A method and system for automatically identifying binary software distribution structure

Abstract

The present invention discloses a method and system for automatically identifying a binary software distribution structure, and belongs to the field of binary software identification and detection technology. In the method, based on the control flow and data flow structure features contained in the distribution structure, the code area that matches the distribution structure control flow feature is first identified by the distribution structure control flow feature matching technology; then the distribution structure data flow constraint checking technology is used to check whether the code area meets the distribution structure data flow feature. If it is determined to meet, the code area can be determined as a distribution structure, and finally the distribution structure metadata extraction technology is used to extract the metadata information of the distribution structure and automatically dump it into a disk file. Based on the analysis results, security analysts can automatically obtain the key information such as the distribution point program location, distribution message code program variables, etc. of the distribution structure contained in the target binary program.

Description

Technical Field

[0001] The present invention belongs to the technical field of binary software identification and detection, and in particular relates to a method and system for automatically identifying a binary software distribution structure. Background Art

[0002] A distribution structure is a program structure used to perform calculations on all messages contained in a message sequence according to their specific categories. From the perspective of the control flow graph, this structure is generally manifested as a loop structure with a main body of multi-branch distribution processing. Each time the loop iterates, the corresponding branch is selected for processing and calculation according to the message code corresponding to the current message. This structure is commonly found in software systems such as network service programs, compilers, and interpreters that contain event loops.

[0003] Static analysis of binary programs and identification of the distribution structures therein can help security analysts strengthen their understanding of the software and provide support for technical research such as intelligent software vulnerability discovery, analysis, exploitation, and patching.

[0004] Binary program analysis is a research hotspot in the field of information security. Current analysis methods can be divided into two categories: control flow analysis and data flow analysis. Control flow analysis focuses on analyzing the control flow structure within a binary program. Current analysis methods can identify each function contained in a binary program, the loop structure contained in the function, and can calculate the basic block composition within each function, the transfer relationship between basic blocks, and the calling relationship between functions. Data flow analysis aims to calculate the corresponding data constants for each program variable at each program point within the function. Arrival constant analysis is a typical data flow analysis method at present.

[0005] Although control flow analysis and data flow analysis techniques have been widely used in the field of binary program security analysis, there is currently a lack of effective analysis methods for the distribution structures contained in binary programs, making it difficult to automatically identify the distribution structures contained in binary programs and extract the structural information. Summary of the invention

[0006] In view of the above problems, the present invention proposes a binary software distribution structure automatic identification scheme. In this scheme, based on the control flow and data flow structure features contained in the distribution structure, the distribution structure control flow feature matching technology is first used to identify the code area that matches the distribution structure control flow feature; then the distribution structure data flow constraint checking technology is used to check whether these code areas meet the distribution structure data flow features. If it is determined that they can be satisfied, these code areas can be determined as distribution structures, and finally the distribution structure metadata extraction technology is used to automatically dump the metadata information of the distribution structure into a disk file. Based on the analysis results, security analysts can automatically obtain key information such as the distribution point program location, distribution message code program variables, etc. of the distribution structure contained in the target binary program.

[0007] The first aspect of the present invention discloses a method for automatically identifying a binary software distribution structure. Given a target binary program to be analyzed, the method comprises:

[0008] Calling the distribution structure control flow feature matching component to perform static analysis on the target binary program and identify the code area that matches the distribution structure control flow feature;

[0009] Calling the distribution structure data flow constraint checking component to check whether the identified code region meets the distribution structure data flow characteristics, and if so, determining the code region as a distribution structure;

[0010] Calling a distribution structure dump component to extract metadata information from the distribution structure;

[0011] Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics;

[0012] The control flow features include:

[0013] The distribution structure is a loop structure;

[0014] The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz;

[0015] The data flow characteristics include:

[0016] There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

[0017] According to the method of the first aspect of the present invention, the distribution structure control flow feature matching component is called, and the specific execution is: taking the execution image of the target binary program as input, using the loop analysis technology to identify the loop structure contained in the target binary program, performing static analysis on each loop structure, and further screening to obtain the sequential branch sequence existing in the target binary program.

[0018] According to the method of the first aspect of the present invention, each loop structure is statically analyzed, and the sequential branch sequence existing in the target binary program is further screened, specifically including:

[0019] For the loop structure, firstly, the topological sorting sequence of all basic blocks in the loop structure is obtained, and the first node of the topological sorting sequence is added to the work queue and analyzed; wherein, a sequential branch sequence accumulated on the program path from the loop head node to the basic block is associated with each basic block, and for the entry node, the sequential branch sequence of its corresponding entry position is set to empty, and all the calculated sequential branch sequences are collected in the predSeqs list;

[0020] After obtaining the basic block node node stored in the head element of the work queue and the sequential branch sequence cur_predSeq corresponding to its entry position, the run_on_node function is called to analyze the basic block node node, accumulate the newly discovered sequential branch sequences into the predSeqs list, and accumulate the subsequent basic blocks and the corresponding sequential branch sequences into the work queue node_queue for scheduling calculation in the loop iteration; wherein, when the work queue is empty, the loop iteration terminates, and the calculated sequential branch queue is returned from the predSeqs list;

[0021] Mark the current basic block node node as analyzed, call the check_eqPredicate procedure to analyze the last assembly instruction contained in the basic block node node, and check whether the last assembly instruction is a conditional jump instruction in the form of jz or jnz;

[0022] If so, set the is_eq_pred flag to True;

[0023] Otherwise, set the is_eq_pred flag to False;

[0024] The eq_branch and neq_branch variables are used to store the branch addresses corresponding to the equal and not equal cases respectively, the cmp_addr is used to store the virtual address corresponding to the previous cmp or test instruction of the conditional jump instruction, and the pred_operand and constant variables are used to record the program variables and constant information involved in the comparison operation respectively;

[0025] Get the flag status of is_eq_pred;

[0026] When is_eq_pred is False, the last instruction of the current basic block node node is not the corresponding conditional jump instruction;

[0027] End the sequential branch sequence of the entry position of the current basic block node node, and accumulate the sequential branch sequence into the predSeqs list; at the same time, for each successor basic block succ of the current basic block node node, the sequential branch sequence of the entry position of the current basic block node node is no longer inherited, and the sequential branch sequence of the entry position corresponding to succ is set to empty;

[0028] When is_eq_pred is True, the last instruction of the current basic block node node is the corresponding conditional jump instruction;

[0029] In the case of equality, the corresponding successor basic block will no longer perform the message code query matching operation, and the sequential branch sequence corresponding to the successor basic block succ is set to empty;

[0030] At the same time, since there is a query and matching operation on the message code after the corresponding successor basic block in the unequal case, the current basic block branch related information is added after the sequential branch sequence pred_seq corresponding to the current basic block node node.

[0031] Call the run_on_node function to get the sequential branch sequence corresponding to the successor basic block of the basic block node node, add it to the work queue, schedule it for execution in the loop iteration, and complete the automatic recognition of all distribution structures in the loop structure.

[0032] According to the method of the first aspect of the present invention, the distribution structure data flow constraint checking component is called to specifically perform:

[0033] Analyze a given sequential branch sequence to check whether the variable operands corresponding to each branch node in the sequential branch sequence point to the same memory unit; if so, determine that the loop in which the sequential branch sequence is located is a distribution structure; specifically, including:

[0034] Calculate the arrival values ​​of all program variables at each program position in the loop structure where the sequential branch sequence is located;

[0035] From the first i A specific branch node Start by tracing back the variable operands corresponding to the branch node along the fixed value linked list. When the variable value outside the loop structure is traced back, or the variable value of the highest basic block in the topological sorting of all nodes in the loop structure is reached, the tracing process is terminated and the variable value is used as The variable operand corresponding to the program point The root value of

[0036] After calculating the root values ​​of the variable operands corresponding to the program points of each branch node in the sequential branch sequence, check whether the root values ​​are the same; if they are the same, the loop where the given sequential branch sequence is located is determined to be a distribution structure; otherwise, it is a non-distribution structure.

[0037] According to the method of the first aspect of the present invention, the distribution structure dump component is called to specifically perform:

[0038] The metadata information of the distribution structure includes: the start and end addresses of the function where the distribution structure is located, the virtual address of the first operation code comparison position of the distribution structure, and the operand type, size, and all values ​​of the message code stored at the virtual address;

[0039] The metadata information other than all values ​​of the message code is obtained directly from the distribution structure; all values ​​of the message code are collected by integrating the comparison constants corresponding to each branch position in the sequential branch sequence contained in the distribution structure; and dumped to the disk file in the form of a Lua script.

[0040] The second aspect of the present invention discloses a binary software distribution structure automatic identification system, the system comprising: a distribution structure control flow feature matching component, a distribution structure data flow constraint checking component, and a distribution structure dumping component; wherein, given a target binary program to be analyzed:

[0041] The distribution structure control flow feature matching component is configured to: perform static analysis on the target binary program to identify code regions therein that match the distribution structure control flow features;

[0042] The distribution structure data flow constraint checking component is configured to: check whether the identified code region satisfies the distribution structure data flow feature, and if so, determine the code region as a distribution structure;

[0043] The distribution structure dump component is configured to: extract metadata information from the distribution structure;

[0044] Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics;

[0045] The control flow features include:

[0046] The distribution structure is a loop structure;

[0047] The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz;

[0048] The data flow characteristics include:

[0049] There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

[0050] The third aspect of the present invention discloses an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for automatically identifying a binary software distribution structure described in the first aspect of the present disclosure is implemented.

[0051] The fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for automatically identifying a binary software distribution structure described in the first aspect of the present disclosure is implemented.

[0052] In summary, the technical solution proposed in the present invention calculates all the distribution structures contained in a given binary program and dumps the description information of the structure to a disk file. This solution can be combined with static binary analysis, dynamic fuzz testing and other technologies to further assist security analysts in understanding and reverse analyzing the functions of binary programs and enhance the capabilities of automated vulnerability mining, analysis and utilization tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 is a flowchart of a method for automatically identifying a binary software distribution structure according to an embodiment of the present invention;

[0055] Figure 2 It is a schematic diagram of a prototype system for automatically identifying the binary software distribution structure according to an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] The first aspect of the present invention discloses a method for automatically identifying a binary software distribution structure. Given a target binary program to be analyzed, the method comprises:

[0058] Calling the distribution structure control flow feature matching component to perform static analysis on the target binary program and identify the code area that matches the distribution structure control flow feature;

[0059] Calling the distribution structure data flow constraint checking component to check whether the identified code region meets the distribution structure data flow characteristics, and if so, determining the code region as a distribution structure;

[0060] Calling a distribution structure dump component to extract metadata information from the distribution structure;

[0061] Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics;

[0062] The control flow features include:

[0063] The distribution structure is a loop structure;

[0064] The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz;

[0065] The data flow characteristics include:

[0066] There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

[0067] In some embodiments, the distribution structure has the following key features:

[0068] (1) The distribution structure is a circular structure;

[0069] (2) The dispatch structure contains a sequence of basic blocks that are executed sequentially. The basic blocks in the sequence can be executed sequentially, and the tail instruction must be a conditional jump instruction in the form of jz or jnz. For example: That is, a basic block sequence that satisfies this condition. Such a basic block sequence is a sequential branch sequence;

[0070] (3) There is at least one sequential branch sequence , n Indicates the number of basic blocks in the branch sequence. The jump conditions of the jump instructions in the form of jz / jnz at the end of all basic blocks inside it depend on two operands: one is a constant and the other is a program variable at a specific program location. The program variable is the message code of the distribution structure.

[0071] Define features (1) and (2) as control flow features of the distribution structure, and define feature (3) as the data flow feature of the distribution structure.

[0072] Based on the above analysis, the method flow of the first aspect of the present invention is as follows Figure 1 The method respectively calls the distribution structure control flow feature matching, distribution structure data flow constraint checking, and distribution structure dumping components; optionally, a message code sequence-sensitive fuzzy test component can also be called later.

[0073] Given a target binary program to be analyzed, the distribution structure control flow feature matching component first statically analyzes the binary program to identify the code regions that match the distribution structure control flow features; the distribution structure data flow constraint checking component then further analyzes these identified code regions to check whether these code regions meet the distribution structure data flow features. If it is determined that they can be met, these code regions can be determined as distribution structures; the distribution structure dump component then extracts metadata information from the distribution structure.

[0074] According to the method of the first aspect of the present invention, the distribution structure control flow feature matching component is called, and the specific execution is: taking the execution image of the target binary program as input, using the loop analysis technology to identify the loop structure contained in the target binary program, performing static analysis on each loop structure, and further screening to obtain the sequential branch sequence existing in the target binary program.

[0075] According to the method of the first aspect of the present invention, each loop structure is statically analyzed, and the sequential branch sequence existing in the target binary program is further screened, specifically including:

[0076] For the loop structure, firstly, the topological sorting sequence of all basic blocks in the loop structure is obtained, and the first node of the topological sorting sequence is added to the work queue and analyzed; wherein, a sequential branch sequence accumulated on the program path from the loop head node to the basic block is associated with each basic block, and for the entry node, the sequential branch sequence of its corresponding entry position is set to empty, and all the calculated sequential branch sequences are collected in the predSeqs list;

[0077] After obtaining the basic block node node stored in the head element of the work queue and the sequential branch sequence cur_predSeq corresponding to its entry position, the run_on_node function is called to analyze the basic block node node, accumulate the newly discovered sequential branch sequences into the predSeqs list, and accumulate the subsequent basic blocks and the corresponding sequential branch sequences into the work queue node_queue for scheduling calculation in the loop iteration; wherein, when the work queue is empty, the loop iteration terminates, and the calculated sequential branch queue is returned from the predSeqs list;

[0078] Mark the current basic block node node as analyzed, call the check_eqPredicate procedure to analyze the last assembly instruction contained in the basic block node node, and check whether the last assembly instruction is a conditional jump instruction in the form of jz or jnz;

[0079] If so, set the is_eq_pred flag to True;

[0080] Otherwise, set the is_eq_pred flag to False;

[0081] The eq_branch and neq_branch variables are used to store the branch addresses corresponding to the equal and not equal cases respectively, the cmp_addr is used to store the virtual address corresponding to the previous cmp or test instruction of the conditional jump instruction, and the pred_operand and constant variables are used to record the program variables and constant information involved in the comparison operation respectively;

[0082] Get the flag status of is_eq_pred;

[0083] When is_eq_pred is False, the last instruction of the current basic block node node is not the corresponding conditional jump instruction;

[0084] End the sequential branch sequence of the entry position of the current basic block node node, and accumulate the sequential branch sequence into the predSeqs list; at the same time, for each successor basic block succ of the current basic block node node, the sequential branch sequence of the entry position of the current basic block node node is no longer inherited, and the sequential branch sequence of the entry position corresponding to succ is set to empty;

[0085] When is_eq_pred is True, the last instruction of the current basic block node node is the corresponding conditional jump instruction;

[0086] In the case of equality, the corresponding successor basic block will no longer perform the message code query matching operation, and the sequential branch sequence corresponding to the successor basic block succ is set to empty;

[0087] At the same time, since there is a query and matching operation on the message code after the corresponding successor basic block in the unequal case, the current basic block branch related information is added after the sequential branch sequence pred_seq corresponding to the current basic block node node.

[0088] Call the run_on_node function to get the sequential branch sequence corresponding to the successor basic block of the basic block node node, add it to the work queue, schedule it for execution in the loop iteration, and complete the automatic recognition of all distribution structures in the loop structure.

[0089] In some embodiments, the distribution structure control flow feature matching component focuses on identifying code regions that meet the distribution structure control flow features. The component takes a given binary program execution image as input, first applies existing loop analysis technology, and identifies loop structures contained in the target program. Then, each such loop structure is analyzed using the following algorithm proposed in this application, and further screens out the sequential branch sequence existing in the target program.

[0090]

[0091] For a given loop structure, the dispatcher_recognize_cfg algorithm first calculates the topological sorting sequence of all basic blocks in the loop structure (line 1), and then adds the first node of the topological sequence (which is also the head node of the loop structure) to the work queue for analysis (line 3). In the specific calculation process, the analysis algorithm associates a sequential branch sequence accumulated on the program path from the head node of the loop to the basic block for each basic block. For the entry node, the corresponding entry position sequential branch sequence is set to empty (line 4). The algorithm collects all the calculated sequential branch sequences in the predSeqs list (line 5).

[0092] After completing the above initialization, the algorithm starts the analysis in the working set mode (lines 6-11). After obtaining the basic block node stored in the head element of the working queue and the sequential branch sequence cur_predSeq corresponding to the entry position of the basic block (line 7), the algorithm calls the run_on_node function to further analyze the basic block, accumulates the new sequential branch sequences found into the predSeqs list (line 8), and then accumulates the subsequent basic blocks and corresponding sequential branch sequences that need to be further analyzed into the working queue node_queue (lines 9-11). This information will be scheduled and calculated in the subsequent loop iterations of the algorithm. When the working queue is empty, the loop iteration terminates, and the algorithm returns the calculated sequential branch queue from the predSeqs list.

[0093] The run_on_node procedure first marks the currently analyzed basic block node node as "analyzed" (line 16), and then calls the check_eqPredicate procedure to analyze the last assembly instruction contained in the basic block node to check whether the instruction is a conditional jump instruction in the form of jz or jnz. When it is determined that the last instruction is a corresponding conditional jump instruction, the is_eq_pred flag is set to True, and the eq_branch and neq_branch variables are used to store the branch addresses corresponding to the "equal" and "not equal" situations, respectively, and the cmp_addr is used to store the virtual address corresponding to the previous cmp or test instruction of the conditional jump instruction. The pred_operand and constant variables are used to record the program variables and constant information involved in the comparison operation; otherwise, is_eq_pred is set to False (lines 17-18). The calculation process then performs the following calculations based on the value status of is_eq_pred:

[0094] (1) When is_eq_pred is False, that is, the last instruction of the current basic block is not the corresponding conditional jump instruction. This means that the sequential branch sequence at the entry position of the current basic block has ended, so the sequential branch sequence is accumulated into the predSeqs list (lines 20-21); at the same time, for each successor basic block succ of the current basic block node, it is obvious that succ will no longer inherit the sequential branch sequence at the entry position of node, so the entry position sequential branch sequence corresponding to succ is set to empty (lines 23-24);

[0095] (2) When is_eq_pred is True, the last instruction of the current basic block is the corresponding conditional jump instruction. At this time, the message code query and matching operation will no longer be performed in the subsequent basic block corresponding to the "equal" situation, so the sequential branch sequence corresponding to the subsequent basic block is set to empty (line 26). At the same time, since there may be a query and matching operation for the message code after the subsequent basic block corresponding to the "not equal" situation, the branch-related information of this basic block is added after the sequential branch sequence pred_seq corresponding to the current basic block (lines 27-29).

[0096] After the above calculation, run_on_node obtains the sequential branch sequence corresponding to the successor basic block of basic block node. This information will be added to the work queue by the dispatcher_recognizer_cfg algorithm, and will be scheduled for execution in subsequent loop iterations, and finally complete the automatic recognition of all dispatch structures in the loop structure.

[0097] According to the method of the first aspect of the present invention, the distribution structure data flow constraint checking component is called to specifically perform:

[0098] Analyze a given sequential branch sequence to check whether the variable operands corresponding to each branch node in the sequential branch sequence point to the same memory unit; if so, determine that the loop in which the sequential branch sequence is located is a distribution structure; specifically, including:

[0099] Calculate the arrival values ​​of all program variables at each program position in the loop structure where the sequential branch sequence is located;

[0100] From the first i A specific branch node Start by tracing back the variable operands corresponding to the branch node along the fixed value linked list. When the variable value outside the loop structure is traced back, or the variable value of the highest basic block in the topological sorting of all nodes in the loop structure is reached, the tracing process is terminated and the variable value is used as The variable operand corresponding to the program point The root value of

[0101] After calculating the root values ​​of the variable operands corresponding to the program points of each branch node in the sequential branch sequence, check whether the root values ​​are the same; if they are the same, the loop where the given sequential branch sequence is located is determined to be a distribution structure; otherwise, it is a non-distribution structure.

[0102] In some embodiments, the distribution structure data flow constraint checking component analyzes a given sequential branch sequence to check whether the variable operands corresponding to each branch node in the sequence point to the same memory unit. If it is determined that they point to the same memory unit, it can be determined that the loop in which the sequential branch sequence is located is a distribution structure.

[0103] The core of the distributed structure data flow constraint check is to calculate the root source of the fixed value of each non-constant operand of each branch node. To achieve this calculation goal, the distributed structure data flow constraint check proposes a root fixed value acquisition method based on the arrival fixed value technology. The specific calculation process is as follows:

[0104] (1) Calculate the arrival values ​​of all program variables at each program position in the loop structure where the sequential branch sequence is located. This step is implemented based on the existing arrival value technology;

[0105] (2) From a specific branch node within a sequential branching sequence Start by tracing back along the constant value linked list to the variable operand corresponding to the branch node. When the variable value outside the loop structure is traced, or the variable value of the highest basic block in the topological sorting of all nodes in the loop is reached, the tracing process is terminated and the variable value is used as Program point The root value corresponding to the variable.

[0106] After calculating the root values ​​corresponding to the variable operands at each branch program point in the sequential branch sequence, the dispatch structure data flow constraint checking component checks whether these root values ​​are the same. Only when these variables are determined to be the same, the loop where the given sequential branch sequence is located is determined to be a dispatch structure. Otherwise, the target loop is determined to be a non-dispatching structure.

[0107] According to the method of the first aspect of the present invention, the distribution structure dump component is called to specifically perform:

[0108] The metadata information of the distribution structure includes: the start and end addresses of the function where the distribution structure is located, the virtual address of the first operation code comparison position of the distribution structure, and the operand type, size, and all values ​​of the message code stored at the virtual address;

[0109] The metadata information other than all values ​​of the message code is obtained directly from the distribution structure; all values ​​of the message code are collected by integrating the comparison constants corresponding to each branch position in the sequential branch sequence contained in the distribution structure; and dumped to the disk file in the form of a Lua script.

[0110] In some embodiments, the distribution structure metadata extraction component is intended to extract data information that can characterize the distribution structure and dump the information to a disk file.

[0111] The information that can describe the distribution structure includes the start and end addresses of the function where the distribution structure is located, the virtual address of the first opcode comparison position of the distribution structure, and the operand type, size, and all possible values ​​of the message code stored at this address. In addition to all possible values ​​of the message code, other information can be directly obtained from the distribution structure. For all possible values ​​of the message code, the distribution structure metadata extraction component collects this part of information by integrating the comparison constants corresponding to each branch position in the sequential branch sequence contained in the distribution structure. This information is then dumped to a disk file in the form of a Lua script.

[0112] Prototype system example

[0113] Based on the technical solutions discussed above, a prototype system (an automatic identification system for binary software distribution structure) was designed and implemented based on the binary program analysis platform angr. Figure 2 The system first relies on the built-in control flow analysis function of angr to calculate the relevant information of each function contained in the target binary program, and then passes this information to the distribution structure identification component.

[0114] The distribution structure recognition component is essentially implemented in the form of a function-level analysis module. It includes three key functions: distribution structure control flow feature matching, distribution structure data flow constraint checking, and distribution structure metadata extraction. During the analysis of a single function, the distribution structure recognition component will automatically extract the distribution structure existing in a given function and dump the description information of the structure to a disk file in the form of a Lua script.

[0115] Experimental Examples

[0116] To verify the system's ability to automatically identify binary program distribution structures, we compiled the following program into a binary program for experimental analysis. It can be seen that the while loop in the program contains a switch-type distribution structure, in which the idx variable is used to store the message code and different branches are scheduled for execution according to the message code. The sample program is as follows:

[0117]

[0118]

[0119] The program is compiled into an ELF executable program bin under the 32-bit i386 architecture on a 64-bit Ubuntu-16.04 operating system. The built analysis system is started to analyze the program, and the output lua result file content is as follows:

[0120]

[0121] It can be seen that the analysis engine calculated that there is a distribution structure in the function at the address 0x901 of the bin module loading address. The first message code comparison instruction of the distribution structure is offset by 0x945 bytes from the bin module loading base address. The EAX register is used to store the message code at this instruction. The possible values ​​of the message code include 1, 2, and 0.

[0122] The second aspect of the present invention discloses a binary software distribution structure automatic identification system, the system comprising: a distribution structure control flow feature matching component, a distribution structure data flow constraint checking component, and a distribution structure dumping component; wherein, given a target binary program to be analyzed:

[0123] The distribution structure control flow feature matching component is configured to: perform static analysis on the target binary program to identify code regions therein that match the distribution structure control flow features;

[0124] The distribution structure data flow constraint checking component is configured to: check whether the identified code region satisfies the distribution structure data flow feature, and if so, determine the code region as a distribution structure;

[0125] The distribution structure dump component is configured to: extract metadata information from the distribution structure;

[0126] Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics;

[0127] The control flow features include:

[0128] The distribution structure is a loop structure;

[0129] The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz;

[0130] The data flow characteristics include:

[0131] There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

[0132] The third aspect of the present invention discloses an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for automatically identifying a binary software distribution structure described in the first aspect of the present disclosure is implemented.

[0133] The fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for automatically identifying a binary software distribution structure described in the first aspect of the present disclosure is implemented.

[0134] In summary, the technical solution proposed in the present invention calculates all the distribution structures contained in a given binary program and dumps the description information of the structure to a disk file. This solution can be combined with static binary analysis, dynamic fuzz testing and other technologies to further assist security analysts in understanding and reverse analyzing the functions of binary programs and enhance the capabilities of automated vulnerability mining, analysis and utilization tools.

[0135] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several variations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A method for automatically identifying binary software distribution structure, characterized in that: Given a target binary program to be analyzed, the method comprises: Calling the distribution structure control flow feature matching component to perform static analysis on the target binary program and identify the code area that matches the distribution structure control flow feature; Calling the distribution structure data flow constraint checking component to check whether the identified code region meets the distribution structure data flow characteristics, and if so, determining the code region as a distribution structure; Calling a distribution structure dump component to extract metadata information from the distribution structure; Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics; The control flow features include: The distribution structure is a loop structure; The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz; The data flow characteristics include: There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

2. A method for automatically identifying binary software distribution structure according to claim 1, characterized in that: The distribution structure control flow feature matching component is called and specifically executed as follows: the execution image of the target binary program is used as input, loop analysis technology is used to identify loop structures contained in the target binary program, each loop structure is statically analyzed, and the sequential branch sequence existing in the target binary program is further screened.

3. A method for automatically identifying binary software distribution structure according to claim 2, characterized in that: Perform static analysis on each loop structure and further screen out the sequential branch sequences existing in the target binary program, including: For the loop structure, firstly, the topological sorting sequence of all basic blocks in the loop structure is obtained, and the first node of the topological sorting sequence is added to the work queue and analyzed; wherein, a sequential branch sequence accumulated on the program path from the loop head node to the basic block is associated with each basic block, and for the entry node, the sequential branch sequence of its corresponding entry position is set to empty, and all the calculated sequential branch sequences are collected in the predSeqs list; After obtaining the basic block node node stored in the head element of the work queue and the sequential branch sequence cur_predSeq corresponding to its entry position, the run_on_node function is called to analyze the basic block node node, accumulate the newly discovered sequential branch sequences into the predSeqs list, and accumulate the subsequent basic blocks and the corresponding sequential branch sequences into the work queue node_queue for scheduling calculation in the loop iteration; wherein, when the work queue is empty, the loop iteration terminates, and the calculated sequential branch queue is returned from the predSeqs list; Mark the current basic block node node as analyzed, call the check_eqPredicate procedure to analyze the last assembly instruction contained in the basic block node node, and check whether the last assembly instruction is a conditional jump instruction in the form of jz or jnz; If so, set the is_eq_pred flag to True; Otherwise, set the is_eq_pred flag to False; The eq_branch and neq_branch variables are used to store the branch addresses corresponding to the equal and not equal cases respectively, the cmp_addr is used to store the virtual address corresponding to the previous cmp or test instruction of the conditional jump instruction, and the pred_operand and constant variables are used to record the program variables and constant information involved in the comparison operation respectively; Get the flag status of is_eq_pred; When is_eq_pred is False, the last instruction of the current basic block node node is not the corresponding conditional jump instruction; End the sequential branch sequence of the entry position of the current basic block node node, and accumulate the sequential branch sequence into the predSeqs list; at the same time, for each successor basic block succ of the current basic block node node, the sequential branch sequence of the entry position of the current basic block node node is no longer inherited, and the sequential branch sequence of the entry position corresponding to succ is set to empty; When is_eq_pred is True, the last instruction of the current basic block node node is the corresponding conditional jump instruction; In the case of equality, the corresponding successor basic block will no longer perform the message code query matching operation, and the sequential branch sequence corresponding to the successor basic block succ is set to empty; At the same time, since there is a query and matching operation on the message code after the corresponding successor basic block in the case of inequality, the current basic block branch related information is added after the sequential branch sequence pred_seq corresponding to the current basic block node node; Call the run_on_node function to get the sequential branch sequence corresponding to the successor basic block of the basic block node node, add it to the work queue, schedule it for execution in the loop iteration, and complete the automatic recognition of all distribution structures in the loop structure.

4. A method for automatically identifying binary software distribution structure according to claim 3, characterized in that: Call the distribution structure data flow constraint check component and perform the following operations: Analyze a given sequential branch sequence to check whether the variable operands corresponding to each branch node in the sequential branch sequence point to the same memory unit; if so, determine that the loop in which the sequential branch sequence is located is a distribution structure; specifically, including: Calculate the arrival values ​​of all program variables at each program position in the loop structure where the sequential branch sequence is located; From the first i A specific branch node Start by tracing back the variable operands corresponding to the branch node along the fixed value linked list When the variable value outside the loop structure is traced back, or the variable value of the highest basic block in the topological sorting of all nodes in the loop structure is reached, the tracing process is terminated and the variable value is used as The variable operand corresponding to the program point The root value of After calculating the root values ​​of the variable operands corresponding to the program points of each branch node in the sequential branch sequence, check whether the root values ​​are the same; if they are the same, the loop where the given sequential branch sequence is located is determined to be a distribution structure; otherwise, it is a non-distribution structure.

5. A method for automatically identifying binary software distribution structure according to claim 4, characterized in that: Call the distribution structure dump component and execute: The metadata information of the distribution structure includes: the start and end addresses of the function where the distribution structure is located, the virtual address of the first operation code comparison position of the distribution structure, and the operand type, size, and all values ​​of the message code stored at the virtual address; The metadata information other than all values ​​of the message code is obtained directly from the distribution structure; all values ​​of the message code are collected by integrating the comparison constants corresponding to each branch position in the sequential branch sequence contained in the distribution structure; and dumped to the disk file in the form of a Lua script.

6. A binary software distribution structure automatic identification system, characterized in that: The system comprises: a distribution structure control flow feature matching component, a distribution structure data flow constraint checking component, and a distribution structure dumping component; wherein, given a target binary program to be analyzed: The distribution structure control flow feature matching component is configured to: perform static analysis on the target binary program to identify code regions therein that match the distribution structure control flow features; The distribution structure data flow constraint checking component is configured to: check whether the identified code region satisfies the distribution structure data flow feature, and if so, determine the code region as a distribution structure; The distribution structure dump component is configured to: extract metadata information from the distribution structure; Among them, the characteristics of the distribution structure include control flow characteristics and data flow characteristics; The control flow features include: The distribution structure is a loop structure; The dispatch structure includes a basic block sequence that is executed sequentially, the basic blocks in the basic block sequence are executed sequentially, and the tail instruction is a conditional jump instruction in the form of jz or jnz; The data flow characteristics include: There is at least one sequential branch sequence, in which the jump conditions of the jz or jnz form conditional jump instructions at the end of all basic blocks in the sequential branch sequence depend on two operands, one is a constant and the other is a program variable at a specific program position, and the program variable is a message code of a distribution structure.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the method for automatically identifying a binary software distribution structure as described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for automatically identifying a binary software distribution structure according to any one of claims 1 to 5 is implemented.

Images