Reverse processing method and device, electronic equipment and storage medium

Abstract

The invention provides a reverse processing method and device, electronic equipment and a storage medium, and relates to the technical field of computers, in particular to the field of software testing. According to the specific implementation scheme, a target application program and a reverse tool calling instruction are obtained; based on the reverse tool calling instruction, determining at least one reverse tool for the target application program in a pre-configured reverse tool set; and performing reverse processing on the target application program based on the at least one reverse tool to obtain a reverse processing result of the target application program. According to the embodiment of the invention, the operation process of reverse processing of the application is simplified, the compatibility problem is reduced, and the overall performance of reverse analysis is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of software testing. Background Art

[0002] By reverse engineering an application, potential vulnerabilities and security risks can be discovered to enhance the security of the application. Therefore, reverse engineering is suitable for security testing, vulnerability analysis, performance optimization, and development and debugging of applications. Currently, reverse engineering has problems such as complex operations and cumbersome processes. Summary of the invention

[0003] The present disclosure provides a reverse processing method, device, electronic device and storage medium.

[0004] According to one aspect of the present disclosure, there is provided a reverse processing method, comprising:

[0005] Get the target application and reverse tool calling instructions;

[0006] Based on the reverse tool calling instruction, determining at least one reverse tool for the target application in a pre-configured reverse tool set;

[0007] The target application is reversely processed based on the at least one reverse tool to obtain a reverse processing result of the target application.

[0008] According to another aspect of the present disclosure, there is provided a reverse processing device, comprising:

[0009] An acquisition module is used to acquire the target application and reverse tool calling instructions;

[0010] A tool determination module, configured to determine at least one reverse tool for the target application from a preconfigured reverse tool set based on the reverse tool calling instruction;

[0011] The execution module is used to perform reverse processing on the target application based on the at least one reverse tool to obtain a reverse processing result of the target application.

[0012] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0016] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0018] According to the technical solution of the embodiment of the present disclosure, multiple reverse tools are pre-configured as a reverse tool set. Developers can call one or more reverse tools on a single platform without frequently switching between different tools. This simplifies the operation process, reduces compatibility issues, and improves the overall performance of reverse analysis.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0021] Figure 1 is a flowchart of a reverse processing method provided by an embodiment of the present disclosure;

[0022] Figure 2 is a schematic diagram of an application example of the reverse processing method provided by an embodiment of the present disclosure;

[0023] Figure 3 It is a technical architecture diagram of the tool used to implement the reverse processing method;

[0024] Figure 4 It is the technical architecture diagram of the dynamic analysis tool;

[0025] Figure 5 is a schematic block diagram of a reverse processing device provided by an embodiment of the present disclosure;

[0026] Figure 6 is a schematic block diagram of a reverse processing device provided by another embodiment of the present disclosure;

[0027] Figure 7 It is a block diagram of an electronic device used to implement the reverse processing method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0029] Figure 1 A flow chart of a reverse processing method provided by an embodiment of the present disclosure is shown. Optionally, the method can be applied to a reverse processing device, which can be deployed in an electronic device. The electronic device is, for example, a single or multi-machine terminal, server or other processing device. Among them, the terminal can be a user equipment (User Equipment, UE) such as a mobile device, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the method can also be implemented by a processor calling computer-readable instructions stored in a memory. For example Figure 1 As shown, the method may include:

[0030] S110, obtaining a target application and a reverse tool calling instruction.

[0031] The target application is the application to be processed. In one embodiment, the electronic device can obtain the target application and the reverse tool calling instruction through a user interaction interface. The user interaction interface can be a user interaction interface displayed on a display device of the electronic device, or a user interaction interface displayed on a user device connected to the electronic device.

[0032] Optionally, a relevant program or system is installed in the electronic device, and a user interaction interface is provided based on the program or system. The user interaction interface may include an application upload interface, through which a user can upload a target application. The user interaction interface may also include a tool selection interface, through which a user can input a reverse tool call instruction, which is used to specify, call or select one or more reverse tools.

[0033] S120: Based on the reverse tool calling instruction, determine at least one reverse tool for the target application in a pre-configured reverse tool set.

[0034] In an embodiment of the present disclosure, a preconfigured reverse tool set may include multiple reverse tools. Exemplarily, the reverse tool set may include tools such as decompilation, dynamic analysis, shell removal, and network packet capture. Among them, the decompilation tool is used to convert the compiled target application into source code to provide users with a program language with better readability, so that users can understand the target application. The dynamic analysis tool is used to run the target application, obtain the status and return data of the target application at runtime, and facilitate observation and modification of the operation of the target application, and understanding the operation process, dynamic data and memory status of the target application. The shell removal tool is used to remove the encryption shell, compression shell, virtual machine protection shell and other protection programs of the target application. The network packet capture tool is used to capture and analyze the network communication data of the target application, including request and response data, data format and encryption method, etc.

[0035] Optionally, at least one reverse tool for the target application may include one or more reverse tools specified, called or selected by the reverse tool calling instruction. Optionally, at least one reverse tool for the target application may also include other reverse tools associated with the reverse tool specified, called or selected by the reverse tool calling instruction. For example, in some application scenarios, a dynamic analysis tool can obtain analysis suggestions based on the source code obtained by decompilation and the state and data of the target application at runtime. When the reverse tool calling instruction formulates a dynamic analysis tool, it can be determined that at least one reverse tool for the target application includes a dynamic analysis tool and a decompilation tool.

[0036] S130: Perform reverse processing on the target application based on at least one reverse engineering tool to obtain a reverse processing result of the target application.

[0037] Optionally, the target application may be processed accordingly based on the respective functions of each reverse tool in at least one reverse tool. For example, the target application is decompiled based on the decompilation tool to obtain a reverse processing result, and the reverse processing result includes source code. For another example, the target application is dynamically analyzed based on the dynamic analysis tool to obtain a reverse processing result, and the reverse processing result includes the running status and return data of the target application.

[0038] In the related art, the reverse engineering process usually requires developers to install and configure multiple independent tools, such as packet capture tools, decompilation tools, shelling tools, dynamic analysis tools and other auxiliary analysis tools. This multi-tool collaboration not only increases the complexity of operation, but also may cause compatibility issues between different tools, affecting the efficiency of reverse analysis. The above method provided by the embodiment of the present disclosure integrates multiple reverse tools, and developers can complete static and dynamic analysis tasks on a single platform, avoiding switching and compatibility issues between multiple tools, and there is no need to manually configure each tool, which greatly simplifies the operation process and improves the efficiency and convenience of analysis. Therefore, the above method improves the overall performance of reverse analysis.

[0039] In some embodiments, when at least one reverse tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain. Specifically, the above step S130, performing reverse processing on the target application based on at least one reverse tool to obtain the reverse processing result of the target application, may include: when at least one reverse tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain the operation result corresponding to the application operation instruction; and determining at least one call chain based on the application operation instruction and the operation result.

[0040] Optionally, the application operation instruction may be an operation instruction for a target application received on a user interaction interface, and the instruction is used to trigger the target application to run. During the running process of the target application, one or more network nodes are called, and the running result corresponding to the application operation instruction is obtained based on the services provided by the one or more network nodes.

[0041] The above-mentioned call chain refers to the network link formed by multiple network nodes called by the target application when executing a task. For example, when a user initiates a task through an application operation instruction, in response to the application operation instruction, the target application needs to first call node 1 to obtain data X. Data X is determined based on data Y, and node 2 needs to be called to obtain data Y. Data Y is determined based on data Z, and node 3 needs to be called to obtain data Z. Then the target application needs to call node 1, node 2 and node 3 in sequence, and the call chain includes node 1, node 2 and node 3.

[0042] In the disclosed embodiment, at least one call chain is determined based on application operation instructions and operation results, that is, the call chain related to the network node is automatically tracked. This allows developers to quickly understand the call chain in the target application without manually analyzing the code, which significantly improves the accuracy of reverse analysis.

[0043] Optionally, the reverse processing result may also include network traffic data related to each call chain in at least one call chain. When the electronic device obtains the reverse processing result, it may display the reverse processing result to the user through the user interaction interface, for example, by displaying the call chain in association with the network traffic data, further providing refined data, and improving the accuracy of the reverse analysis.

[0044] In some embodiments, at least one call chain is determined based on application operation instructions and operation results, including: based on the application operation instructions and information of each node in the call network of the target application, at least one call chain starting point is determined in the call network; based on the operation results and information of each node in the call network, at least one call chain end point is determined in the call network; based on at least one call chain starting point and at least one call chain end point, matching links are searched in the call network to obtain at least one call chain.

[0045] In actual applications, the target application can communicate directly or indirectly with multiple network nodes to call the services provided by these network nodes, which constitute the call network of the target application. In related technologies, when reverse analyzing the target application, the call network of the target application can be sorted out by analyzing the source code. If the call chain needs to be determined, it is necessary to input different application operation instructions multiple times, and check the call path corresponding to each application operation instruction according to the call network. For example, multiple operations are required, and the data returned by each operation is analyzed. The call path direction after each node in the call network is verified to sort out the call chain corresponding to a single operation.

[0046] In the disclosed embodiment, by analyzing the information of each node in the call network, such as the service content and input and output data form provided by each node, the application operation instruction is matched with the information of each node, and at least one matched node is used as at least one call chain starting point. Similarly, based on the operation result and the information of each node, at least one matched node is used as at least one call chain end point. Based on this, at least one matching link can be sorted out in the call network based on at least one call chain starting point and at least one call chain end point as the call chain corresponding to the application operation instruction.

[0047] According to the above method, the user does not need to perform multiple operations. The electronic device can identify one or more possible call chains based on the input instructions of a single operation and the corresponding operation results, and display them to the user. The user can perform analysis based on these call chains and related information, which significantly improves the efficiency of reverse analysis.

[0048] In some embodiments, when at least one reverse tool includes a dynamic analysis tool, the reverse processing result includes relevant information of the target search object. Specifically, step S130, performing reverse processing on the target application based on at least one reverse tool to obtain the reverse processing result of the target application, may include: when at least one reverse tool includes a dynamic analysis tool, displaying multiple search objects in the target application, and detecting a selection operation in the multiple search objects; generating a monitoring code based on the target search object corresponding to the selection operation; and obtaining relevant information of the target search object based on the monitoring code when running the target application.

[0049] Optionally, the search object may include classes and / or methods in the target application.

[0050] Optionally, the above-mentioned monitoring code may include Hook code. In dynamic analysis, the execution process of the program can be monitored and key information can be captured by inserting specific Hook code when the application is running. The Hook code can be used to intercept the execution process of the application by intercepting function calls, modifying function parameters or return values, etc. By inserting Hook code at key locations, class and method calls during program execution, as well as related parameters and return values, can be captured, thereby helping to understand the runtime behavior of the program and find the calling path and usage of the target class and method.

[0051] According to the above embodiment, when it is necessary to dynamically analyze the target application, the electronic device can display various classes and / or methods in the target application through the user interaction interface, and the user can select from them. Based on the user's selection operation, the electronic device will generate a monitoring code, such as a Hook code, and based on the monitoring code, when running the target application, obtain relevant information of the class and / or method selected by the user, such as returned data, device status, etc.

[0052] It can be seen that the reverse processing method according to the embodiment of the present disclosure can allow users to dynamically search for objects of interest, automatically generate and execute monitoring codes, thereby improving the efficiency and operability of dynamic debugging.

[0053] Optionally, the above method may further include: displaying relevant information of the target search object through a user interaction interface.

[0054] In some embodiments, before obtaining relevant information of the target search object based on the monitoring code, the above method further includes: detecting a modification operation on the monitoring code, and modifying the monitoring code based on the modification operation.

[0055] Optionally, after the monitoring code is generated, the electronic device can display the monitoring code through a user interaction interface, so that the user can input a modification operation to modify the monitoring code. For example, the user can modify the key information type captured in the Hook code. Based on the modified monitoring code, the electronic device obtains relevant information of the target search object when the target application is running.

[0056] According to the above method, the monitoring code can be modified according to user needs, so as to more flexibly support the user's analysis of the target search object, thereby improving the flexibility of dynamic analysis and user experience.

[0057] In some embodiments, when at least one reverse tool includes a network packet capture tool, the reverse processing result includes a network replay result. Specifically, step S130, based on at least one reverse tool, reverse processing is performed on the target application to obtain the reverse processing result of the target application, including: when at least one reverse tool includes a network packet capture tool, based on a network request, obtaining a first network packet capture result; correlating and displaying the network request and the network packet capture result, and detecting a modification operation on the network request; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; and obtaining a network replay result based on the second network packet capture result.

[0058] Among them, the network packet capture tool is used to obtain the communication data between the target application and each network node, analyze the network request of the target application, obtain the Uniform Resource Location (URL), parameters, response data and other information of the request, so as to conduct an in-depth analysis of the behavior of the target application. In the embodiment of the present disclosure, obtaining the first network packet capture result based on the network request may include: triggering the target application to execute the network request, and capturing relevant data in the network, and using the relevant data as the first network packet capture result. Among them, the relevant data are, for example, parameters related to the network protocol, response data, flow data, etc.

[0059] According to the above method, the electronic device will display the network request in association with the network packet capture result, allowing the user to input a modification operation for the network request, and replay the network request based on the modification operation. Specifically, replaying the network request can refer to modifying the network request and triggering the target application to execute the modified network request. By replaying the network request, the relevant data in the network can be captured again, and the relevant data can be used as the second network packet capture result.

[0060] Optionally, the network replay result obtained based on the second network packet capture result may include the second network packet capture result, and may also include comparison information between the first network packet capture result and the second network packet capture result.

[0061] According to the above method, the network packet capture tool integrates the function of network traffic replay, and users can capture network requests and simulate replay. Therefore, it is convenient for users to perform security testing, help users quickly identify vulnerabilities or abnormal behaviors, and improve the efficiency of security testing.

[0062] Optionally, the electronic device generates a feedback report after network playback, and the feedback report includes the above network playback result for the user to view.

[0063] In practical applications, one or more of the above embodiments may be combined. For example, when at least one reverse engineering tool for a target application includes a dynamic analysis tool and a network packet capture tool, at least one call chain may be analyzed and supported for network replay.

[0064] Figure 2 FIG. 1 is a schematic diagram showing an application example of the reverse processing method provided by an embodiment of the present disclosure. Figure 2 As shown, this application example includes:

[0065] S210: Capture network packets for the target application.

[0066] S220: Display a packet capture list, which includes network requests and corresponding packet capture results.

[0067] S230: Display network data details.

[0068] S240: Determine whether the user has modified the network data. If yes, jump to step S250; if no, jump to step S280.

[0069] S250: Determine whether the user replays the network request. If yes, jump to step S260; if no, jump to step S270.

[0070] S260: re-execute the network request according to the modified content, and display the network data.

[0071] S270: Execute other operations.

[0072] S280, trace the call chain.

[0073] S290. Check the call chain.

[0074] S300. View any method in the call chain by generating Hook code.

[0075] S310, analyzing the selected method.

[0076] In some embodiments, the above-mentioned reverse processing method further includes: using a large language model (LLM) to analyze the reverse processing results to obtain optimization suggestions for the target application.

[0077] According to the above method, through the integrated large language model (also called large model), the electronic device can intelligently parse complex call chains and give optimization suggestions. This function takes automated analysis to a new level, can intelligently identify potential problem areas, and provide decision support for developers.

[0078] In order to facilitate understanding of the above technical solution, Figure 3 A technical architecture diagram of a tool for implementing the reverse processing method in an embodiment of the present disclosure is shown.

[0079] like Figure 3 As shown, the underlying service 310 of the tool includes a decompilation service, an unpacking service, a Hook service and a network service.

[0080] The core capabilities 320 include decompilation capability, shelling capability, dynamic debugging capability and network packet capture capability.

[0081] Business functions 330 include decompilation, code review, static search, APK (Android Application Package) unpacking, call chain tracing, call chain analysis, dynamic search, Hook class / method, AI (Artificial Intelligence) analysis, packet capture network interface, network interface analysis, network interface call chain tracing, network interface replay, etc. Among them, decompilation, code review, static search, etc. are used to support the decompilation capability in the core capability 320; APK unpacking is used to support the unpacking capability in the core capability 320; call chain tracing, call chain analysis, dynamic search, Hook class / method, AI analysis are used to support the dynamic debugging capability in the core capability 320; packet capture network interface, network interface analysis, network interface call chain tracing, network interface replay, etc. are used to support the network packet capture capability in the core capability 320.

[0082] At the user layer 340 , a target application provided by a user may be received. The target application may be in a format such as APK, AAR, or ZIP.

[0083] Regarding the dynamic analysis tools in the above methods, Figure 4 The technical architecture diagram of the dynamic analysis tool is shown in FIG. Figure 4As shown, in dynamic analysis, the base capability 410 includes Hook system key API (Application Programming Interface), dynamic library Hook, page data monitoring and network data monitoring. Functional module 420 includes a module for generating Hook code, a module for executing Hook for a specified class / method, a data search module and an AI analysis module. At the user layer 430, the operations that users can perform include: paying attention to specified classes and methods to trigger automatic generation of Hook code; selecting classes and methods for Hook; searching for data generated when an application (App) is executed and associating it with a specific method; searching for page data and network data.

[0084] It can be seen that the integrated reverse tool provided by the embodiment of the present disclosure greatly improves the efficiency and accuracy of application reverse engineering. By integrating multiple independent functions such as decompilation, network packet capture, shelling, dynamic debugging, call chain tracing, etc. into a single platform, developers do not need to frequently switch between different tools, simplifying the operation process and reducing configuration and compatibility issues. At the same time, the platform significantly reduces the complexity of manual analysis and improves the accuracy of problem location and debugging through automated call chain analysis, intelligent large model parsing, and network traffic replay functions.

[0085] In addition, the integrated design optimizes multi-functional collaboration, ensures seamless integration between the functions of each tool, and further improves the overall performance of reverse analysis. This solution is not only suitable for scenarios such as security testing and vulnerability analysis, but also helps developers obtain faster and more accurate feedback in performance optimization, code auditing, etc., providing efficient and comprehensive support for the development process. Ultimately, this technical solution effectively shortens the development cycle, reduces the labor cost in reverse engineering, and improves the overall efficiency of product development by improving analysis automation and enhancing intelligent parsing capabilities.

[0086] According to an embodiment of the present disclosure, the present disclosure also provides a reverse processing device, Figure 5 A schematic block diagram of a reverse processing device provided by an embodiment of the present disclosure is shown. Figure 5 As shown, the device comprises:

[0087] An acquisition module 510 is used to acquire a target application and a reverse tool calling instruction;

[0088] A tool determination module 520, configured to determine at least one reverse tool for a target application program from a pre-configured reverse tool set based on the reverse tool calling instruction;

[0089] The execution module 530 is used to perform reverse processing on the target application based on at least one reverse tool to obtain a reverse processing result of the target application.

[0090] In some embodiments, when at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; the execution module 530 is used to:

[0091] In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction;

[0092] At least one call chain is determined based on the application operation instruction and the operation result.

[0093] In some embodiments, the execution module 530 is further configured to:

[0094] Based on the application operation instruction and information of each node in the call network of the target application program, determining at least one call chain starting point in the call network;

[0095] Based on the running result and the information of each node in the call network, determining at least one call chain endpoint in the call network;

[0096] Based on at least one call chain starting point and at least one call chain end point, a matching link is searched in the call network to obtain at least one call chain.

[0097] In some embodiments, when at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information of the target search object; the execution module 530 is used to:

[0098] In a case where the at least one reverse engineering tool includes a dynamic analysis tool, displaying a plurality of search objects in the target application and detecting a selection operation in the plurality of search objects;

[0099] Generate monitoring code based on the target search object corresponding to the selection operation;

[0100] When the target application is running, relevant information of the target search object is obtained based on the listening code.

[0101] In some embodiments, the execution module 530 is further configured to:

[0102] Detect modification operations on the listening code, and modify the listening code based on the modification operations.

[0103] In some embodiments, when at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; the execution module 530 is used to:

[0104] In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request;

[0105] Display network requests and network packet capture results in a correlated manner, and detect modification operations on network requests;

[0106] Replay the network request based on the modification operation on the network request to obtain a second network packet capture result;

[0107] Based on the second network packet capture result, a network replay result is obtained.

[0108] In some embodiments, Figure 6 As shown, the reverse processing device also includes:

[0109] The analysis module 610 is used to analyze the reverse processing results using the large language model to obtain optimization suggestions for the target application.

[0110] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0111] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0112] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0113] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0114] like Figure 7As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0115] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0116] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the inverse processing method. For example, in some embodiments, the inverse processing method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the inverse processing method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the inverse processing method in any other appropriate manner (e.g., by means of firmware).

[0117] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0119] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0122] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0123] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0124] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A reverse processing method, comprising: Get the target application and reverse tool calling instructions; Based on the reverse tool calling instruction, determining at least one reverse tool for the target application in a pre-configured reverse tool set; The target application is reversely processed based on the at least one reverse tool to obtain a reverse processing result of the target application.

2. The method according to claim 1, wherein: In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; The performing reverse processing on the target application based on the at least one reverse tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction; Based on the application operation instruction and the running result, the at least one call chain is determined.

3. The method according to claim 2, wherein: The determining the at least one call chain based on the application operation instruction and the operation result includes: Based on the application operation instruction and information of each node in the call network of the target application program, determining at least one call chain starting point in the call network; Based on the operation result and information of each node in the call network, determining at least one call chain endpoint in the call network; Based on the at least one call chain starting point and the at least one call chain end point, a matching link is searched in the call network to obtain the at least one call chain.

4. The method according to any one of claims 1 to 3, wherein: In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information of the target search object; The performing reverse processing on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, displaying a plurality of search objects in the target application and detecting a selection operation in the plurality of search objects; Generate a monitoring code based on the target search object corresponding to the selection operation; When the target application is running, relevant information of the target search object is obtained based on the monitoring code.

5. The method according to claim 4, wherein: Before acquiring the relevant information of the target search object based on the monitoring code, the method further includes: A modification operation on the monitoring code is detected, and the monitoring code is modified based on the modification operation.

6. The method according to any one of claims 1 to 5, wherein: In the case where the at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; The performing reverse processing on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request; The network request and the network packet capture result are displayed in association, and a modification operation on the network request is detected; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; Based on the second network packet capture result, the network replay result is obtained.

7. The method according to any one of claims 1 to 6, further comprising: The reverse processing result is analyzed using a large language model to obtain optimization suggestions for the target application.

8. A reverse processing device, comprising: An acquisition module is used to acquire the target application and reverse tool calling instructions; A tool determination module, configured to determine at least one reverse tool for the target application from a preconfigured reverse tool set based on the reverse tool calling instruction; The execution module is used to perform reverse processing on the target application based on the at least one reverse tool to obtain a reverse processing result of the target application.

9. The device according to claim 8, wherein: In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; The execution module is used for: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction; Based on the application operation instruction and the running result, the at least one call chain is determined.

10. The device according to claim 9, wherein: The execution module is used for: Based on the application operation instruction and information of each node in the call network of the target application program, determining at least one call chain starting point in the call network; Based on the operation result and information of each node in the call network, determining at least one call chain endpoint in the call network; Based on the at least one call chain starting point and the at least one call chain end point, a matching link is searched in the call network to obtain the at least one call chain.

11. The device according to any one of claims 8 to 10, wherein: In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information of the target search object; The execution module is used for: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, displaying a plurality of search objects in the target application and detecting a selection operation in the plurality of search objects; Generate a monitoring code based on the target search object corresponding to the selection operation; When the target application is running, relevant information of the target search object is obtained based on the monitoring code.

12. The device according to claim 11, wherein The execution module is also used for: A modification operation on the monitoring code is detected, and the monitoring code is modified based on the modification operation.

13. The device according to any one of claims 8 to 12, wherein: In the case where the at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; The execution module is used for: In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request; The network request and the network packet capture result are displayed in association, and a modification operation on the network request is detected; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; Based on the second network packet capture result, the network replay result is obtained.

14. The apparatus according to any one of claims 8 to 13, further comprising: The analysis module is used to analyze the reverse processing result by using a large language model to obtain optimization suggestions for the target application.

15. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

17. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images