code, determine a code fragment in the executable code that has a calling relationship with the target code fragment as a second code fragment.

[0060] The analysis system can search the historical search results to see whether the target code snippet is included. For at least one code snippet group stored in the form of a key-value pair, more specifically, the analysis system can search the historical search results to see whether the target code snippet is used as a key.

[0061] If the target code snippet as a key exists in the historical search results, indicating that the target code snippet has been reverse analyzed in the historical period, and there are related code snippets associated with it in the historical search results, then the real-time search process can be omitted, and the related code snippets associated with the target code snippet can be directly read from the cache. If the target code snippet as a key does not exist in the historical search results, indicating that the target code snippet has not been reverse analyzed, then the analysis system can further perform real-time search to retrieve the first code snippet and the second code snippet in the related code snippets respectively.

[0062] As for the retrieval of the first code snippet, in an optional manner, the analysis system can use the similarity between code snippets to retrieve a code snippet that meets the similarity requirements in the first code library pre-created locally in the system as the first code snippet. The retrieved first code snippet is usually the code snippet in the first code library that has the highest similarity with the target code snippet. The code snippets in the first code library have functional identifiers, that is, the functions of the code snippets in the first code library are known. The first code library can store common algorithms in different fields, such as hash algorithms, compression algorithms, encryption algorithms, etc. And the first code library is essentially an offline code library.

[0063] In order to improve the accuracy of the retrieval of the first code snippet, in another optional manner, the analysis system may convert the code snippet into a vector, so as to retrieve the first code snippet by utilizing the similarity between the vectors.

[0064] Specifically, the analysis system can input the executable code into the reverse analysis tool deployed in the system, so that the reverse analysis tool can output the assembly code fragment corresponding to the target code fragment. Then, the assembly code fragment is vector-encoded using the coding model deployed in the analysis system to obtain a first vector. And the coding model can also vector-encode the code fragment in the first code library to obtain a second vector. By calculating the similarity between the first vector and the second vector, the code fragment corresponding to the second vector whose similarity meets the requirements is determined as the first code fragment. Generally speaking, the code fragment corresponding to the second vector corresponding to the highest similarity is determined as the first code fragment.

[0065] Optionally, the vectors of different code snippets in the first code library and the first vector corresponding to the target code snippet can also be stored in a vector database in the analysis system. Optionally, the similarity between vectors can be measured by cosine similarity, Euclidean distance, or Manhattan distance.

[0066] For the retrieval of the second code snippet, optionally, the analysis system may determine the code snippet in the executable code that has a calling relationship with the target code snippet as the second code snippet based on the calling relationship between different functions in the executable code. Optionally, the executable code is input into a reverse analysis tool so that the reverse analysis tool outputs the calling relationship between different functions in the executable code. Optionally, the reverse analysis tool may be IDA Pro, Ghidra, etc. The calling relationship output by the reverse analysis tool may also be stored in a graph database.

[0067] In this embodiment, in the process of real-time retrieval of relevant code snippets, the first code snippet can be retrieved from the first code library storing code snippets with known functions by the similarity between codes or vectors. At the same time, the second code snippet can be directly retrieved from the executable code by using the call relationship output by the reverse analysis tool.

[0068] Optionally, the reverse analysis results output by the large model can also be updated to the reverse analysis tool in the system, and this analysis result can also assist the subsequent analysis process of the reverse analysis tool. Optionally, the reverse analysis results output by the large model and the reverse analysis tool can be displayed in the interface provided by the analysis system.

[0069] Based on the code reverse analysis methods provided in the above embodiments, the above code reverse analysis process can also be described from a system perspective.

[0070] Figure 4 A schematic diagram of the structure of a code reverse analysis system provided by an embodiment of the present invention. Figure 4 As shown, the system includes: a retrieval module and a large model.

[0071] Wherein, for the target code fragment to be analyzed in the executable code input into the analysis system, the retrieval module can further retrieve the related code fragment associated with the target code fragment. Wherein, the related code fragment includes a first code fragment similar to the target code fragment, and / or a second code fragment in the executable code having a calling relationship with the target code fragment, and the first code fragment has a function identifier. The above-mentioned target code fragment and the related code fragment as auxiliary analysis information can be input into the big model to obtain the reverse analysis result of the target code fragment of the big model.

[0072] In this embodiment, for the target code fragment to be analyzed, the retrieval module in the system can retrieve the first code fragment and / or the second code fragment associated with the target code fragment, that is, the related code fragment. Finally, the above-mentioned target code fragment and the retrieved related code fragment are input into the big model, so that the big model outputs the reverse analysis result of the target code fragment.

[0073] In the above method, since the function of the first code snippet retrieved is known, the first code snippet can be used as auxiliary information to help the large model understand the function of the target code snippet. At the same time, the second code snippet retrieved can be used as context information of the target code snippet to assist the large model in understanding the target code snippet. In summary, the retrieval of related code snippets can enable the large model to understand the target code snippet more accurately, thereby outputting reverse analysis results with higher readability and accuracy.

[0074] Figure 5 A schematic diagram of another code reverse analysis system provided by an embodiment of the present invention. Figure 5 As shown, in Figure 4 Based on the system shown, the system includes: a cache module.

[0075] The cache module can cache historical search results. For an explanation of the historical search results, please refer to the relevant description in the above embodiment, and will not be repeated in this step.

[0076] In this embodiment, the use of the cache module can improve the retrieval efficiency of related code snippets.

[0077] Optionally, the system may further include: a reverse analysis tool and an offline first code library. When the relevant code fragment associated with the target code fragment is not retrieved in the cache, the reverse analysis tool and the first code library may be used in combination to achieve real-time retrieval of the relevant code fragment.

[0078] Specifically, after obtaining the target code snippet, the retrieval module in the analysis system can first search in the cache module whether the target code snippet is included. If the target code snippet as a key exists in the cache, the related code snippet associated with the target code snippet can be directly read from the cache. If the target code snippet as a key does not exist in the historical retrieval results, the analysis system can perform a real-time retrieval to obtain the first code snippet and the second code snippet in the related code snippets respectively.

[0079] For the retrieval of the first code snippet, the analysis system may optionally use the similarity between the code snippets to retrieve a code snippet that meets the similarity requirement from a first code library pre-created locally in the system as the first code snippet. The first code library stores code snippets with function identifiers.

[0080] Regarding the retrieval of the second code snippet, optionally, the analysis system may determine a code snippet in the executable code that has a calling relationship with the target code snippet as the second code snippet based on the calling relationship between different functions in the executable code output by the reverse analysis tool.

[0081] For details not described in detail in the above code segment retrieval process, please refer to Figure 3 The relevant description in the illustrated embodiment will not be repeated here.

[0082] In this embodiment, the reverse analysis tool in the analysis system and the offline first code library can be used to realize real-time retrieval of relevant code snippets.

[0083] As Figure 3 As described in the illustrated embodiment, optionally, in order to improve the accuracy of real-time retrieval of the first code snippet, the code snippet may be encoded into a vector, and the first code snippet may be retrieved according to the similarity between the vectors. Optionally, the reverse analysis system may also include an encoding model and a vector database.

[0084] The reverse analysis tool may analyze the executable code to output an assembly code fragment corresponding to the target code fragment. The encoding model may vector encode the assembly code fragment to obtain a first vector. The encoding model may also vector encode the code fragment in the first code library to obtain a second vector. The first vector and the second vector may be stored in a vector database.

[0085] When the target code snippet is not included in the historical search results, the search module can determine the code snippet corresponding to the second vector that meets the similarity requirement as the first code snippet by calculating the similarity between the first vector and the second vector.

[0086] In this embodiment, the coding model in the analysis system is used to vectorize the code snippet, and then the first code snippet is retrieved more accurately through the similarity between vectors.

[0087] It should be noted that the code reverse analysis system provided by the embodiment of the present invention may include Figure 5 All components in the system may also include some of the components, such as a retrieval module, a cache module, and a large model; for example, a retrieval module, a cache module, a reverse analysis tool, an offline first code library, and a large model, etc. And because "retrieve relevant code snippets from the cache module" and "retrieve relevant code snippets from the call relationship and vector database in real time" are two parallel solutions, the retrieval module is executed one by one, so in Figure 5 Indicated by dotted line.

[0088] Using the above Figure 1~Figure 3The first code snippet retrieved by the method provided by the illustrated embodiment may have a high similarity with the first part of the statement in the target code snippet, and the second code snippet retrieved may also have a calling relationship with the second part of the statement in the target code snippet. Among them, the first code snippet can be considered as the auxiliary analysis information corresponding to the first part of the statement, and the function identifier of the first code snippet can make it easier for the large model to understand the function of the first part of the statement. Similarly, the second code snippet can be considered as the auxiliary analysis information corresponding to the second part of the statement, and the second code snippet as the context of the second part of the statement can make it easier for the large model to understand the function of the second part of the statement. It is easy to understand that there may be a remaining part of the statement in the target code snippet after the above retrieval. At this time, the remaining part of the statement can also be analyzed to obtain the auxiliary analysis information corresponding to the remaining part of the statement.

[0089] The following can be used Figure 6 The method of the illustrated embodiment obtains auxiliary analysis information corresponding to the first part of statements, the second part of statements and the remaining part of statements in the target code fragment, respectively, thereby finally achieving the reverse analysis result of the target code fragment.

[0090] Figure 6 Flow chart of another code reverse analysis method provided by an embodiment of the present invention. Figure 3 As shown, the method may include the following steps:

[0091] S301, obtaining a target code segment to be analyzed in the executable code.

[0092] S302, retrieving related code snippets associated with the target code snippet, the related code snippets include a first code snippet and / or a second code snippet, the similarity between the first code snippet and the target code snippet meets the requirement, the second code snippet includes a code snippet in the executable code that has a calling relationship with the target code snippet, and the first code snippet has a function identifier.

[0093] The specific implementation of steps S301 to S302 can be found in Figure 1 or Figure 3 The relevant descriptions in the illustrated embodiment are not repeated in this step.

[0094] S303, performing an annotation on the magic number and / or the system interaction statement in the target code segment to obtain a target code segment with an annotation result, wherein the system interaction statement describes the interaction between the executable code and the operating system running the executable code.

[0095] After step S302, the corresponding auxiliary analysis information has been retrieved for the first part of statements and the second part of statements in the target code snippet. At this time, the analysis system can further identify the magic number and / or system interaction statement in the target code snippet, and mark the identified magic number and / or system interaction statement in the target code snippet. The identified magic number and / or system interaction statement is usually the remaining part of the statement in the target code snippet.

[0096] As for the identification of magic numbers and / or system interaction statements, similar to the retrieval of related code snippets, you can also first search from the historical retrieval results in the cache. If the historical retrieval results contain the target code snippet as a key, the analysis system can directly obtain the target code snippet with the annotation results from the historical retrieval results. If the historical retrieval results do not contain the target code snippet as a key, the analysis system can use an online search method, that is, call the online second code library to identify the system interaction statements and / or magic numbers in the target code snippet to obtain the target code snippet with the annotation results. Among them, it should also be noted that with Figure 1 and Figure 3 Different from the embodiment shown, in this embodiment, the historical search results include not only code snippet groups stored in the form of key-value pairs, but also the code snippet used as a key in the code snippet group may have annotation results.

[0097] Specifically, some common magic numbers, common system call statements, and standard library call statements can be stored in the online second code library. The analysis system can call this second code library, calculate the similarity between the target code snippet and the statements in the second code library, and use the similarity to identify which statements in the target code snippet are magic numbers, which statements are system call statements, and which statements are standard library call statements, thereby finally completing the labeling of the target code snippet.

[0098] S304, inputting the target code snippet with the annotation result and the related code snippet into the big model, so that the big model outputs the reverse analysis result of the target code snippet.

[0099] Finally, the target code fragment with the annotation result and the related code fragment as auxiliary analysis information are input into the big model, so that the big model outputs the reverse analysis result of the target code fragment.

[0100] In this embodiment, the analysis system can first retrieve the target code snippet with the annotation results and the related code snippet associated with the code snippet from the cache, thereby improving the retrieval speed of the auxiliary analysis information. If it is not retrieved in the cache, the target code snippet with the annotation results can be further obtained by online retrieval; and the related code snippet can be obtained by offline retrieval. Through retrieval, the large model can better understand the function of the target code snippet, thereby outputting the reverse analysis results with higher readability and accuracy.

[0101] In addition, for the contents not described in detail in this embodiment and the technical effects that can be achieved, please refer to the relevant descriptions in the above embodiments, and will not be repeated here.

[0102] for Figure 6 The method embodiment shown below can also describe the above code reverse analysis process from a system perspective. Figure 7 A schematic diagram of the structure of another code reverse analysis system provided by an embodiment of the present invention. Figure 7 As shown, in Figure 5 Based on the illustrated embodiment, the retrieval module in the system may specifically include a first retrieval submodule and a second retrieval submodule.

[0103] The first search submodule can search for related code snippets associated with the target code snippet, and send a call instruction to the second search submodule in response to the search for the related code snippet. The second search submodule can identify the magic number and / or system interaction statement in the target code snippet in response to the call instruction to obtain the target code snippet with the annotation result.

[0104] and Figure 6 Corresponding to the embodiment shown, the historical search results in this embodiment, on the basis of including a code snippet group stored in the form of key-value pairs, the code snippet used as the key in the code snippet group still has a marked result. Therefore, the first retrieval submodule can specifically first retrieve from the historical search results whether there is a target code snippet used as the key. If there is a target code snippet used as the key, the target code snippet with the marked result can be obtained from the historical retrieval results. If there is no target code snippet used as the key, the first retrieval submodule can use the offline first code library to retrieve the relevant code snippets in real time, and can also use the online second code library to identify the system interaction statements and / or magic numbers in the target code snippet, and mark the system interaction statements and / or magic numbers in the target code snippet according to the recognition results.

[0105] Finally, the large model can use the relevant code snippets as auxiliary analysis information and the annotation results of the target code snippets to perform reverse analysis on the target code snippets to output the reverse analysis results.

[0106] In this embodiment, in addition to the relevant code snippets, the annotation results of the target code snippets can also be included as auxiliary analysis information of the large model. The combination of the two can enable the large model to better understand the function of the target code snippet, thereby outputting reverse analysis results with higher readability and accuracy. In addition, the contents not described in detail in this embodiment and the technical effects that can be achieved can all be referred to the relevant descriptions in the above method embodiments, and will not be repeated here.

[0107] It should be noted that the code reverse analysis system provided by the embodiment of the present invention may include Figure 7 In addition, since "retrieve relevant code snippets and target code snippets with annotation results from the cache module" and "retrieve relevant code snippets and target code snippets with annotation results from the first code library and the second code library in real time" are two parallel solutions, the retrieval module is executed one by one. Therefore, in Figure 7 Indicated by dotted line.

[0108] The following will describe in detail the code reverse analysis device of one or more embodiments of the present invention. Those skilled in the art will appreciate that the device can be configured using commercially available hardware components through the steps taught in this solution.

[0109] Figure 8 A schematic diagram of the structure of a code reverse analysis device provided by an embodiment of the present invention is shown in FIG. Figure 8 As shown, the device comprises:

[0110] The acquisition module 11 is used to acquire the target code segment to be analyzed in the executable code.

[0111] The first retrieval module 12 is used to retrieve related code snippets associated with the target code snippet, the related code snippets include a first code snippet and / or a second code snippet, the similarity between the first code snippet and the target code snippet meets the requirements, the second code snippet includes a code snippet in the executable code that has a calling relationship with the target code snippet, and the first code snippet has a function identifier.

[0112] The input module 13 is used to input the target code fragment and the related code fragment into the large model, so that the large model outputs the reverse analysis result of the target code fragment.

[0113] Optionally, the apparatus further comprises: a marking module 14, configured to mark the magic number and / or the system interaction statement in the target code segment to obtain the target code segment with the marking result, wherein the system interaction statement describes the interaction between the executable code and the operating system running the executable code;

[0114] The input module 13 is used to input the target code snippet with the annotation result and the related code snippet into the large model.

[0115] Optionally, the first retrieval module 12 is used to determine whether the target code snippet is included in the historical retrieval results, the historical retrieval results comprising at least one code snippet group, the code snippet group comprising a historical code snippet and a code snippet associated with the historical code snippet;

[0116] If the target code snippet is included in the historical search results, the related code snippet associated with the target code snippet is obtained from the code snippet group including the target code snippet.

[0117] Optionally, the first retrieval module 12 is configured to determine the first code snippet in an offline first code library if the historical retrieval result does not include the target code snippet, the code snippet in the first code library having a function identifier;

[0118] According to the calling relationship between different functions in the executable code, a code fragment in the executable code that has a calling relationship with the target code fragment is determined as the second code fragment.

[0119] Optionally, the device further comprises: an analysis module 15, configured to input the executable code into a reverse analysis tool, so that the reverse analysis tool outputs an assembly code fragment corresponding to the target code fragment.

[0120] The first retrieval module 12 is used to perform vector encoding on the assembly code snippet to obtain a first vector; perform vector encoding on the code snippet in the first code library to obtain a second vector; and determine the first code snippet according to the similarity between the first vector and the second vector.

[0121] Optionally, the analysis module 12 is used to input the executable code into a reverse analysis tool, so that the reverse analysis tool outputs an assembly code fragment corresponding to the target code fragment.

[0122] Optionally, the historical code snippets in the historical search results have annotation results.

[0123] The device further comprises a second retrieval module 16, which is configured to obtain the target code segment with the annotated result from the historical retrieval result if the target code segment is included in the historical retrieval result.

[0124] Optionally, the second retrieval module 16 is used to identify the system interaction statement in the target code snippet according to the online second code library if the historical retrieval result does not include the target code snippet; and mark the target code snippet according to the identification result.

[0125] Optionally, the device further includes a data reduction module 17, which is used to reduce the length of the relevant code fragment and / or the target code fragment with the annotation result if the total length of the relevant code fragment and the target code fragment with the annotation result exceeds a preset length upper limit.

[0126] The input module 13 is used to input the reduction processing result into the large model.

[0127] Figure 8 The device shown can perform Figure 1~Figure 3 and Figure 6 For the method of the embodiment shown in the figure, the part not described in detail in this embodiment can be referred to Figure 1~Figure 3 and Figure 6 The implementation process and technical effects of this technical solution refer to Figure 1~Figure 3 and Figure 6 The description in the illustrated embodiment will not be repeated here.

[0128] In a possible design, the code reverse analysis method provided in the above embodiments can be applied in an electronic device, such as Fig. 9 As shown, the electronic device may include: a processor 21 and a memory 22. The memory 22 is used to store information that supports the electronic device to execute the above Figure 1~Figure 3 and Figure 6 The program of the code reverse analysis method provided in the illustrated embodiment, the processor 21 is configured to execute the program stored in the memory 22 .

[0129] The program includes one or more computer instructions, wherein the one or more computer instructions can implement the following steps when executed by the processor 21:

[0130] Obtain the target code fragment to be analyzed in the executable code;

[0131] Retrieving related code snippets associated with the target code snippet, the related code snippets comprising a first code snippet and / or a second code snippet, the similarity between the first code snippet and the target code snippet meeting a requirement, the second code snippet comprising a code snippet in the executable code having a calling relationship with the target code snippet, and the first code snippet having a function identifier;

[0132] The target code fragment and the related code fragment are input into a large model, so that the large model outputs a reverse analysis result of the target code fragment.

[0133] Optionally, the processor 21 is further configured to execute the aforementioned Figure 1~Figure 3 and Figure 6 All or part of the steps in the illustrated embodiments.

[0134] The structure of the electronic device may further include a communication interface 23 for the electronic device to communicate with other devices or a communication network.

[0135] In addition, an embodiment of the present invention provides a non-transitory machine-readable storage medium for storing computer software instructions used by the above electronic device, which includes instructions for executing the above Figure 1~Figure 3 and Figure 6 The code shown reverses the program involved.

[0136] In addition, an embodiment of the present invention provides a computer program product. The computer program product includes a computer program or an instruction. When the computer program or the instruction is executed by a processor, the processor is enabled to implement the above Figure 1~Figure 3 and Figure 6 The steps or functions of the code reverse analysis method shown.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A code reverse analysis method, characterized in that: include: Obtain the target code fragment to be analyzed in the executable code; Retrieving a related code snippet associated with the target code snippet, wherein the related code snippet includes a second code snippet, and the second code snippet includes a code snippet in the executable code that has a calling relationship with the target code snippet; Annotating system interaction statements in the target code fragment, wherein the system interaction statements describe the interaction between the executable code and an operating system running the executable code; The target code fragment annotated with the system interaction statement and the related code fragment are input into the big model, so that the big model outputs the reverse analysis result of the target code fragment.

2. The method according to claim 1, characterized in that: The method further comprises: Marking the magic number in the target code snippet; inputting the target code snippet marked with the system interaction statement and the related code snippet into the big model, including: The target code snippet annotated with magic numbers and system interaction statements, and the related code snippet are input into the large model.

3. The method according to claim 2, characterized in that The retrieving a code snippet associated with the target code snippet comprises: Determining whether the target code snippet is included in the historical search results, wherein the historical search results include at least one code snippet group, and the code snippet group includes a historical code snippet and a code snippet associated with the historical code snippet; If the target code snippet is included in the historical search results, the related code snippet associated with the target code snippet is obtained from the code snippet group including the target code snippet.

4. The method according to claim 3, characterized in that: The related code snippet further includes a first code snippet, and the similarity between the first code snippet and the target code snippet meets the requirement; the method further includes: If the target code snippet is not included in the historical search result, determining the first code snippet in an offline first code library, where the code snippet in the first code library has a function identifier; According to the calling relationship between different functions in the executable code, a code fragment in the executable code that has a calling relationship with the target code fragment is determined as the second code fragment.

5. The method according to claim 4, characterized in that The method further comprises: Inputting the executable code into a reverse analysis tool so that the reverse analysis tool outputs an assembly code fragment corresponding to the target code fragment; The determining the first code snippet in an offline first code library includes: Performing vector encoding on the assembly code fragment to obtain a first vector; Performing vector encoding on the code fragments in the first code library to obtain a second vector; The first code segment is determined according to the similarity between the first vector and the second vector.

6. The method according to claim 4, characterized in that The method further comprises: The executable code is input into a reverse analysis tool, so that the reverse analysis tool outputs the calling relationship between different functions in the executable code.

7. The method according to claim 3, characterized in that The historical code snippets in the historical search results are annotated with system interaction statements and magic numbers; the method further includes: If the target code snippet is included in the historical search results, the target code snippet annotated with the system interaction statement and the magic number is obtained from the historical search results.

8. The method according to claim 7, characterized in that The method further comprises: If the target code snippet is not included in the historical search results, identifying the system interaction statement and the magic number in the target code snippet according to the online second code library; The target code fragment is marked according to the recognition result.

9. The method according to claim 2, characterized in that: The method further comprises: If the total length of the relevant code snippet and the target code snippet marked with the system interaction statement and the magic number exceeds a preset length upper limit, the relevant code snippet and / or the target code snippet are subjected to length reduction processing; The step of inputting the target code snippet annotated with the magic number and the system interaction statement and the related code snippet into the large model comprises: The results of the reduction process are input into the large model.

10. A code reverse analysis system, characterized in that: include: Retrieval modules and large models; The retrieval module is used to obtain the target code fragment to be analyzed in the executable code; Retrieving a related code snippet associated with the target code snippet, the related code snippet comprising a second code snippet, the second code snippet comprising a code snippet in the executable code having a calling relationship with the target code snippet; marking a system interaction statement in the target code snippet, the system interaction statement describing the interaction between the executable code and an operating system running the executable code; The large model is used to output the reverse analysis result of the target code fragment according to the target code fragment annotated with the system interaction statement and the related code fragment.

11. The system according to claim 10, characterized in that The retrieval module includes a first retrieval submodule and a second retrieval submodule: The first retrieval submodule is used to retrieve the related code snippet associated with the target code snippet; in response to the retrieval of the related code snippet, send a call instruction to the second retrieval submodule; The second retrieval submodule is used to annotate the magic number and the system interaction statement in the target code fragment in response to the call instruction; The large model is used to take the relevant code snippets and the target code snippets annotated with system interaction statements and magic numbers as input, and output the reverse analysis results.

12. The system according to claim 11, characterized in that The system further comprises: a cache module, configured to cache historical search results, wherein the historical search results include at least one code snippet group, wherein the code snippet group includes historical code snippets and code snippets associated with the historical code snippets; The first retrieval submodule is used to read the cache history results from the cache module; if the historical retrieval results include the target code snippet, then obtain the related code snippet associated with the target code snippet from the code snippet group including the target code snippet.

13. The system according to claim 12, characterized in that The related code fragments also include a first code fragment, the similarity between the first code fragment and the target code fragment meets the requirement, and the first code fragment has a function identifier; the system also includes: a reverse analysis tool, a coding model, an offline first code library and a vector database; The first code library is used to store code snippets with function identifiers; The reverse analysis tool is used to analyze the executable code to output an assembly code fragment corresponding to the target code fragment; The encoding model is used to perform vector encoding on the assembly code fragment to obtain a first vector; and perform vector encoding on the code fragment in the first code library to obtain a second vector; The vector database is used to store the first vector and the second vector; The first search submodule is configured to determine the first code snippet in the first code library according to the similarity between the first vector and the second vector if the target code snippet is not included in the historical search results.

14. The system according to claim 13, characterized in that The reverse analysis tool is used to analyze the executable code to output the calling relationship between different functions in the executable code; The first retrieval submodule is used to determine a code fragment in the executable code that has a calling relationship with the target code fragment as the second code fragment based on the calling relationship between different functions in the executable code if the target code fragment is not included in the historical retrieval results.

15. The system according to claim 12, characterized in that The historical code snippets cached in the cache module are annotated with system interaction statements and magic numbers; The first search submodule is used to obtain the target code snippet annotated with the system interaction statement and the magic number from the historical search results if the target code snippet is included in the historical search results.

16. The system according to claim 15, characterized in that The second retrieval submodule is used to identify the system interaction statement and the magic number in the target code snippet according to the online second code library if the historical retrieval result does not include the target code snippet; and mark the target code snippet according to the identification result.

17. An electronic device, characterized in that: include: A memory and a processor; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the code reverse analysis method as described in any one of claims 1 to 9.

18. A non-transitory machine-readable storage medium, characterized in that: The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor executes the code reverse analysis method as described in any one of claims 1 to 9.

19. A computer program product, characterized in that The computer program product includes a computer program or instructions, so that the computer program or instructions can implement the steps in the code reverse analysis method according to any one of claims 1 to 9.

Images