CFG reconstruction method based on PPC binary file

Abstract

The invention discloses a CFG reconstruction method based on a PPC binary file, and the method comprises the following steps: (1) analyzing a symbol table in an executable file, and obtaining all function information; (2) disassembling the executable file to obtain a disassembling code; (3) analyzing the assembly instructions one by one by taking a function as a unit, and identifying all basic blocks influencing the sequential execution of the instructions; (4) summarizing the basic block related information obtained in the step (3) to form a basic block information list, namely the information of all basic blocks in the function; (5) drawing CFG according to the basic block information list; according to the method and the device, the switch jump in the PowerPC can be accurately identified.

Description

Technical Field

[0001] The present invention relates to the field of embedded technology, and in particular to a CFG reconstruction method based on a PPC binary file. Background Art

[0002] Reconstructing the Control Flow Graph (CFG) from binary files is an essential foundation for target code analysis. Common target code analysis activities, such as target code-based stack analysis and target code-based WCET analysis, rely on two steps: 1) disassembling the binary executable file to obtain assembly code; 2) reconstructing the CFG from the assembly code. Currently, tools for disassembling PowerPC binary target files, such as objdump and IDA, are relatively mature and require no further research. However, there is no mature method to guide the implementation of corresponding automated tools for reconstructing the CFG from PowerPC assembly code. Summary of the Invention

[0003] Purpose of the invention: The purpose of the present invention is to provide a CFG reconstruction method based on PPC binary files. For PowerPC binary executable files, a CFG reconstruction method is proposed to serve as the basis for activities such as stack analysis based on PowerPC target code and WCET analysis based on PowerPC target code.

[0004] Technical solution: The CFG reconstruction method based on PPC binary files described in the present invention includes the following steps: (1) Parse the symbol table in the executable file and obtain all function information; (2) Disassemble the executable file to obtain the disassembled code; (3) Analyze assembly instructions one by one in function units to identify all basic blocks that affect the sequential execution of instructions; (4) Summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; (5) Draw CFG according to the basic block information list.

[0005] Furthermore, in step (1), the executable file is in ELF format.

[0006] Furthermore, in step (1), the function information includes the function name, starting address and length.

[0007] Furthermore, step (3) includes the following steps: (31) Add the [address of the start instruction of the current function] to the [list of the start addresses of the basic blocks], and then go to step (32), that is, starting from the start instruction, analyze the assembly instructions of the function one by one in the order of address from small to large; (32) If the current assembly instruction is a bl instruction, i.e., a function call instruction, then add [the address of the current instruction, the jump address of the current instruction] to the [function call information list], and then go to step (37); otherwise, go to step (33); (33) If the current assembly instruction is a blr or rfi instruction, i.e., a return instruction, then add the [address of the current instruction] to the [return instruction address list] and proceed to step (37); otherwise, proceed to step (34); (34) If the current assembly instruction is instruction b, that is, an unconditional jump instruction, then add [the jump address of the current instruction] to [the list of the starting addresses of the basic blocks], and add the jump information [1-way, current instruction address, jump address of the current instruction] to [the jump information list], and then go to step (37); otherwise, go to step (35); (35) If the current assembly instruction is a bc instruction, i.e., a conditional jump instruction, then add [the jump address of the current instruction] and [the current instruction address + 4] to the [list of the starting addresses of the basic blocks], and add [2-way, the current instruction address, (the jump address of the current instruction, the current instruction address + 4)] to the [jump information list], and then go to step (37); otherwise, go to step (36); (36) If the current assembly instruction is bctr, that is, a switch jump instruction, then perform jump table analysis and then proceed to step (37); otherwise, proceed directly to step (37); (37) If the current instruction address - the function start instruction + 4 < the function length, it means that the function has not yet ended, so get the next instruction and then go to step (32); otherwise, the function analysis ends and go to step (4).

[0008] Furthermore, step (36) includes the following steps: (361) From the current bctr instruction, traverse upwards. If all the above instructions are found, and there is only one bc xxx jump instruction, then it is determined that the jump table is found, and the first address of the jump table is value, and the number of jump addresses in the jump table is n+1, then go to step (362); otherwise, go to step (37); (362) Calculate the jump address of the jump table. There are n jump addresses in total. The calculation method is: Jump address 1 = jump table first address value + the first value in the jump table … Jump address n = Value of the start address of the jump table + The nth value in the jump table Then proceed to step (363); (363) Add [Jump address 1, Jump address 2... Jump address n] to [The list of start addresses of basic blocks], and add [n-way, the current instruction address, (Jump address 1, Jump address 2... Jump address n)] to [The jump information list], then proceed to step (37).

[0009] Furthermore, step (4) includes the following steps: (41) Arrange the addresses in [The list of start addresses of basic blocks] in ascending order and remove duplicate addresses; (42) Traverse [The list of start addresses of basic blocks], and for each start address therein, establish the corresponding basic block information.

[0010] Furthermore, step (42) is specifically as follows: Assume that there are N elements in [The list of start addresses of basic blocks], with the serial numbers ranging from 1 - N, and currently the i-th element is being traversed; (421) [Basic block information list][i].[Start address] = [The list of start addresses of basic blocks][i];[[ID=१८]] Where, [Basic block information list][i] represents the i-th basic block information in the basic block information list; [Basic block information list][i].[Start address] represents the start address of the i-th basic block information; Similar description methods will not be elaborated further below;[[ID=२०]] (422) If i < N - 1, [Basic block information list][i].[Length] = [The list of start addresses of basic blocks][i + 1] - [The list of start addresses of basic blocks][i]; Otherwise, it means it is the last basic block, [Basic block information list][i].[Length] = Function start address + Function length - [The list of start addresses of basic blocks] [i];[[ID=२२]] (423) Traverse [The list of return instruction addresses], if [Basic block information list][i].[Start address] + [Basic block information list][i].[Length] - 4 = any element in [The list of return instruction addresses], then [Basic block information list][i].[Whether it contains a function return] = Yes, otherwise [Basic block information list][i].[Whether it contains a function return] = No;[[ID=२४]] (424) Traverse the [jump information list]. If [basic block information list][i].[starting address] + [basic block information list][i].[length] - 4 = [jump information list][j].[address of jump instruction], then [basic block information list][i].[successor starting address list] = [jump information list][j].[target address list of jump instruction]; (425) Traverse [Function Call Information List]. If [Basic Block Information List][i].[Starting Address] ≤ [Function Call Information List][j]. [Address of Function Call Instruction] < [Basic Block Information List][i].[Starting Address] + [Basic Block Information List][i].[Length], then add [Function Call Information List][j] to [Basic Block Information List][i].[Function Call Information List].

[0011] The present invention provides a CFG reconstruction system based on a PPC binary file, comprising: Parsing module: used to parse the symbol table in the executable file and obtain all function information; Disassembly module: used to disassemble the executable file and obtain the disassembly code; Identification module: used to analyze assembly instructions one by one in function units and identify all basic blocks that affect the sequential execution of instructions; Summary module: used to summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; Drawing module: used to draw CFG according to the basic block information list.

[0012] An electronic device described in the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, any one of the CFG reconstruction methods based on a PPC binary file is implemented.

[0013] The storage medium of the present invention stores a computer program, and when the computer program is executed by a processor, it implements any one of the CFG reconstruction methods based on PPC binary files.

[0014] Beneficial effects: Compared with the existing technology, the present invention has the following significant advantages: only one scan analysis is required for the assembly code of each function to obtain all the information required to reconstruct the CFG, without the need to scan the assembly code multiple times; it is specially customized for the PowerPC instruction set and has high accuracy, especially the ability to accurately identify switch jumps in PowerPC. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0016] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0017] like Figure 1 As shown, an embodiment of the present invention provides a CFG reconstruction method based on a PPC binary file, comprising the following steps: (1) Parse the symbol table in the executable file to obtain all function information; the executable file is in ELF format; the function information includes function name, starting address and length.

[0018] (2) Disassemble the executable file to obtain the disassembled code; (3) Analyze the assembly instructions one by one in function units to identify all basic blocks that affect the sequential execution of instructions; including the following steps: (31) Add the [address of the start instruction of the current function] to the [list of the start addresses of the basic blocks], and then go to step (32), that is, starting from the start instruction, analyze the assembly instructions of the function one by one in the order of address from small to large; (32) If the current assembly instruction is a bl instruction, i.e., a function call instruction, then add [the address of the current instruction, the jump address of the current instruction] to the [function call information list], and then go to step (37); otherwise, go to step (33); (33) If the current assembly instruction is a blr or rfi instruction, i.e., a return instruction, then add the [address of the current instruction] to the [return instruction address list] and proceed to step (37); otherwise, proceed to step (34); (34) If the current assembly instruction is instruction b, that is, an unconditional jump instruction, then add [the jump address of the current instruction] to [the list of the starting addresses of the basic blocks], and add the jump information [1-way, current instruction address, jump address of the current instruction] to [the jump information list], and then go to step (37); otherwise, go to step (35); (35) If the current assembly instruction is a bc instruction, i.e., a conditional jump instruction, then add [the jump address of the current instruction] and [the current instruction address + 4] to the [list of the starting addresses of the basic blocks], and add [2-way, the current instruction address, (the jump address of the current instruction, the current instruction address + 4)] to the [jump information list], and then go to step (37); otherwise, go to step (36); (36) If the current assembly instruction is bctr, i.e., a switch jump instruction, then perform jump table analysis and then proceed to step (37); otherwise, proceed directly to step (37); including the following steps: (361) From the current bctr instruction, traverse upwards. If all the above instructions are found, and there is only one bc xxx jump instruction, then it is determined that the jump table is found, and the first address of the jump table is value, and the number of jump addresses in the jump table is n+1, then go to step (362); otherwise, go to step (37); (362) Calculate the jump address of the jump table. There are n jump addresses in total. The calculation method is: Jump address 1 = jump table first address value + the first value in the jump table … Jump address n = jump table first address value + the nth value in the jump table Then go to step (363); (363) Add [jump address 1, jump address 2 ... jump address n] to the [list of starting addresses of basic blocks], and add [n-way, current instruction address, (jump address 1, jump address 2 ... jump address n)] to the [jump information list], and then go to step (37).

[0019] (37) If the current instruction address - the function start instruction + 4 < the function length, it means that the function has not yet ended, so get the next instruction and then go to step (32); otherwise, the function analysis ends and go to step (4).

[0020] Among them, all PowerPC instructions that affect the sequential execution of instructions are identified, see Table 1, and then the basic block related information is obtained, see Table 2.

[0021] Table 1 PowerPC instructions that affect the order of instruction execution ; Table 2 Basic block information required to rebuild CFG ; (4) Summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; including the following steps: (41) Arrange the addresses in the [list of starting addresses of basic blocks] from small to large and remove duplicate addresses; (42) Traverse the [list of basic block start addresses] and establish the corresponding basic block information for each start address. The details are as follows: Assume that there are N elements in the [list of basic block start addresses], numbered from 1 to N, and the current traversal reaches the i-th element; (421) [basic block information list][i].[start address] = [list of basic block start addresses][i]; Among them, [basic block information list][i] represents the i-th basic block information in the basic block information list; [basic block information list][i].[starting address] represents the starting address of the i-th basic block information; similar description methods will not be elaborated hereinafter; (422)If i < N - 1, [basic block information list][i].[length] = [list of starting addresses of basic blocks][i + 1] - [list of starting addresses of basic blocks][i]; otherwise, it means it is the last basic block, [basic block information list][i].[length] = function starting address + function length - [list of starting addresses of basic blocks][i]; (423)Traverse the [list of return instruction addresses]. If [basic block information list][i].[starting address] + [basic block information list][i].[length] - 4 is equal to any element in the [list of return instruction addresses], then [basic block information list][i].[whether it contains function return] = yes, otherwise [basic block information list][i].[whether it contains function return] = no; (424)Traverse the [jump information list]. If [basic block information list][i].[starting address] + [basic block information list][i].[length] - 4 = [jump information list][j].[address of jump instruction], then [basic block information list][i].[list of starting addresses of successors] = [jump information list][j].[list of target addresses of jump instruction]; (425)Traverse the [function call information list]. If [basic block information list][i].[starting address] ≤ [function call information list][j].[address of function call instruction] < [basic block information list][i].[starting address] + [basic block information list][i].[length], then add [function call information list][j] to [basic block information list][i].[function call information list].

[0022] Among them, the content of each basic block information is shown in Table 3; Table 3 Content contained in each basic block information ; (5)Draw the CFG according to the basic block information list.

[0023] [[ID=二十一]]This embodiment of the present invention also provides a CFG reconstruction system based on a PPC binary file, including: [[ID=二十二]] [[ID=二十三]]Parsing module: used to parse the symbol table in the executable file to obtain all function information; [[ID=二十四]] [[ID=二十五]]Disassembly module: used to disassemble the executable file to obtain the disassembly code; [[ID=二十六]] Identification module: used to analyze assembly instructions one by one in function units and identify all basic blocks that affect the sequential execution of instructions; Summary module: used to summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; Drawing module: used to draw CFG according to the basic block information list.

[0024] An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, it implements any one of the CFG reconstruction methods based on PPC binary files.

[0025] An embodiment of the present invention further provides a storage medium storing a computer program. When the computer program is executed by a processor, it implements any one of the CFG reconstruction methods based on a PPC binary file.

Claims

1. A CFG reconstruction method based on PPC binary file, characterized in that: The following steps are involved: (1) Parse the symbol table in the executable file to obtain all function information; (2) Disassemble the executable file to obtain the disassembled code; (3) Analyze assembly instructions one by one in function units to identify all basic blocks that affect the sequential execution of instructions; (4) Summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; (5) Draw CFG according to the basic block information list.

2. A CFG reconstruction method based on PPC binary file according to claim 1, characterized in that: In step (1), the executable file is in ELF format.

3. A CFG reconstruction method based on PPC binary file according to claim 1, characterized in that: In step (1), the function information includes the function name, starting address and length.

4. The CFG reconstruction method based on PPC binary file according to claim 1, characterized in that: Step (3) includes the following steps: (31) Add [the address of the start instruction of the current function] to [the list of the start addresses of the basic blocks], and then go to step (32), that is, starting from the start instruction, analyze the assembly instructions of the function one by one in the order of address from small to large; (32) If the current assembly instruction is a bl instruction, i.e., a function call instruction, then add [the address of the current instruction, the jump address of the current instruction] to the [function call information list], and then go to step (37); otherwise, go to step (33); (33) If the current assembly instruction is a blr or rfi instruction, i.e., a return instruction, then add the [address of the current instruction] to the [return instruction address list] and proceed to step (37); otherwise, proceed to step (34); (34) If the current assembly instruction is instruction b, that is, an unconditional jump instruction, then add [the jump address of the current instruction] to [the list of the starting addresses of the basic blocks], and add the jump information [1-way, current instruction address, jump address of the current instruction] to [the jump information list], and then go to step (37); otherwise, go to step (35); (35) If the current assembly instruction is a bc instruction, i.e., a conditional jump instruction, then add [the jump address of the current instruction] and [the current instruction address + 4] to the [list of the starting addresses of the basic blocks], and add [2-way, the current instruction address, (the jump address of the current instruction, the current instruction address + 4)] to the [jump information list], and then go to step (37); otherwise, go to step (36); (36) If the current assembly instruction is bctr, i.e., a switch jump instruction, then perform jump table analysis and then proceed to step (37); otherwise, proceed directly to step (37); (37) If the current instruction address - the function start instruction + 4 < the function length, it means that the function has not ended yet, so get the next instruction and then go to step (32); otherwise, the function analysis ends and go to step (4).

5. A CFG reconstruction method based on PPC binary file according to claim 4, characterized in that: Step (36) comprises the following steps: (361) From the current bctr instruction, traverse upwards. If all the above instructions are found, and there is only one bcxxx jump instruction among them, then it is determined that the jump table is found, and the first address of the jump table is value, and the number of jump addresses in the jump table is n+1, then go to step (362); otherwise, go to step (37); (362) Calculate the jump address of the jump table. There are n jump addresses in total. The calculation method is: Jump address 1 = jump table first address value + the first value in the jump table … Jump address n = jump table first address value + nth value in jump table Then go to step (363); (363) Add [jump address 1, jump address 2 ... jump address n] to the [list of starting addresses of basic blocks], and add [n-way, current instruction address, (jump address 1, jump address 2 ... jump address n)] to the [jump information list], and then go to step (37).

6. The CFG reconstruction method based on PPC binary file according to claim 1, characterized in that: Step (4) includes the following steps: (41) Arrange the addresses in [the list of starting addresses of basic blocks] from small to large and remove duplicate addresses; (42) Traverse the [list of starting addresses of basic blocks] and establish corresponding basic block information for each starting address.

7. A CFG reconstruction method based on PPC binary file according to claim 6, characterized in that: Step (42) is as follows: Assume that there are N elements in the [list of starting addresses of basic blocks], numbered from 1 to N, and the current traversal is to the i-th element; (421) [basic block information list][i].[starting address] = [list of starting addresses of basic blocks][i]; Wherein, [basic block information list][i] represents the i-th basic block information in the basic block information list; [basic block information list][i].[starting address] represents the starting address of the i-th basic block information; similar descriptions are described below and will not be further explained; (422) If i < N -1, [basic block information list][i].[length] = [basic block start address list] [i+1] - [basic block start address list] [i]; otherwise, it means it is the last basic block, [basic block information list][i].[length] = function start address + function length - [basic block start address list] [i]; (423) Traverse [Return Instruction Address List], if [Basic Block Information List][i].[Start Address] + [Basic Block Information List][i].[Length] - 4 = any element in [Return Instruction Address List], then [Basic Block Information List][i].[Whether to include function return] = Yes, otherwise [Basic Block Information List][i].[Whether to include function return] = No; (424) Traverse the [jump information list]. If [basic block information list][i].[starting address] + [basic block information list][i].[length] - 4 = [jump information list][j].[address of jump instruction], then [basic block information list][i].[successor starting address list] = [jump information list][j].[target address list of jump instruction]; (425) Traverse [Function Call Information List]. If [Basic Block Information List][i].[Starting Address] ≤ [Function Call Information List][j]. [Address of Function Call Instruction] < [Basic Block Information List][i].[Starting Address] + [Basic Block Information List][i].[Length], then add [Function Call Information List][j] to [Basic Block Information List][i].[Function Call Information List].

8. A CFG reconstruction system based on PPC binary files, characterized in that: include: Parsing module: used to parse the symbol table in the executable file and obtain all function information; Disassembly module: used to disassemble the executable file and obtain the disassembly code; Identification module: used to analyze assembly instructions one by one in function units and identify all basic blocks that affect the sequential execution of instructions; Summarization module: used to summarize the basic block related information obtained in step (3) to form a basic block information list, that is, the information of all basic blocks in the function; Drawing module: used to draw CFG according to the basic block information list.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the computer program is loaded into a processor, a CFG reconstruction method based on a PPC binary file according to any one of claims 1 to 7 is implemented.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a CFG reconstruction method based on a PPC binary file according to any one of claims 1 to 7 is implemented.

Images