A parallel analysis method for binary file control flow

Abstract

The invention discloses a parallel analysis method for binary file control flow, which relates to the field of software development. The method uses multiple working processes to perform radial analysis on each basic block to be analyzed in parallel, finds all jump targets of the basic block, forms a sub-CFG graph with a depth of one, and finally merges all the sub-CFG graphs to restore the complete CFG graph, restore the complete control flow of the entire binary file, and then quickly completes the parallel analysis of the binary file control flow. The method avoids a large amount of backtracking during the analysis process, reduces repeated analysis work; uses work queues and work processes for parallel analysis, fully utilizes the multi-core performance of the CPU, and greatly shortens the analysis time; and during the analysis, each jump branch is completely broken up, saved through a result queue, and finally merged, avoiding the use of stack space to save a large number of intermediate paths, saving the program's memory stack.

Description

Technical Field

[0001] The present invention relates to the field of software development, and in particular to a parallel analysis method for binary file control flow. Background Art

[0002] In the field of software development, developers usually write code in a programming language to implement software functions. After development is completed, the source code is compiled into an executable binary file by a compiler and deployed on the target device for operation. Due to compiler optimization and complex and changeable field environments, the execution process of the binary file is inconsistent with the expected behavior of the source code. Therefore, static and dynamic analysis of binary files is an important means to discover potential vulnerabilities and understand their operating logic.

[0003] angr is a well-known open source binary analysis framework. It restores the control flow of binary files by simulating execution based on the DFS (Deep First Search) algorithm. It analyzes execution branches as deep as possible along the control flow jump path, backtracks after reaching the deepest basic block, and repeats this process until the entire control flow is restored. For example, Figure 2 As shown, the implementation process of angr is as follows:

[0004] In the first step, after starting the analysis, angr finds the execution entry of the binary file, analyzes the binary code at the entry, creates the entry basic block, adds it to the CFG (Control Flow Graph), and sets it as the current basic block.

[0005] In the second step, angr marks the current block, analyzes the binary code of the current block, and discovers all jump targets of the current block.

[0006] The third step is to determine whether there is a jump target in the current block. If there is a jump target, create a basic block for each target and add it to the CFG graph. Each jump target belongs to an adjacent relationship. Then set the first jump target as the current block and return to the second step; if there is no jump target, proceed to the next step.

[0007] The fourth step is to determine whether there is an unmarked basic block among the basic blocks adjacent to the current block. If so, set the first adjacent basic block as the non-current block and return to the second step; if not, proceed to the next step.

[0008] The fifth step is to determine whether the current block is the entry basic block of the binary file. If not, set the parent basic block of the current block as the current block and return to the second step. If yes, the analysis is completed.

[0009] Angr can easily perform reverse analysis on binary files. It provides a means to simulate the execution of binary code to restore the CFG graph of the binary file. Each node in the CFG graph represents a basic block, that is, a straight code block without any jumps or jump targets in the binary code; branches, jumps, and loop logic will all lead to jumps. The jump target starts with a block and ends with a block. Directed edges represent jumps in the control flow.

[0010] The CFG graph can fully understand the operation logic of the binary file. However, in the implementation of the angr framework to restore the control flow through simulation execution, every time a jump branch is restored, it will backtrack to the jump source of the previous level, and then continue to analyze downward. The entire analysis is full of forward and backtracking, which is essentially a recursive method. The disadvantages of this method are as follows:

[0011] ① Too much backtracking leads to reduced efficiency. The time spent on analyzing binary files containing a large number of complex jumps increases sharply, and the increase rate increases exponentially with the complexity of the jumps;

[0012] ② Each analysis depends on the marking results of the previous analysis, and the task cannot be disassembled, and can only rely on the single-core performance of the CPU;

[0013] ③. Depth-first analysis requires stack space to save intermediate jump paths. The more complex the jumps, the more stack space is occupied.

[0014] In summary, the time consumed by the prior art angr increases dramatically when analyzing binary files containing a large number of complex jumps, and the increase rate increases exponentially with the complexity of the jumps. Summary of the invention

[0015] In view of the above-mentioned deficiencies in the prior art, the present invention provides a parallel analysis method for binary file control flow, which solves the problem that the prior art angr is relatively time-consuming when analyzing binary files containing a large number of complex jumps.

[0016] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0017] A method for parallel analysis of binary file control flow is provided, which comprises the following steps:

[0018] S1. Create a work queue and a result queue; the work queue is used to store the basic blocks to be analyzed; the result queue is used to store the basic blocks and the CFG graph with a depth of one formed with their direct jump targets;

[0019] S2. Create a working process according to the number of CPU cores;

[0020] S3, putting the binary file entry code basic block into the work queue;

[0021] S4, determine whether the current work queue is empty, if so, proceed to step S5; otherwise, proceed to step S6;

[0022] S5. Determine whether there is a working process currently analyzing. If so, wait and return to step S4 after the current working process completes the analysis. Otherwise, merge all CFG graphs with a depth of one, restore the complete control flow of the entire binary file, and complete the parallel analysis of the control flow of the binary file.

[0023] S6, extract the basic block from the work queue, analyze all jump targets of the basic block through the work process, and submit the analysis results; one of the work processes analyzes one basic block at a time;

[0024] S7, creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis result of the working process;

[0025] S8. Take the direct jump target as a new basic block to be analyzed and put it into the work queue, and return to step S4.

[0026] Further, in step S2, the number of working processes is twice the number of CPU cores.

[0027] Furthermore, when the basic blocks to be analyzed in the work queue are insufficient to be allocated to all waiting work processes, the work processes that are not allocated the basic blocks to be analyzed are made to continue waiting.

[0028] Furthermore, the specific method of creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis result of the working process is as follows:

[0029] The basic block to be analyzed and all its direct jump targets are taken as nodes of the CFG graph, and each direct jump relationship starting from the basic block to be analyzed is taken as an edge of the CFG graph. From the node representing the basic block to be analyzed to the node representing the direct jump target, a CFG graph with a depth of one is obtained.

[0030] Furthermore, in step S8, the specific method of taking the direct jump target as a new basic block to be analyzed and putting it into the work queue is:

[0031] The direct jump target not included in the result queue is determined by checking the result queue, and the direct jump target not included in the result queue is put into the work queue as a new basic block to be analyzed.

[0032] Furthermore, the specific method of merging all CFG graphs with a depth of one is:

[0033] All CFG graphs with a depth of one are merged according to the node merging algorithm of directed graphs.

[0034] The beneficial effects of the present invention are as follows: when restoring the control flow of a binary file, the method performs radial analysis on each basic block to be analyzed in parallel through multiple working processes, finds all the jump targets of the basic block, forms a sub-CFG graph with a depth of one, and finally merges all the sub-CFG graphs to restore the complete CFG graph, restores the complete control flow of the entire binary file, and then quickly completes the parallel analysis of the control flow of the binary file. A large amount of backtracking is avoided during the analysis process, reducing repeated analysis work; using work queues and work processes for parallel analysis, fully utilizing the multi-core performance of the CPU, greatly shortening the analysis time; and during the analysis, each jump branch is completely broken up, saved through the result queue, and finally merged, avoiding the use of stack space to save a large number of intermediate paths, saving the program's memory stack. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic diagram of the process of this method;

[0036] Figure 2 This is the implementation flow chart of the existing angr;

[0037] Figure 3 It is a schematic diagram of the processing flow of the existing angr in the embodiment;

[0038] Figure 4 A schematic diagram of the jump relationship of seven basic blocks in the embodiment;

[0039] Figure 5 Schematic diagram of multi-process parallel analysis of the method in the embodiment. DETAILED DESCRIPTION

[0040] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0041] like Figure 1 As shown, the parallel analysis method of the binary file control flow includes the following steps:

[0042] S1. Create a work queue and a result queue; the work queue is used to store the basic blocks to be analyzed; the result queue is used to store the basic blocks and the CFG graph with a depth of one formed with their direct jump targets;

[0043] S2. Create a working process according to the number of CPU cores;

[0044] S3, putting the binary file entry code basic block into the work queue;

[0045] S4, determine whether the current work queue is empty, if so, proceed to step S5; otherwise, proceed to step S6;

[0046] S5. Determine whether there is a working process currently analyzing. If so, wait and return to step S4 after the current working process completes the analysis. Otherwise, merge all CFG graphs with a depth of one, restore the complete control flow of the entire binary file, and complete the parallel analysis of the control flow of the binary file.

[0047] S6, extract the basic block from the work queue, analyze all jump targets of the basic block through the work process, and submit the analysis results; one of the work processes analyzes one basic block at a time;

[0048] S7, creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis result of the working process;

[0049] S8. Take the direct jump target as a new basic block to be analyzed and put it into the work queue, and return to step S4.

[0050] In step S2, the number of working processes is twice the number of CPU cores. This method can make the most of the multi-core capability of the CPU and allow the working processes to perform analysis in parallel at the same time.

[0051] When the basic blocks to be analyzed in the work queue are not enough to be allocated to all waiting work processes, the work processes that are not allocated to the basic blocks to be analyzed are made to continue waiting. The work process identifies all jump targets of the basic block by analyzing the binary code of the basic block using an analysis program. The analysis program can be the assembly analysis program libvex in the debugging tool Valgrind, which can scan the assembly code in the basic block line by line, calculate the value of each register, and determine the target of the jump instruction.

[0052] In the specific implementation process, the working process keeps looping to obtain tasks, analyze basic blocks, and submit results until no new analysis tasks can be obtained, indicating that all basic blocks of the binary file have been analyzed.

[0053] The specific method for creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis results of the working process is: the basic block to be analyzed and all its direct jump targets are used as nodes of the CFG graph, each direct jump relationship starting from the basic block to be analyzed is used as an edge of the CFG graph, and a CFG graph with a depth of one is obtained from the node representing the basic block to be analyzed to the node representing the direct jump target.

[0054] The specific method of taking the direct jump target as a new basic block to be analyzed and putting it into the work queue in step S8 is: determining the direct jump target not included in the result queue by checking the result queue, and putting the direct jump target not included in the result queue as a new basic block to be analyzed into the work queue.

[0055] The result queue stores each basic block and its jump target analyzed by the work process. These results are fragmented, incomplete directed graphs. This embodiment can merge all CFG graphs with a depth of one according to the node merging algorithm of the directed graph to achieve the merging of all CFG graphs with a depth of one.

[0056] In one embodiment of the present invention, Figure 3 As shown in the figure, basic block A jumps to basic block B, and basic block B jumps to basic block C and basic block D. angr uses [A,B,C] to mark the jump branch from basic block A to basic block C. In the above example, there are two complete paths: [A,B,C] and [A,B,D]. When angr restores the control flow, it marks each node it passes through, returns to the previous divergence point after reaching the end of a complete branch, and then continues from the divergence point. After reaching the end, it returns to the nearest divergence point, and continues the whole process until all nodes are marked.

[0057] In the process of restoring the control flow, angr marks nodes to indicate that the path composed of these nodes has been traversed. The search and marking node operations are performed on the way forward and backward, and both forward and backward are based on the current node position. The current node position depends on the result of the last traversal, and the last traversal operation depends on the result of the previous traversal. The whole process forms a logical sequential dependency. Even if the original algorithm is put into a multi-process environment, synchronization means such as mutexes are required for protection to avoid confusion caused by multiple processes moving forward or backward at the same time. After using synchronization means, multiple processes are actually running in series, and the effect of parallel acceleration cannot be achieved. It even requires additional time overhead for synchronization means, which is less efficient than the original algorithm. Therefore, angr cannot perform parallel analysis.

[0058] like Figure 4 and Figure 5As shown, there are seven basic blocks, A, B, C, D, E, F, and G. The jump relationship between the basic blocks is indicated by the black arrows. Basic block A can jump to basic block B and basic block C, basic block B can jump to itself and basic block D and basic block E, and basic block C can jump to basic block F and basic block G. This method can divide the entire control flow into three layers according to the depth of the jump: the first layer is basic block A; the second layer is basic block B and basic block C; basic block D, basic block E, basic block F, and basic block G are located in the third layer. In this embodiment, this method uses three processes for analysis. To determine the link relationship between the first layer and the second layer, the analysis of basic block A is placed in one process (as shown by the green arrow); to determine the link relationship between the second layer and the third layer, the analysis of basic block B and basic block C is placed in one process respectively (as shown by the blue and red arrows). Process 1, process 2, and process 3 are executed in parallel, and control flows with a depth of one and starting from basic block A, basic block B, and basic block C are obtained respectively. The common basic blocks B and basic block C are merged to form the entire control flow.

[0059] Each process of the multi-process technology adopted by this method only considers the direct jump target of the current basic block during analysis, and does not care about the subsequent indirect jump path and the previous jump source. All analysis processes are completely independent and carried out in parallel without interfering with each other. It is only necessary to determine the level to which each basic block belongs in the control flow and the link relationship between adjacent levels to restore the entire control flow. There is no need to traverse all complete paths in the control flow. Links with different starting points between levels are independent of each other, so that parallel analysis can be performed without relying on the results of other links. After all process analyses are completed, the previous jump source and subsequent indirect jump target are implicitly obtained through the common node merge to restore the entire control flow.

[0060] In summary, when restoring the control flow of a binary file, the present invention performs radial analysis on each basic block to be analyzed in parallel through multiple working processes, finds all the jump targets of the basic block, forms a sub-CFG graph with a depth of one, and finally merges all the sub-CFG graphs to restore the complete CFG graph, restores the complete control flow of the entire binary file, and then quickly completes the parallel analysis of the control flow of the binary file. A large amount of backtracking is avoided during the analysis process, reducing repeated analysis work; using work queues and work processes for parallel analysis, fully utilizing the multi-core performance of the CPU, greatly shortening the analysis time; and during the analysis, each jump branch is completely broken up, saved through the result queue, and finally merged, avoiding the use of stack space to save a large number of intermediate paths, saving the program's memory stack.

Claims

1. A parallel analysis method for binary file control flow, characterized in that: The following steps are involved: S1. Create a work queue and a result queue; the work queue is used to store the basic blocks to be analyzed; the result queue is used to store the basic blocks and the CFG graph with a depth of one formed with their direct jump targets; S2. Create a working process according to the number of CPU cores; S3, putting the binary file entry code basic block into the work queue; S4, determine whether the current work queue is empty, if so, proceed to step S5; otherwise, proceed to step S6; S5. Determine whether there is a working process currently analyzing. If so, wait and return to step S4 after the current working process completes the analysis. Otherwise, merge all CFG graphs with a depth of one, restore the complete control flow of the entire binary file, and complete the parallel analysis of the control flow of the binary file. S6, extract the basic block from the work queue, analyze all jump targets of the basic block through the work process, and submit the analysis results; one of the work processes analyzes one basic block at a time; S7, creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis result of the working process; S8, taking the direct jump target as a new basic block to be analyzed and putting it into the work queue, and returning to step S4; The specific method of creating a CFG graph with a depth of one formed by the corresponding basic block and its direct jump target according to the analysis results of the working process is: The basic block to be analyzed and all its direct jump targets are taken as nodes of the CFG graph, and each direct jump relationship starting from the basic block to be analyzed is taken as an edge of the CFG graph. From the node representing the basic block to be analyzed to the node representing the direct jump target, a CFG graph with a depth of one is obtained.

2. A method for parallel analysis of binary file control flow according to claim 1, characterized in that: In step S2, the number of working processes is twice the number of CPU cores.

3. The method for parallel analysis of binary file control flow according to claim 1, characterized in that: When the basic blocks to be analyzed in the work queue are insufficient to be allocated to all waiting work processes, the work processes that are not allocated the basic blocks to be analyzed are made to continue waiting.

4. The method for parallel analysis of binary file control flow according to claim 1, characterized in that: The specific method of taking the direct jump target as a new basic block to be analyzed and putting it into the work queue in step S8 is: The direct jump target not included in the result queue is determined by checking the result queue, and the direct jump target not included in the result queue is put into the work queue as a new basic block to be analyzed.

5. The method for parallel analysis of binary file control flow according to claim 1, characterized in that: The specific method to merge all CFG graphs with a depth of one is: All CFG graphs with a depth of one are merged according to the node merging algorithm of directed graphs.

Images