A method for extracting structural information from Pascal-like binary programs based on static analysis

Abstract

The present invention relates to a method for extracting structured information from a Pascal-like binary program based on static analysis, which is as follows: (1) using scripts and other tools to preliminarily read basic properties in a binary file compiled from a Pascal-like program; (2) finding all functions that create class objects by obtaining construction feature functions and combining control flow analysis technology; (3) using the base object address as the base address and combining data analysis technology, recursively identifying the member object definition relationship and the inheritance relationship between classes in the binary file; (4) combining the results automatically generated by the script to confirm the corresponding construction function name and the corresponding parameter type and name; (5) based on the above analysis results, finding the corresponding class interface to ensure that the restored code logic is consistent with the original binary file behavior. This method achieves accurate restoration of the class structure, interface, and function, thereby improving the efficiency and accuracy of reverse analysis.

Description

Technical Field

[0001] The present invention relates to an information extraction method, specifically to a method for extracting structured information from Pascal-like binary programs based on static analysis, and more particularly to a method for restoring Pascal-like compiled binary code based on IDAPython scripts. The method is oriented towards malicious code analysis scenarios and is used to improve the efficiency of reverse analysis of complex compiled binary code. The method belongs to the field of reverse engineering and software security analysis. Background Art

[0002] With the development of computer technology and the widespread use of programming languages, programming languages ​​derived from Pascal (such as Pascal-like languages) continue to be widely adopted in embedded development and specific application scenarios. Many traditional software and malware are still developed using these programming languages. However, due to their compilation characteristics, binary files generated by Pascal-like languages ​​present many challenges during reverse analysis. In particular, these binary codes contain a large number of virtual function pointers and highly abstract class and interface structure information, making it difficult for reverse engineers to quickly and accurately understand their logic and behavior, greatly hindering malicious code and virus analysis.

[0003] When security researchers conduct vulnerability discovery or malware analysis, they often need to reverse engineer the relevant binaries, understanding the program's contextual meaning to extract malicious behavior characteristics or details about possible vulnerabilities. In traditional binary code reverse engineering, security researchers often use existing static binary analysis tools (such as IDA Pro) to assist with analysis. While static analysis tools like IDA provide basic decompilation and analysis capabilities, they have limited support for binary files generated by complex compiled languages ​​(particularly structures like virtual function tables and class inheritance), resulting in incomplete and inaccurate restoration results. This limitation is particularly pronounced in Pascal-like compiled binaries, making malware security analysis and other tasks extremely difficult.

[0004] Existing solutions include many structured information extraction tools, such as IDR, that perform limited analysis on binaries compiled from Pascal-like languages, thereby assisting security researchers. However, these tools are incomplete, leveraging only the built-in information of the language, such as built-in variable types, combined with the structured information in the binary to perform limited recovery of a few interface signatures. These analysis solutions lack sufficient structured information to effectively assist in analysis, particularly in locating custom type information, including but not limited to class, function signatures, parameter meanings, and structure information, resulting in very limited analysis results.

[0005] Existing methods rely heavily on symbol table integrity or manual intervention, lacking versatility and automation. Therefore, the question of how to restore the class and interface structures in Pascal-like compiled binaries through automated techniques, particularly by improving the efficiency and accuracy of restoration through virtual function optimization and data flow analysis, has become a key focus in the fields of reverse engineering and malware analysis. Summary of the Invention

[0006] The present invention is aimed at the technical problems existing in the prior art and provides a method for extracting structured information of Pascal-like binary programs based on static analysis. This application proposes a solution based on IDAPython scripts, which can automatically process the class structure, interface implementation and member variable restoration in Pascal-like compiled binaries, effectively improving the analysis efficiency and the accuracy of code understanding, and providing a new technical means for reverse engineering and malicious code analysis.

[0007] Glossary

[0008] Pascal-like languages ​​refer to a family of languages ​​related to Pascal that support object-oriented programming, including Pascal, Delphi, and Object Pascal. These languages ​​retain the simple syntax of Pascal but incorporate object-oriented features, such as the concepts of classes and interfaces, to support complex software design and modular development.

[0009] Compared to traditional low-level languages ​​like C++, compilers for Pascal-like languages ​​retain more symbolic and structured compilation information when generating binary code, such as function names, class names, and some interface implementations. However, because Pascal-like languages ​​make extensive use of advanced features like interface inheritance and virtual function tables, the generated binary files remain challenging to reverse engineer.

[0010] Virtual functions are a mechanism in object-oriented programming that supports runtime polymorphism. Within a class, virtual functions are bound to specific instances of an object through a virtual function table (VTable), enabling dynamic dispatch of function calls based on the object type. At the compiled binary level, the call path to a virtual function is abstracted to an indirect access to a virtual function table pointer.

[0011] An interface is a special type of abstraction that defines the behavior of a class. The implementation is provided by the class that implements the interface. Interfaces are widely used in Pascal-like languages ​​to support multiple inheritance and modular design.

[0012] In reverse engineering, the presence of virtual functions and interfaces significantly increases the difficulty of program flow analysis. Because the call path of virtual functions relies on dynamic dispatch logic at runtime, reverse analysis tools struggle to accurately restore the call chain without symbolic information. Furthermore, interface implementations often introduce numerous indirect calls and complex inheritance relationships, making the control flow of binary programs difficult to trace.

[0013] IDR (Interactive Delphi Reconstructor): is an interactive Delphi reconstructor for companies or individuals engaged in anti-virus software development. It is a decompiler for executable files (EXE) and dynamic link libraries (DLL) written in Delphi, helping to recover lost program source code.

[0014] IDA (Interactive Disassembler): A powerful binary disassembly and analysis tool widely used in reverse engineering. It can convert binary files into assembly code and provides rich static analysis capabilities to help users understand program structure and logic.

[0015] IDA Python: This is a scripting extension provided by IDA that allows users to use the Python programming language for more efficient automated analysis of binary files. Through IDA Python, users can access the assembly code, symbolic information, and control flow of binary files. They can read data at a specific address; flexibly extract and manipulate data structures corresponding to memory addresses; dynamically define and create structures based on analysis results to restore the program's data layout; and automate repetitive tasks through scripting, quickly locating key points and improving reverse engineering efficiency.

[0016] Constructor CreateClass: The present invention discovered in the analysis of Pascal-like codes that this type of programming language uses a function called CreateClass to create objects after generating binary. This creation function and its parent function may include the class description address in the parameters.

[0017] Class description address: This invention uses TargetAddress to describe this address. This address will record all the information of a class, including member variables, virtual function definitions, parent class definitions, interface definitions, etc.

[0018] In order to achieve the above-mentioned purpose, the technical solution of the present invention is as follows: a method for extracting structured information of Pascal-like binary programs based on static analysis, which automatically analyzes the key symbols and control flow in the Pascal-like binary files, parses and restores the class member variables, interface addresses and their associated functions, and reconstructs the class inheritance relationship and interface structure based on the data segment information, thereby generating pseudocode that is close to the original source code.

[0019] A method for extracting structural information from a Pascal-like binary program based on static analysis, the method comprising the following steps:

[0020] (1) The script and other tools are used to preliminarily read the basic properties of the binary file compiled by the Pascal class, including the definition of some basic properties and common basic information.

[0021] (2) By obtaining the construction feature function and combining it with control flow analysis technology, find all functions that create class objects and confirm the basic object addresses required for building the class;

[0022] (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table;

[0023] (4) Combined with the results of the automatic generation of the script, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into relatively complete C++ codes, including function names, member variables, and dynamically restore the corresponding parameter types.

[0024] (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior.

[0025] The specific method of step (1) is as follows:

[0026] (1.1) Use common analysis tools (Idr.exe) or use public program signature methods to parse the Pascal basic types used in the current binary program;

[0027] (1.2) Import the parsed input into IDA to reduce some redundant analysis content.

[0028] The method for constructing the characteristic function obtained in step (2) is as follows:

[0029] (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass. At the same time, by analyzing the control flow, confirm the address of its parent function or other functions that indirectly call this function.

[0030] (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs:

[0031] (2.3) Traverse RawAddrs, use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs.

[0032] The specific method of step (3) is as follows:

[0033] (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, use BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty;

[0034] (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, trace back to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass.

[0035] (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses. The InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for further use later.

[0036] (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and perform a preliminary construction of the function;

[0037] (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable

[0038] (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class.

[0039] (3.7) After all analyses are completed, mark the current address as the analyzed class.

[0040] (3.8) Backtrack the subclasses until the class analysis of all processes is completed.

[0041] The specific method of step (4) is as follows:

[0042] (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type.

[0043] (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved.

[0044] (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to obtain a complete function definition.

[0045] The specific method of step (5) is as follows:

[0046] (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName

[0047] (5.2) Find the jump table jmp_table, and according to the definition therein, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code (5.3) Construct a new structure object based on InterfaceName, and set the converted jmp_table as a member in it.

[0048] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for extracting structured information from a Pascal-like binary program based on static analysis is implemented.

[0049] A computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the method for extracting structured information from a Pascal-like binary program based on static analysis.

[0050] Compared with the existing technology, the present invention has the following advantages: through the proposed analysis method and steps, the present invention can effectively parse key class-related information in binary files generated by Pascal-like compilation, including function signatures, parameter meanings, class structure members, and interface information. Using this information, malware analysts can more easily understand the behavioral logic of related malware and better extract behavioral details.

[0051] This invention achieves the restoration of binary code to near-original source code, significantly reducing the difficulty and time cost of reverse analysis. While traditional tools (such as IDA Pro and IDR) can only extract interface information and a small number of function names, this solution, through in-depth analysis based on control flow and data segments, can not only extract richer structured information from the program, but also fully restore class inheritance relationships, class member attributes, and virtual function table structures. Utilizing these two technologies, it is possible to optimize the manual intervention in software analysis in existing solutions, automatically construct virtual function tables and class relationships, significantly saving time and improving analysis efficiency.

[0052] This solution automatically extracts and reconstructs class structure information by analyzing the control flow and data segments of binary files based on IDAPython scripts, transforming the traditional analysis process that relies on manual operations into an efficient automated method. The present invention can analyze programs on different platforms. In actual scenarios, most malware written in Pascal-like languages ​​may run on multiple platforms. By utilizing the compatible analysis capabilities of IDAPython scripts, it can provide analysis capabilities for Pascal-like software on different platforms. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A function before script analysis is used;

[0054] Figure 2 For the structured class definition;

[0055] Figure 3 For the structured function definition;

[0056] Figure 4 It is the structured interface definition;

[0057] Figure 5 This is the result obtained after control flow analysis of the constructor ClassCreate;

[0058] Figure 6 To record the process of all valid class addresses TargetAddr;

[0059] Figure 7 The process of class analysis and class creation for recursion;

[0060] Figure 8 The result obtained after analysis. DETAILED DESCRIPTION

[0061] In order to deepen the understanding of the present invention, this embodiment is described in detail below with reference to the accompanying drawings.

[0062] Example 1: See Figures 1-8 , the figure shows the analysis process for an existing Pascal-like binary program. Before implementing the invention ( Figure 1 )back( Figure 8 ), significantly improving program readability. The following describes an implementation method. A method for extracting structured information from Pascal-like binary programs based on static analysis automatically analyzes key symbols and control flow in Pascal-like binary files, parses and restores class member variables, interface addresses, and associated functions, and reconstructs class inheritance relationships and interface structures based on data segment information, thereby generating pseudocode close to the original source code. The method includes the following steps:

[0063] (1) Using scripts and other tools, the basic properties of the binary file compiled by Pascal are preliminarily read, including the definition of some basic properties and common basic information;

[0064] (2) By obtaining the construction feature function and combining it with control flow analysis technology, find all functions that create class objects and confirm the basic object addresses required for building the class;

[0065] (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table;

[0066] (4) Combined with the results of the automatic generation of the script, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into relatively complete C++ codes, including function names, member variables, and dynamically restore the corresponding parameter types.

[0067] (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior;

[0068] The specific method of step (1) is as follows:

[0069] (1.1) Use common analysis tools (such as IDR) or public program signatures to analyze the basic Pascal types used in the current binary program;

[0070] (1.2) Import the parsed input into IDA to reduce some redundant analysis content;

[0071] The method for constructing the characteristic function obtained in step (2) is as follows:

[0072] (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass. At the same time, by analyzing the control flow, confirm the address of its parent function or other Pascal built-in basic functions for creating classes, such as those that indirectly call this function;

[0073] (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs:

[0074] (2.3) Traverse RawAddrs and use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs:

[0075] The specific method of step (3) is as follows:

[0076] (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, use BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty;

[0077] (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, backtrack to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass

[0078] (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses. The InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for further use later.

[0079] (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and perform a preliminary construction of the function;

[0080] (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable

[0081] (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class.

[0082] (3.7) After all analyses are completed, mark the current address as the analyzed class.

[0083] (3.8) Backtrack the subclasses until the class analysis of all processes is completed.

[0084] The specific method of step (4) is as follows:

[0085] (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type.

[0086] (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved.

[0087] (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to get the complete function definition

[0088] The specific method of step (5) is as follows:

[0089] (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName

[0090] (5.2) Find the jump table jmp_table, and according to the definition, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code

[0091] (5.3) Construct a new structure object based on InterfaceName and set the converted jmp_table as a member in it.

[0092] Example 2:

[0093] In order to better illustrate the steps of the structured information extraction method of Pascal-like binary programs based on static analysis, we first introduce the key data types and structures extracted from binary programs. Figure 2 、 3 As shown in Figure 4, these key data include class definitions, function definitions, interface definitions, etc. Each type of information occupies a different level in the analysis:

[0094] Function definition: contains information such as the function's return value, parameter name and type, and is used to build the program's functional module.

[0095] Class definition: describes the class's member variables, virtual function table, and inheritance relationships to facilitate the restoration of object-oriented structures.

[0096] Interface definition: stores the interface UUID, jump table, and interface name, which are used to determine the function binding of the interface.

[0097] To explain the implementation process of this method in detail, the extraction and processing of key data in each step are introduced next.

[0098] 1. Analysis of Pascal basic types

[0099] First, use common binary analysis tools (such as IDR) or publicly available program signatures to parse Pascal basic types and import the parsed results into IDA. This process reduces redundant analysis content and lays the foundation for subsequent analysis.

[0100] 2. Constructing characteristic functions

[0101] Based on the known Pascal built-in function CreateClass, such as Figure 5 As shown, the address of its parent function or other indirect call base function is confirmed through control flow analysis. After traversing these addresses:

[0102] 1. Extract the data segment address from the passed parameter and record it as RawAddrs;

[0103] 2. Verify that each address in RawAddrs is a valid class base address and store the valid addresses as BaseAddrs.

[0104] The above steps can be referred to as Figure 6 .

[0105] 3. Recursive analysis of class structure

[0106] like Figure 7 As shown, for each BaseAddr, the class analysis and construction are completed recursively:

[0107] 1. Find the parent class address ParentAddr and verify its existence;

[0108] 2. If the parent class exists, recursively analyze until the base class is found;

[0109] 3. Extract the class interface definition, member variable address, class name and virtual function address, and gradually build the complete class structure NewClass;

[0110] 4. If there is an inheritance relationship between classes, the class is supplemented and constructed based on the member variables of the parent class;

[0111] 5. Mark the classes that have completed analysis and trace back to the subclasses until all classes are analyzed.

[0112] 4. Extraction and renaming of function signatures

[0113] like Figure 3 As shown, the specific process of extracting the function signature includes:

[0114] 1. Traverse all function definition addresses FuncAddr and confirm the return value type and parameter name;

[0115] 2. Verify whether the parameter type is defined. If the type is not defined, the parsing is completed by recursive analysis of the class structure.

[0116] 3. Associate the parsed function with the class name, update the function signature, and rename the remaining member variables.

[0117] 5. Extraction and processing of interface definitions

[0118] like Figure 4 As shown, when analyzing the interface, first extract the interface UUID, jump table address jmp_table and interface name InterfaceName:

[0119] 1. According to the definition of jmp_table, parse the jump address and control flow information stored in it;

[0120] 2. Construct a new structure object to store the contents of jmp_table and other member variables of the interface to describe the interface functions.

[0121] After the script is finished running, you can see the analyzed content as follows Figure 8 At this point, most of the program logic is very clear, and the virtual function table has been made public. At this time, it is easy to confirm the next called function by adding the address and offset.

[0122] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions fall within the scope of protection of the claims of the present invention.

Claims

1. A method for extracting structural information from Pascal-like binary programs based on static analysis, characterized in that: The method comprises the following steps: (1) The script and other tools are used to preliminarily read the basic properties of the binary file compiled by the Pascal class, including the definition of some basic properties and common basic information. (2) By obtaining the construction feature function and combining it with the control flow analysis technology, find all the functions that create class objects and confirm the basic object address required for building the class. (3) Using the base object address as the base address and combining data analysis technology, recursively identify the member object definition relationship and the inheritance relationship between classes in the binary file, and restore the class methods and member variables based on the structure of the virtual function table. (4) Combined with the results of the script automatic generation, confirm the corresponding construction function name and the corresponding parameter type and name, map the identified functions and classes into a relatively complete C++ code, including function names, member variables, and dynamically restore the corresponding parameter types. (5) Based on the above analysis results, find the corresponding class interface and implement the corresponding interface type to ensure that the restored code logic is consistent with the original binary file behavior.

2. The method for extracting structured information from Pascal-like binary programs based on static analysis according to claim 1, characterized in that: The specific method of step (1) is as follows: (1.1) Use the common analysis tool IDR or the public program signature method to analyze the Pascal basic types used in the current binary program; (1.2) Import the parsed input into IDA to reduce some redundant analysis content.

3. The method for extracting structured information from Pascal-like binary programs based on static analysis according to claim 1, characterized in that: The method for constructing the feature function obtained in step (2) is as follows: (2.1) Based on prior knowledge, use IDA to obtain the base address of CreateClass. At the same time, by analyzing the control flow, confirm the address of its parent function or other functions that indirectly call this function. (2.2) Traverse the above function addresses, confirm that the parameters passed into these functions are data segments, and record the addresses of these data segments as RawAddrs: (2.3) Traverse RawAddrs, use the base class + offset method to verify whether the current base class is a valid class base address, and record all valid base addresses as the base object address BaseAddrs.

4. The method for extracting structured information from Pascal-like binary programs based on static analysis according to claim 1, characterized in that: The specific method of step (3) is as follows: (3.1) Use the script function provided by IDA to traverse each BaseAddr in BaseAddrs, use BaseAddr as the base address, find the parent class definition ParentAddr, and confirm whether it is empty; (3.2) Confirm whether the current class has a parent class ParentAddr. If the address is not empty, recursively analyze the current class until the address of the base class is found; or if an analyzed BaseAddr is found, backtrack to its subclass, define the address to be analyzed as TargetAddr, and record the analyzed class as ParentClass (3.3) According to TargetAddr, the interface definition InterfaceAddr, member definition address MemberAddr, class name ClassNameAddr, function definition address FuncAddr, and all built-in function addresses of the current class are derived in sequence, and the TargetAddr address is updated to the new address after analyzing the above addresses. The InterfaceAddr and FuncAddr are recorded, and the corresponding class name is recorded for further use later. (3.4) Further analyze TargetAddr, analyze the pointer jump address data, and confirm whether it is a code segment address to determine the number of virtual functions and perform a preliminary construction of the function; (3.5) Create a separate structure NewClass based on ClassNameAddr to represent the structure object that describes the current object. Next, fill in the virtual function address analyzed above as the first member variable (3.6) Next, according to MemberAddr, all member objects are filled into the created structure. If the current class has a parent class ParentClass, all member variables except virtual functions are used to construct the current class. (3.7) After completing all analysis, mark the current address as the analyzed class. (3.8) Backtrack the subclasses until the class analysis of all processes is completed.

5. The method for extracting structured information from Pascal-like binary programs based on static analysis according to claim 1, characterized in that: The specific method of step (4) is as follows: (4.1) Find the FuncAddr mentioned above, traverse all the function definitions in it, and confirm its function signature, that is, whether there is a return value, return value type, parameter name and parameter type. (4.2) According to the analyzed function signature, confirm that each parameter type is a defined parameter. Otherwise, according to the address specified by the parameter type, analyze whether it is an undefined Class or Struct, and recursively analyze according to step (3) until the corresponding type is resolved. (4.3) Add the corresponding NewClassName to the current function definition to distinguish it, and rename the remaining member variables according to the function signature to obtain a complete function definition.

6. The method for extracting structured information from Pascal-like binary programs based on static analysis according to claim 1, characterized in that: The specific method of step (5) is as follows: (5.1) Find the InterfaceAddr mentioned above, traverse all the interface definitions, confirm the UUID corresponding to the interface, the jump table address jmp_table used by the interface and the corresponding interface name InterfaceName (5.2) Find the jump table jmp_table, and according to the definition, find the number of jump table offsets, and convert the address content pointed to by the jump table into control flow code (5.3) Construct a new structure object based on InterfaceName and set the converted jmp_table as a member in it.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for extracting structural information from a Pascal-like binary program based on static analysis as described in any one of claims 1 to 6 is implemented.

8. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by a processor, the method for extracting structural information from a Pascal-like binary program based on static analysis as claimed in any one of claims 1 to 6 is implemented.

Images