Password misuse detector for binary executable file based on dynamic and static combination

Abstract

The invention relates to the technical field of information security, and provides a password misuse detector of a binary executable file based on dynamic and static combination, which comprises a sampling module, a backtracking slicing module, a symbol execution module and a rule verification module, the sampling module constructs a local control flow diagram of a cryptographic function, analyzes a calling relation, positions functions and data related to cryptographic operation and detects a sensitive function; the backtracking slice module traces the life cycle of the parameter of the sensitive function; the symbolic execution module simulates an actual execution path of a program and outputs a dynamic symbolic execution result; and the rule verification module judges whether password misuse exists in the program or not and records a judgment result in a log file. According to the method, the password misuse problem in the binary executable file is detected through a dynamic and static combined analysis technology, the correctness of a program when a password algorithm is used is ensured, and therefore the safety of a software system is improved.

Description

Technical Field

[0001] The invention belongs to the field of information security, and in particular relates to a password misuse detector for binary executable files based on dynamic and static combination. Background Art

[0002] The rapid development and popularization of the Internet has brought great convenience to society. Cryptography provides security for personal privacy, financial transactions, corporate secrets, etc. in information transmission. However, in the actual application of cryptography, some developers lack professional knowledge of cryptography and use inappropriate encryption functions and incorrect encryption parameters, resulting in the lack of due protection of program security and system security.

[0003] In order to ensure information security, software generally needs to be encrypted and protected in accordance with security standards. If high-intensity encryption measures are not used in accordance with security standards, there will be many security risks in the files, and the user's security and privacy will be threatened. In addition, identifying the cryptographic algorithms used in malware and decrypting them can ensure the correct use and security of the encryption algorithms and strengthen the detection and resistance capabilities of malware.

[0004] The related patent discloses a method, device and system for identifying password misuse vulnerabilities based on graph neural networks (CN118153065B). The method mainly identifies password misuse vulnerabilities in programs through steps such as feature extraction, graph neural network model training and graph embedding generation. The specific steps are summarized as follows: Feature extraction: Process the target program file, extract the cryptographic algorithm feature constants therein, and generate a control flow graph based on the cryptographic algorithm features. Graph embedding generation: Input the extracted target feature graph into the trained graph neural network model, and generate the target graph embedding represented by a high-dimensional vector through multiple iterative calculations. Password misuse identification: Use linear regression in the graph embedding model to identify the password misuse vulnerability category in the embedding and its probability of occurrence. Model training: Perform model training through a pre-collected data set (including program files containing password misuse vulnerabilities), use Mahalanobis distance and linear regression to calculate the loss value, and optimize the parameters of the neural network model.

[0005] In the process of implementing the disclosed embodiments, it was found that at least the following problems exist in the related art: the related art relies too much on static analysis when detecting password misuse, and does not consider the dynamic behavior of the code at runtime, such as parameter passing and memory state management in the function call chain. This approach leads to insufficient accuracy in detecting runtime memory problems, especially in terms of memory management, such as unreleased keys, and fails to effectively identify static analysis problems such as hard-coded keys. At the same time, another method also has limitations when constructing a global control flow graph, and fails to effectively solve the path and state explosion problems, thereby affecting the analysis efficiency of large-scale binary files and the speed of password misuse detection.

[0006] The main reason for the above shortcomings is that the existing technology relies too much on static analysis, which can only capture the grammatical features of the code, but cannot deeply analyze the dynamic behavior of the program at runtime, such as important information such as variable transfer, memory allocation and release. In addition, the lack of monitoring of runtime memory status, especially when dealing with cryptographic operations, further limits the accuracy of detection. Another limitation of the above method is that the method of globally constructing the control flow graph is prone to path and state explosion problems when analyzing large-scale binary files, which increases the complexity and time consumption of the analysis, and further reduces the detection efficiency. Summary of the invention

[0007] In view of the above-mentioned defects of the prior art, the present invention proposes a password misuse detector for binary executable files based on a combination of dynamic and static detection. The technical solution designed by the present invention includes:

[0008] Sampling module, backtracking slicing module, symbolic execution module and rule verification module;

[0009] The sampling module extracts symbol information from the binary executable file, performs local analysis on the cryptographic function based on the symbol information and constructs a local control flow graph of the cryptographic function. After the local control flow graph of the cryptographic function is established, the calling relationship of the cryptographic function is analyzed, the functions and data involved in the cryptographic operation are located, and sensitive functions are detected;

[0010] The backtracking slicing module traces back the life cycle of the parameters of the sensitive function and determines the source and transfer path of the parameters;

[0011] The symbolic execution module simulates the actual execution path of the program based on the parameter source and transfer path of the sensitive function, executes the program in a symbolic state, creates a symbol vector for the starting address of the binary executable file, and opens up a virtual space of corresponding size, maps the simulated execution result to the symbol and memory, and outputs the dynamic symbolic execution result;

[0012] The rule verification module matches the dynamic symbol execution results according to the predefined rule file to determine whether there is password misuse in the program and records the judgment result in a log file.

[0013] Preferably, the backtracking slice module traces back the life cycle of the parameters of the sensitive function, including:

[0014] Based on the backtracking slicing technology, the parameter passing instruction address of the sensitive function is determined, the register and stack operations in the function call relationship of the cryptographic function are analyzed, and the parameters in the sensitive function are tracked. The backtracking slicing will start from the use point of the parameters in the sensitive function and track the initial assignment point of the parameters in the sensitive function.

[0015] Preferably, the initial value assignment point of the parameter in the tracking sensitive function includes:

[0016] Based on the backtracking slicing technology, the flow of parameters in sensitive functions is traced forward step by step through the function call chain.

[0017] Preferably, the backtrace slicing module performs backtrace based on assembly instructions of the X86 architecture.

[0018] Preferably, the framework adopted by the symbolic execution module is UC-Angr, which is based on the symbolic execution extension of UC-KLEE and supports dynamic symbolic execution and under-constrained state management. In UC-Angr, insufficiently constrained data will be marked as a symbolic state and used as a pointer during program execution to generate a new unconstrained symbolic area and track memory operations and register states during program execution.

[0019] Preferably, the symbolic execution module further includes:

[0020] The execution is performed by setting restrictions on path exploration, including UC-Angr controlling the execution path by limiting the number of branches of function calls. When the number of branches of a sensitive function exceeds the limit, the return instruction is used to return directly.

[0021] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, including:

[0022] When the symbolic execution module executes the program in a symbolic state, the state information of the program under different execution paths is recorded. The rule verification module determines whether the conditions defined in the predefined rule file are met by analyzing the state information.

[0023] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, and further includes:

[0024] When the symbolic execution module executes the program in a symbolic state, it generates a memory map of the program and records the usage and storage of key data. The rule verification module determines whether there is a problem with the program by checking the memory map.

[0025] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, and further includes:

[0026] When a function calls an encryption function in the cryptographic library, but the parameter configuration before the call is completed in other functions, the rule verification module tracks the entire call chain to ensure that all encryption parameters meet the requirements of the predefined rule file during the entire transmission process.

[0027] Beneficial effects:

[0028] 1. By combining static analysis and dynamic analysis, the present invention can effectively capture the dynamic behavior of the program at runtime, especially information such as variable transfer and memory status in cryptographic operations. Compared with the traditional solution that only relies on static analysis, the present invention can more comprehensively identify the problem of password misuse and significantly improve the efficiency of detection.

[0029] 2. The present invention avoids the path explosion and state explosion problems that are easily caused in the process of building a global control flow graph by introducing local static analysis and underconstrained dynamic symbolic execution methods. While ensuring the detection accuracy, this method greatly improves the analysis efficiency of large-scale binary files, making password misuse detection not only applicable to small-scale programs, but also to the detection of large and complex binary files.

[0030] 3. The present invention uses under-constrained dynamic symbolic execution technology to simulate the execution path between a specific starting point and end point, especially the execution path for cryptographic operations. This process can dynamically analyze parameter transfer and memory operations in the function call chain, further improving the depth and accuracy of cryptographic misuse detection, especially in detecting cryptographic parameter misuse.

[0031] 4. The present invention verifies the detection results through predefined rule files, and can detect problems such as insecure encryption algorithms, weak keys, and insecure random number generation according to different cryptographic rules. The rule verification module has strong scalability, and developers can customize rule files according to needs to adapt to security detection requirements in different scenarios, thereby improving the flexibility and adaptability of the detection system.

[0032] 5. The present invention uses an automated analysis and log generation system to quickly generate detailed misuse logs when password misuse is detected. These logs include the specific location of the misuse problem, function call information, and parameter usage, which helps developers quickly locate and fix security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a structural flow diagram of a preferred embodiment of the present invention;

[0034] Figure 2 It is a schematic diagram of password rule classification of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0035] The embodiments of the present invention are described in detail below. The following embodiments are implemented on the premise of the technical solution of the present invention, and detailed implementation methods and specific operation processes are given, but the protection scope of the present invention is not limited to the following embodiments.

[0036] The present invention designs a password misuse detector for binary executable files based on a combination of dynamic and static methods, aiming to solve the problems in the prior art that the dynamic behavior, memory state and variable transfer of the program during runtime cannot be effectively captured. Figure 1-2 As shown, the technical solution includes the following steps, specifically including:

[0037] Sampling module, backtracking slicing module, symbolic execution module and rule verification module;

[0038] The sampling module extracts symbol information from binary executable files, performs local analysis on cryptographic functions based on the symbol information, and constructs a local control flow graph of the cryptographic functions. After the local control flow graph of the cryptographic functions is established, the calling relationship of the cryptographic functions is analyzed, the functions and data involved in cryptographic operations are located, and sensitive functions are detected.

[0039] The backtracking slice module traces the life cycle of the parameters of sensitive functions and determines the source and transfer path of the parameters;

[0040] The symbolic execution module simulates the actual execution path of the program based on the parameter source and transfer path of the sensitive function, executes the program in a symbolic state, creates a symbol vector for the starting address of the binary executable file, and opens up a virtual space of the corresponding size, maps the simulated execution results to symbols and memory, and outputs the dynamic symbolic execution results;

[0041] The rule verification module matches the dynamic symbolic execution results according to the predefined rule file to determine whether there is password misuse in the program and records the judgment results in the log file.

[0042] Specifically, when analyzing binary files, the path explosion problem is a common challenge. In order to avoid the serious path explosion caused by global static analysis of the entire binary file, this work proposes a local static analysis method. The goal of this step is to perform analysis only in the area related to cryptographic operations, ensuring both the accuracy of detection and the complexity caused by path explosion. In addition, since building the control flow graph of the entire binary file will inevitably lead to the path explosion problem, this paper performs sampling analysis on the binary file based on the characteristics of cryptographic functions with specific usage locations. For example, encryption functions often appear in user-defined information transmission functions. Through local analysis of binary executable files, the path explosion problem can be greatly alleviated while ensuring accuracy. The extracted symbol information includes function name, function call location, assembly instruction address, etc. Then, based on this symbol information, local analysis is performed on cryptographic-related functions to construct local control flow graphs of these functions. The local control flow graph can present the execution path directly related to the cryptographic function and avoid the analysis of irrelevant paths. In local static analysis, the construction of these local CFGs effectively reduces the analysis complexity while retaining the key path information for the cryptographic misuse problem.

[0043] In addition, after the local control flow graph is built, further parsing the function call relationship is a crucial step. By parsing the function call relationship, the functions and data involved in cryptographic operations can be accurately located. This includes not only the custom cryptographic functions in the program, but also the function calls of the cryptographic library (such as OpenSSL). The process of parsing the function call relationship is to establish a function call chain by analyzing the data transfer and calling process between each function. For example, when it is found that a function calls an encryption function in the cryptographic library, static analysis will further trace the source of its parameters. These parameters may include the type of encryption algorithm, the length of the key, the value of the key, etc., which is very important for detecting cryptographic misuse. In this way, it is clear which functions in the program call sensitive cryptographic operations and the contextual relationship of these operations. In some complex cases, the existence of function pointers and dynamic library calls makes the function call relationship difficult to parse. In order to deal with these situations, this work adopts an in-depth analysis of the function call context in static analysis, and ensures that all function calls involving cryptography can be correctly identified and analyzed by parsing the symbol table information and the data flow relationship in the control flow graph.

[0044] Preferably, the backtracking slice module traces the life cycle of the parameters of the sensitive function, including:

[0045] Based on the backtracking slicing technology, the parameter passing instruction address of the sensitive function is determined, the register and stack operations in the function call relationship of the cryptographic function are analyzed, and the parameters in the sensitive function are tracked. The backtracking slicing will start from the use point of the parameters in the sensitive function and track the initial assignment point of the parameters in the sensitive function.

[0046] Preferably, tracking the initial value assignment point of the parameter in the sensitive function includes:

[0047] Based on the backtracking slicing technology, the flow of parameters in sensitive functions is traced forward step by step through the function call chain.

[0048] Preferably, the backtrace slicing module performs backtrace based on assembly instructions of the X86 architecture.

[0049] Specifically, the backtracking module mainly solves the problem of tracing the function parameters. If a sensitive function is detected (i.e., the "convergence point function" defined in the rule, SINK function), and the rule has specific restrictions on its parameters, it is necessary to trace the life cycle of the parameters to determine the correct starting point for the subsequent dynamic symbolic execution process. For example, in the asymmetric encryption algorithm RSA, it is necessary to find the instruction address that defines the key length. The goal of the backtracking slicing technology is to start from the SINK function, trace the transfer path of its parameters, and determine the initial value and source of these parameters. First, when the local static analysis locks a sensitive cryptographic function (such as an encryption function or a key generation function), it is necessary to start the backtracking analysis from the parameters of these functions.

[0050] In addition, in binary executable files, parameter passing is often implemented through registers and stacks, which is different from the explicit variable names in the source code. The backtracking slicing technology tracks the parameters in sensitive functions by analyzing the operations of registers and stacks in function calls. Specifically, the backtracking slicing will start from the point of use of these parameters and gradually trace forward until their initial assignment points are found. In this framework, the starting point of the analysis is first determined, that is, the address of the parameter passing instruction of the SINK function. For example, in RSA encryption, the key length is a very critical parameter. The starting point of the backtracking slicing is when the SINK function is found. If there are restrictions on its parameters in the rules, then it is necessary to find the starting position of the parameter life cycle as the starting point of the dynamic symbolic execution process. Next, by analyzing the transfer process of these parameters, backtrack to their assignment points. For example, in assembly code, instructions such as mov will assign values ​​to registers or stacks. Through these instructions, the specific assignment location of the key length or encryption mode can be traced. At the same time, the backtracking slicing technology can also handle cross-function parameter passing. In complex binary executable files, parameters are often not passed only in a single function, but across multiple functions. The backtracking slicing technique will gradually trace the flow of parameters forward through the function call chain to ensure that the original source of the parameters can be traced. For example, the key length variable may be initialized in a function upstream and then passed to the SINK function through a function call. Backtracking slicing can accurately handle this cross-function parameter passing situation. In addition, in order to improve the efficiency of tracing, this work does not use the intermediate representation (IR) for parameter analysis, but directly backtracks based on the assembly instructions of the X86 architecture. This avoids the additional overhead caused by instruction generalization and can more efficiently track the initial assignment of parameters.

[0051] Preferably, the framework adopted by the symbolic execution module is UC-Angr. UC-Angr is based on the symbolic execution extension of UC-KLEE and supports dynamic symbolic execution and under-constrained state management. In UC-Angr, insufficiently constrained data will be marked as a symbolic state and used as a pointer during program execution to generate a new unconstrained symbolic area and track memory operations and register states during program execution.

[0052] Preferably, the symbolic execution module further includes:

[0053] The execution is performed by setting restrictions on path exploration, including UC-Angr controlling the execution path by limiting the number of branches of function calls. When the number of branches of a sensitive function exceeds the limit, the return instruction is used to return directly.

[0054] Specifically, underconstrained dynamic symbolic execution is a very critical step in the cryptographic misuse detection process. It simulates the execution of binary files and executes code between limited starting points and end points to detect potential cryptographic misuse problems. Since the path and state space of a program are often very large, underconstrained dynamic symbolic execution avoids the global path explosion problem by constraining the starting point and end point, and focuses on the analysis of cryptographic related areas. The core of underconstrained dynamic symbolic execution (UCSE) is to execute code between a specific starting point and end point without having to fully explore the execution path of the entire program. This enables the tool to analyze only local paths related to cryptography without having to process the entire program. For example, in the detection of the RSA algorithm, symbolic execution starts from a certain starting point (such as the location of key initialization) and executes to the end point (such as the call of the encryption operation). This localized execution greatly reduces the number of paths that need to be processed, thereby avoiding the path explosion problem. A key feature of underconstrained dynamic symbolic execution is that it symbolizes memory and register states. During execution, the memory and register states of the program are symbolized, that is, these states are not assigned specific values, but are represented by symbolic variables. This symbolization enables analysis tools to execute programs within specific constraints and focus on relevant paths without exhausting all possible execution paths. Underconstrained dynamic symbolic execution is not designed to explore more paths, but to avoid the path explosion problem by limiting the execution scope while ensuring that critical cryptographic misuse issues are captured within the scope.

[0055] In addition, in order to achieve underconstrained execution, the framework of this paper adopts the technology of UC-Angr. UC-Angr is based on the symbolic execution extension of UC-KLEE and supports dynamic symbolic execution and underconstrained state management. In UC-Angr, insufficiently constrained data (i.e., underconstrained data) is marked as symbolic state. These data may be used as pointers during program execution, generating a new unconstrained symbolic area (called shadow memory). In this way, UC-Angr can track memory operations and register states during program execution, providing more fine-grained analysis for cryptographic misuse detection. Another improvement of UC-Angr is the processing of global variables. Traditional symbolic execution tools often do not symbolize global variables, which may result in some program behaviors that cannot be fully analyzed, especially in cryptographic misuse detection, where global variables may be used to store sensitive keys or configuration parameters. UC-Angr symbolizes global variables, which enables it to more accurately simulate the execution of cryptographic functions and capture potential misuse issues that rely on global variables. Finally, underconstrained dynamic symbolic execution avoids state explosion by setting restrictions on path exploration. For example, UC-Angr controls the complexity of the execution path by limiting the number of branches of function calls (e.g., no more than 64 branches). If the number of branches of a function exceeds this limit, the tool will use the return instruction to return directly to avoid falling into a complex branch structure. Through this path restriction mechanism, underconstrained dynamic symbolic execution can greatly reduce the risk of path explosion while maintaining sufficient accuracy. The goal of this step is to simulate execution paths related to cryptographic operations and detect possible misuse issues on these paths, such as insecure encryption algorithms or parameter configuration errors.

[0056] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, including:

[0057] When the symbolic execution module executes the program in a symbolic state, the state information of the program under different execution paths is recorded. The rule verification module determines whether the conditions defined in the predefined rule file are met by analyzing the state information.

[0058] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, and further includes:

[0059] When the symbolic execution module executes the program in a symbolic state, it generates a memory map of the program and records the usage and storage of key data. The rule verification module determines whether there is a problem with the program by checking the memory map.

[0060] Preferably, the rule verification module matches the dynamic symbolic execution result according to the predefined rule file, and further includes:

[0061] When a function calls an encryption function in the cryptographic library, but the parameter configuration before the call is completed in other functions, the rule verification module tracks the entire call chain to ensure that all encryption parameters meet the requirements of the predefined rule file during the entire transmission process.

[0062] Specifically, rule verification is the last step of the entire cryptographic misuse detection process. It uses a pre-defined rule file to judge the results of dynamic symbolic execution to confirm whether there is a cryptographic misuse problem in the program. Through this step, the system can compare the analysis results of symbolic execution with the correct usage specified in the rule file, thereby identifying potential security vulnerabilities and generating corresponding logs.

[0063] In addition, these rules mainly include common cryptographic misuse issues such as the use of insecure encryption algorithms, unreasonable encryption parameter configuration, and insecure random number generation. Each rule specifies corresponding function calls, parameter usage, and other requirements based on different cryptographic operations. For example, the rule file may specify that certain specific encryption algorithms (such as DES and RC4) are insecure algorithms. If the use of these algorithms is detected in the program, the tool will generate a misuse warning. In addition, the rule file may also define restrictions on certain encryption parameters, such as the key length cannot be less than a certain standard (for example, the RSA key length cannot be less than 1024 bits). The specific rule classification is as follows: Figure 2 shown.

[0064] The implementation of the rule verification process depends on the execution states generated by the previous steps of dynamic symbolic execution. During the dynamic symbolic execution process, the tool records the state information of the program under different execution paths, including register values, symbolic data in memory, function call sequences, etc. The rule verification module analyzes these states to determine whether the conditions defined in the rule file are met. For example, if the rule file stipulates that the key length must be greater than 128 bits, the rule verification module will check all key-related operations on the execution path to confirm whether the actual length of the key meets the requirements.

[0065] Another important function of rule verification is to analyze the runtime memory state. During the dynamic symbolic execution process, the tool generates a memory map of the program and records the use and storage of key data. The rule verification module can check these memory maps to determine whether the program has problems such as unreleased memory and key exposure in memory. For example, the rule file may stipulate that the key should be cleared from the memory after the encryption operation is completed. If it is detected that the program does not clear the key in a certain execution path, the tool will generate a log warning about the memory leak.

[0066] In addition, rule verification also needs to handle complex function call sequences and cross-function contexts. Rule verification is not just a simple check of whether the use of a function or a parameter complies with the specification, but also analyzes the entire function call chain to ensure that the parameters passed between different functions also meet security requirements. For example, a function may call an encryption function in the cryptographic library, but the parameter configuration before the call is completed in other functions. The rule verification module ensures that all encryption parameters meet the requirements of the rule file during the entire transfer process by tracing the entire call chain.

[0067] At the end of rule verification, the tool will generate log files based on the matched rule results to record the misuse in the program. These log files include detailed information such as the specific location of the misuse, the function calls involved, and parameter usage. Developers can use these logs to fix problems in the code and ensure that the cryptographic operations of the program meet security standards. The logs generated by rule verification can accurately identify cryptographic misuse issues in binary files and locate the misuse very accurately.

[0068] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A password misuse detector for binary executable files based on a combination of dynamic and static methods, characterized in that: include: Sampling module, backtracking slicing module, symbolic execution module and rule verification module; The sampling module extracts symbol information from the binary executable file, performs local analysis on the cryptographic function based on the symbol information and constructs a local control flow graph of the cryptographic function. After the local control flow graph of the cryptographic function is established, the calling relationship of the cryptographic function is analyzed, the functions and data involved in the cryptographic operation are located, and sensitive functions are detected; The backtracking slicing module traces back the life cycle of the parameters of the sensitive function and determines the source and transfer path of the parameters; The symbolic execution module simulates the actual execution path of the program based on the parameter source and transfer path of the sensitive function, executes the program in a symbolic state, creates a symbol vector for the starting address of the binary executable file, and opens up a virtual space of corresponding size, maps the simulated execution result to the symbol and memory, and outputs the dynamic symbolic execution result; The rule verification module matches the dynamic symbol execution results according to the predefined rule file to determine whether there is password misuse in the program and records the judgment result in a log file.

2. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 1 is characterized in that: The backtracking slice module traces the life cycle of the parameters of the sensitive function, including: Based on the backtracking slicing technology, the parameter passing instruction address of the sensitive function is determined, the register and stack operations in the function call relationship of the cryptographic function are analyzed, and the parameters in the sensitive function are tracked. The backtracking slicing will start from the use point of the parameters in the sensitive function and track the initial assignment point of the parameters in the sensitive function.

3. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 2 is characterized in that: The initial value assignment point of the parameters in the tracking sensitive function includes: Based on the backtracking slicing technology, the flow of parameters in sensitive functions is traced forward step by step through the function call chain.

4. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 3 is characterized in that: The backtrace slicing module performs backtrace based on the assembly instructions of the X86 architecture.

5. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 1 is characterized in that: The framework adopted by the symbolic execution module is UC-Angr. UC-Angr is based on the symbolic execution extension of UC-KLEE and supports dynamic symbolic execution and under-constrained state management. In UC-Angr, insufficiently constrained data will be marked as a symbolic state and used as a pointer during program execution to generate a new unconstrained symbolic area and track memory operations and register states during program execution.

6. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 5 is characterized in that: The symbolic execution module also includes: The execution is performed by setting restrictions on path exploration, including UC-Angr controlling the execution path by limiting the number of branches of function calls. When the number of branches of a sensitive function exceeds the limit, the return instruction is used to return directly.

7. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 1 is characterized in that: The rule verification module matches the dynamic symbolic execution result according to the predefined rule file, including: When the symbolic execution module executes the program in a symbolic state, the state information of the program under different execution paths is recorded. The rule verification module determines whether the conditions defined in the predefined rule file are met by analyzing the state information.

8. The password misuse detector based on a binary executable file combining dynamic and static detection according to claim 7, characterized in that: The rule verification module matches the dynamic symbol execution result according to the predefined rule file, and also includes: When the symbolic execution module executes the program in a symbolic state, it generates a memory map of the program and records the usage and storage of key data. The rule verification module determines whether there is a problem with the program by checking the memory map.

9. The password misuse detector based on binary executable files combined with dynamic and static methods according to claim 8 is characterized in that: The rule verification module matches the dynamic symbol execution result according to the predefined rule file, and also includes: When a function calls an encryption function in the cryptographic library, but the parameter configuration before the call is completed in other functions, the rule verification module tracks the entire call chain to ensure that all encryption parameters meet the requirements of the predefined rule file during the entire transmission process.

Images