A self-constructed context decompilation method, device and storage medium

Abstract

The present invention belongs to the field of computer technology, and in particular to a decompilation method, device and storage medium for self-constructed context. Aiming at the problem that the accuracy of the decompiled code generated by the existing technology is not high. A decompilation method for self-constructed context is proposed, which includes: obtaining a binary file X to be decompiled, disassembling the binary file X to be decompiled, and obtaining an assembly code A; using a pre-trained generation model to decompile the assembly code A to obtain a compiled code B; using a compiler to compile the obtained compiled code B to obtain a new binary file C; disassembling the obtained binary file C to obtain an assembly code E, and constructing the assembly code E and the compiled code B into a group of samples Y; splicing the obtained sample Y and the assembly code A together and inputting them into the pre-trained generation model, performing decompilation processing, and obtaining a new compiled code F.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a decompilation method, a device and a storage medium for self-constructing context. Background Art

[0002] In software development and technology projects, the unavailability of source code often leads to a host of problems and challenges. Among these, the reasons for this unavailability are: many companies have been using legacy technologies and systems for years, which may not be well documented, or whose source code has been lost or inaccessible. Typical scenarios include: companies wanting to migrate legacy systems to a new platform or technology stack but lacking sufficient source code and documentation to effectively migrate.

[0003] Developer attrition can occur within a team or company, and key developers may leave, resulting in a project's source code becoming unavailable. This often occurs when effective knowledge management and documentation are not implemented. The team may lose critical understanding of the project and access to the source code after the departure. Some projects rely on the proprietary knowledge of individual developers, and when these developers leave, the project is at risk of becoming unmaintainable.

[0004] Therefore, decompilation, which converts compiled code back into a high-level programming language for analysis, is particularly important when the source code is unavailable. Previous work has focused on improving decompilation performance by increasing the size of model parameters or the amount of training data used for pre-training. However, existing technologies for decompilation lack the contextual features of the compilation task, resulting in low accuracy in the decompiled code generated by existing generative models for decompilation tasks. Summary of the Invention

[0005] The present invention aims to solve the problem of low accuracy of decompiled code generated by existing generation models for decompilation tasks. A decompilation method with self-constructed context is proposed, comprising:

[0006] Step 1: Obtain the binary file X to be decompiled, and disassemble the binary file X to be decompiled to obtain the assembly code A;

[0007] The binary file to be decompiled is a compiled program file, typically a machine code file converted from a high-level programming language (such as C++, Go, or Java). This binary file contains instructions that can be directly executed by a computer or interpreter. Due to reasons such as the departure of the software maintainer or project changes, the original code needs to be restored from the software for continued maintenance.

[0008] Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B;

[0009] The pre-trained generative model is a generative model that has been trained.

[0010] Step 3: Use a compiler to recompile the compiled code B obtained in step 2 to obtain a new binary file C;

[0011] In addition, a processing process well known to those skilled in the art is introduced, where the compilation process is to convert the code into a binary file;

[0012] The disassembly process is to convert the binary file into assembly code;

[0013] The decompilation process is to convert the assembly code into code, which is a process well known to those skilled in the art;

[0014] Step 4: Decompile the binary file C obtained in step 3 to obtain assembly code E (the code generated by decompilation, which is the assembly code that can be obtained after the code is compiled). Reconstruct the assembly code E and the compiled code B obtained by the initial decompilation into a set of samples Y;

[0015] Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generation model for decompilation to obtain the new compiled code F.

[0016] A computer storage medium, characterized in that at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement the self-constructed context decompilation method.

[0017] A decompilation device for self-constructing context, characterized in that the device includes a processor and a memory, the memory stores at least one instruction, and the at least one instruction is loaded by the processor and executed by the decompilation method for self-constructing context.

[0018] The beneficial effects of the present invention are:

[0019] We propose a self-constructed context decompilation method. By recompiling the decompilation results of the LLM, we construct a pair for context learning to help the model improve the decompilation performance. According to the decompilation results of the generated model, we reconstruct the context of the generated model, thereby improving the decompilation performance of the model. We use the assembly code E obtained after the initial decompilation code is recompiled for context construction.

[0020] The assembly code E and compiled code B are constructed into a set of examples Y using an appropriate context format, typically consistent with the training format of the generative model. Typically, Y takes the form of E=>B. When decompiled again, the format becomes E=>B, A=>. This is fed into the pre-trained model and decompiled again to obtain new source code. The result, F, is the required assembly code. Projects where source code has been lost due to the departure of the software maintainer or project changes can be maintained based on the result F, improving the project's cost-effectiveness and maintenance efficiency. This solves the problem of low accuracy in the decompiled code generated when decompilation is performed using existing generative models. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a decompilation method of self-constructing context of the present invention;

[0022] Figure 2 This is a flowchart of step 4 in a decompilation method for self-constructing context of the present invention. DETAILED DESCRIPTION

[0023] Specific implementation method 1: Combination Figure 1 The present invention includes the following steps: Step 1: obtaining a binary file X to be decompiled, and disassembling the binary file X to be decompiled to obtain an assembly code A;

[0024] The binary file to be decompiled is a compiled program file, typically a machine code file converted from a high-level programming language (such as C++, Go, or Java). This binary file contains instructions that can be directly executed by a computer or interpreter. Due to reasons such as the departure of the software maintainer or project changes, the original code needs to be restored from the software for continued maintenance.

[0025] Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B;

[0026] The pre-trained generative model is a generative model that has been trained.

[0027] Step 3: Use a compiler to recompile the compiled code B obtained in step 2 to obtain a new binary file C;

[0028] In addition, a processing process well known to those skilled in the art is introduced, where the compilation process is to convert the code into a binary file;

[0029] The disassembly process is to convert the binary file into assembly code;

[0030] The decompilation process is to convert the assembly code into code, which is a process well known to those skilled in the art;

[0031] Step 4: Decompile the binary file C obtained in step 3 to obtain assembly code E (the code generated by decompilation, which is the assembly code that can be obtained after the code is compiled). Reconstruct the assembly code E and the compiled code B obtained by the initial decompilation into a set of samples Y;

[0032] Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generative model for decompilation to obtain the new compiled code F.

[0033] The assembly code E obtained after the initial decompilation is used for context construction. In step 4, the assembly code E and the compiled code B are constructed into a set of examples Y. A suitable context format is used, usually consistent with the training format of the generated model, to construct a set of examples. Usually, Y is in the form of E=>B. When decompiled again, the format is E=>B, A=>, which is fed into the pre-trained model and decompiled again to obtain new source code.

[0034] The result F is the required assembly code. Projects whose source code has been lost due to reasons such as the departure of the software maintainer or project changes can be maintained based on the result F, which improves the cost-effectiveness and maintenance efficiency of the project.

[0035] Specific embodiment 2: The difference between this embodiment and specific embodiment 1 is that in step 1, a binary file X to be decompiled is obtained, and the binary file X to be decompiled is disassembled to obtain assembly code A; the specific process is:

[0036] Step 11: Get the binary file X to be decompiled;

[0037] The binary file X to be decompiled is usually a legacy executable file or dynamic link library, but the source code is lost due to various reasons.

[0038] Step 1 and 2: Disassemble the binary file to be decompiled to obtain assembly A. The specific process is as follows:

[0039] Use the disassembler to disassemble the binary file X to obtain the assembly code A;

[0040] The disassemblers include: objdump, capstone; and common disassemblers;.

[0041] Other steps and parameters are the same as those in the first embodiment.

[0042] Specific embodiment three: The difference between this embodiment and specific embodiment one is that the decompilation is performed using a pre-trained model, and the pre-trained generation model used in step 2 is the trained llm4decompile decompilation model;

[0043] Specifically, it is a llm4decompile decompilation model that was trained on the decompilation task again based on Deepseek-Coder;

[0044] In addition, the pre-training generation model used in step 2 of the present invention is not limited to this model, and can be based on various decompilation models, code pre-training models or general large language models.

[0045] The other steps and parameters are the same as those in the first and second embodiments.

[0046] Specific embodiment 4: This embodiment differs from specific embodiments 1 to 4 in that the training process of the llm4decompile decompilation model is:

[0047] A1: Get the existing executable compiled code;

[0048] A2: Compile the existing executable compiled code to obtain the training assembly code;

[0049] A3: Disassemble the training assembly code and compile the training code;

[0050] A4: Construct a decompilation training set based on the training assembly code and compiled code, and use the decompilation training set to pre-train the llm4decompile decompilation model to obtain the trained llm4decompile decompilation model

[0051] The other steps and parameters are the same as those in the first to third embodiments.

[0052] Specific embodiment 5: The difference between this embodiment and specific embodiments 1 to 4 is that the compiler in step 3 is GCC (the GNU Compiler Collection) by utilizing the compilable nature of the first decompiled code.

[0053] In addition, the compiler used in step three of the present invention is not limited to the GCC compiler, and the method can be applied to various languages ​​or compilers.

[0054] The other steps and parameters are the same as those in the first to fourth embodiments.

[0055] Specific embodiment 6: This embodiment is a computer storage medium, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the self-constructed context decompilation method.

[0056] It should be understood that the instructions include computer program products, software, or computerized methods corresponding to any method described in the present invention; the instructions can be used to program a computer system or other electronic device. Computer storage media may include readable media on which instructions are stored, and may include but are not limited to magnetic storage media, optical storage media; magneto-optical storage media include read-only memory ROM, random access memory RAM, erasable programmable memory (e.g., EPROM and EEPROM) and flash memory layers, or other types of media suitable for storing electronic instructions.

[0057] Specific embodiment seven: This embodiment is a multi-granularity dataset construction device for a multimodal large model, the device including a processor and a memory. It should be understood that the device includes any device including a processor and a memory described in the present invention, and the device may also include other units and modules that perform display, interaction, processing, control, and other functions through signals or instructions;

[0058] At least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor to implement the self-constructed context decompilation method.

[0059] Those skilled in the art will appreciate that at least one instruction stored is a computer program product corresponding to the method or system. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and interpreted scripting language JavaScript, etc.

[0060] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems, and computer program products according to the embodiments of the present application, and can also be used for corresponding devices. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0063] The above only describes the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the above-mentioned specific implementation methods. Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Any technician familiar with this profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical content disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modifications, equivalent replacements and improvements made to the above embodiments without departing from the content of the technical solution of the present invention, based on the technical essence of the present invention, within the spirit and principles of the present invention, still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A decompilation method with self-constructed context, characterized in that: The following steps are involved: Step 1: Obtain a binary file X to be decompiled, and disassemble the binary file X to be decompiled to obtain assembly code A; Step 2: Use the pre-trained generation model to decompile the assembly code A to obtain the compiled code B; Step 3: Use a compiler to compile the compiled code B obtained in step 2 to obtain a new binary file C; Step 4: Disassemble the binary file C obtained in step 3 to obtain assembly code E, and construct a set of samples Y by combining the assembly code E and the compiled code B; Step 5: Concatenate the sample Y obtained in step 4 and the assembly code A and input them into the pre-trained generative model for decompilation to obtain the new compiled code F. In the step 4, the assembly code E and the compiled code B are constructed into a set of samples Y; the specific process is: using a suitable context format, consistent with the training format of the generative model, to construct a set of examples.

2. A decompilation method of self-constructed context according to claim 1, characterized in that: In the step 1, a binary file X to be decompiled is obtained, and the binary file X to be decompiled is disassembled to obtain an assembly code A. The specific process is as follows: Step 11: Get the binary file X to be decompiled; Step 1 and 2: Use a disassembler to disassemble the binary file X to obtain the assembly code A; The disassemblers include: objdump and capstone.

3. A decompilation method of self-constructed context according to claim 2, characterized in that: In the step 2, the pre-trained generation model is used as the trained llm4decompile decompilation model.

4. The decompilation method of the self-constructed context according to claim 3, characterized in that: The training process of the llm4decompile decompilation model is as follows: A1: Get the existing executable compiled code; A2: Compile the existing executable compiled code to obtain training assembly code; A3: Disassemble the training assembly code and compile the training code; A4: Construct a decompilation training set based on the training assembly code and compiled code. Use the decompilation training set to pre-train the llm4decompile decompilation model to obtain a trained llm4decompile decompilation model.

5. A decompilation method of self-constructed context according to claim 4, characterized in that: The compiler in step 3 is GCC.

6. A computer storage medium, characterized in that The storage medium stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement a decompilation method of a self-constructed context according to any one of claims 1 to 5.

7. A decompilation device with self-constructed context, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the decompilation method of a self-constructed context according to any one of claims 1 to 5.

Images