Method for automatically analyzing computer program

Abstract

According to various embodiments, there is provided a method for automatically analyzing a computer program, i.e., in particular determining a program component present in a computer program (to be checked), which is present in a compiled version, i.e. Binary code), having: decompiling the binary code of the computer program; generating an intermediate representation code having an intermediate representation instruction sequence; generating one or more intermediate representation code strings from the intermediate representation instruction sequence; searching, among the one or more intermediate representation code strings, a reference intermediate representation code string of a plurality of reference intermediate representation code strings by means of a string kernel search, where each reference intermediate representation code string belongs to a program component; and determining, as a program component present in the computer program, a program component to which a reference intermediate representation code string found in the one or more intermediate representation code strings by means of a string kernel comparison belongs.

Description

Technical Field

[0001] The present disclosure relates to methods for automatically analyzing computer programs. Background Art

[0002] The manufacturer of a programmable device with associated software is responsible for its correct operation and must therefore know the software contained and which vulnerabilities may exist. However, the corresponding software development team usually does not have complete knowledge of the source code of the software, because it uses precompiled program parts (such as certain program libraries) from third-party providers. Therefore, an efficient method of analyzing the software starting from its binary code is needed.

[0003] Raul Ernesto Torres Carvajal's paper "Comparison of Compiler's Intermediate Representations and Input / Output Access Patterns with StringKernels", University of Hamburg, 2018, hereinafter referred to as Reference 1, describes applying string kernel search to compiler intermediate representations. Summary of the invention

[0004] According to various embodiments, a method for automatically analyzing a computer program, i.e., in particular determining program components present in a computer program (to be checked) which is present in a compiled version, i.e., a binary code, is provided, the method comprising:

[0005] Decompiling the binary code of the computer program to generate an intermediate representation code having an intermediate representation instruction sequence;

[0006] · generating one or more intermediate representation code strings from the intermediate representation instruction sequence;

[0007] searching, among the one or more intermediate representation code strings, for a reference intermediate representation code string among a plurality of reference intermediate representation code strings (from a database) by means of a string kernel search, wherein each reference intermediate representation code string belongs to a program component (e.g. a function, but also possibly a larger (sub)program); and

[0008] Determining, as a program component present in the computer program, the program component to which the reference intermediate representation code string found in the one or more intermediate representation code strings by means of the string kernel comparison belongs.

[0009] The above method makes:

[0010] - Ability to compare between code compiled by a compiler (binary code) and the source code, regardless of changes made by that compiler at compile time;

[0011] - Ability to find code similarities even when obfuscation techniques are used during compilation;

[0012] - Capable of generating the SBOM (Software Bill of Materials) of the computer program based on the binary code of the computer program;

[0013] - Ability to find software vulnerabilities such as those stored in the CVE (Common Vulnerabilities and Exposures) database;

[0014] - The analysis of the final binary code can be ensured. Since the binary code is used as the test object, all possible vulnerabilities contained in the source code or added during compilation due to compiler changes, options and target architectures are included in the analysis by default. Therefore, it can be ensured that the analyzed binary code is the binary code used (for example, included in the delivered product).

[0015] Various embodiments are described below.

[0016] Embodiment 1 is a method for automatically analyzing a computer program as described above.

[0017] Embodiment 2 is a method according to embodiment 1, wherein the one or more intermediate representation code strings are multiple intermediate representation code strings generated by combining subsequences of the intermediate representation instruction sequence into program code segments, these program code segments respectively form functions, and wherein a reference intermediate representation code string is searched in each intermediate representation code string.

[0018] In this way, it is possible to determine whether a program code segment corresponds to a specific program component, and it is possible to avoid erroneously finding a program component based on a code component distributed over a plurality of functions in a computer program.

[0019] Embodiment 3 is a method according to embodiment 1 or 2, the method comprising: determining the security vulnerability of the computer program based on the determined program component and information about the security vulnerability of the determined program component.

[0020] For example, the program components to which these reference intermediate representation code strings belong can be at least partially marked as program components with security vulnerabilities. Therefore, the security check of the computer program can be performed with the help of this method.

[0021] Embodiment 4 is a method according to any one of embodiments 1 to 3, wherein the one or more intermediate representation code strings are generated from the intermediate representation instruction sequence at least in part by compensating or taking into account obfuscation techniques.

[0022] For example, these strings can be generated in a special way by omitting or taking into account obfuscation techniques so that obfuscated (sub)sequences of intermediate representation instructions can also be assigned to these reference intermediate representation code strings (and thereby to the relevant program components).

[0023] Embodiment 5 is a method according to any one of embodiments 1 to 4, the method comprising: determining a program component missing from the computer program based on a program component determined to be present in the computer program.

[0024] This way, security holes or faults due to missing program parts (such as error handling functions) can be found.

[0025] Embodiment 6 is a method according to any one of embodiments 1 to 5, comprising: controlling a robotic device using the computer program according to program components determined to be present in the computer program corresponding to a specified set of required and / or allowed program components.

[0026] This allows for safe control.

[0027] Embodiment 7 is a software analysis system, which is configured to execute the method according to any one of Embodiments 1 to 6.

[0028] Embodiment 8 is a computer program having instructions, which, when executed by a processor, cause the processor to execute the method according to any one of embodiments 1 to 6.

[0029] Embodiment 9 is a computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform a method according to any one of embodiments 1 to 6. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In the accompanying drawings, like reference numerals generally refer to the same parts in all the different views. These drawings are not necessarily to scale, with emphasis instead generally being placed on presenting the principles of the invention. In the description below, various aspects are described with reference to the following drawings.

[0031] Figure 1 A computer for developing and / or testing software applications is shown.

[0032] Figure 2A flow chart for analyzing a computer program by means of binary lifting and subsequent string kernel search based on its binary code is shown.

[0033] Figure 3 A flow chart is shown which presents a method for automatically analyzing a computer program according to an embodiment. DETAILED DESCRIPTION

[0034] The detailed description below refers to the accompanying drawings, which show, for the purpose of illustration, the specific details and aspects of the present disclosure in which the present invention may be implemented. Other aspects may be used and structural changes, logical changes, and electrical changes may be performed without departing from the scope of protection of the present invention. Different aspects of the present disclosure are not necessarily mutually exclusive, as some aspects of the present disclosure may be combined with one or more other aspects of the present disclosure to form new aspects.

[0035] Various examples are described in more detail below.

[0036] Figure 1 A computer 100 is shown for use in developing and / or testing software applications.

[0037] The computer 100 has a CPU (Central Processing Unit) 101 and a working memory (RAM) 102. The working memory 102 is used to load a program code, for example, from a hard disk 103, and the CPU 101 executes the program code.

[0038] In the current example, it is assumed that a user (developer) intends to use computer 100 to develop and / or test a software application.

[0039] To this end, the user runs the software development environment 104 on the CPU 101 .

[0040] The software development environment 104 enables users to develop and test applications (i.e., software) 105 for various devices 106, i.e., target hardware, such as embedded systems for controlling robotic devices including robot arms and autonomous vehicles, or also for mobile (communication) devices. For this purpose, the CPU 101 can run an emulator as part of the software development environment 104 in order to simulate the behavior of the corresponding device 106 for which the application is being or has been developed. If the software development environment is only used to test software from other sources, the software development environment 104 can also be regarded as or designed as a software testing environment.

[0041] The user can distribute the finished application to the corresponding devices 106 via the communication network 107. Instead of via the communication network 107, this can also be done in another way, for example by means of a USB memory stick.

[0042] However, before doing so, the user should be aware of possible security holes in the application 105 in order to avoid distributing an application that functions insecurely to the device 106. This may also be the case if the user does not write the application 105 at least partially himself (but instead uses program parts, such as libraries, from a third-party provider, for example). For a Tier 1 supplier of an application (or a device with the associated software), the application consists, for example, of the (supplier's) own code, OSS (Open Source Software) parts and precompiled libraries of a third-party provider. In particular, the following situation may occur: the user does not have the source code of the (entire) application, but only its executable code (i.e., a binary program), i.e., the application (computer program) 105 is (at least partially) a black-box computer program from the tester's point of view.

[0043] Therefore, the starting point for the security check is the binary code of the computer program, in the case where the user (or the corresponding development team) does not (completely) write the application 105 himself. According to various embodiments, a method is described that enables an analysis based on the binary code, in particular with regard to the security of the binary code (which security may also depend on whether all expected program components are present).

[0044] Therefore, the compiled code is used as the starting point of this analysis, and according to one embodiment, the compiled code is returned to its intermediate representation (this can be regarded as a part of reverse engineering (Reverse Engineering)) by binary promotion. Then, this intermediate representation is converted into a string (String). Finally, a string kernel comparison algorithm is applied to find the similarity between the generated string and a local (string) database with a reference program code string, for example. The reference program code can be regarded as the program code of a program library (wherein, this can include source code from a generally accessible library, a commercial library or a program code previously even written by a corresponding user (or a user group to which the user belongs)).

[0045] With this method, code similarities (between the binary code and the database) are found even if the compiler has been changed during compilation. The string kernel pattern search is able to find similarities between the strings of the binary code generated from the intermediate representation and the strings from the string database, even if the source code is compiled for a different architecture and optimization settings and obfuscation techniques are applied. By applying the string kernel method, it is possible to identify whether certain code fragments or library functions are part of the analyzed binary file in order to facilitate security and vulnerability management, for example by creating a software bill of materials (SBOM). In addition, malware analysis can be performed by comparing the generated strings with known software that has been reported as vulnerable. For this purpose, for example, strings corresponding to code contained in the (open) CVE (Common Vulnerabilities and Exposures) database can be included in the string database.

[0046] Below, some of the terms used in this article are explained:

[0047] -Binary lifting is a technique for converting machine instructions into intermediate representation.

[0048] - Reverse engineering is about: discovering the components and functions of a program. Recovering the original software by analyzing the compiled code. Hackers use this technique to find vulnerabilities.

[0049] - Code obfuscation refers to a collection of techniques used to improve code security by hiding implicit values ​​and obfuscating logic, thereby making it more difficult to reverse engineer the compiled software and recover the original source code.

[0050] - Obfuscation techniques are applied to the following code areas: data, control flow, and layout structures.

[0051] - The intermediate representation (IR) serves as the central data structure of the compiler. Optimizations and analyses are applied to this IR. Thus, the IR serves as a connection point between the front-end and the back-end of the compiler.

[0052] -Compilers are used to generate machine code from source code. Thus, the front end of the compiler takes the source code as input and generates an intermediate representation. This intermediate representation is then handed over to the back end, which generates the target code (binary code) as the final result.

[0053] - String kernels are tree-like data structures that are viewed as a collection of consecutive weighted tokens.

[0054] -The Software Bill of Materials (SBOM) of a program (i.e. software) is a list of third-party providers and open source components that are part of the program code. The SBOM also contains the licenses of these components, the component versions used in the code, and the corresponding patch status.

[0055] According to various embodiments, as described above, a string kernel comparison method (in the field of code similarity) is applied to generate an SBOM of a program from its binary code (e.g., completely, at least with respect to the list of program components). This can improve and automate the security management of the program.

[0056] Most software components from third-party providers (i.e. "external" program components) are delivered as binary code, without the developer or development team having access to the source code. Even within a manufacturer, it can happen that software libraries (i.e. "internal" program components) are transferred from one software management system to another without proper tracking. In the case of external software components, it is difficult to correctly identify these and assign vulnerabilities to them, but the same situation may therefore also apply to internal software components.

[0057] With the method described in this article, it is possible to search for vulnerabilities in binary code without external support, thereby improving the understanding of risks associated with the corresponding software and its security management. In addition, developers can identify if and which parts are missing in the provided SBOM. The string kernel search enables searching for software components (especially source code components) based on compiled binaries with a certain degree of fuzziness.

[0058] Figure 2 A flow chart for analyzing a computer program by means of binary lifting and subsequent string kernel search based on its binary code is shown.

[0059] The starting point is the binary code of the program to be checked (e.g. a compiled binary file) 201, which is promoted by means of binary promotion to a promoted binary code 202. Based on the promoted binary code 202, an intermediate representation (IR) 203 can be generated. From these two sources (IR 203 and / or promoted binary code 202), a string 204 is generated.

[0060] This string generation is also performed for the program components to be detected in the compiled binary file 201 (if they exist in the binary file), that is, a program code database 205 in the form of strings is generated. The program code collection for which the program code database 205 contains strings can be regarded as a program library (which contains: software components (such as subroutines, functions, etc.) to be detected in the SBOM of the binary code, or known harmful program components, or program components with vulnerabilities to be detected therein for the security analysis of the binary code). The strings of the program code database 205 can be generated in the same way as for the binary file 201 from the binary code of the program components for which the program code database 205 contains strings (or alternatively from the source code of the corresponding software component, if the source code is known). For example, the known suspicious source code can be directly converted into IR and strings, or first compiled and further analyzed from there (that is, for example, strings are generated for this similar to the binary file 201).

[0061] The kernel can now be used to search the program to be checked for program components for which program code database 205 contains character strings by means of kernel search 206 .

[0062] Due to the fuzziness of the approach provided by kernel search, for example, for known program components with vulnerabilities (for which program code database 205 contains strings), similar vulnerable code can be found in binary file 201 .

[0063] The results 207 of the kernel search 206 can be used in various ways, such as

[0064] · For generating SBOM for the program under test: Even if the source code of the program cannot be accessed, known program components can be identified and listed (e.g. from software libraries of third-party providers).

[0065] for finding vulnerable code segments based on internal and external program components (e.g., code fragments) for which strings are contained in database 205, even if code in libraries from third-party providers has been reused for the program under test or internal libraries (i.e., program components of the same manufacturer as the program under test) have been transferred between code databases and renamed.

[0066] Identification of obfuscation: The fuzziness of the string kernel search enables identification of program components from database 205 even for certain classes of obfuscation.

[0067] In the following, according to Figure 2 A simple example of processing is described.

[0068] In this example, the source code of the program to be checked is:

[0069]

[0070] The binary code 201 of the program is:

[0071]

[0072] The binary code 202 after promotion is:

[0073]

[0074] The generation of the promoted binary code 202 includes, in particular, decompiling the binary code 201 so that an intermediate representation instruction sequence is generated. The promoted binary code 202 indicates which values ​​relate to memory addresses and which values ​​relate to instructions and which regions of the binary code 201 together form a function. For this purpose, the intermediate representation instructions of a subsequence of the intermediate representation instruction sequence are grouped into program code segments, which respectively form a function.

[0075] The intermediate representation 203 (p-code in this example) has the following form:

[0076]

[0077]

[0078]

[0079] Now, a string kernel search, such as described in reference 1, may be applied to the intermediate representation 203 .

[0080] One or more strings are generated from this intermediate representation 203, for example via intermediate steps (grouping of characters into "tokens", ie strings followed by chains of such tokens, which are themselves (short) strings).

[0081] If the programs to be checked are then respectively provided in the form of character strings in program database 205 , the string kernel search searches for the longest character string which is contained both in the program to be checked and in program database 205 .

[0082] The number of such common substrings between the program to be checked and program components in the form of strings in program database 205 can be used as a similarity measure and it can then be ascertained (eg by comparison with a threshold value) whether the program component is contained in the program to be checked.

[0083] In this case, weights can be assigned to tokens, and the parameter "cutweight" specifies the minimum weight such a common substring must have in order to be considered.

[0084] For example, the search is performed for each program code segment, that is, for each program code segment identified in the promoted binary code 202 or in the intermediate representation 203, the similarity with the program code segment stored in the program database 205 in the form of a string is determined, and based on the similarity, it is judged whether the program component (as a program code segment) is included in the program to be checked.

[0085] The intermediate representation code strings from the intermediate representation instruction sequence can be generated at least partially by compensating for the obfuscation technique. For example, these strings can be generated in a special way, in which the obfuscation technique is revoked or taken into account, so that the obfuscated (sub)sequences of the intermediate representation instructions can also be assigned to the reference intermediate representation code strings (and thereby to the associated program components).

[0086] The following table shows an example of this in intermediate representation code.

[0087]

[0088] Even if the obfuscated code is different from the original code, the above method can find the obfuscated code because in the string kernel search, the codes are not searched one by one, but similarities are considered.

[0089] For example, these strings may be generated such that instead of mnemonics being considered as tokens (here for example JLE and JNC), instruction classes (ie here for example the “Sprung” class) are considered as tokens.

[0090] In summary, according to various embodiments, there is provided a method for Figure 3 The method shown in .

[0091] Figure 3 A flow chart 300 is shown which illustrates a method according to one embodiment for automatically analyzing a computer program, ie in particular for determining program components present in a computer program (to be checked) which is present in a compiled version, ie binary code.

[0092] At 301, an intermediate representation code having an intermediate representation instruction sequence is generated by decompiling the binary code of the computer program (to be checked). For example, the intermediate representation code can be generated from the binary code by first decompiling the binary code into assembly instructions and generating the intermediate representation code (e.g., p-code) therefrom by binary promotion.

[0093] At 302, one or more intermediate representation code strings are generated from the intermediate representation instruction sequence. This is achieved, for example, by generating a control flow graph (Call Graph in English) and generating tokens based thereon (for example, generating one token for each node of the control flow graph) and generating intermediate representation code strings from these tokens.

[0094] At 303, among the one or more intermediate representation code strings, a reference intermediate representation code string among multiple reference intermediate representation code strings (from a database) is searched by means of a string kernel search, wherein each reference intermediate representation code string belongs to a program component (e.g. a function, but may also be a larger (sub)program).

[0095] At 304 , a program component to which the reference intermediate representation code string found in the one or more intermediate representation code strings by means of the string kernel comparison belongs is determined as a program component present in the computer program.

[0096] Figure 3 The method can be performed by one or more computers with one or more data processing units. The term "data processing unit" can be understood as any type of entity capable of processing data or signals. For example, these data or signals can be processed according to at least one (that is, one or more than one) specific function, which is performed by a data processing unit. The data processing unit may include an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an integrated circuit of a programmable gate array (FPGA), or any combination thereof or be constructed by these. Any other means for implementing the corresponding functions described in more detail herein may also be understood as a data processing unit or a logic circuit device. One or more of the method steps described in detail here can be implemented (e.g., realized) by a data processing unit through one or more specific functions, which are performed by the data processing unit.

[0097] In particular, according to various embodiments, the method is computer-implemented.

[0098] Figure 3 The method is used to analyze a program, for example control software for a robotic device (e.g. for vulnerabilities). The term "robotic device" may be understood to refer to any technical system, such as a computer-controlled machine, a vehicle, a household appliance, a power tool, a manufacturing machine, a personal assistant or an access control system. The control software may also be used in data processing systems such as navigation devices.

[0099] For example, by means of a test device (e.g. Figure 1computer 100 and target device 106) to execute Figure 3 method.

Claims

1. A method for automatically analyzing a computer program (105), the method comprising: Decompiling the binary code (201) of the computer program (105) to generate (301) an intermediate representation code having an intermediate representation instruction sequence; generating (302) one or more intermediate representation code strings (204) from the intermediate representation instruction sequence; Among the one or more intermediate representation code strings (204), a reference intermediate representation code string among a plurality of reference intermediate representation code strings is searched (303) by means of a string kernel search (206), wherein: Each reference to an intermediate representation code string belongs to a program component; and The program component to which the reference intermediate representation code string found in the one or more intermediate representation code strings (204) by means of a string kernel comparison belongs is determined (304) as a program component present in the computer program (105).

2. The method according to claim 1, wherein: The one or more intermediate representation code strings (204) are multiple intermediate representation code strings (204) generated by combining subsequences of the intermediate representation instruction sequence into program code segments, the program code segments respectively forming functions, and wherein the reference intermediate representation code string is searched for in each intermediate representation code string. 3 . The method according to claim 1 , comprising: determining a security vulnerability of the computer program ( 105 ) as a function of the determined program component and the information about the security vulnerability of the determined program component.

4. The method according to any one of claims 1 to 3, wherein: The one or more intermediate representation code strings are generated from the intermediate representation instruction sequence at least in part by compensating or taking into account obfuscation techniques (204). 5 . The method according to claim 1 , comprising: determining program components missing from the computer program ( 105 ) as a function of program components determined to be present in the computer program.

6. A method according to any one of claims 1 to 5, comprising: using the computer program (105), controlling the robotic device according to the program components determined to be present in the computer program (105) corresponding to a specified set of required and / or permitted program components.

7. A software analysis system (100) configured to execute the method according to any one of claims 1 to 6. 8 . A computer program comprising instructions which, when executed by a processor, cause the processor to execute the method according to claim 1 .

9. A computer-readable medium storing instructions, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 6.

Images