Binary program variable type recovery method, model training method and device

Abstract

This application provides a binary program variable type recovery method, model training method, and apparatus. The recovery method includes: acquiring a target binary program; obtaining multiple samples to be recovered based on the target binary program; determining the target training sample with the highest similarity to the samples to be recovered in the training sample set through a target learning model; and determining the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be recovered. This application uses data flow information between functions to slice the binary program, obtaining training samples containing cross-function variable information, thereby obtaining training samples with richer information. The target learning model obtained after training the first learning model based on the training sample set can reliably identify more important features from complex and uncommon data types, thus more accurately recovering the data type of the variable.

Description

Technical Field

[0001] This application belongs to the field of program variable type analysis technology, and in particular relates to a binary program variable type recovery method, model training method and device. Background Technology

[0002] In binary programs, recovering the data type of variables is a critical and challenging task in reverse engineering because it is fundamental to many security applications, such as vulnerability detection, especially for scenarios requiring the analysis of commercial binaries with missing source code. Traditional program analysis methods rely heavily on manually defined, hand-coded type inference rules, which are fragile, require significant effort to maintain and update, and are often limited by the inherent complexity of real-world software systems, particularly complex data structures.

[0003] To address these limitations, most existing binary program variable type recovery techniques employ data-driven machine learning methods. However, these techniques rely heavily on the quality of the training dataset. The conventional supervised learning strategies used in these techniques cause the trained neural networks to focus on learning frequently occurring samples, making them ill-suited for analyzing complex and uncommon data types. In many real-world scenarios, complex and uncommon data types are crucial for subsequent security analysis, and existing techniques suffer from low accuracy and unclear data structure information in recovering complex and uncommon data types. Summary of the Invention

[0004] This application provides a binary program variable type recovery method, model training method, and apparatus, which can solve the problems of low accuracy and unclear data structure information in the recovery of complex and uncommon data types in the prior art.

[0005] In a first aspect, embodiments of this application provide a method for restoring binary program variable types, including:

[0006] Obtain the target binary program;

[0007] Based on the target binary program, multiple samples to be recovered are obtained; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function obtained from the target binary program.

[0008] The target learning model determines the target training sample in the training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between the first functions in the source code;

[0009] The data type corresponding to the target training sample is determined as the data type of the variable corresponding to the sample to be recovered.

[0010] In one possible implementation of the first aspect, obtaining multiple samples to be recovered based on the target binary program includes:

[0011] The target binary program is disassembled to obtain the target assembly instructions, the boundaries of the target functions, and the call relationships of the target functions;

[0012] Analyze the boundaries and call relationships of the objective functions to generate a target control flow graph and a target data flow graph between the objective functions;

[0013] Based on the target control flow graph and the target data flow graph, the target assembly instructions are sliced ​​to obtain multiple samples to be recovered; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in the target function.

[0014] Secondly, embodiments of this application provide a model training method, including:

[0015] Obtain one or more source codes and extract the data types of the variables in the source code;

[0016] The data flow information between the first functions in the source code is sliced ​​to obtain multiple training samples; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code.

[0017] The training samples are labeled using the data types of the variables in the source code to obtain a training sample set;

[0018] The first learning model is trained using the training sample set to obtain the target learning model.

[0019] In one possible implementation of the second aspect, the process of slicing the data flow information between the first functions in the source code to obtain multiple training samples includes:

[0020] The source code is compiled to obtain the first binary program;

[0021] The first binary program is disassembled to obtain the first assembly instructions, the boundaries of the first function, and the calling relationship of the first function;

[0022] Analyze the boundaries and call relationships of the first function to generate a first control flow graph and a first data flow graph among the first functions;

[0023] Based on the first control flow graph and the first data flow graph, the first assembly instructions are sliced ​​to obtain multiple training samples; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in the first function.

[0024] In one possible implementation of the second aspect, training the first learning model using the training sample set to obtain the target learning model includes:

[0025] The training sample set is divided into a training set, a validation set, and a test set;

[0026] A first number of different types of data are extracted from the training set, the validation set, and the test set, and for each of the first number of different types of data, a second number of training samples are extracted as a support set and a third number of training samples are extracted as a query set.

[0027] The first learning model is trained using the training set, validation set, test set, support set, and query set, or using the training set, validation set, support set, and query set, so that the first learning model establishes a mapping relationship based on the similarity of the training samples in the support set and the query set; and the target learning model is obtained by updating the weight matrix of the first learning model to make the loss function of the first learning model converge.

[0028] In one possible implementation of the second aspect, after obtaining the target learning model, the method further includes:

[0029] The similarity between training samples in the query set of the prediction set and training samples in the support set of the prediction set is determined using the target learning model.

[0030] The data type corresponding to the training sample in the support set of the prediction set that has the highest similarity to the training sample in the query set of the prediction set is determined as the data type of the training sample in the query set of the prediction set.

[0031] Based on the data type prediction results of the target learning model for the training samples in the query set of the prediction set, and the data type labeled on the training samples in the query set of the prediction set, the accuracy of the target learning model in recovering the data type is determined.

[0032] In one possible implementation of the second aspect, compiling the source code to obtain a first binary program includes:

[0033] The source code is compiled separately using the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

[0034] Thirdly, embodiments of this application provide a binary program variable type recovery device, comprising:

[0035] The target binary program acquisition module is used to acquire the target binary program;

[0036] The sample to be recovered module is used to obtain multiple samples to be recovered based on the target binary program; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function obtained from the target binary program.

[0037] The first determining module is used to determine, through a target learning model, a target training sample in the training sample set that has the highest similarity to the sample to be restored; wherein, the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between the first functions in the source code;

[0038] The second determining module is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be recovered.

[0039] Fourthly, embodiments of this application provide a model training apparatus, including:

[0040] The source code retrieval module is used to retrieve one or more source codes.

[0041] The extraction module is used to extract the data types of variables in the source code;

[0042] The program slicing module is used to slice the data flow information between the first functions in the source code to obtain multiple training samples; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code.

[0043] The annotation module is used to annotate the training samples using the data types of variables in the source code as labels, thereby obtaining a training sample set;

[0044] The training module is used to train the first learning model using the training sample set to obtain the target learning model.

[0045] Fifthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the binary program variable type recovery method as described in any of the first aspects above, or implements the model training method as described in any of the second aspects above.

[0046] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the binary program variable type recovery method as described in any of the first aspects above, or implements the model training method as described in any of the second aspects above.

[0047] In a seventh aspect, embodiments of this application provide a computer program product that, when run on an electronic device, causes the electronic device to execute the binary program variable type recovery method as described in any of the first aspects above, or to implement the model training method as described in any of the second aspects above.

[0048] The beneficial effects of this embodiment compared to the prior art are as follows: This embodiment uses binary program slicing by using data flow information between functions to obtain training samples containing cross-function variable information, thereby obtaining training samples with richer information. The target learning model obtained after training the first learning model based on the training sample set can reliably identify more important features from complex and uncommon data types, thereby more accurately recovering the data type of the variables. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart illustrating a model training method provided in an embodiment of this application. Figure 1 ;

[0051] Figure 2 This is a schematic diagram illustrating the principle of a model training method provided in one embodiment of this application;

[0052] Figure 3 This is a flowchart illustrating a model training method provided in an embodiment of this application. Figure 2 ;

[0053] Figure 4 This is a flowchart illustrating a model training method provided in an embodiment of this application. Figure 3 ;

[0054] Figure 5 This is a flowchart illustrating a model training method provided in an embodiment of this application. Figure 4 ;

[0055] Figure 6 This is a flowchart illustrating a binary program variable type recovery method provided in an embodiment of this application. Figure 1 ;

[0056] Figure 7 This is a flowchart illustrating a binary program variable type recovery method provided in an embodiment of this application. Figure 2 ;

[0057] Figure 8 This is a schematic diagram of the structure of a model training device provided in one embodiment of this application;

[0058] Figure 9 This is a schematic diagram of the structure of a binary program variable type recovery device provided in an embodiment of this application. Detailed Implementation

[0059] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0060] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0061] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0062] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0063] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0064] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0065] Definitions:

[0066] Source code: Source code is code written by developers in a high-level programming language. It is a human-readable text file that contains the logic and functionality of a program and defines its behavior. Source code contains all elements of a program, including functions, variables, data types, control structures, etc.

[0067] Binary Program: A binary program is machine code composed of 0s and 1s, a language that computers can directly understand and execute. When source code is processed by a compiler or interpreter, it is converted into a binary program, which is then executed by the computer hardware.

[0068] Assembly instructions are a part of assembly language, a low-level language that directly corresponds to the computer's machine instructions but is easier to understand than binary. Assembly instructions are direct descriptions of computer hardware operations; each instruction corresponds to a specific machine operation. Assembly instructions are typically used to manipulate variables, such as addition, subtraction, multiplication, and division. These operations change the values ​​of variables, thus implementing the program's functionality. Assembly instructions can access variables through addressing.

[0069] A function is a module or block of code in source code used to perform a specific task or calculation. A function accepts input parameters (i.e., passed values ​​or variables), performs a series of operations, and returns a result. Functions improve code reusability, readability, and modularity. Functions are defined in the source code and can be called from other places. For example, in the function y = 3x + 5y, x and y are variables; x is the independent variable, representing the input value; y is the dependent variable, representing the output value. The data type of the independent variable x can be integer, meaning x only takes integer values; or it can be floating-point, meaning x can take decimal values. The data type of y is the same as x. The coefficient 3 and the constant 5 are not variables; they are constants.

[0070] Variable: A variable is a named location in source code used to store data. Variables can store various data types, such as integers, floating-point numbers, and strings. During program execution, the value of a variable can be read and modified. Variables are typically defined inside functions or in the global scope and must be declared (in statically typed languages) or assigned a value (in dynamically typed languages) before use. In high-level languages, variables are namespaces used to store data. In assembly language, a variable typically corresponds to a memory address. The definition of variables (such as data type, size, etc.) is implemented in assembly language through instructions and pseudo-instructions.

[0071] Data type: A data type in a programming language specifies the type of values ​​that a variable can store. Data types define the size, structure, and allowed operations on the data stored in the variable. Common data types include integers (int), floating-point numbers (float), strings, booleans, complex numbers, pointers, unions, and enumerations. Some programming languages ​​also support more complex data types such as arrays, structures, classes, and interfaces.

[0072] Program slicing is a program analysis technique used to extract parts of a program that are relevant to specific variables or calculations. By focusing on a particular aspect of the program (such as a specific variable) while ignoring irrelevant parts, program slicing simplifies understanding and analysis.

[0073] In reverse engineering, the original source code is unknown and inaccessible. Therefore, reverse engineering requires analyzing the compiled binary program (i.e., binary file) to understand the program's logic and functionality. However, binary programs lack explicit data types; that is, the data types of variables are partially discarded during compilation, requiring inference to recover them during analysis.

[0074] Current variable type (i.e., data type) recovery techniques are ineffective at recovering complex and uncommon data types. Therefore, this application proposes a model training method to recover complex and uncommon variable types.

[0075] See Figure 1 and Figure 2 , Figure 1 A schematic flowchart of a model training method provided in an embodiment of this application is shown. Figure 2 The diagram illustrates the principle of the model training method, which includes steps S110-S150:

[0076] S110: Obtain one or more source codes and extract the data types of variables in the source code.

[0077] The data types of variables in the source code should be as diverse as possible. For example, the data types of variables can include: integer, floating-point, string, boolean, structure, class, interface, pointer, union, enumeration, empty type, and user-defined data types. To achieve this, multiple source code samples can be obtained.

[0078] The source code can be obtained from C / C++ projects in open-source and / or closed-source databases.

[0079] Extracting data types from source code involves parsing and analyzing the source code. This process can be accomplished in various ways, including using a compiler, manual parsing, writing scripts, or using existing syntax analysis tools. For statically typed languages ​​like C / C++, the data type of a variable is known at compile time and is specified in the code through declaration.

[0080] S120: Perform program slicing on the data flow information between the first functions in the source code to obtain multiple training samples; any training sample is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code.

[0081] The first function can be any function in the source code.

[0082] Extracting the first function from the source code can be achieved through various methods, such as manual searching, regular expressions, abstract syntax trees, or static analysis tools.

[0083] Data flow information between first-level functions refers to the information about how data is transferred and flows between different first-level functions during source code execution. Analyzing this data flow information helps in understanding program logic, optimizing performance, debugging errors, and maintaining code.

[0084] A variable might be defined in one function and used in another, thus requiring the tracking of data flow information across functions (i.e., between functions). By analyzing the data flow information between functions, we can determine how data flows between them.

[0085] Specifically, program slicing of the data flow information between the first functions means considering the calling relationships and data transfer between the first functions, thus enabling a systematic analysis of the impact of each first function on a specific variable (the variable currently being analyzed) in the source code. Since each variable is converted into a series of assembly instructions during source code execution, program slicing extracts the assembly instructions related to the specific variable from each first function, forming the first assembly instruction sequence.

[0086] For example, if there are 20 first functions in the source code, and each first function has 10 variables, then there are a total of 200 variables in the source code. Each variable corresponds to its own assembly instructions, and these assembly instructions may be related to multiple first functions. Program slicing involves iterating through each variable in these 20 first functions, retaining the assembly instructions related to the variables in the currently analyzed first function, and removing the assembly instructions unrelated to the variables in the currently analyzed first function, resulting in 20 * 10 = 200 sequences of first assembly instructions. It's easy to understand that the number of training samples equals the number of sequences of first assembly instructions equals the number of variables in the first functions.

[0087] It should be noted that the first assembly instruction sequence also needs to be converted into vector form before it can be processed by the first learning model.

[0088] Since the first learning model processes numerical data, while the first assembly instruction sequence is non-numerical data, converting the first assembly instruction sequence into vector form is to adapt it to the first learning model. Optionally, an assembly language model (e.g., Asm2vec, DeepBinDiff, or PalmTree) can be used to encode the first assembly instruction sequence and convert it into vector form. To improve the reliability of the assembly language model encoding, the assembly language model can also be trained using the first assembly instruction sequence obtained in S120, and then the trained assembly language model can be used to encode the first assembly instruction sequence.

[0089] S130: Label the training samples using the data types of variables in the source code to obtain a training sample set.

[0090] S140: Train the first learning model using the training sample set to obtain the target learning model.

[0091] Specifically, the first learning model belongs to the neural network model.

[0092] This application embodiment utilizes the data flow information between the first functions to perform program slicing, which can obtain variable information across functions, thereby obtaining training samples with richer information. The target learning model obtained after training the first learning model with these training samples can improve the accuracy of recovering complex and uncommon data types.

[0093] As an optional implementation of the embodiments of this application, see [link to relevant documentation]. Figure 3 S120: Perform program slicing on the data flow information between the first functions to obtain multiple training samples, specifically including S121-S124.

[0094] S121: Compile the source code to obtain the first binary program.

[0095] Compiling source code into a binary program is the process of converting human-readable high-level programming languages ​​into low-level machine instructions that computers can directly execute. This process can be achieved through a compiler and a linker. The compiler is responsible for converting the source code into object files, and the linker is responsible for linking multiple object files into the final executable binary file.

[0096] S122: Disassemble the first binary program to obtain the first assembly instructions, the boundaries of the first function, and the calling relationships of the first function.

[0097] Disassembling a binary program is the process of converting the compiled machine code (i.e., the binary program) back into assembly language. Disassembly can be done using disassembler tools such as Ghidra and IDA Pro.

[0098] Disassemblers identify the start and end points of each first function by analyzing stack frames, calling conventions, and jump instructions, thus determining the boundaries of each first function. Specifically, for C / C++ compiled programs, each first function typically begins with `push ebp` and `mov ebp, esp`, and ends with `leave` or `pop ebp; ret`. The size of each first function can be estimated by calculating the number of instructions between its start and end addresses.

[0099] Disassemblers can also identify the call relationships between the first-level functions, which can be achieved by analyzing jump instructions (such as CALL instructions). The disassembler traces these jump instructions to construct a function call graph, showing the mutual call relationships between the first-level functions.

[0100] S123: Analyze the boundaries of the first function and the calling relationships of the first function to generate the first control flow graph and the first data flow graph between the first functions.

[0101] The first control flow graph is a directed graph where nodes represent first functions or basic blocks (a basic block can be a section of independently executable code within a first function, or a control structure within the entire program), and edges represent the call relationships between nodes. For each node's call, an edge is drawn from the calling node to the called node, forming the first control flow graph.

[0102] By analyzing the boundaries and call relationships of the first function, all possible execution paths in the program can be determined, thereby constructing a complete first control flow graph.

[0103] The first data flow graph is a directed graph where nodes represent operations (such as assignments, arithmetic operations, logical operations, etc.) or data values ​​(which can be variables, constants, or temporary values) in the source code; edges represent the direction of data flow, that is, from the output of one node to the input of another node. The first data flow graph graphically represents the way data flows and operates in the source code.

[0104] By analyzing the boundaries and call relationships of the first function, all possible data flow paths in the source code can be determined, thereby constructing a complete first data flow graph.

[0105] S124: Based on the first control flow graph and the first data flow graph, the first assembly instruction is sliced ​​to obtain multiple training samples; any training sample is a vector-form sequence of first assembly instructions corresponding to a variable in a first function.

[0106] Program slicing is a program analysis technique used to extract parts of a program that are related to specific variables. By slicing the first assembly instructions based on the first control flow graph and the first data flow graph, the first assembly instructions in the source code that are related to the variables of the first function can be selected.

[0107] By combining the first control flow graph and the first data flow graph, starting from a specific variable (i.e. the variable being analyzed at the moment), all possible execution paths are found along the first control flow graph, and all first assembly instructions related to that variable are found in the first data flow graph. In this way, the sequence of first assembly instructions corresponding to that specific variable can be obtained. Similarly, the first assembly instructions corresponding to each variable in each first function can be obtained.

[0108] For example, if the variable in a certain first function is an integer variable, when searching for all first assembly instructions related to the integer variable in the entire source code, we can first find all the first assembly instructions that affect the integer variable in the first data flow graph, then determine the execution order of these first assembly instructions in the first function in the first control flow graph, and finally locate the first assembly instruction related to the integer variable among all the first assembly instructions. In this way, we obtain the sequence of first assembly instructions corresponding to the integer variable in the first function.

[0109] Optional, S121: Compile the source code to obtain the first binary program, including:

[0110] Compile the source code separately using the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

[0111] "Same source" refers to the same source code but different architectures, such as x86 and ARM. Analyzing these source codes makes it easier to identify and resolve common problems in cross-platform programming, such as data type mismatches and differences in memory management. Different optimization levels include code refactoring, algorithm improvement, loop unrolling, and instruction reordering.

[0112] The training samples obtained from different versions of the first binary program contain information across architectures and optimization levels. The target learning model trained using these samples has strong generalization capabilities and can support transfer learning.

[0113] As an optional implementation of the embodiments of this application, see [link to relevant documentation]. Figure 4 S140: Train the first learning model using the training sample set to obtain the target learning model, including S141-S143.

[0114] S141: Divide the training sample set into training set D train Validation set D val and test set Dtest .

[0115] S142: In training set D train Validation set D val and test set D test N different data types are extracted from the dataset, and for each of the N different data types, K training samples are extracted as the support set and L training samples are extracted as the query set.

[0116] Optionally, the N data types include the data types of all variables extracted from the source code. Integer and floating-point types belong to two different categories of data types.

[0117] For example, in the training set D train Validation set D val and test set D test Twenty different data types were extracted, and five training samples were extracted for each data type as the support set and five training samples were extracted as the query set.

[0118] In other words, for the training set D train Validation set D val and test set D test We construct an N-way K-shot classification task from the support set D; that is, the support set has N data types, and each data type has K training samples. train Validation set D val and test set D test We construct an N-way L-shot classification task using the query set; that is, the query set has N data types, and each data type has L training samples. Finally, the resulting support set S and query set Q are represented as follows:

[0119]

[0120] Where I represents the training sample (I k I represents the Kth training sample in the support set. l (This represents the Lth training sample in the query set). This represents a collection containing all data types, where t represents the data type (t). n (Represents the Nth data type).

[0121] S143: Through training set D train Validation set D val Test set D test The support set and query set, or through the training set D train Validation set D valThe first learning model is trained using the support set and query set, so that the first learning model establishes a mapping relationship based on the similarity of the training samples in the support set and query set; and the target learning model is obtained by updating the weight matrix of the first learning model to make the loss function of the first learning model converge.

[0122] Using training set D train Validation set D val Test set D test Given a support set S and a query set Q, we train a first learning model. Essentially, this model utilizes a neural network to construct a mapping function Γ(·), which predicts the sample types in the query set Q with reference to the support set S. Specifically, it is expressed as:

[0123]

[0124] Since the data types of the training samples in the support set S and query set Q have been labeled, establishing a mapping relationship between the training samples in the support set S and the training samples in the query set Q is equivalent to predicting the data types of the training samples in the query set Q. Establishing the mapping relationship involves finding the training sample in the support set S that has the highest similarity to the training samples in the query set Q. Comparing the similarity between the training samples in the support set S and the training samples in the query set Q is equivalent to comparing the similarity between two first-encoded instruction sequences.

[0125] For example, for a training sample A (of integer data type) in the query set Q, it is only necessary to find the training sample B in the support set that has the highest similarity to training sample A to establish a mapping relationship between training sample A and training sample B. If the data type of training sample B is also integer, it means that the mapping relationship is successfully established; if the data type of training sample B is not integer, it means that the mapping relationship fails to be established.

[0126] Ideally, both the support set S and the query set Q should be derived from the training set D. train Validation set D val Or from the test set D test In the sampling process, the mapping function Γ(·) can always correctly predict the data type of each training sample in the query set Q using a small number of training samples in the support set S.

[0127] During the training of the first learning model, the weight matrix W in the first learning model is updated according to the backpropagation algorithm, thereby minimizing the loss function:

[0128]

[0129] in This indicates that the data type is t. i The support set and query set of the training samples, Is Iq and D(·) represent training samples from the support set and query set, respectively. D(·) is a function that calculates the similarity between two training samples. The smaller the value of D(·), the higher the similarity between the two training samples.

[0130] The training samples in the support set are equivalent to the standard answer. The process of training the first learning model is to increase the similarity between the training samples in the query set and the training samples in the support set.

[0131] Validation set D val In addition to training the first learning model, it is also used to evaluate the performance of the first learning model during training and to help tune the hyperparameters of the first learning model (such as learning rate, batch size, number of network layers, etc.).

[0132] Optional, test set D test Used to evaluate the final performance of the model after training, therefore through the training set D train Validation set D val The support set and query set are used to train the first learning model so that the test set D test With training set D train Validation set D val Maintain independence to ensure the impartiality and accuracy of the assessment results.

[0133] As an optional implementation of the embodiments of this application, see [link to relevant documentation]. Figure 5 In S143, the target learning model is obtained. After that, S144-S146 are also included.

[0134] S144: Using the target learning model, determine the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set.

[0135] The similarity between training samples in the prediction set and training samples in the support set of the prediction set is calculated using the weight matrix of the target learning model. Specifically, the mapping function Γ(·) of the target learning model is used:

[0136]

[0137] in For the support set of the prediction set, This is the query set for the prediction set. Typically, it's the support set. and query set The output of the mapping function Γ(·) is assumed to be a sequence of length L, and each element in the sequence is the data type of the predicted variable.

[0138] S145: The data type corresponding to the training sample in the support set of the prediction set that has the highest similarity to the training sample in the query set of the prediction set is determined as the data type of the training sample in the query set of the prediction set.

[0139] It's easy to understand that the data type corresponding to the training samples is the same as the data type labeled on the training samples.

[0140] S146: Based on the target learning model's prediction results of the data types of the training samples in the query set of the prediction set, and the data types labeled in the training samples in the query set of the prediction set, determine the accuracy of the target learning model in recovering the data types.

[0141] If the target learning model predicts the data type of the training samples in the query set of the prediction set to be the same as the data type labeled in the training samples in the query set of the prediction set, it means that the prediction is correct; otherwise, it means that the prediction is wrong. This allows us to determine the accuracy of the target learning model in recovering the data type.

[0142] This application employs an N-way K-shot classification task, allowing the first learning model to learn the features and patterns of each data type from a limited number of training samples (tens or even single digits, such as 5-10 training samples). For complex and uncommon data types, such as complex struct types artificially defined in certain projects, the target learning model can usually effectively predict the data type because it has already learned how to learn from a small number of samples during the training phase. This enables the target learning model to have better learning and generalization capabilities.

[0143] After training, the target learning model can be applied to real-world scenarios to restore the data type of variables. Based on this, this application provides a binary program variable type restoration method, see [link to relevant documentation]. Figure 6 The method includes S210-S240.

[0144] S210: Obtain the target binary program.

[0145] In real-world scenarios, the source code is unknown, but the target binary program can be obtained during runtime. Specifically, a debugger (such as GDB or WinDbg) can be attached to the running process, allowing the binary program to be read from memory. Alternatively, system calls and direct extraction from memory can also be used to obtain the target binary program.

[0146] S220: Based on the target binary program, obtain multiple samples to be recovered; any sample to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function obtained from the target binary program.

[0147] By analyzing the target binary program, a vector-form sequence of target assembly instructions can be obtained. The term "to be recovered" in the "to be recovered sample" should be understood as: the data types of variables in the target assembly instruction sequence need to be recovered. The target function is any one of the functions obtained from the target binary program.

[0148] S230: Using the target learning model, determine the target training sample in the training sample set that has the highest similarity to the sample to be restored; wherein, the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any training sample is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between functions in the source code.

[0149] The training sample set can be the training sample set obtained in S130 above. The training sample can be the first assembly instruction sequence in vector form obtained in S120 above, and the variables of the training sample are labeled with data types; and the training sample can be obtained through S120 and its sub-steps S121-S124; the target learning model is obtained by using the training sample set on the first learning model.

[0150] The process of comparing the similarity between the sample to be restored and the training sample can be compared to the process in S144 above of determining the similarity between the training samples in the query set of the prediction set and the training samples in the support set of the prediction set.

[0151] S240: Determine the data type of the target training sample as the data type of the variable corresponding to the sample to be recovered.

[0152] The process of comparing the similarity between the sample to be restored and the training samples involves treating the training samples in the training sample set as options, and then comparing the sample to be restored with the option whose similarity is the highest. The data type of that option is then determined as the data type of the sample to be restored. This is more efficient than current methods that infer variable data types based on the operational semantics of assembly instructions, especially for complex and uncommon data types, requiring only a small number of training samples to predict the variable data type of the sample to be restored.

[0153] When using a target learning model to predict the data type of a variable, there are three cases depending on whether the data type exists in the training dataset:

[0154] Scenario 1: If a data type already exists in the training dataset, then the data type of the variable can be effectively predicted without new training samples.

[0155] Scenario 2: If a data type is not included in my training dataset (i.e., due to vocabulary issues), then the objective learning model will predict the closest data type. This is acceptable in many cases for data type recovery; for example, if a user defines a new type "uint16" instead of "unsigned short," the objective learning model can predict it as "unsigned short" instead of "uint16." Although they are essentially different names, they are functionally equivalent.

[0156] Scenario 3: If developers find that user-defined data types are not being recovered well, they can put the samples corresponding to that data type into the support set of the training dataset and rerun the target learning model (without retraining). After that, the target learning model can provide more accurate prediction results for that data type.

[0157] In one optional implementation of the embodiments of this application, see [link to relevant documentation]. Figure 7 S220: Based on the target binary program, obtain multiple samples to be recovered, which may specifically include S221-S223.

[0158] S221: Disassemble the target binary program to obtain the target assembly instructions, the boundaries of the target functions, and the call relationships of the target functions.

[0159] S222: Analyze the boundary and call relationship information of the objective function to generate the objective control flow graph and objective data flow graph between objective functions.

[0160] S223: Based on the target control flow graph and the target data flow graph, the target assembly instructions are sliced ​​to obtain multiple samples to be recovered; any sample to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function.

[0161] The target assembly instruction sequence in vector form is converted into a vector form, which facilitates processing by the target learning model.

[0162] As can be seen from S221-S223, the method of obtaining the sample to be recovered based on the target binary program is the same as the method of obtaining the training sample based on the first binary program, only the objects of operation are different.

[0163] This embodiment uses binary program slicing by using data flow information between functions to obtain training samples containing cross-function variable information. It also uses a few-shot learning method to allow the first learning model to learn a new task containing only a small number of training samples by combining prior knowledge (i.e., the training sample set). The target learning model obtained after training can reliably identify more important features from complex and uncommon data types, thereby enabling more accurate variable data type recovery.

[0164] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0165] Corresponding to the model training method described in the above embodiments, Figure 8 A structural block diagram of the model training apparatus provided in the embodiments of this application is shown. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0166] Reference Figure 8 The device includes:

[0167] Source code retrieval modulo 310 is used to retrieve one or more source codes.

[0168] Extraction module 320 is used to extract the data type of variables in the source code.

[0169] The program slicing module 330 is used to slice the data flow information between the first functions in the source code to obtain multiple training samples; any training sample is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code.

[0170] The annotation module 340 is used to annotate training samples using the data types of variables in the source code as labels to obtain a training sample set.

[0171] Training module 350 is used to train the first learning model using the training sample set to obtain the target learning model.

[0172] Corresponding to the binary program variable type recovery method described in the above embodiments, Figure 9 The diagram shows a structural block diagram of a binary program variable type recovery device provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0173] Reference Figure 9 The device includes:

[0174] The target binary program acquisition module 410 is used to acquire the target binary program;

[0175] The sample generation module 420 is used to obtain multiple samples to be recovered based on the target binary program; any sample to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function obtained from the target binary program.

[0176] The first determining module 430 is used to determine the target training sample with the highest similarity to the sample to be restored in the training sample set through the target learning model; wherein, the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any training sample is a vector form of the first assembly instruction sequence corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between the first functions in the source code;

[0177] The second determining module 440 is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be recovered.

[0178] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0179] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0180] This application also provides an electronic device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the steps in any of the above method embodiments.

[0181] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0182] This application provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps described in the above-described method embodiments.

[0183] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0184] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0185] Computer program code for performing the operations of the embodiments of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages ​​such as Python, Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0186] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0187] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0188] In the embodiments provided in this application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0189] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0190] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for restoring binary program variable types, characterized in that, include: Obtain the target binary program; The target binary program is disassembled to obtain the target assembly instructions, the boundaries of the target functions, and the call relationships of the target functions; Analyze the boundaries and call relationships of the objective functions to generate a target control flow graph and a target data flow graph between the objective functions; Based on the target control flow graph and the target data flow graph, the target assembly instructions are sliced ​​to obtain multiple samples to be recovered; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in the target function. The target learning model determines the target training sample in the training sample set that has the highest similarity to the sample to be restored; wherein the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between the first functions in the source code; The data type corresponding to the target training sample is determined as the data type of the variable corresponding to the sample to be recovered.

2. A model training method, characterized in that, include: Obtain one or more source codes and extract the data types of the variables in the source code; The source code is compiled to obtain the first binary program; The first binary program is disassembled to obtain the first assembly instructions, the boundaries of the first function, and the calling relationship of the first function; Analyze the boundaries and call relationships of the first function to generate a first control flow graph and a first data flow graph among the first functions; Based on the first control flow graph and the first data flow graph, the first assembly instruction is sliced ​​to obtain multiple training samples; Each of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in the first function; The training samples are labeled with the data types of the variables in the source code to obtain a training sample set; The first learning model is trained using the training sample set to obtain the target learning model.

3. The model training method as described in claim 2, characterized in that, The step of training the first learning model using the training sample set to obtain the target learning model includes: The training sample set is divided into a training set, a validation set, and a test set; A first number of different types of data are extracted from the training set, the validation set, and the test set, and for each of the first number of different types of data, a second number of training samples are extracted as a support set and a third number of training samples are extracted as a query set. The first learning model is trained using the support and query sets of the training set, the support and query sets of the validation set, and the support and query sets of the test set, or using the support and query sets of the training set and the support and query sets of the validation set, so that the first learning model establishes a mapping relationship based on the similarity of the training samples in the support set and the query set; and the target learning model is obtained by updating the weight matrix of the first learning model to make the loss function of the first learning model converge.

4. The model training method as described in claim 3, characterized in that, After obtaining the target learning model, the process also includes: The similarity between training samples in the query set of the prediction set and training samples in the support set of the prediction set is determined using the target learning model. The data type corresponding to the training sample in the support set of the prediction set that has the highest similarity to the training sample in the query set of the prediction set is determined as the data type of the training sample in the query set of the prediction set. Based on the data type prediction results of the target learning model for the training samples in the query set of the prediction set, and the data type labeled on the training samples in the query set of the prediction set, the accuracy of the target learning model in recovering the data type is determined.

5. The model training method according to any one of claims 2-4, characterized in that, The process of compiling the source code to obtain a first binary program includes: The source code is compiled separately using the same source but different architectures and / or the same source but different optimization levels to obtain different versions of the first binary program.

6. A binary program variable type recovery device, characterized in that, include: The target binary program acquisition module is used to acquire the target binary program; The sample to be recovered module is used to obtain multiple samples to be recovered based on the target binary program; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in a target function obtained from the target binary program. The first determining module is used to determine, through a target learning model, a target training sample in the training sample set that has the highest similarity to the sample to be restored; wherein, the target learning model is obtained by training the first learning model using the training sample set, and the training sample set includes multiple training samples labeled with data types; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; the first assembly instruction sequence is obtained by slicing the data flow information between the first functions in the source code; The second determining module is used to determine the data type corresponding to the target training sample as the data type of the variable corresponding to the sample to be recovered; The sample generation module to be recovered includes: The first disassembly submodule is used to disassemble the target binary program to obtain the target assembly instructions, the boundaries of the target functions, and the call relationships of the target functions; The first analysis submodule is used to analyze the boundaries of the objective function and the call relationship information of the objective function, and generate the objective control flow graph and the objective data flow graph between the objective functions; The first program slicing submodule is used to slice the target assembly instructions based on the target control flow graph and the target data flow graph to obtain multiple samples to be recovered; any one of the samples to be recovered is a vector-form sequence of target assembly instructions corresponding to a variable in the target function.

7. A model training device, characterized in that, include: The source code retrieval module is used to retrieve one or more source codes. The extraction module is used to extract the data types of variables in the source code; The program slicing module is used to slice the data flow information between the first functions in the source code to obtain multiple training samples. Each of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in a first function in the source code; The annotation module is used to annotate the training samples using the data types of variables in the source code as labels, thereby obtaining a training sample set; The training module is used to train the first learning model using the training sample set to obtain the target learning model; The program slicing module includes: The compilation submodule is used to compile the source code to obtain the first binary program; The second disassembly submodule is used to disassemble the first binary program to obtain the first assembly instructions, the boundaries of the first function, and the call relationship of the first function; The second analysis submodule is used to analyze the boundaries of the first function and the calling relationship of the first function, and generate the first control flow graph and the first data flow graph between the first functions; The second program slicing submodule is used to slice the first assembly instructions based on the first control flow graph and the first data flow graph to obtain multiple training samples; any one of the training samples is a vector-form sequence of first assembly instructions corresponding to a variable in the first function.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the binary program variable type recovery method as described in claim 1, or the model training method as described in any one of claims 2 to 5.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the binary program variable type recovery method as described in claim 1, or the model training method as described in any one of claims 2 to 5.

10. A computer program product, characterized in that, When a computer program product is run on an electronic device, the electronic device executes the binary program variable type recovery method as described in claim 1, or implements the model training method as described in any one of claims 2 to 5.

Images