Self-construction context decompiling method and device and storage medium

Abstract

The invention belongs to the technical field of computers, and particularly relates to a self-construction context decompiling method and device and a storage medium. The problem that the accuracy of decompiled codes generated in the prior art is not high is solved. The self-construction context decompiling method comprises the following steps: acquiring a binary file X to be decompiled, and disassembling the binary file X to be decompiled to obtain an assembly code A; decompiling the assembly code A by using a pre-training generation model to obtain a compiled code B; compiling the obtained compiled code B by using a compiler to obtain a new binary file C; disassembling the obtained binary file C to obtain an assembly code E, and constructing the assembly code E and the compiled code B into a group of examples Y; and splicing the obtained sample Y and the assembly code A, inputting the spliced sample Y and assembly code A into a pre-training generation model, and carrying out decompilation processing to obtain a new compilation code F.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a decompiling method, a device and a storage medium for self-constructing context. Background Art

[0002] In software development and technology projects, the unavailability of source code often leads to a series of problems and challenges. Among them, the unavailability of source code and its possible reasons: many companies have used old technologies and systems in the past few years. These systems may not have good documentation support, or the source code has been lost or inaccessible. Typical scenarios include: companies may want to migrate old systems to new platforms or technology stacks, but there is not enough source code and documentation support for effective migration.

[0003] Developer loss: In a team or company, key developers may leave, resulting in the source code of the project no longer being available. This is common when, without effective knowledge management and documentation, the team may lose important understanding of the project and access to the source code after the departure. Some projects rely on the proprietary knowledge of individual developers, and when these developers leave, the project will face the risk of being unmaintainable.

[0004] Therefore, decompilation is the process of converting the compiled code back to a high-level programming language for analysis, which is especially important when the source code is not available. Previous work has focused on improving decompilation performance by increasing the size of model parameters or the training data used for pre-training. However, existing technologies lack the contextual features of compilation tasks when performing decompilation tasks, resulting in low accuracy of the decompiled code generated by existing technology models for decompilation tasks. Summary of the invention

[0005] The purpose of the present invention is to solve the problem that the accuracy of the decompiled code generated by the prior art generation model is not high when performing decompilation tasks. A decompilation method of self-constructed context is proposed, comprising:

[0006] Step 1: Obtain a binary file X to be decompiled, and perform decompilation processing on the binary file X to be decompiled to obtain an assembly code A;

[0007] The binary file to be decompiled is a compiled program file. The binary file to be decompiled is usually a machine code file converted from a high-level programming language (such as C++, Go, Java, etc.). This binary file to be decompiled contains instructions that can be directly executed by a computer or interpreter. Due to the loss of source code due to reasons such as the departure of the previous software maintainer or project changes, it is necessary to restore the original code from the software to continue maintenance.

[0008] Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B;

[0009] The pre-trained generative model is a generative model that has been trained.

[0010] Step 3: Use a compiler to recompile the compiled code B obtained in step 2 to obtain a new binary file C;

[0011] In addition, a processing process known to those skilled in the art is introduced, where the compilation process is to convert the code into a binary file;

[0012] The disassembly process is to convert the binary file into assembly code;

[0013] The decompilation process is to convert the assembly code into code, which is a process well known to those skilled in the art;

[0014] Step 4: Decompile the binary file C obtained in step 3 to obtain assembly code E (the code generated by decompilation, the assembly that can be obtained after the code is compiled), and reconstruct the assembly code E and the initial decompilation result compiled code B into a set of samples Y;

[0015] Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generation model for decompilation to obtain a new compiled code F.

[0016] A computer storage medium, characterized in that at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement the self-constructed context decompilation method.

[0017] A self-constructed context decompilation device, characterized in that the device includes a processor and a memory, the memory stores at least one instruction, and the at least one instruction is loaded by the processor and executed by the self-constructed context decompilation method.

[0018] The beneficial effects of the present invention are:

[0019] We propose a self-constructed context decompilation method. By recompiling the decompilation results of LLM, we construct pairs for context learning to help the model improve the decompilation performance. According to the decompilation results of the generated model, we reconstruct the context of the generated model to improve the decompilation performance of the model. We use the assembly code E obtained after the initial decompilation code is recompiled for context construction.

[0020] The assembly code E and the compiled code B are constructed into a set of samples Y; a suitable context format is used, which is usually consistent with the training format of the generated model, to construct a set of examples. Usually Y is in the form of E=>B, and when decompiled again, the format is in the form of E=>B, A=>, which is sent to the pre-trained model and decompiled again to obtain new source code; the result F is the required assembly code, and projects where the source code is lost due to reasons such as the departure of the software maintainer or project changes can be maintained according to the result F, which improves the economy and maintenance efficiency of the project. The problem of low accuracy of the decompiled code generated when the prior art generation model performs decompilation tasks is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a decompilation method of self-constructing context of the present invention;

[0022] Figure 2 It is a flowchart of step 4 in a decompilation method for self-constructing context of the present invention. DETAILED DESCRIPTION

[0023] Specific implementation method 1: Combination Figure 1 The present invention includes: step 1, obtaining a binary file X to be decompiled, and performing a disassembly process on the binary file X to be decompiled to obtain an assembly code A;

[0024] The binary file to be decompiled is a compiled program file. The binary file to be decompiled is usually a machine code file converted from a high-level programming language (such as C++, Go, Java, etc.). This binary file to be decompiled contains instructions that can be directly executed by a computer or interpreter. Due to the loss of source code due to reasons such as the departure of the previous software maintainer or project changes, it is necessary to restore the original code from the software to continue maintenance.

[0025] Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B;

[0026] The pre-trained generative model is a generative model that has been trained.

[0027] Step 3: Use a compiler to recompile the compiled code B obtained in step 2 to obtain a new binary file C;

[0028] In addition, a processing process known to those skilled in the art is introduced, where the compilation process is to convert the code into a binary file;

[0029] The disassembly process is to convert the binary file into assembly code;

[0030] The decompilation process is to convert the assembly code into code, which is a process well known to those skilled in the art;

[0031] Step 4: Decompile the binary file C obtained in step 3 to obtain assembly code E (the code generated by decompilation, the assembly that can be obtained after the code is compiled), and reconstruct the assembly code E and the initial decompilation result compiled code B into a set of samples Y;

[0032] Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generation model for decompilation to obtain a new compiled code F.

[0033] The assembly code E obtained after the initial decompilation code is recompiled is used for context construction. In step 4, the assembly code E and the compiled code B are constructed into a set of samples Y; a suitable context format is used, which is usually consistent with the training format of the generated model, to construct a set of examples. Usually Y is in the form of E=>B, and when decompiled again, the format is in the form of E=>B, A=>, which is sent to the pre-trained model and decompiled again to obtain new source code;

[0034] The result F is the required assembly code. Projects whose source code is lost due to reasons such as the departure of the maintainer of the previous software or changes in the project can be maintained based on the result F, which improves the cost-effectiveness and maintenance efficiency of the project.

[0035] Specific implementation method 2: The difference between this implementation method and specific implementation method 1 is that in step 1, a binary file X to be decompiled is obtained, and the binary file X to be decompiled is decompiled to obtain an assembly code A; the specific process is:

[0036] Step 11: Get the binary file X to be decompiled;

[0037] The binary file X to be decompiled is usually a legacy executable file or a dynamic link library, but the source code is lost due to various reasons.

[0038] Step 1 and 2: Disassemble the binary file to be decompiled to obtain assembly A. The specific process is as follows:

[0039] Use a disassembler to disassemble the binary file X to be decompiled, and obtain the assembly code A;

[0040] The disassemblers include: objdump, capstone; and common disassemblers;.

[0041] The other steps and parameters are the same as those in the first specific implementation.

[0042] Specific implementation method three: The difference between this implementation method and specific implementation method one is that the pre-trained model is used for decompilation, and the pre-trained generation model used in step 2 is the trained llm4decompile decompilation model;

[0043] Specifically, it is a llm4decompile decompilation model that has been trained again on the decompilation task based on Deepseek-Coder;

[0044] In addition, the pre-trained generation model used in step 2 of the present invention is not limited to this model, and can be based on various decompilation models, code pre-training models or general large language models.

[0045] The other steps and parameters are the same as those in Specific Implementation 1 to 2.

[0046] Specific implementation method 4: This implementation method is different from specific implementation methods 1 to 4 in that the training process of the llm4decompile decompilation model is:

[0047] A1: Get the existing executable compiled code;

[0048] A2: Compile the existing executable compiled code to obtain the training assembly code;

[0049] A3: Disassemble the training assembly code and compile the training code;

[0050] A4: Construct a decompilation training set based on the training assembly code and compiled code, and use the decompilation training set to pre-train the llm4decompile decompilation model to obtain the trained llm4decompile decompilation model

[0051] The other steps and parameters are the same as those in the first to third embodiments.

[0052] Specific implementation method 5: The difference between this implementation method and specific implementation methods 1 to 4 is that the compiler in step 3 is GCC (the GNU Compiler Collection) by utilizing the compilable nature of the first decompiled code.

[0053] In addition, the compiler used in step three of the present invention is not limited to the GCC compiler, and the method can be applied to various languages ​​or compilers.

[0054] The other steps and parameters are the same as those in Specific Embodiments 1 to 4.

[0055] Specific implementation method six: This implementation method is a computer storage medium, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the self-constructed context decompilation method.

[0056] It should be understood that the instructions include computer program products, software or computerized methods corresponding to any method described in the present invention; the instructions can be used to program a computer system, or other electronic device. Computer storage media may include readable media on which instructions are stored, which may include but are not limited to magnetic storage media, optical storage media; magneto-optical storage media include read-only memory ROM, random access memory RAM, erasable programmable memory (e.g., EPROM and EEPROM) and flash memory layers, or other types of media suitable for storing electronic instructions.

[0057] Specific implementation method 7: This implementation method is a multi-granularity data set construction device for a multi-modal large model, the device includes a processor and a memory, and it should be understood that including any device including a processor and a memory described in the present invention, the device may also include other units and modules that perform display, interaction, processing, control, etc. and other functions through signals or instructions;

[0058] At least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor to implement the self-constructed context decompilation method.

[0059] Those skilled in the art will appreciate that at least one instruction stored is a computer program product corresponding to the method or system. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0060] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems, and computer program products according to the embodiments of the present application, and may also be used for corresponding devices. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0063] The above only describes the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the above specific implementation methods. Although the present invention has been disclosed as above in the preferred embodiments, it is not used to limit the present invention. Any technician familiar with the profession can make some changes or modify the technical contents disclosed above into equivalent embodiments with equivalent changes without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent replacement and improvement made to the above embodiments without departing from the content of the technical solution of the present invention, based on the technical essence of the present invention, within the spirit and principles of the present invention, still fall within the protection scope of the technical solution of the present invention.

Claims

1. A decompilation method for self-constructing context, characterized in that: The following steps are involved: Step 1: Obtain a binary file X to be decompiled, and perform decompilation processing on the binary file X to be decompiled to obtain an assembly code A; Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B; Step 3: Use a compiler to compile the compiled code B obtained in step 2 to obtain a new binary file C; Step 4: Disassemble the binary file C obtained in step 3 to obtain assembly code E, and construct the assembly code E and the compiled code B into a set of samples Y; Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generation model for decompilation to obtain a new compiled code F.

2. A decompilation method of self-constructed context according to claim 1, characterized in that: In the step 1, the binary file X to be decompiled is obtained, and the binary file X to be decompiled is decompiled to obtain the assembly code A; the specific process is: Step 11: Get the binary file X to be decompiled; Step 1 and 2: Use a disassembler to disassemble the binary file X to be decompiled, and obtain the assembly code A; The disassemblers include: objdump, capstone.

3. A decompiling method for self-constructing context according to claim 2, characterized in that: In the step 2, the pre-trained generation model is used as the trained llm4decompile decompilation model.

4. The decompiling method of the self-constructed context according to claim 3, characterized in that: The training process of the llm4decompile decompilation model is: A1: Get the existing executable compiled code; A2: Compile the existing executable compiled code to obtain the training assembly code; A3: Disassemble the training assembly code and compile the training code; A4: A decompilation training set is formed according to the training assembly code and the compiled code. The decompilation training set is used to pre-train the llm4decompile decompilation model to obtain a trained llm4decompile decompilation model.

5. A decompilation method of self-constructed context according to claim 4, characterized in that: The compiler in step 3 is GCC.

6. A computer storage medium, characterized in that: The storage medium stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement a decompilation method for a self-constructed context as described in any one of claims 1 to 5.

7. A decompilation device with self-constructed context, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement a self-constructed context decompilation method as described in any one of claims 1 to 5.

Images