Binary program variable type recovery method, model training method and device

Abstract

The invention provides a binary program variable type recovery method and device and a model training method and device. The recovery method comprises the steps of obtaining a target binary program; obtaining a plurality of to-be-recovered samples according to the target binary program; determining a target training sample with the highest similarity with the to-be-recovered sample in the training sample set through the target learning model; and determining the data type corresponding to the target training sample as the data type of the variable corresponding to the to-be-recovered sample. According to the method and the device, binary program slicing is carried out by using the data stream information between the functions to obtain the training sample containing the cross-function variable information, so that the training sample with richer information amount is obtained. The target learning model obtained after the first learning model is trained based on the training sample set can reliably recognize more important features from complex and uncommon data types, so that the data types of the variables can be recovered more accurately.

Description

Technical Field

[0001] The present application belongs to the technical field of program variable type analysis, and in particular, relates to a binary program variable type recovery method, a model training method and a device. Background Art

[0002] Recovering the data types of variables in binary programs is a critical and challenging task in reverse engineering, as it is fundamental to many security applications (e.g., vulnerability detection), especially for scenarios where commercial binary programs with missing source code need to be analyzed. Traditional program analysis methods heavily rely on human-made hand-coded type inference rules, which are brittle, require much effort to maintain and update, and are often limited by the inherent complexity of real-world software systems, especially complex data structures.

[0003] To address these limitations, most existing binary program variable type recovery technologies use data-driven machine learning methods. However, existing machine learning-based binary program variable type recovery technologies are overly dependent on the quality of the training data set. The conventional supervised learning strategies used by these technologies will make the trained neural networks more focused on learning samples with high frequency of occurrence, which makes it difficult for the above technologies to analyze complex and uncommon data types. In many actual usage scenarios, complex and uncommon data types are often the key to subsequent security analysis. In actual applications, existing technologies have problems with low accuracy and unclear data structure information when recovering complex and uncommon data types. Summary of the invention

[0004] The embodiments of the present application provide a binary program variable type recovery method, a model training method and a device, which can solve the problems of low accuracy and unclear data structure information in the prior art for recovering complex and uncommon data types.

[0005] In a first aspect, an embodiment of the present application provides a binary program variable type recovery method, comprising:

[0006] Get the target binary program;

[0007] According to the target binary program, a plurality of samples to be restored are obtained; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program;

[0008] Determine, by means of a target learning model, a target training sample in a training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training a first learning model using the training sample set, and the training sample set includes a plurality of training samples annotated with data types; any of the training samples is a first assembly instruction sequence in a vector form corresponding to a variable in a first function in a source code; the first assembly instruction sequence is obtained by program slicing data flow information between first functions in the source code;

[0009] The data type corresponding to the target training sample is determined as the data type of the variable corresponding to the sample to be restored.

[0010] In a possible implementation manner of the first aspect, obtaining a plurality of samples to be restored according to the target binary program includes:

[0011] Disassembling the target binary program to obtain target assembly instructions, target function boundaries, and target function call relationships;

[0012] Analyze the boundary of the target function and the calling relationship information of the target function, and generate a target control flow graph and a target data flow graph between the target functions;

[0013] The target assembly instructions are program sliced ​​based on the target control flow graph and the target data flow graph to obtain a plurality of samples to be restored; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in the target function.

[0014] In a second aspect, an embodiment of the present application provides a model training method, comprising:

[0015] Obtain one or more source codes and extract data types of variables in the source codes;

[0016] Program slicing is performed on data flow information between first functions in the source code to obtain a plurality of training samples; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code;

[0017] The training samples are labeled using the data types of the variables in the source code as labels to obtain a training sample set;

[0018] The first learning model is trained using the training sample set to obtain a target learning model.

[0019] In a possible implementation manner of the second aspect, the performing program slicing on the data flow information between the first functions in the source code to obtain multiple training samples includes:

[0020] Compiling the source code to obtain a first binary program;

[0021] Disassembling the first binary program to obtain a first assembly instruction, a boundary of a first function, and a calling relationship of the first function;

[0022] Analyze the boundary of the first function and the calling relationship of the first function, and generate a first control flow graph and a first data flow graph between the first functions;

[0023] The first assembly instruction is program sliced ​​based on the first control flow graph and the first data flow graph to obtain multiple training samples; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in the first function.

[0024] In a possible implementation manner of the second aspect, the using the training sample set to train the first learning model to obtain a target learning model includes:

[0025] Dividing the training sample set into a training set, a validation set and a test set;

[0026] Extracting a first number of different types of data from the training set, the validation set, and the test set, respectively, and for each data type in the first number of different types of data types, extracting a second number of training samples as a support set and a third number of training samples as a query set;

[0027] The first learning model is trained through the support set and query set of the training set, validation set, and test set, or through the support set and query set of the training set and validation set, so that the first learning model establishes a mapping relationship according to the similarity of the training samples in the support set and the query set; and the loss function of the first learning model converges by updating the weight matrix of the first learning model to obtain the target learning model.

[0028] In a possible implementation manner of the second aspect, after obtaining the target learning model, the method further includes:

[0029] Determining the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set by using the target learning model;

[0030] Determine the data type corresponding to the training sample in the support set of the prediction set having the highest similarity to the training sample in the query set of the prediction set as the data type of the training sample in the query set of the prediction set;

[0031] The accuracy of the target learning model in restoring the data type is determined based on the target learning model's prediction results of the data type of the training samples in the query set of the prediction set and the data types annotated by the training samples in the query set of the prediction set.

[0032] In a possible implementation manner of the second aspect, compiling the source code to obtain the first binary program includes:

[0033] The source codes are compiled respectively with the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

[0034] In a third aspect, an embodiment of the present application provides a binary program variable type recovery device, comprising:

[0035] A target binary program acquisition module is used to acquire the target binary program;

[0036] A sample generation module to be restored is used to obtain a plurality of samples to be restored according to the target binary program; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program;

[0037] A first determination module is used to determine, through a target learning model, a target training sample in a training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training a first learning model using the training sample set, and the training sample set includes a plurality of training samples labeled with data types; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by program slicing data flow information between first functions in the source code;

[0038] The second determination module is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be restored.

[0039] In a fourth aspect, an embodiment of the present application provides a model training device, including:

[0040] A source code acquisition module is used to acquire one or more source codes;

[0041] An extraction module, used for extracting the data type of the variable in the source code;

[0042] A program slicing module, used for slicing the data flow information between the first functions in the source code to obtain a plurality of training samples; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code;

[0043] A labeling module, used for labeling the training samples with the data types of the variables in the source code as labels to obtain a training sample set;

[0044] The training module is used to train the first learning model using the training sample set to obtain a target learning model.

[0045] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the processor implements a binary program variable type recovery method as described in any one of the first aspects above, or implements a model training method as described in any one of the second aspects above.

[0046] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the binary program variable type recovery method as described in any one of the first aspects above, or implements the model training method as described in any one of the second aspects above.

[0047] In the seventh aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the binary program variable type recovery method as described in any one of the first aspects above, or implements the model training method as described in any one of the second aspects above.

[0048] Compared with the prior art, the embodiment of the present application has the following beneficial effects: the embodiment of the present application obtains training samples containing cross-function variable information by using data flow information between functions to slice binary programs, thereby obtaining training samples with richer information. The target learning model obtained after training the first learning model based on the training sample set can reliably identify more important features from complex and uncommon data types, thereby more accurately restoring the data type of the variable. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 This is a flow chart of a model training method provided in an embodiment of the present application. Figure 1 ;

[0051] Figure 2 It is a schematic diagram of the principle of the model training method provided in one embodiment of the present application;

[0052] Figure 3 This is a flow chart of a model training method provided in an embodiment of the present application. Figure 2 ;

[0053] Figure 4 This is a flow chart of a model training method provided in an embodiment of the present application. Figure 3 ;

[0054] Figure 5 This is a flow chart of a model training method provided in an embodiment of the present application. Figure 4 ;

[0055] Figure 6 This is a flow chart of a binary program variable type recovery method provided by an embodiment of the present application. Figure 1 ;

[0056] Figure 7 This is a flow chart of a binary program variable type recovery method provided by an embodiment of the present application. Figure 2 ;

[0057] Figure 8 It is a structural schematic diagram of a model training device provided in one embodiment of the present application;

[0058] Fig. 9 It is a structural diagram of a binary program variable type recovery device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0060] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0061] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0062] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0063] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0064] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0065] Glossary:

[0066] Source Code: Source code is the code written by developers in a high-level programming language. It is a human-readable text file that contains the logic and functionality of the program and defines the behavior of a computer program. The source code contains all elements of the program, including functions, variables, data types, control structures, etc.

[0067] Binary Program: A binary program is a machine code consisting of 0s and 1s, which is a language that computers can directly understand and execute. When the source code is processed by a compiler or interpreter, it is converted into a binary program, which is then executed by the computer hardware.

[0068] Assembly Instructions: Assembly instructions belong to assembly language, which is a low-level language that directly corresponds to the machine instructions of the computer, but is easier to understand than binary. Assembly instructions are a direct description of the operation of computer hardware, and each assembly instruction corresponds to a specific machine operation. Assembly instructions are usually used to operate on variables, such as addition, subtraction, multiplication, and division. These operations change the value of the variable, thereby realizing the function of the program. Assembly instructions can access variables through addressing.

[0069] Function: A function is a module or block of code in the source code that is used to perform a specific task or calculation. A function can accept input parameters (i.e., passed values ​​or variables), perform a series of operations, and return results. Functions improve the reusability, readability, and modularity of the code. Functions are defined in the source code and can be called from other places. For example, for the function y=3x+5y, where x and y are both variables, x is the independent variable, representing the input value; y is the dependent variable, representing the output value. The data type of the independent variable x can be integer, that is, x can only take integer values; the data type of x can also be floating point, that is, x can take decimal values. The data type of y is the same as that of x. The coefficient 3 and the constant 5 are not variables, they are constants.

[0070] Variable: A variable is a named location in the source code that is used to store data. Variables can store various types of data, such as integers, floating point numbers, strings, etc. The value of a variable can be read and modified during program execution. Variables are usually defined inside a function or in the global scope, and must be declared (in statically typed languages) or assigned a value (in dynamically typed languages) before use. In high-level languages, variables are namespaces used to store data. In assembly language, a variable usually corresponds to an address in memory. The definition of a variable (such as data type, size, etc.) is implemented in assembly through instructions and pseudo-instructions.

[0071] Data Type: Data type is used in programming languages ​​to specify the type of value that a variable can store. Data type defines the size, structure, and allowed operations of the data stored in the variable. Common data types include integer (int), floating point (float), string (string), Boolean (boolean), complex (complex), pointer (Pointer), union (Union), enumeration (Enum), etc. Some programming languages ​​also support more complex data types, such as arrays, structures, classes, interfaces, etc.

[0072] Program Slicing: Program slicing is a program analysis technique used to extract the parts of a program that are related to specific variables or calculations. Program slicing can focus on a specific aspect of a program (such as a specific variable) and ignore other irrelevant parts, thereby simplifying the understanding and analysis of the program.

[0073] When performing reverse engineering, the original source code is unknown and cannot be directly accessed, so reverse engineering requires analyzing the compiled binary program (i.e., binary file) to understand the logic and function of the program. However, binary programs lack clear data types, which means that the data type of the variable will be partially discarded during the compilation process, resulting in the need to restore it through inference during analysis.

[0074] Current variable type (i.e., data type of a variable) recovery technology has a poor effect on recovering complex and uncommon data types. For this reason, an embodiment of the present application proposes a model training method to recover complex and uncommon variable types.

[0075] See also Figure 1 and Figure 2 , Figure 1 A schematic flow chart of a model training method provided in an embodiment of the present application is shown. Figure 2 A schematic diagram of the principle of the model training method is shown, and the method includes S110-S150:

[0076] S110: Obtain one or more source codes, and extract data types of variables in the source codes.

[0077] The data types of variables in the source code should be as rich as possible. For example, the data types of variables include: integer, floating point, string, Boolean, structure, class, interface, pointer, union, enumeration, empty type, custom data types, etc.; for this purpose, multiple source codes can be obtained.

[0078] Source code is available from open source and / or closed source C / C++ projects.

[0079] Extracting data types from source code involves parsing and analyzing the source code. This process can be done in a variety of ways, including compilers, manual parsing, scripting, or using existing syntax analysis tools. For statically typed languages ​​such as C / C++, the data type of a variable is known at compile time and is specified in the code through declarations.

[0080] S120: Slice the data flow information between the first functions in the source code to obtain multiple training samples; any training sample is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code.

[0081] The first function is any function in the source code.

[0082] Extracting the first function in the source code can be achieved through a variety of methods such as manual search, regular expressions, abstract syntax trees or static analysis tools.

[0083] The data flow information between first functions refers to the information about the data transmission and flow between different first functions during the operation of the source code. By analyzing the data flow information between first functions, it is helpful to understand the logic of the program, optimize performance, debug errors, and maintain the code.

[0084] A variable may be defined in a first function and used in another first function, so it is necessary to track the data flow information across functions (i.e., between functions). By analyzing the data flow information between the first functions, it can be found out how the data between the first functions flows.

[0085] Specifically, program slicing of the data flow information between the first functions means that the calling relationship and data transfer between the first functions are taken into account, so that the influence of each first function in the source code on the specific variable (the specific variable is the variable currently being analyzed) can be systematically analyzed. Since each variable will be converted into a series of assembly instructions during the execution of the source code, the assembly instructions related to the specific variable in each first function are extracted through program slicing, and the extracted assembly instructions form the first assembly instruction sequence.

[0086] For example, if there are 20 first functions in the source code, and each first function has 10 variables, then there are 200 variables in the source code, and each variable corresponds to its own assembly instruction, which may be related to multiple first functions. Then program slicing is to traverse each variable in these 20 first functions, retain the assembly instructions related to the variables in the first function currently analyzed, and remove the assembly instructions that are not related to the variables in the first function currently analyzed, and obtain a total of 20*10=200 first assembly instruction sequences. It is easy to understand that the number of training samples = the number of first assembly instruction sequences = the number of variables in the first function.

[0087] It should be noted that the first assembly instruction sequence also needs to be converted into a vector form before it can be processed by the first learning model.

[0088] Since the first learning model processes numerical data, and the first assembly instruction sequence is non-numerical data, the first assembly instruction sequence is converted into a vector form in order to adapt the first learning model. Optionally, an assembly language model (for example: Asm2vec, DeepBinDiff or PalmTree, etc.) is used to encode the first assembly instruction sequence and convert it into a vector form. In order to improve the reliability of the assembly language model encoding, the first assembly instruction sequence obtained in S120 can also be used to train the assembly language model, and then the trained assembly language model is used to encode the first assembly instruction sequence.

[0089] S130: labeling training samples with data types of variables in the source code as labels to obtain a training sample set.

[0090] S140: Train the first learning model using the training sample set to obtain a target learning model.

[0091] Specifically, the first learning model is a neural network model.

[0092] The embodiment of the present application utilizes the data flow information between the first functions to perform program slicing, which can obtain variable information across functions, and further obtain training samples with richer information. The target learning model obtained by training the first learning model with this training sample can improve the accuracy of recovering complex and uncommon data types.

[0093] As an optional implementation of the embodiment of the present application, see Figure 3 , S120: program slicing the data flow information between the first functions to obtain multiple training samples, specifically including S121-S124.

[0094] S121: Compile the source code to obtain a first binary program.

[0095] Compiling source code into binary programs is the process of converting human-readable high-level programming languages ​​into low-level machine instructions that can be directly executed by computers. This process can be achieved through compilers and linkers. The compiler is responsible for converting source code into object files, and the linker is responsible for linking multiple object files into the final executable binary file.

[0096] S122: Disassemble the first binary program to obtain a first assembly instruction, a boundary of a first function, and a calling relationship of the first function.

[0097] Disassembling a binary program is the process of converting the compiled machine code (i.e., binary program) back to assembly language. Disassembly can be done with disassembly tools, such as Ghidra, IDA Pro, etc.

[0098] The disassembly tool identifies the start and end positions of each first function by analyzing the stack frame, calling conventions, and jump instructions, thereby determining the boundaries of each first function. Specifically, for programs compiled in C / C++, each first function usually starts with push ebp and mov ebp, esp, and ends with leave or pop ebp; ret. The size of each first function can be estimated by counting the number of instructions between the start address and the end address of each first function.

[0099] The disassembly tool can also identify the calling relationship between the first functions, which can be achieved by analyzing jump instructions (such as CALL instructions). The disassembly tool will track these jump instructions to build a function call graph (CallGraph) to show the mutual calling relationship between the first functions.

[0100] S123: Analyze the boundary of the first function and the calling relationship of the first function, and generate a first control flow graph and a first data flow graph between the first functions.

[0101] The first control flow graph is a directed graph, in which nodes represent the first function or basic blocks (the basic block can be a piece of independently executed code inside the first function, or a control structure in the entire program), and edges represent the calling relationship between nodes. For each node call, an edge is drawn from the calling node to the called node to form the first control flow graph.

[0102] By analyzing the first function boundary and the first function calling relationship, all possible execution paths in the program can be determined, thereby constructing a complete first control flow graph.

[0103] The first data flow graph is a directed graph, where nodes represent operations (such as assignment, arithmetic operation, logical operation, etc.) or data values ​​(which can be variables, constants or temporary values) in the source code; edges represent the direction of data flow, that is, from the output of one node to the input of another node. The first data flow graph graphically represents the way data flows and operates in the source code.

[0104] By analyzing the first function boundary and the first function calling relationship, all possible data flow paths in the source code can be determined, thereby constructing a complete first data flow graph.

[0105] S124: Slice the first assembly instruction based on the first control flow graph and the first data flow graph to obtain multiple training samples; any training sample is a first assembly instruction sequence in vector form corresponding to a variable in a first function.

[0106] Program slicing is a program analysis technique used to extract the portion of a program related to a specific variable. Program slicing is performed on the first assembly instruction based on the first control flow graph and the first data flow graph, and the first assembly instruction related to the variable of the first function in the source code can be screened out.

[0107] Combining the first control flow graph and the first data flow graph, starting from a specific variable (i.e., the variable currently being analyzed), all possible execution paths are found along the first control flow graph, and all first assembly instructions related to the variable are found in the first data flow graph, so that the first assembly instruction sequence corresponding to the specific variable can be obtained; similarly, the first assembly instruction corresponding to each variable in each first function can be obtained.

[0108] Exemplarily, a variable in a first function is an integer variable. When searching for all first assembly instructions related to the integer variable in the entire source code, all first assembly instructions that affect the integer variable can be first found in the first data flow graph, and then the execution order of these first assembly instructions in the first function can be determined in the first control flow graph, and finally the first assembly instruction related to the integer variable can be located among all the first assembly instructions, so as to obtain the first assembly instruction sequence corresponding to the integer variable in the first function.

[0109] Optionally, S121: compile the source code to obtain a first binary program, including:

[0110] The source codes are compiled respectively with the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

[0111] Homogeneity refers to the same source code, but different architectures, such as x86 architecture and ARM architecture. By analyzing these source codes, it is easier to identify and solve common problems in cross-platform programming, such as data type mismatch, memory management differences, etc. Different optimization levels, such as code refactoring, algorithm improvement, loop unrolling, instruction reordering, etc.

[0112] The training samples obtained by different versions of the first binary program contain information across architectures and optimization levels. The target learning model trained by the training samples has strong generalization ability and can support its transfer learning.

[0113] As an optional implementation of the embodiment of the present application, see Figure 4 , S140: Use the training sample set to train the first learning model to obtain the target learning model, including S141-S143.

[0114] S141: Divide the training sample set into training set D train , validation set D val and the test set Dtest .

[0115] S142: In practice set D train , validation set D val and the test set D test N different data types are extracted respectively, and for each of the N different data types, K training samples are extracted as the support set and L training samples are extracted as the query set.

[0116] Optionally, the N data types include data types of all variables extracted from the source code. Integer type and floating point type are two different types of data types.

[0117] For example, in training set D train , validation set D val and the test set D test 20 different data types are extracted from the dataset, 5 training samples are extracted from each data type as the support set, and 5 training samples are extracted as the query set.

[0118] That is to say, for training set D train , validation set D val and the test set D test In the support set, we construct an N-way K-shot classification task; that is, there are N data types in the support set, and each data type has K training samples. train , validation set D val and the test set D test The query set in , constructs an N-way L-shot classification task; that is, there are N data types in the query set, and each data type has L training samples. Finally, the support set S and query set Q are expressed as:

[0119]

[0120] Where I represents the training sample (I k represents the Kth training sample in the support set, I l represents the Lth training sample in the query set), Represents a set containing all data types, and t represents the data type (t n Indicates the Nth data type).

[0121] S143: Through training set D train , validation set D val , test set D test The support set and query set of D, or through the training set D train , validation set D valThe first learning model is trained based on the support set and query set, so that the first learning model establishes a mapping relationship according to the similarity of the training samples in the support set and the query set; and the target learning model is obtained by updating the weight matrix of the first learning model so that the loss function of the first learning model converges.

[0122] Using the training set D train , validation set D val , test set D test The support set S and query set Q are used to train the first learning model. Its essence is to use a neural network to construct a mapping function Γ(·). This mapping function uses the support set S as a reference to predict the sample type in the query set Q. It is specifically expressed as:

[0123]

[0124] Since the data types of the training samples in the support set S and the query set Q have been labeled, establishing a mapping relationship between the training samples in the support set S and the training samples in the query set Q is equivalent to predicting the data type of the training samples in the query set Q. Establishing a mapping relationship is to find the training samples in the support set S that are most similar to the training samples in the query set Q. Comparing the similarity between the training samples in the support set S and the training samples in the query set Q is to compare the similarity between the two first encoding instruction sequences.

[0125] For example, for a training sample A (data type is integer) in the query set Q, it is only necessary to find the training sample B with the highest similarity to the training sample A in the support set S to establish the mapping relationship between the training sample A and the training sample B. If the data type of the training sample B is also integer, it means that the mapping relationship is successfully established; if the data type of the training sample B is not integer, it means that the mapping relationship fails to be established.

[0126] Ideally, both the support set S and the query set Q are derived from the training set D. train , validation set D val , or from the test set D test The mapping function Γ(·) can always correctly predict the data type of each training sample in the query set Q using fewer training samples in the support set S.

[0127] During the training of the first learning model, the weight matrix W in the first learning model will be updated according to the back propagation algorithm to minimize the loss function:

[0128]

[0129] in Indicates that the data type is t i The support set and query set of training samples, Is and Iq represent the training samples from the support set and the query set, D(·) is the function for calculating the similarity between two training samples, and the smaller the value of D(·), the higher the similarity between the two training samples.

[0130] The training samples in the support set are equivalent to the standard answers. The process of training the first learning model is to increase the similarity between the training samples in the query set and the training samples in the support set.

[0131] Validation set D val In addition to training the first learning model, it is also used to evaluate the performance of the first learning model during the training process and help adjust the hyperparameters of the first learning model (such as learning rate, batch size, number of network layers, etc.).

[0132] Optional, test set D test It is used to evaluate the final performance of the model after training is completed, so the training set D train , validation set D val The support set and query set of the first learning model are trained to make the test set D test With the training set D train , validation set D val Maintain independence to ensure the fairness and accuracy of the evaluation results.

[0133] As an optional implementation of the embodiment of the present application, see Figure 5 , in S143: obtain the target learning model, and then, also include S144-S146.

[0134] S144: Determine the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set through the target learning model.

[0135] The similarity between the training samples of the prediction set and the training samples in the support set of the prediction set is calculated through the weight matrix of the target learning model. The specific method is to use the mapping function Γ(·) of the target learning model:

[0136]

[0137] in is the support set of the prediction set, is the query set of the prediction set. Usually, the support set and queryset Processed into the form of K×N and L×N matrices, the output of the mapping function Γ(·) is assumed to be a sequence of length L, each element of which is the data type of the predicted variable.

[0138] S145: Determine the data type corresponding to the training sample in the support set of the prediction set having the highest similarity to the training sample in the query set of the prediction set as the data type of the training sample in the query set of the prediction set.

[0139] It is easy to understand that the data type corresponding to the training sample is the data type annotated by the training sample.

[0140] S146: Determine the accuracy of the target learning model in restoring the data type according to the target learning model's prediction results of the data type of the training samples in the query set of the prediction set and the data types annotated by the training samples in the query set of the prediction set.

[0141] If the target learning model predicts the data type of the training samples in the query set of the prediction set to be the same as the data type labeled by the training samples in the query set of the prediction set, it means that the prediction is correct, otherwise it means that the prediction is wrong, thereby determining the accuracy of the target learning model in recovering the data type.

[0142] The embodiment of the present application adopts an N-way K-shot classification task to allow the first learning model to learn the characteristics and patterns of each data type from a limited number of training samples (tens or even single-digit training samples, such as 5-10 training samples). For complex and uncommon data types, such as complex structure types artificially defined in some projects, since the target learning model has learned how to learn from a small number of samples during the training phase, it can usually effectively predict the data type, thereby enabling the target learning model to have better learning and generalization capabilities.

[0143] After the training is completed, the target learning model can be applied in the actual scenario to complete the recovery of the data type of the variable. Based on this, the embodiment of the present application provides a binary program variable type recovery method, see Figure 6 , the method includes S210-S240.

[0144] S210: Obtain the target binary program.

[0145] In actual scenarios, the source code is unknown, and the target binary program can be obtained while the program is running. Specifically, a debugger (such as GDB, WinDbg) can be used to attach to the running process, and then the binary program in the memory can be read. In addition, the target binary program can be obtained by using system calls, direct extraction from memory, etc.

[0146] S220: obtaining a plurality of samples to be restored according to the target binary program; any sample to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program.

[0147] By analyzing the target binary program, a target assembly instruction sequence in vector form can be obtained. The "to be restored" in the sample to be restored should be understood as: the data type of the variable in the target assembly instruction sequence to be restored. The target function is any one of the functions obtained according to the target binary program.

[0148] S230: Determine the target training sample in the training sample set that has the highest similarity to the sample to be restored through the target learning model; wherein the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any training sample is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by program slicing the data flow information between functions in the source code.

[0149] The training sample set may be the training sample set obtained in S130. The training sample may be the first assembly instruction sequence in vector form obtained in S120, and the variables of the training sample are marked with data types; and the training sample may be obtained through S120 and its sub-steps S121-S124; the target learning model is obtained by using the training sample set to train the first learning model.

[0150] The process of comparing the similarity between the sample to be restored and the training sample can be analogous to the process of determining the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set in the above S144.

[0151] S240: Determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be restored.

[0152] The process of comparing the similarity between the sample to be restored and the training sample is to take the training samples in the training sample set as options, and then compare which option has the highest similarity with the sample to be restored, and determine the data type marked by the option as the data type of the sample to be restored. This is more effective than the current method of inferring variable data types based on the operational semantics of assembly instructions, especially for complex and uncommon data types, and only a small number of training samples are needed to predict the variable data type of the sample to be restored.

[0153] When using the target learning model to predict the data type of a variable, there are three cases depending on whether the data type exists in the training data set:

[0154] Case 1: If a data type already exists in the training data set, then no new training samples are needed to effectively predict the data type of the variable.

[0155] Case 2: If a data type is not included in my training data set (i.e., due to vocabulary issues), the target learning model will predict the closest data type. For data type recovery, this is acceptable in many cases. For example, if the user defines a new type "uint16" to replace "unsigned short", the target learning model can predict it as "unsigned short" instead of "uint16". Although they are different in nature, they are functionally equivalent.

[0156] Case 3: If the developer finds that the user-defined data type is not recovered well, the samples corresponding to the data type can be put into the support set of the training dataset and the target learning model can be re-run (without retraining). After that, the target learning model can provide more accurate prediction results for the data type.

[0157] In an optional implementation of the embodiment of the present application, see Figure 7 , S220: According to the target binary program, a plurality of samples to be restored are obtained, which may specifically include S221-S223.

[0158] S221: Disassemble the target binary program to obtain target assembly instructions, target function boundaries, and target function call relationships.

[0159] S222: Analyze the boundary of the target function and the calling relationship information of the target function, and generate a target control flow graph and a target data flow graph between the target functions.

[0160] S223: Slice the target assembly instructions based on the target control flow graph and the target data flow graph to obtain multiple samples to be restored; any sample to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function.

[0161] The target assembly instruction sequence in vector form is to convert the target assembly instruction sequence into vector form, so as to facilitate the processing of the target learning model.

[0162] It can be seen from S221-S223 that the method of obtaining the sample to be restored according to the target binary program is the same as the method of obtaining the training sample according to the first binary program, except that the objects of action are different.

[0163] This embodiment uses the data flow information between functions to slice the binary program to obtain training samples containing cross-function variable information, and uses the few-sample learning method to allow the first learning model to combine prior knowledge (i.e., the training sample set) to learn new tasks that only contain a small number of training samples. The target learning model obtained after training can reliably identify more important features from complex and uncommon data types, thereby more accurately recovering variable data types.

[0164] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0165] Corresponding to the model training method described in the above embodiment, Figure 8 A structural block diagram of a model training device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0166] Reference Figure 8 , the device comprises:

[0167] The source code acquisition module 310 is used to acquire one or more source codes.

[0168] The extraction module 320 is used to extract the data type of the variable in the source code.

[0169] The program slicing module 330 is used to slice the data flow information between the first functions in the source code to obtain multiple training samples; any training sample is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code.

[0170] The labeling module 340 is used to label the training samples using the data types of the variables in the source code as labels to obtain a training sample set.

[0171] The training module 350 is used to train the first learning model using the training sample set to obtain a target learning model.

[0172] Corresponding to the binary program variable type recovery method described in the above embodiment, Fig. 9 A structural block diagram of a binary program variable type recovery device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0173] Reference Fig. 9 , the device comprises:

[0174] A target binary program acquisition module 410 is used to acquire a target binary program;

[0175] The sample generation module 420 to be restored is used to obtain a plurality of samples to be restored according to the target binary program; any sample to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program;

[0176] A first determination module 430 is used to determine, through a target learning model, a target training sample in a training sample set that has the highest similarity to a sample to be restored; wherein the target learning model is obtained by training a first learning model using the training sample set, and the training sample set includes a plurality of training samples annotated with data types; any training sample is a first assembly instruction sequence in a vector form corresponding to a variable in a first function in a source code; the first assembly instruction sequence is obtained by program slicing data flow information between first functions in the source code;

[0177] The second determination module 440 is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be restored.

[0178] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0179] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0180] An embodiment of the present application also provides an electronic device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps of any of the above-mentioned method embodiments when executing the computer program.

[0181] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0182] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0183] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0184] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0185] The computer program code for performing the operation of the embodiment of the application can be written with one or more programming languages ​​or their combination, and the programming language includes object-oriented programming languages, such as python, Java, Smalltalk, C++, and also includes conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on the remote computer, or executed completely on the remote computer or server. In the case of a remote computer, the remote computer can include a local area network (LAN) or a wide area network (WAN)--connected to the user's computer through any type of network, or, can be connected to an external computer (for example, utilizing an Internet service provider to connect through the Internet).

[0186] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0187] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0188] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0189] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0190] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A binary program variable type recovery method, characterized in that: include: Get the target binary program; According to the target binary program, a plurality of samples to be restored are obtained; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program; Determine, by means of a target learning model, a target training sample in a training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training a first learning model using the training sample set, and the training sample set includes a plurality of training samples annotated with data types; any of the training samples is a first assembly instruction sequence in a vector form corresponding to a variable in a first function in a source code; the first assembly instruction sequence is obtained by program slicing data flow information between first functions in the source code; The data type corresponding to the target training sample is determined as the data type of the variable corresponding to the sample to be restored.

2. The binary program variable type recovery method according to claim 1, characterized in that: According to the target binary program, a plurality of samples to be restored are obtained; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program, including: Disassembling the target binary program to obtain target assembly instructions, target function boundaries, and target function call relationships; Analyze the boundary of the target function and the calling relationship information of the target function, and generate a target control flow graph and a target data flow graph between the target functions; The target assembly instructions are program sliced ​​based on the target control flow graph and the target data flow graph to obtain a plurality of samples to be restored; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in the target function.

3. A model training method, characterized in that: include: Obtain one or more source codes and extract data types of variables in the source codes; Program slicing is performed on data flow information between first functions in the source code to obtain a plurality of training samples; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code; The training samples are labeled using the data types of the variables in the source code as labels to obtain a training sample set; The first learning model is trained using the training sample set to obtain a target learning model.

4. The model training method according to claim 3, characterized in that: performing program slicing on the data flow information between the first functions in the source code to obtain a plurality of training samples; Any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code, including: Compiling the source code to obtain a first binary program; Disassembling the first binary program to obtain a first assembly instruction, a boundary of a first function, and a calling relationship of the first function; Analyze the boundary of the first function and the calling relationship of the first function, and generate a first control flow graph and a first data flow graph between the first functions; The first assembly instruction is program sliced ​​based on the first control flow graph and the first data flow graph to obtain multiple training samples; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in the first function.

5. The model training method according to claim 3, characterized in that: The step of training the first learning model using the training sample set to obtain a target learning model includes: Dividing the training sample set into a training set, a validation set and a test set; Extracting a first number of different types of data from the training set, the validation set, and the test set, respectively, and for each data type in the first number of different types of data types, extracting a second number of training samples as a support set and a third number of training samples as a query set; The first learning model is trained through the support set and query set of the training set, validation set, and test set, or through the support set and query set of the training set and validation set, so that the first learning model establishes a mapping relationship according to the similarity of the training samples in the support set and the query set; and the loss function of the first learning model converges by updating the weight matrix of the first learning model to obtain the target learning model.

6. The model training method according to claim 5, characterized in that: After obtaining the target learning model, the method further includes: Determining the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set by using the target learning model; Determine the data type corresponding to the training sample in the support set of the prediction set having the highest similarity to the training sample in the query set of the prediction set as the data type of the training sample in the query set of the prediction set; The accuracy of the target learning model in restoring the data type is determined based on the target learning model's prediction results of the data type of the training samples in the query set of the prediction set and the data types annotated by the training samples in the query set of the prediction set.

7. The model training method according to any one of claims 3 to 6, characterized in that: The compiling of the source code to obtain a first binary program includes: The source codes are compiled respectively with the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

8. A binary program variable type recovery device, characterized in that: include: A target binary program acquisition module is used to acquire the target binary program; A sample generation module to be restored is used to obtain a plurality of samples to be restored according to the target binary program; any of the samples to be restored is a target assembly instruction sequence in vector form corresponding to a variable in a target function obtained according to the target binary program; A first determination module is used to determine, through a target learning model, a target training sample in a training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training a first learning model using the training sample set, and the training sample set includes a plurality of training samples labeled with data types; any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by program slicing data flow information between first functions in the source code; The second determination module is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be restored.

9. A model training device, characterized in that: include: A source code acquisition module is used to acquire one or more source codes; An extraction module, used for extracting the data type of the variable in the source code; A program slicing module, used for performing program slicing on the data flow information between the first functions in the source code to obtain a plurality of training samples; Any of the training samples is a first assembly instruction sequence in vector form corresponding to a variable in a first function in the source code; A labeling module, used for labeling the training samples with the data types of the variables in the source code as labels to obtain a training sample set; The training module is used to train the first learning model using the training sample set to obtain a target learning model.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the binary program variable type recovery method as described in claim 1 or 2, or implements the model training method as described in any one of claims 3 to 7.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the binary program variable type recovery method as described in claim 1 or 2, or implements the model training method as described in any one of claims 3 to 7.

12. A computer program product, characterized in that When the computer program product runs on an electronic device, the electronic device executes the binary program variable type recovery method as described in claim 1 or 2, or implements the model training method as described in any one of claims 3 to 7.

Images