Reverse processing method, device, electronic device and storage medium

Abstract

The present disclosure provides a reverse processing method, apparatus, electronic device, and storage medium, relating to the field of computer technology, particularly the field of software testing. A specific implementation scheme comprises: obtaining a target application and a reverse tool call instruction; based on the reverse tool call instruction, determining at least one reverse tool for the target application from a preconfigured reverse tool set; and performing reverse processing on the target application based on the at least one reverse tool to obtain a reverse processing result for the target application. The disclosed embodiments simplify the operational process of application reverse processing, reduce compatibility issues, and improve the overall performance of reverse analysis.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of software testing. Background Art

[0002] By reverse engineering an application, potential vulnerabilities and security risks can be discovered, thereby enhancing its security. Therefore, reverse engineering is suitable for security testing, vulnerability analysis, performance optimization, and development and debugging. Currently, reverse engineering presents challenges such as complex operations and cumbersome processes. Summary of the Invention

[0003] The present disclosure provides a reverse processing method, device, electronic device and storage medium.

[0004] According to one aspect of the present disclosure, there is provided a reverse processing method, comprising:

[0005] Obtain the target application and reverse engineering tool calling instructions;

[0006] Determining at least one reverse tool for the target application from a pre-configured reverse tool set based on the reverse tool calling instruction;

[0007] The target application is reverse-engineered based on the at least one reverse-engineering tool to obtain a reverse-engineering result of the target application.

[0008] According to another aspect of the present disclosure, there is provided a reverse processing device, comprising:

[0009] The acquisition module is used to obtain the target application and reverse tool calling instructions;

[0010] a tool determination module, configured to determine, based on the reverse tool calling instruction, at least one reverse tool for the target application from a preconfigured reverse tool set;

[0011] An execution module is configured to perform reverse processing on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application.

[0012] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any method in the embodiments of the present disclosure.

[0016] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the computer program implements any one of the methods according to the embodiments of the present disclosure.

[0018] According to the technical solution of the embodiment of the present disclosure, multiple reverse tools are pre-configured as a reverse tool set. Developers can call one or more reverse tools on a single platform without having to frequently switch between different tools. This simplifies the operation process, reduces compatibility issues, and improves the overall performance of reverse analysis.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0021] Figure 1 is a flowchart of a reverse processing method provided by an embodiment of the present disclosure;

[0022] Figure 2 is a schematic diagram of an application example of the reverse processing method provided by an embodiment of the present disclosure;

[0023] Figure 3 It is a technical architecture diagram of the tool used to implement the reverse processing method;

[0024] Figure 4 This is the technical architecture diagram of the dynamic analysis tool;

[0025] Figure 5 is a schematic block diagram of a reverse processing device provided by an embodiment of the present disclosure;

[0026] Figure 6 is a schematic block diagram of a reverse processing device provided by another embodiment of the present disclosure;

[0027] Figure 7 It is a block diagram of an electronic device used to implement the reverse processing method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0029] Figure 1 A flow chart of the reverse processing method provided by an embodiment of the present disclosure is shown. Optionally, the method can be applied to a reverse processing device, which can be deployed in an electronic device. The electronic device is, for example, a single or multi-machine terminal, server or other processing device. Among them, the terminal can be a user equipment (UE) such as a mobile device, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the method can also be implemented by a processor calling computer-readable instructions stored in a memory. For example Figure 1 As shown, the method may include:

[0030] S110: Obtain a target application and a reverse engineering tool calling instruction.

[0031] The target application is the application to be processed. In one embodiment, the electronic device can obtain the target application and the reverse engineering tool call instruction through a user interface. The user interface can be a user interface displayed on a display device of the electronic device, or a user interface displayed on a user device connected to the electronic device.

[0032] Optionally, the electronic device is installed with a relevant program or system, and a user interface is provided based on the program or system. The user interface may include an application upload interface, through which a user can upload a target application. The user interface may also include a tool selection interface, through which a user can input a reverse engineering tool call instruction, which is used to specify, call, or select one or more reverse engineering tools.

[0033] S120 : Based on the reverse tool calling instruction, determine at least one reverse tool for the target application from a pre-configured reverse tool set.

[0034] In an embodiment of the present disclosure, a pre-configured reverse tool set may include multiple reverse tools. Exemplarily, the reverse tool set may include tools such as decompilation, dynamic analysis, unpacking, and network packet capture. Among them, the decompilation tool is used to convert the compiled target application into source code to provide users with a more readable programming language, which is convenient for users to understand the target application. The dynamic analysis tool is used to run the target application and obtain the status and return data of the target application at runtime, which is convenient for observing and modifying the operation status of the target application and understanding the operation process, dynamic data and memory status of the target application. The unpacking tool is used to remove the encryption shell, compression shell, virtual machine protection shell and other protection programs of the target application. The network packet capture tool is used to capture and analyze the network communication data of the target application, including request and response data, data format and encryption method, etc.

[0035] Optionally, the at least one reverse tool for the target application may include one or more reverse tools specified, called or selected by the reverse tool calling instruction. Optionally, the at least one reverse tool for the target application may also include other reverse tools associated with the reverse tool specified, called or selected by the reverse tool calling instruction. For example, in some application scenarios, a dynamic analysis tool can obtain analysis suggestions based on the source code obtained by decompilation and the state and data of the target application at runtime. When the reverse tool calling instruction formulates a dynamic analysis tool, it can be determined that the at least one reverse tool for the target application includes a dynamic analysis tool and a decompilation tool.

[0036] S130: Perform reverse engineering on the target application based on at least one reverse engineering tool to obtain a reverse processing result of the target application.

[0037] Optionally, the target application may be processed accordingly based on the respective functions of each of the at least one reverse engineering tool. For example, the target application may be decompiled using a decompilation tool to obtain a reverse processing result, which may include source code. For another example, the target application may be dynamically analyzed using a dynamic analysis tool to obtain a reverse processing result, which may include the target application's running status and return data.

[0038] In the related art, the reverse engineering process usually requires developers to install and configure multiple independent tools, such as packet capture tools, decompilation tools, shelling tools, dynamic analysis tools and other auxiliary analysis tools. This multi-tool collaboration not only increases the complexity of operation, but may also cause compatibility issues between different tools, affecting the efficiency of reverse analysis. The above method provided by the embodiment of the present disclosure integrates multiple reverse tools, and developers can complete static and dynamic analysis tasks on a single platform, avoiding switching and compatibility issues between multiple tools, and there is no need to manually configure each tool, which greatly simplifies the operation process and improves the efficiency and convenience of analysis. Therefore, the above method improves the overall performance of reverse analysis.

[0039] In some embodiments, when the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain. Specifically, the aforementioned step S130 of performing reverse processing on the target application based on the at least one reverse tool to obtain the reverse processing result of the target application may include: when the at least one reverse tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain the operation result corresponding to the application operation instruction; and determining at least one call chain based on the application operation instruction and the operation result.

[0040] Optionally, the application operation instruction may be an operation instruction for a target application program received on a user interface, which is used to trigger the target application program to run. During the running process of the target application program, one or more network nodes are called, and the running result corresponding to the application operation instruction is obtained based on the services provided by the one or more network nodes.

[0041] The call chain is the network link formed by multiple network nodes called by the target application when executing a task. For example, when a user initiates a task through an application operation instruction, in response to the application operation instruction, the target application needs to first call node 1 to obtain data X. Data X is determined based on data Y, so it needs to call node 2 to obtain data Y. Data Y is determined based on data Z, so it needs to call node 3 to obtain data Z. In this case, the target application needs to call nodes 1, 2, and 3 in sequence, and the call chain includes nodes 1, 2, and 3.

[0042] In the embodiment of the present disclosure, at least one call chain is determined based on application operation instructions and operation results, that is, the call chain related to the network node is automatically tracked. This allows developers to quickly understand the call chain in the target application without manually analyzing the code, significantly improving the accuracy of reverse analysis.

[0043] Optionally, the reverse processing results may further include network traffic data associated with each call chain in at least one call chain. Upon obtaining the reverse processing results, the electronic device may display the reverse processing results to the user through a user interface, for example, by associating the call chain with the network traffic data, thereby providing further refined data and improving the accuracy of the reverse analysis.

[0044] In some embodiments, based on application operation instructions and operation results, at least one call chain is determined, including: based on the application operation instructions and information of each node in the call network of the target application, at least one call chain starting point is determined in the call network; based on the operation results and information of each node in the call network, at least one call chain end point is determined in the call network; based on at least one call chain starting point and at least one call chain end point, matching links are searched in the call network to obtain at least one call chain.

[0045] In actual applications, the target application can communicate directly or indirectly with multiple network nodes to invoke the services provided by these network nodes. These network nodes constitute the target application's call network. In related technologies, when reverse engineering the target application, the target application's call network can be analyzed by analyzing the source code. If the call chain needs to be determined, it is necessary to input different application operation instructions multiple times and then check the call path corresponding to each application operation instruction according to the call network. For example, multiple operations may be required, and the data returned by each operation must be analyzed. The call path direction after each node in the call network must be verified to sort out the call chain corresponding to a single operation.

[0046] In an embodiment of the present disclosure, by analyzing the information of each node in the call network, such as the service content and input and output data formats provided by each node, the application operation instruction is matched with the information of each node, and at least one matched node is used as the starting point of at least one call chain. Similarly, based on the operation result and the information of each node, at least one matched node is used as the end point of at least one call chain. Based on this, at least one matching link can be sorted out in the call network based on at least one call chain starting point and at least one call chain end point as the call chain corresponding to the application operation instruction.

[0047] According to the above method, the user does not need to perform multiple operations. The electronic device can identify one or more possible call chains based on the input instructions of a single operation and the corresponding operation results, and display them to the user. The user can perform analysis based on these call chains and related information, which significantly improves the efficiency of reverse analysis.

[0048] In some embodiments, when at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing results include relevant information about the target search object. Specifically, step S130, performing reverse processing on the target application based on the at least one reverse engineering tool to obtain the reverse processing results for the target application, may include: when at least one reverse engineering tool includes a dynamic analysis tool, displaying multiple search objects in the target application and detecting a selection operation among the multiple search objects; generating a monitoring code based on the target search object corresponding to the selection operation; and obtaining relevant information about the target search object based on the monitoring code when running the target application.

[0049] Optionally, the search object may include classes and / or methods in the target application.

[0050] Optionally, the monitoring code may include a Hook code. In dynamic analysis, specific Hook codes may be inserted during the application's runtime to monitor the program's execution and capture key information. Hook codes may be used to intercept the application's execution flow by intercepting function calls, modifying function parameters or return values, and so on. By inserting Hook codes at key locations, class and method calls during program execution, as well as related parameters and return values, may be captured, thereby helping to understand the program's runtime behavior and find the call path and usage of the target classes and methods.

[0051] According to the above embodiment, when dynamic analysis of a target application is required, the electronic device can display various classes and / or methods in the target application through a user interaction interface, allowing the user to select from them. Based on the user's selection, the electronic device generates monitoring code, such as a Hook code, which, when running the target application, obtains relevant information about the class and / or method selected by the user, such as returned data, device status, etc.

[0052] It can be seen that the reverse processing method according to the embodiment of the present disclosure can allow users to dynamically search for objects of their interest, automatically generate and execute monitoring codes, thereby improving the efficiency and operability of dynamic debugging.

[0053] Optionally, the above method may further include: displaying relevant information of the target search object through a user interaction interface.

[0054] In some embodiments, before obtaining relevant information of the target search object based on the monitoring code, the above method further includes: detecting a modification operation on the monitoring code, and modifying the monitoring code based on the modification operation.

[0055] Optionally, after generating the hook code, the electronic device can display the hook code through a user interface, allowing the user to enter a modification operation to modify the hook code. For example, the user can modify the key information type captured in the hook code. Based on the modified hook code, the electronic device obtains relevant information about the target search object when the target application is running.

[0056] According to the above method, the monitoring code can be modified according to user needs, thereby more flexibly supporting the user's analysis of the target search object, improving the flexibility of dynamic analysis and user experience.

[0057] In some embodiments, when at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result. Specifically, step S130, performing reverse processing on the target application based on the at least one reverse tool to obtain the reverse processing result of the target application, includes: when at least one reverse tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request; displaying the network request and the network packet capture result in association, and detecting a modification operation on the network request; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; and obtaining a network replay result based on the second network packet capture result.

[0058] Among them, the network packet capture tool is used to obtain the communication data between the target application and each network node, analyze the network request of the target application, obtain the Uniform Resource Locator (URL), parameters, response data and other information of the request, so as to conduct an in-depth analysis of the behavior of the target application. In the embodiment of the present disclosure, obtaining the first network packet capture result based on the network request may include: triggering the target application to execute the network request, and capturing relevant data in the network, and using the relevant data as the first network packet capture result. Among them, the relevant data are, for example, parameters related to the network protocol, response data, traffic data, etc.

[0059] According to the above method, the electronic device will display the network request in association with the network packet capture result, allowing the user to input a modification operation for the network request and replay the network request based on the modification operation. Specifically, replaying the network request can mean modifying the network request and triggering the target application to execute the modified network request. By replaying the network request, relevant data from the network can be captured again and used as the second network packet capture result.

[0060] Optionally, the network replay result obtained based on the second network packet capture result may include the second network packet capture result, and may also include comparison information between the first network packet capture result and the second network packet capture result.

[0061] According to the above method, the network packet capture tool integrates the network traffic replay function, and users can capture network requests and simulate replay. Therefore, it is convenient for users to perform security testing, help users quickly identify vulnerabilities or abnormal behaviors, and improve the efficiency of security testing.

[0062] Optionally, the electronic device generates a feedback report after network replay, and the feedback report includes the above network replay result for user viewing.

[0063] In practical applications, one or more of the above embodiments may be combined. For example, when at least one reverse engineering tool for a target application includes a dynamic analysis tool and a network packet capture tool, at least one call chain may be analyzed and supported for network replay.

[0064] Figure 2 FIG. 1 is a schematic diagram showing an application example of the reverse processing method provided by an embodiment of the present disclosure. Figure 2 As shown, this application example includes:

[0065] S210: Capture network packets for the target application.

[0066] S220: Display a packet capture list, which includes network requests and corresponding packet capture results.

[0067] S230: Display network data details.

[0068] S240: Determine whether the user has modified the network data. If yes, jump to step S250; if no, jump to step S280.

[0069] S250: Determine whether the user replays the network request. If yes, jump to step S260; if not, jump to step S270.

[0070] S260: Re-execute the network request according to the modified content and display the network data.

[0071] S270: Execute other operations.

[0072] S280, trace the call chain.

[0073] S290. Check the call chain.

[0074] S300. View any method in the call chain by generating Hook code.

[0075] S310: Analyze the selected method.

[0076] In some embodiments, the above-mentioned reverse processing method further includes: analyzing the reverse processing results using a large language model (LLM) to obtain optimization suggestions for the target application.

[0077] Based on this approach, electronic devices, using an integrated large language model (also known as a large model), can intelligently analyze complex call chains and provide optimization recommendations. This capability elevates automated analysis to a new level, intelligently identifying potential problem areas and providing decision support for developers.

[0078] In order to facilitate understanding of the above technical solution, Figure 3 A technical architecture diagram of a tool for implementing the reverse processing method in an embodiment of the present disclosure is shown.

[0079] like Figure 3 As shown, the underlying service 310 of the tool includes decompilation service, unpacking service, Hook service and network service.

[0080] Core capabilities 320 include decompilation capabilities, shelling capabilities, dynamic debugging capabilities, and network packet capture capabilities.

[0081] Business functions 330 include decompilation, code review, static search, APK (Android Application Package) unpacking, call chain tracing, call chain analysis, dynamic search, Hook classes / methods, AI (Artificial Intelligence) analysis, packet capture network interface, network interface analysis, network interface call chain tracing, network interface replay, etc. Decompilation, code review, and static search support the decompilation capability within core capabilities 320; APK unpacking supports the unpacking capability within core capabilities 320; call chain tracing, call chain analysis, dynamic search, Hook classes / methods, and AI analysis support the dynamic debugging capability within core capabilities 320; and packet capture network interface, network interface analysis, network interface call chain tracing, and network interface replay support the network packet capture capability within core capabilities 320.

[0082] At the user layer 340 , a target application provided by a user may be received. The target application may be in a format such as APK, AAR, or ZIP.

[0083] Regarding the dynamic analysis tools in the above methods, Figure 4 The technical architecture diagram of the dynamic analysis tool is shown in FIG. Figure 4As shown, in dynamic analysis, the base capability 410 includes Hook system key API (Application Programming Interface), dynamic library Hook, page data monitoring, and network data monitoring. The functional module 420 includes a module for generating Hook code, a module for executing Hook for a specified class / method, a data search module, and an AI analysis module. At the user layer 430, the operations that users can perform include: paying attention to specified classes and methods to trigger automatic generation of Hook code; selecting classes and methods for Hook; searching for data generated when the application (App) is executed and associating it with a specific method; and searching for page data and network data.

[0084] It can be seen that the integrated reverse engineering tool provided by the embodiments of the present disclosure significantly improves the efficiency and accuracy of application reverse engineering. By integrating multiple independent functions such as decompilation, network packet capture, shelling, dynamic debugging, and call chain tracing into a single platform, developers no longer need to frequently switch between different tools, simplifying the operation process and reducing configuration and compatibility issues. At the same time, the platform significantly reduces the complexity of manual analysis and improves the accuracy of problem location and debugging through automated call chain analysis, intelligent large model parsing, and network traffic replay functions.

[0085] In addition, the integrated design optimizes multi-functional collaboration, ensuring seamless integration between tool functions and further improving the overall performance of reverse analysis. This solution is not only applicable to scenarios such as security testing and vulnerability analysis, but also helps developers obtain faster and more accurate feedback in performance optimization, code auditing, and other aspects, providing efficient and comprehensive support for the development process. Ultimately, this technical solution effectively shortens the development cycle, reduces the labor cost of reverse engineering, and improves the overall efficiency of product development by improving analysis automation and enhancing intelligent parsing capabilities.

[0086] According to an embodiment of the present disclosure, the present disclosure further provides a reverse processing device, Figure 5 FIG. 1 shows a schematic block diagram of a reverse processing device provided by an embodiment of the present disclosure, as shown in FIG. Figure 5 As shown, the device includes:

[0087] An acquisition module 510 is used to acquire a target application and reverse engineering tool calling instructions;

[0088] A tool determination module 520 is configured to determine, based on the reverse tool calling instruction, at least one reverse tool for the target application from a pre-configured reverse tool set;

[0089] The execution module 530 is configured to perform reverse engineering on the target application based on at least one reverse engineering tool to obtain a reverse engineering result of the target application.

[0090] In some embodiments, when the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; the execution module 530 is configured to:

[0091] In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction;

[0092] At least one call chain is determined based on the application operation instruction and the execution result.

[0093] In some embodiments, the execution module 530 is further configured to:

[0094] Determine at least one call chain starting point in the call network based on the application operation instruction and information of each node in the call network of the target application program;

[0095] Based on the running results and information of each node in the call network, determining at least one call chain endpoint in the call network;

[0096] Based on at least one call chain starting point and at least one call chain end point, a matching link is searched in the call network to obtain at least one call chain.

[0097] In some embodiments, when at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information of the target search object; the execution module 530 is configured to:

[0098] In a case where the at least one reverse engineering tool includes a dynamic analysis tool, presenting a plurality of search objects in the target application and detecting a selection operation in the plurality of search objects;

[0099] Generate monitoring code based on the target search object corresponding to the selection operation;

[0100] When the target application is running, relevant information about the target search object is obtained based on the monitoring code.

[0101] In some embodiments, the execution module 530 is further configured to:

[0102] Detect modification operations on the listening code, and modify the listening code based on the modification operations.

[0103] In some embodiments, when at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; the execution module 530 is configured to:

[0104] In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request;

[0105] Correlate and display network requests and network packet capture results, and detect modification operations on network requests;

[0106] Replaying the network request based on the modification operation on the network request to obtain a second network packet capture result;

[0107] Based on the second network packet capture result, a network replay result is obtained.

[0108] In some embodiments, as Figure 6 As shown, the reverse processing device also includes:

[0109] The analysis module 610 is used to analyze the reverse processing results using a large language model to obtain optimization suggestions for the target application.

[0110] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, please refer to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0111] In the technical solutions disclosed herein, the acquisition, storage, and application of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0112] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0113] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0114] like Figure 7As shown, electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. Various programs and data required for the operation of device 700 can also be stored in RAM 703. Computing unit 701, ROM 702, and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0115] Various components in device 700 are connected to I / O interface 705, including an input unit 706, such as a keyboard, mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, optical disk, etc.; and a communication unit 709, such as a network card, modem, wireless communication transceiver, etc. The communication unit 709 allows device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0116] The computing unit 701 can be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the inverse processing method. For example, in some embodiments, the inverse processing method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the inverse processing method described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the inverse processing method by any other appropriate means (e.g., by means of firmware).

[0117] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0119] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0122] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0123] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0124] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A reverse processing method comprising: Obtain the target application and reverse engineering tool calling instructions; Determining at least one reverse tool for the target application from a pre-configured reverse tool set based on the reverse tool calling instruction; Performing reverse engineering on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application; Wherein, in the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; The performing reverse engineering on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction; Matching the application operation instruction with information of each node in the call network of the target application program, and using at least one matched node as the starting point of at least one call chain; wherein the information of each node includes the service content provided by each node and the input and output data formats; Matching the running result with information of each node in the call network, and using at least one matched node as at least one call chain endpoint; Based on the at least one call chain starting point and the at least one call chain end point, a matching link is searched in the call network to obtain the at least one call chain.

2. The method according to claim 1, wherein In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information about the target search object; The performing reverse engineering on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, presenting a plurality of search objects in the target application and detecting a selection operation among the plurality of search objects; Generate a monitoring code based on the target search object corresponding to the selection operation; When the target application is running, relevant information of the target search object is obtained based on the monitoring code.

3. The method according to claim 2, wherein: Before acquiring the relevant information of the target search object based on the monitoring code, the method further includes: A modification operation on the monitoring code is detected, and the monitoring code is modified based on the modification operation.

4. The method according to any one of claims 1 to 3, wherein In a case where the at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; The performing reverse engineering on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application includes: In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request; Correlate and display the network request and the network packet capture result, and detect modification operations on the network request; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; Based on the second network packet capture result, the network replay result is obtained.

5. The method according to any one of claims 1 to 3, further comprising: The reverse processing results are analyzed using a large language model to obtain optimization suggestions for the target application.

6. A reverse processing device comprising: The acquisition module is used to obtain the target application and reverse tool calling instructions; a tool determination module, configured to determine, based on the reverse tool calling instruction, at least one reverse tool for the target application from a preconfigured reverse tool set; an execution module, configured to perform reverse engineering on the target application based on the at least one reverse engineering tool to obtain a reverse processing result of the target application; In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes at least one call chain; The execution module is used to: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, running the target application based on the dynamic analysis tool and the received application operation instruction to obtain an operation result corresponding to the application operation instruction; Matching the application operation instruction with information of each node in the call network of the target application program, and using at least one matched node as the starting point of at least one call chain; wherein the information of each node includes the service content provided by each node and the input and output data formats; Matching the running result with information of each node in the call network, and using at least one matched node as at least one call chain endpoint; Based on the at least one call chain starting point and the at least one call chain end point, a matching link is searched in the call network to obtain the at least one call chain.

7. The device according to claim 6, wherein In the case where the at least one reverse engineering tool includes a dynamic analysis tool, the reverse processing result includes relevant information about the target search object; The execution module is used to: In a case where the at least one reverse engineering tool includes a dynamic analysis tool, presenting a plurality of search objects in the target application and detecting a selection operation among the plurality of search objects; Generate a monitoring code based on the target search object corresponding to the selection operation; When the target application is running, relevant information of the target search object is obtained based on the monitoring code.

8. The device according to claim 7, wherein The execution module is further configured to: A modification operation on the monitoring code is detected, and the monitoring code is modified based on the modification operation.

9. The device according to any one of claims 6 to 8, wherein: In a case where the at least one reverse engineering tool includes a network packet capture tool, the reverse processing result includes a network replay result; The execution module is used to: In a case where the at least one reverse engineering tool includes a network packet capture tool, obtaining a first network packet capture result based on a network request; Correlate and display the network request and the network packet capture result, and detect modification operations on the network request; replaying the network request based on the modification operation on the network request to obtain a second network packet capture result; Based on the second network packet capture result, the network replay result is obtained.

10. The apparatus according to any one of claims 6 to 8, further comprising: An analysis module is used to analyze the reverse processing results using a large language model to obtain optimization suggestions for the target application.

11. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 5.

13. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images