Code generation method and device based on large model, equipment and storage medium

Abstract

The invention provides a code generation method and device based on a large model, equipment and a storage medium, and relates to the technical field of artificial intelligence, in particular to the technical field of large models and reverse engineering. The specific implementation scheme of the code generation method comprises the following steps: segmenting a pseudo code of a dynamic link library file to obtain a plurality of pseudo code fragments and at least one segmentation position; wherein the pseudo code is obtained by disassembling and reversely analyzing a dynamic link library file; correcting errors in the pseudo code snippets based on the large model, and generating a plurality of code snippets; and according to the at least one segmentation position, combining the plurality of code snippets to generate a target code, the target code is used for analyzing whether the dynamic link library file operated in the target system is safe or not.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, in particular to the field of large models and reverse engineering technology, and specifically to a code generation method, device, equipment and storage medium based on a large model. Background Art

[0002] With the development of artificial intelligence technology, big models are widely used in natural language processing, content creation, artificial intelligence-assisted writing, smart assistants, smart manufacturing, smart logistics and other fields. Based on the rich knowledge reserves and natural language understanding capabilities of big models, they are promoting the intelligent development of various fields. Summary of the invention

[0003] The present disclosure provides a code generation method, device, electronic device and storage medium based on a large model.

[0004] According to one aspect of the present disclosure, a code generation method based on a large model is provided, comprising: segmenting a pseudocode of a dynamic link library file to obtain a plurality of pseudocode fragments and at least one segmentation position; wherein the pseudocode is obtained by disassembling and reverse analyzing the dynamic link library file; based on the large model, respectively correcting errors in the plurality of pseudocode fragments to generate a plurality of code fragments; and combining the plurality of code fragments according to at least one segmentation position to generate a target code; the target code is used to analyze whether it is safe to run the dynamic link library file in a target system.

[0005] According to another aspect of the present disclosure, a training method for a large model is provided, comprising: segmenting a pseudocode of a sample dynamic link library file to obtain a plurality of sample pseudocode fragments and at least one sample segmentation position; wherein the sample pseudocode is obtained by disassembling and reverse analyzing the sample dynamic link library file; based on the initial large model, respectively correcting errors in the plurality of sample pseudocode fragments to generate a plurality of sample code fragments; based on a target loss function, generating a loss value according to each source code fragment of the sample dynamic link library and each sample code fragment; wherein the segmentation position of each source code fragment is the same as the segmentation position of each sample pseudocode fragment; and adjusting the model parameters of the initial large model based on the loss value to obtain the large model.

[0006] According to another aspect of the present disclosure, a method for detecting a dynamic link library file is provided, comprising: obtaining a target code of the dynamic link library file, wherein the target code is generated using the large model-based code generation method described above; and detecting the target code to generate a detection result; wherein the detection result is used to characterize whether it is safe to run the dynamic link library file in the target system.

[0007] According to another aspect of the present disclosure, a large model-based code generation device is provided, including: a first segmentation module, a first correction module and a combination module.

[0008] The first segmentation module is used to segment the pseudo code of the dynamic link library file to obtain multiple pseudo code fragments and at least one segmentation position; wherein the pseudo code is obtained by disassembling and reverse analyzing the dynamic link library file.

[0009] The first correction module is used to correct errors in multiple pseudo code fragments based on the large model to generate multiple code fragments.

[0010] The combination module is used to combine multiple code fragments according to at least one segmentation position to generate a target code; the target code is used to analyze whether it is safe to run the dynamic link library file in the target system.

[0011] According to another aspect of the present disclosure, a large model training device is provided, including: a second segmentation module, a second correction module, a loss calculation module and an adjustment module.

[0012] The second segmentation module is used to segment the pseudo code of the sample dynamic link library file to obtain multiple sample pseudo code segments and at least one sample segmentation position; wherein the sample pseudo code is obtained by disassembling and reverse analyzing the sample dynamic link library file.

[0013] The second correction module is used to correct errors in multiple sample pseudo code segments based on the initial large model to generate multiple sample code segments.

[0014] The loss calculation module is used to generate a loss value based on the target loss function according to each source code fragment of the sample dynamic link library and each sample code fragment; wherein the segmentation position of each source code fragment is the same as the segmentation position of each sample pseudocode fragment.

[0015] The adjustment module is used to adjust the model parameters of the initial large model based on the loss value to obtain the large model.

[0016] According to another aspect of the present disclosure, a dynamic link library file detection device is provided, including: an acquisition module and a detection module.

[0017] The acquisition module is used to acquire the target code of the dynamic link library file, wherein the target code is generated by using the large model-based code generation method described above.

[0018] The detection module is used to detect the target code and generate a detection result; wherein the detection result is used to indicate whether it is safe to run the dynamic link library file in the target system.

[0019] According to another aspect of the present disclosure, an artificial intelligence agent is provided, comprising: an input module, a processing module and an output module. The input module is used to receive input information. The processing module is used to determine a target task based on the input information received by the input module, determine a large model based on the target task, and obtain output information by calling the large model to execute the code generation method based on the large model described above. The output module is used to output the output information obtained by the processing module.

[0020] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described above.

[0021] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described above.

[0022] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0025] Figure 1 Schematically illustrates an exemplary system architecture to which a large model-based code generation method or a large model training method or a dynamic link library file detection method and device according to an embodiment of the present disclosure can be applied;

[0026] Figure 2 A flowchart of a code generation method based on a large model according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 3 A schematic diagram of a code generation method based on a large model according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 4A A schematic diagram of segmenting a pseudo code according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 4BA schematic diagram of segmenting a pseudo code according to another embodiment of the present disclosure is schematically shown;

[0030] Figure 5A A schematic diagram of using a large model to correct a missing field error in a pseudo code snippet is shown schematically;

[0031] Figure 5B A schematic diagram of using a large model to correct structural errors in a pseudo code snippet is shown schematically;

[0032] Figure 5C A schematic diagram of correcting data type errors in a pseudo code snippet using a large model is shown schematically;

[0033] Figure 5D A schematic diagram of using a large model to correct inline assembly errors in a pseudo code snippet is shown schematically;

[0034] Figure 6 A flowchart of a large model training method according to an embodiment of the present disclosure is schematically shown;

[0035] Figure 7 A flowchart schematically shows a method for detecting a dynamic link library file according to an embodiment of the present disclosure;

[0036] Figure 8 A block diagram of a code generation device based on a large model according to an embodiment of the present disclosure is schematically shown;

[0037] Fig. 9 A block diagram of a large model training device according to an embodiment of the present disclosure is schematically shown;

[0038] Fig.10 A block diagram schematically shows a device for detecting a dynamic link library file according to an embodiment of the present disclosure;

[0039] Fig.11 A block diagram of an artificial intelligence agent according to an embodiment of the present disclosure is schematically shown;

[0040] Fig.12 A block diagram of an electronic device suitable for implementing a large model-based code generation method or a large model training method or a dynamic link library file detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0041] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0042] Reverse Engineering refers to the process of analyzing and studying existing software, hardware or systems. In the field of programming, it is usually used to analyze compiled program code to reveal its operating mechanism, algorithm and data structure, so as to analyze whether there are operational security risks. Reverse engineering usually includes disassembly, decompilation, dynamic analysis, static analysis and other processes. These processes rely on programming knowledge reserves and reverse analysis experience, resulting in low efficiency of reverse engineering and difficulty in flexibly adapting to the rapidly changing security analysis needs of various applications.

[0043] In order to improve the efficiency of reverse engineering, reverse analysis can be performed using reverse tools. However, in actual applications, it is found that the code generated by reverse tools has various errors, such as disordered structure, missing variables, wrong data types, macros with high-level language features, inline assembly, etc., which are converted into unrecognizable fields, resulting in poor readability of the analysis results and cannot be used to perform operational security analysis tasks for the analysis results.

[0044] In view of this, the embodiments of the present disclosure provide a code generation method based on a big model, which utilizes the natural language understanding ability and rich knowledge reserves of the big model to correct various errors in the pseudocode obtained by disassembling and reverse analyzing the dynamic link library using various reverse analysis tools, thereby improving the readability of the analysis results and the quality and efficiency of reverse engineering.

[0045] Figure 1 An exemplary system architecture is schematically shown to which a large model-based code generation method or a large model training method or a dynamic link library file detection method and device according to an embodiment of the present disclosure can be applied.

[0046] It should be noted that Figure 1What is shown is only an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. For example, in another embodiment, an exemplary system architecture to which a large model-based code generation method or a large model training method or a dynamic link library file detection method and device can be applied may include a terminal device, but the terminal device may implement the large model-based code generation method or a large model training method or a dynamic link library file detection method and device provided in the embodiments of the present disclosure without interacting with the server.

[0047] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a terminal device 101 , a large model 102 , a network 103 and a server 104 .

[0048] The terminal device 101 may be any electronic device having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0049] It should be noted that the code generation method and program running method based on the large model provided in the embodiments of the present disclosure can generally be executed by the terminal device 101. Accordingly, the code generation device and program running device based on the large model provided in the embodiments of the present disclosure can also be set in the terminal device 101. Accordingly, the code generation method or large model training method or dynamic link library file detection device based on the large model provided in the embodiments of the present disclosure can also be set in the terminal device 101.

[0050] For example, the terminal device 101 can obtain model parameters from the server 104 through the network 103, and load the large model 102 into the terminal device 101. The user can import the dynamic link library file into the terminal device 101, and first use the reverse analysis tool to disassemble and reverse analyze the dynamic link library file to generate pseudo code. Then, the pseudo code is segmented using the large model 102, and the errors in each pseudo code fragment are corrected to generate code fragments. Finally, the code fragments are combined according to the segmentation positions to generate the target code 110. The target code 110 can be displayed to the user through the terminal device 101 to analyze whether it is safe to run the dynamic link library file in the target system.

[0051] The server 104 may be a server that provides various services, such as a background management server (only as an example) that provides support for the content browsed by the user using the terminal device 101. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to the user request) to the terminal device 101.

[0052] Alternatively, the code generation method based on a large model or a large model training method or a dynamic link library file detection method provided in the embodiment of the present disclosure can generally be executed by the server 104. Accordingly, the code generation method based on a large model or a large model training method or a dynamic link library file detection device provided in the embodiment of the present disclosure can generally be set in the server 104. The code generation method based on a large model or a large model training method or a dynamic link library file detection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 104 and can communicate with the terminal device 101 and / or the server 104. Accordingly, the code generation method based on a large model or a large model training method or a dynamic link library file detection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 104 and can communicate with the terminal device 101 and / or the server 104.

[0053] For example, a user can import a dynamic link library file into the terminal device 101, and then the terminal device 101 sends the dynamic link library file to the server 104 via the network 103. The server can call a reverse analysis tool to disassemble and reversely analyze the dynamic link library file to generate pseudo code. Then, the pseudo code is segmented to obtain multiple pseudo code fragments. Next, the server 101 can call the large model 102 to correct the errors in each pseudo code fragment and generate code fragments. Finally, the code fragments are combined according to the segmentation position to generate the target code 110. The target code 110 is sent to the terminal device 101 via the network 103 to show the reverse analysis results to the user.

[0054] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0055] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information involved comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0056] In the technical solution of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0057] In the technical solution disclosed in the present invention, legal authorization or permission has been obtained before obtaining the dynamic link library file for reverse analysis.

[0058] Figure 2 The flowchart of the code generation method based on the large model according to the embodiment of the present disclosure is schematically shown.

[0059] like Figure 2 As shown, the method includes operations S210 to S230.

[0060] In operation S210, the pseudo code of the dynamic link library file is segmented to obtain a plurality of pseudo code segments and at least one segmentation position.

[0061] In operation S220 , errors in the plurality of pseudo code segments are corrected respectively based on the large model to generate a plurality of code segments.

[0062] In operation S230, multiple code fragments are combined according to at least one segmentation position to generate a target code.

[0063] According to an embodiment of the present disclosure, a dynamic link library file is a binary program file that allows programs to share codes and other resources necessary to perform specific tasks.

[0064] In some embodiments, before performing operation S210, a reverse analysis tool can be used to disassemble and reverse analyze the dynamic link library file to obtain pseudo code. The acquisition of the dynamic link library file and the use of the dynamic link library file for reverse engineering have both obtained the permission or authorization of the relevant user and are in compliance with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0065] For example, you can use the reverse analysis tool to disassemble the dynamic link library file to generate assembly instruction code. Then, use the reverse analysis tool to reverse analyze the assembly instruction code to generate pseudo code. The pseudo code indicates the execution logic relationship between the function name in the dynamic link library file and each execution statement in each function.

[0066] However, since the dynamic link library file is a binary file compiled from the source code, the compilation process may change various structures of the source code, convert certain variables in the source code into debugging symbols, etc. to optimize the compilation process. Therefore, various forms of errors may exist in the pseudo code obtained through disassembly and reverse analysis, such as missing symbols, confusing structures, missing or incorrect data types, and inability to recognize high-level language features.

[0067] Therefore, the pseudo code of the dynamic link library file can be segmented to obtain multiple pseudo code segments and at least one segmentation position, so that the length of each pseudo code segment meets the requirement of the large model input length.

[0068] When segmenting the pseudocode, the segmentation may be performed based on the input length requirement of the large model, based on the function name indicated in the pseudocode, or based on the logical relationship between the execution units in the functions indicated in the pseudocode. The segmentation method of the pseudocode may be determined based on the actual requirements of the reverse analysis of the dynamic link library files under different system architectures, and the embodiments of the present disclosure do not specifically limit this.

[0069] When the pseudocode is segmented to obtain multiple pseudocode fragments, the segmentation positions may be marked at the same time.

[0070] According to an embodiment of the present disclosure, errors in a plurality of pseudo code snippets are corrected respectively based on a large model to generate a plurality of code snippets.

[0071] For example, the large model can be a large language model trained for the pseudocode correction task. The training data for the pseudocode correction task can be the pseudocode obtained by disassembling and reverse analyzing the dynamic link library files of different system architectures using reverse analysis tools. The large model can learn the differences between the pseudocode and source code of the dynamic link library files under different system architectures and has the ability to correct the differences.

[0072] Since segmenting pseudocode may destroy the semantic relationship between the previous and next fields in the pseudocode, this semantic relationship usually does not affect the correction of pseudocode snippets by the large model. However, in order to further improve the accuracy of correction, the pseudocode snippets can be input into the large model in the order of arrangement before segmentation for correction, which can prompt the large model to provide a reference direction for the pseudocode snippet being corrected based on the correction result of the previous pseudocode snippet.

[0073] For example, the ith pseudocode segment performs variable missing correction. In each execution statement of the same function, the corrected variable should be the same. Therefore, when performing variable missing correction on the i+1th pseudocode segment, the correction result of the ith pseudocode segment can be used first to improve the correction efficiency. 1<i<N, N is the total number of pseudocode segments.

[0074] In some embodiments, for multiple pseudo code segments obtained by segmentation by length, the corrected code segments can be combined according to the marks of the segmentation positions to generate the target code. For multiple pseudo code segments obtained by segmentation by function name, the corrected code segments can be combined according to the function name to generate the target code.

[0075] For the target code, other types of large models can also be called, such as Wenxinyiyan, to verify the target code, including but not limited to format and logical relationship, so as to further improve the accuracy of target code generation.

[0076] According to an embodiment of the present disclosure, the target code is used to analyze whether it is safe to run a dynamic link library file in a target system. The target system can be various versions of the Android system or other system architectures, which are not specifically limited in the embodiment of the present disclosure.

[0077] According to the embodiments of the present disclosure, the natural language understanding ability and rich knowledge reserve of the large model are utilized to correct various errors in the pseudocode obtained by disassembling and reverse analyzing the dynamic link library using various reverse analysis tools, thereby improving the readability of the analysis results and the quality and efficiency of reverse engineering.

[0078] Reference below Figure 3~Figure 5D , combined with specific embodiments Figure 2 The method shown is further explained.

[0079] Figure 3 A schematic diagram of a code generation method based on a large model according to an embodiment of the present disclosure is schematically shown.

[0080] like Figure 3 As shown, in the embodiment 300, first, the dynamic link library file 301 is disassembled to obtain the assembly instruction code 302. Then, the assembly instruction code 302 is reverse analyzed to obtain the pseudo code 303.

[0081] Next, the pseudo code 303 is segmented to obtain n pseudo code segments, which are pseudo code segments P1311 to Pseudo code segments P n Each pseudo code fragment is input into the large model 320 for correction, and the corrected code fragments C1321 to C132n are outputted respectively.

[0082] Finally, code fragments C1321 to C132n are combined according to the segmentation positions to generate target code 331.

[0083] In some embodiments, since the pseudocode indicates the name of each function in the dynamic link library file, the function name indicated in the pseudocode is the same as the function name in the source code in the dynamic link library. Therefore, when the large model is trained based on the pseudocode correction task, the large model can determine the correction solution for the error in the pseudocode snippet by identifying the function name.

[0084] Therefore, segmenting the pseudocode of the dynamic link library file to obtain various pseudocode fragments and segmentation positions may include the following operations: initially segmenting the pseudocode according to the name of each function to obtain multiple function blocks; in response to the length of a first function block among the multiple function blocks being less than or equal to a predetermined threshold, determining that the first function block is a first pseudocode fragment, and marking the initial segmentation position for the pseudocode as the first segmentation position; and in response to the length of a second function block among the multiple function blocks being greater than a predetermined threshold, segmenting the second function block again to obtain a second pseudocode fragment, and marking the second segmentation position for the second function block as the second segmentation position.

[0085] For example, the pseudocode may include a function block corresponding to the function name F1 and a function block corresponding to the function name F2. The pseudocode may be segmented according to the function name to obtain function blocks P F1 and function block P F2 .

[0086] Then, the function block P can be F1 and function block P F2 Perform code length detection and determine the predetermined threshold value based on the input requirements of the large model.

[0087] When the function block P F1 When the code length of is less than or equal to a predetermined threshold, it can be determined that the function block P F1 The code length meets the input requirements of the large model, and the function block P F1 This is identified as pseudo code fragment P1.

[0088] When the function block P F2 When the code length of is greater than a predetermined threshold, it can be determined that the function block P F2 The code length does not meet the input requirements of the large model, and the function block P needs to be F2 The code is segmented again until the length of the segmented code is less than or equal to a predetermined threshold.

[0089] Figure 4A The figure schematically shows a schematic diagram of segmenting a pseudo code according to an embodiment of the present disclosure.

[0090] like Figure 4A As shown, the pseudo code [XXXyyyIIjj]303 is segmented according to the function name to obtain the function block F b1 [XXX] 411. Then, operation S410 is performed to perform the function block F b1 [XXX]411 performs length detection and determines function block F b1 [XXX]411 has a length greater than L (predetermined threshold). And the function block F is b1[XXX]411 is split twice to generate pseudo code fragment P1[XX]311 and pseudo code fragment P2[X]312.

[0091] Similarly, the pseudo code [XXXyyyIIjj]303 is segmented according to the function name to obtain the function block F bm [jj] 41m. Then, operation S410 is performed to perform the function block F bm [jj]41m performs length detection and determines function block F bm [jj] The length of 41m is less than L (predetermined threshold). It can be determined that the function block F bm [jj]41m is a pseudo code fragment P n [jj]31n.

[0092] According to the embodiments of the present disclosure, the pseudocode is segmented based on the function name, and each pseudocode segment includes at least the function name, so that the large model can make targeted corrections to errors caused by field conversion or missing during the compilation process based on various functions, thereby improving the quality and efficiency of the corrections. Even if the function blocks that do not meet the input requirements of the large model are segmented again, the large model can correct each pseudocode segment based on the semantic relevance of the previous and next pseudocode segments, further improving the accuracy of the corrections.

[0093] In some embodiments, since the pseudo code also indicates the execution logic between the execution statements in each function in the dynamic link library file, the second function block is further divided to obtain the pseudo code fragment, which may include the following operations: according to the execution logic relationship between the execution statements in the second function block, the second function block is further divided to obtain the second pseudo code fragment

[0094] According to an embodiment of the present disclosure, the execution logic relationship between the execution statements in the second pseudo code snippet is complete.

[0095] For example, a function block may include execution statements with complex execution logic relationships. When the function block is segmented by length, the execution logic relationship between the execution statements may be destroyed. This pseudo-code fragment that destroys the execution logic relationship brings errors that are not caused by the compilation process to the large model, and introduces interference factors into the correction process of the large model. The large model needs to be corrected based on the logical relationship between multiple pseudo-code fragments input before and after, and the errors generated by the compilation process also need to be corrected, which will reduce the efficiency of the large model in correcting the pseudo-code fragments.

[0096] Therefore, when the function block is split again, it can be split according to the execution logic relationship between the execution statements, so that the execution logic relationship between the execution statements in the second pseudo code fragment obtained by splitting is complete.

[0097] Figure 4B A schematic diagram of segmenting a pseudo code according to another embodiment of the present disclosure is schematically shown.

[0098] like Figure 4B As shown, this embodiment is Figure 4A The embodiment shown differs in that the function block F b1 [XttX]412 can be split according to the logical relationship to obtain pseudo code fragment P1[Xt]413 and pseudo code fragment P2[tX]414.

[0099] Since the length of the second pseudo code segment after segmentation according to the logical relationship is usually smaller than a predetermined threshold, no further segmentation is required.

[0100] According to the embodiments of the present disclosure, the execution logic relationship between the execution statements is not destroyed during the segmentation process, which reduces the interference of the destruction of the execution logic relationship between the execution statements on the large model correction process, and improves the accuracy and efficiency of the large model in correcting the pseudo code fragments.

[0101] The previous article described various errors that exist in the pseudocode. The following describes the process of correcting the large model in detail for each type of error.

[0102] Pseudocode usually lacks symbolic information in the original source code, such as variable names, function names, and comments. This is because the compiled binary file may not have this information or may only contain some debugging symbols. Therefore, in order to improve the readability of the reverse analysis results, the large model can be used to supplement the missing fields based on the semantic relationship between the function names and fields in each pseudocode fragment to generate each code fragment.

[0103] Figure 5A A schematic diagram showing the use of a large model to correct a missing field error in a pseudocode snippet.

[0104] like Figure 5A As shown, the field "!" in the pseudo code snippet P1[AX!X]521a may be a debugging symbol introduced during the compilation of the source code of the dynamic link library file. Therefore, it can be determined that the error in the pseudo code snippet is a field missing error. The pseudo code snippet P1[AX!X]521a may be input into the large model 520, and based on the function name corresponding to the pseudo code snippet P1[AX!X]521a, it is determined that the variable missing at the position corresponding to the field "!" is "Y", thereby adding the variable "Y" to the position of "!" to generate the code snippet C1[AXYX]522a.

[0105] According to the embodiments of the present disclosure, the errors of missing fields in the pseudocode snippet are corrected based on the trained large model, the symbol information in the source code that is missing from the pseudocode is supplemented, and the readability of the reverse analysis results is further improved.

[0106] The compiler may change the code structure to improve performance during the source code optimization process. Therefore, the code structure of the pseudocode will be different from that of the source code, and the structure is not as intuitive as the source code, resulting in poor readability of the reverse analysis results.

[0107] Therefore, for code structure errors, the large model can be used to correct the erroneous code structure based on the function names in each pseudo code fragment to generate each code fragment.

[0108] Figure 5B The schematic diagram of using a large model to correct structural errors in a pseudo code snippet is shown schematically.

[0109] like Figure 5B As shown, there is a structural error in the pseudo code snippet P2[for(((xxx)if(yyy))if(jjj)]521b. This structural error causes the execution logic of the for loop to be chaotic, which is not conducive to the subsequent code security analysis. Therefore, the pseudo code snippet P2[for(((xxx)if(yyy))if(jjj)]521b can be input into the large model 520, and the large model 520 can re-sort the structure of the pseudo code snippet based on the for loop logic in the function block corresponding to the pseudo code snippet learned during the training process, and generate the code snippet C2[for(xxx / yyy)if(iii)]522b.

[0110] According to the embodiments of the present disclosure, the errors in the code structure in the pseudocode snippet are corrected based on the trained large model, further improving the intuitiveness of the execution logic between the execution statements in the reverse analysis results, and facilitating subsequent code security analysis.

[0111] When using reverse analysis tools to disassemble and reverse analyze binary files, the data types in each execution statement are usually inferred based on the context of the assembly instruction code, resulting in missing or incorrect data types in the pseudocode. For example, the data type in the source code is integer data, but the data type in the pseudocode output by the reverse analysis tool is floating point data.

[0112] Therefore, for data type errors or omissions, the big model can be used to modify the data type of the first target field based on the function name in each pseudo code snippet to generate each code snippet, wherein the first target field represents a field with an error or omission in data type.

[0113] Figure 5CThe diagram schematically shows a schematic diagram of correcting data type errors in a pseudo code snippet using a large model.

[0114] like Figure 5C As shown, the content in the data type identifier "()" of the variable X in the pseudo code snippet P3[AX()X]521c is empty, and it can be determined that there is a data type missing error. The pseudo code snippet P3[AX()X]521c can be input into the large model 520, and the missing fields in the pseudo code snippet are supplemented based on the function block data type corresponding to the pseudo code snippet learned during the training process, and the code snippet C3[AX(int)X]522c is output.

[0115] According to an embodiment of the present disclosure, data type errors in pseudo code snippets are corrected based on the trained large model, further improving the readability of each execution statement in the reverse analysis result.

[0116] During the compilation process, high-level language features used in the source code, such as templates, macros, inline assembly, etc., may be converted into other languages. Therefore, the pseudo code output by the reverse analysis tool may not be able to fully reproduce the high-level language features used in the source code.

[0117] Therefore, in order to solve the programming language characteristic errors, the large model can be used to correct the programming language characteristics of the second target field based on the function name in each pseudocode fragment to generate each code fragment; wherein the second target field represents a field corresponding to at least one of a function template, a macro and an inline assembly.

[0118] Figure 5D The diagram schematically shows a schematic diagram of correcting inline assembly errors in a pseudo code snippet using a large model.

[0119] like Figure 5D As shown, the field "$" in the pseudo code snippet P4[AX$X]521d can be a conversion symbol corresponding to inline assembly. For example, when inline assembly is used in the source code, the corresponding field will be replaced by "$" during the compilation process. The pseudo code snippet P4[AX$X]521d can be input into the large model 520, and the large model 520 corrects the "$" based on the function name corresponding to the pseudo code snippet learned during the training process, and outputs the code snippet C4[AX(asm)X]522d.

[0120] According to the embodiments of the present disclosure, programming language feature errors in pseudocode snippets are corrected based on the trained large model, and high-level language features used in the source code, such as templates, macros, or inline assembly, are reproduced, thereby further improving the code readability of the reverse analysis results and reducing the difficulty of code security analysis.

[0121] In practical applications, the pseudocode snippet may include any of the errors described above, or a combination of multiple errors. The large model can be used to correct the errors in the pseudocode snippet. For scenarios with combined errors, the large model can be used to merge and correct them, or to correct them separately. Specifically, it can be based on whether there is coupling between the errors. For non-coupled errors, they can be corrected separately according to the error type. For coupled errors, they can be merged and corrected first, and then corrected separately according to the error type, and the large model can be used to fuse the results of the two corrections to improve the accuracy of the correction.

[0122] The code snippets corrected using the large model are highly readable. When reverse analysis tools are used for disassembly and reverse analysis, the pseudocode retains most of the execution logic relationships in the source code. Therefore, the corrected code snippets can be combined according to the original segmentation positions to reproduce the execution logic and code structure of the source code as much as possible.

[0123] Therefore, combining multiple code fragments according to at least one cutting position to generate target code may include the following operations: combining multiple code fragments corresponding to the same function according to at least one cutting position to generate multiple function blocks; and combining multiple function blocks according to at least one cutting position to generate target code.

[0124] For example, the function block F1 is divided into two pseudo code segments, the segmentation position is 1, and after the errors in the two code segments are corrected using the large model, code segments 1-1 and code segments 1-2 are generated. Similarly, the function block F2 is divided into two pseudo code segments, the segmentation position is 2, and after the errors in the two code segments are corrected using the large model, code segments 2-1 and code segments 2-2 are generated.

[0125] According to the segmentation position 1, the code fragment 1-1 and the code fragment 1-2 can be combined to obtain the function block F1. Similarly, according to the segmentation position 2, the code fragment 2-1 and the code fragment 2-2 can be combined to obtain the function block F2.

[0126] Then, based on the segmentation positions of the function block F1 and the function block F2, the function block F1 and the function block F2 or other function blocks are respectively combined to generate the target code.

[0127] According to the embodiments of the present disclosure, for pseudo codes with a longer length, they are first combined into function blocks according to the segmentation positions and then combined according to the function blocks, which can improve the reorganization efficiency and reorganization accuracy of the code fragments.

[0128] Figure 6 The flowchart of the large model training method according to an embodiment of the present disclosure is schematically shown.

[0129] like Figure 6 As shown, the training method 600 may include operations S610 to S640.

[0130] In operation S610, the pseudo code of the sample dynamic link library file is segmented to obtain a plurality of sample pseudo code segments and at least one sample segmentation position.

[0131] In operation S620, errors in the plurality of sample pseudo code segments are corrected respectively based on the initial large model to generate a plurality of sample code segments.

[0132] In operation S630 , based on the target loss function, a loss value is generated according to each source code fragment of the sample dynamic link library and each sample code fragment.

[0133] In operation S640, model parameters of the initial large model are adjusted based on the loss value to obtain a large model.

[0134] According to an embodiment of the present disclosure, the sample pseudo code is obtained by disassembling and reverse analyzing the sample dynamic link library file. The sample dynamic link library file can be a dynamic link library file for different architecture systems. The training data may include each source code fragment and each sample pseudo code fragment of the sample dynamic link library file.

[0135] Each source code segment can be obtained by segmenting the source code according to the segmentation rule. Each sample pseudo code segment can be obtained by segmenting the pseudo code according to the same segmentation rule. Therefore, the segmentation position of each source code segment can be the same as the segmentation position of each sample pseudo code segment.

[0136] The reverse analysis tool described above can be used to disassemble and reverse analyze the sample dynamic link library file. The definition range of the sample pseudo code is the same as the definition range of the pseudo code described above, which will not be repeated here.

[0137] During the training process, a phased training method can be used. For example, firstly, training is performed based on a pseudo code snippet with a single error to obtain an intermediate model. Then, training is performed based on a pseudo code snippet with a combination of errors to obtain the final large model. The large model obtained by this training process has a higher correction accuracy.

[0138] During the training process, you can also directly train based on the pseudo code snippets with combined errors to obtain the final large model. This training process has a shorter training cycle and higher training efficiency.

[0139] According to an embodiment of the present disclosure, the target loss function may be a cross entropy loss function, or other loss functions that can be used for neural network model training, and the present disclosure does not make any specific limitation on this.

[0140] In some embodiments, the maximum number of training times can be used as a termination condition, or the convergence of the loss value can be used as a termination condition. The training termination condition can be set based on the actual needs of the application scenario, and the present disclosure does not make specific limitations on this.

[0141] According to an embodiment of the present disclosure, the initial large model may be a large language model. Through training, the large language model may learn the ability to correct the reverse analysis results, thereby improving the reverse capability of the large language model and realizing the application of the large language model in the field of reverse engineering.

[0142] Figure 7 The flowchart of the method for detecting a dynamic link library file according to an embodiment of the present disclosure is schematically shown.

[0143] like Figure 7 As shown, the detection method 700 may include: operation S710 to operation S720.

[0144] In operation S710, an object code of a dynamic link library file is acquired.

[0145] In operation S720, the target code is detected and a detection result is generated.

[0146] According to an embodiment of the present disclosure, the target code is generated using the large model-based code generation method described above.

[0147] In some embodiments, any code security detection tool may be used to detect the target code and generate a detection result. The detection result is used to indicate whether it is safe to run the dynamic link library file in the target system. The target system may be an Android system.

[0148] According to the embodiments of the present disclosure, the target code generated by correcting the analysis results of the reverse tool using a large model reproduces the execution logic, code structure, and high-level language characteristics of the source code of the dynamic link library file and other features used for security detection, thereby improving the accuracy of the detection results.

[0149] Figure 8 The block diagram of a code generation device based on a large model according to an embodiment of the present disclosure is schematically shown.

[0150] like Figure 8 As shown, the code generating device 800 may include a first segmentation module 810 , a first correction module 820 and a combination module 830 .

[0151] The first segmentation module 810 is used to segment the pseudo code of the dynamic link library file to obtain multiple pseudo code segments and at least one segmentation position; wherein the pseudo code is obtained by disassembling and reverse analyzing the dynamic link library file.

[0152] The first correction module 820 is used to correct errors in multiple pseudo code snippets based on the large model and generate multiple code snippets.

[0153] The combining module 830 is used to combine multiple code fragments according to at least one segmentation position to generate a target code; the target code is used to analyze whether it is safe to run the dynamic link library file in the target system.

[0154] According to an embodiment of the present disclosure, the error includes a missing field, and the first correction module includes a first correction sub-module, which is used to use a large model to supplement the missing fields based on the function name in each pseudocode fragment and the semantic relationship between each field to generate each code fragment.

[0155] According to an embodiment of the present disclosure, the error includes a code structure error, and the first correction module includes a second correction submodule for correcting the erroneous code structure based on the function name in each pseudo code fragment by using the large model to generate each code fragment.

[0156] According to an embodiment of the present disclosure, the error includes an incorrect or missing data type, and the first correction module includes a third correction sub-module, which is used to use a large model to correct the data type of the first target field based on the function name in each pseudocode fragment to generate each code fragment; wherein the first target field represents a field with an incorrect or missing data type.

[0157] According to an embodiment of the present disclosure, the error includes a programming language characteristic error, and the first correction module includes: a fourth correction sub-module, which is used to use a large model to correct the programming language characteristics of the second target field based on the function name in each pseudo-code fragment to generate each code fragment; wherein the second target field represents a field corresponding to at least one of a function template, a macro, and an inline assembly.

[0158] According to an embodiment of the present disclosure, the pseudo code indicates the name of each function in the dynamic link library file. The first slicing module includes a first slicing submodule, a determining submodule and a second slicing submodule.

[0159] The first sub-module is used to perform initial segmentation of the pseudo code according to the names of each function to obtain multiple function blocks.

[0160] The determination submodule is used to determine that the first function block among the multiple function blocks is a first pseudo code segment in response to the length of the first function block being less than or equal to a predetermined threshold, and mark the initial segmentation position for the pseudo code as the first segmentation position.

[0161] The second segmentation submodule is used to re-segment the second function block to obtain a second pseudo code segment in response to the length of the second function block among the multiple function blocks being greater than a predetermined threshold, and mark the re-segmentation position for the second function block as the second segmentation position.

[0162] According to an embodiment of the present disclosure, the pseudo code also indicates the execution logic relationship between the execution statements in the functions in the dynamic link library file. The second segmentation submodule includes: a first segmentation unit and a second segmentation unit.

[0163] The first segmentation unit is used to segment the second function block again to obtain pseudo code fragments.

[0164] The second segmentation unit is used to segment the second function block again according to the execution logic relationship between the execution statements in the second function block to obtain a second pseudo code fragment; wherein the execution logic relationship between the execution statements in the second pseudo code fragment is complete.

[0165] According to an embodiment of the present disclosure, the combination module includes: a first combination submodule and a second combination submodule. The first combination submodule is used to combine multiple code fragments corresponding to the same function according to at least one segmentation position to generate multiple function blocks. The second combination submodule is used to combine multiple function blocks according to at least one segmentation position to generate target code.

[0166] Fig. 9 A block diagram of a large model training device according to an embodiment of the present disclosure is schematically shown.

[0167] like Fig. 9 As shown, the training device 900 may include: a second segmentation module 910 , a second correction module 920 , a loss calculation module 930 and an adjustment module 940 .

[0168] The second segmentation module 910 is used to segment the pseudo code of the sample dynamic link library file to obtain multiple sample pseudo code segments and at least one sample segmentation position; wherein the sample pseudo code is obtained by disassembling and reverse analyzing the sample dynamic link library file.

[0169] The second correction module 920 is used to correct errors in multiple sample pseudo code segments based on the initial large model to generate multiple sample code segments.

[0170] The loss calculation module 930 is used to generate a loss value based on the target loss function according to each source code fragment of the sample dynamic link library and each sample code fragment; wherein the segmentation position of each source code fragment is the same as the segmentation position of each sample pseudo code fragment.

[0171] The adjustment module 940 is used to adjust the model parameters of the initial large model based on the loss value to obtain the large model.

[0172] Fig.10 A block diagram of a dynamic link library file detection device according to an embodiment of the present disclosure is schematically shown.

[0173] like Fig.10 As shown, the detection device 1000 may include an acquisition module 1010 and a detection module 1020 .

[0174] The acquisition module 1010 is used to acquire the target code of the dynamic link library file, wherein the target code is generated by using the large model-based code generation method described above.

[0175] The detection module 1020 is used to detect the target code and generate a detection result; wherein the detection result is used to indicate whether it is safe to run the dynamic link library file in the target system.

[0176] Fig.11 A block diagram of an artificial intelligence agent according to an embodiment of the present disclosure is schematically shown.

[0177] In the embodiments of the present disclosure, inspired by the von Neumann structure in modern computer theory, such as Fig.11 As shown, the AI ​​agent 1100 may include three core modules: an input module 1110, an output module 1120, and a processing module 1130. The processing module 1130 may include a control unit 1131, a storage unit 1132, and an operation unit 1133.

[0178] The input module 1110 is responsible for receiving or sensing information such as queries, requests, instructions, signals or data from the outside world (such as users or external environment), and converting them into a format that can be understood and processed by the AI ​​agent 1100. The input module 1110 is the primary link for the AI ​​agent 1100 to interact with the outside world. It enables the AI ​​agent 1100 to efficiently and accurately obtain the necessary "sensory" information from the outside world and respond to this information.

[0179] In an example, the input information received by the input module 1110 may be the dynamic link library file described above, or may be pseudo code output by a reverse analysis tool.

[0180] In the example, the processing module 1130 is the core support for the AI ​​agent 1100 to process complex tasks. The processing module 1130 can determine the target task based on the input information received by the input module 1010, determine the big model based on the target task, and execute the code generation method based on the big model described above by calling the big model to output the target code.

[0181] In the example, the control unit 1131 in the processing module 1130 will continuously interact with the storage unit 1132, the computing unit 1133 and / or the output module 1120 during operation. However, it should be noted that in the embodiment of the present disclosure, the control unit 1131 acts as a single initiator to initiate communication with the storage unit 1132, the computing unit 1133 and / or the output module 1120, and there is no communication coupling between the storage unit 1132, the computing unit 1133 and the output module 1120.

[0182] In the example, the performance of the control unit 1131 may be closely related to the large model on which the AI ​​agent 1100 is based. In order to give full play to the capabilities of the large language model, the internal structure of the control unit 1131 may be designed to be highly configurable and scalable to cope with various types of tasks and requirements in real scenarios.

[0183] The storage unit 1132 may be responsible for memorizing information such as historical conversations, event flows, etc. The target code generated in each round as described above may be included in the storage unit 1132 .

[0184] In the example, after the AI ​​agent 1100 obtains the code generation request, the AI ​​agent 1100 can use the reverse analysis tool to disassemble and reverse analyze the dynamic link library file to generate pseudocode. The pseudocode can be stored in the storage unit 1132. The AI ​​agent 1100 can retrieve the relevant code resources from the storage unit 1132 and feed it back to the control unit 1131. Then, the control unit 1131 can use the fed-back code resources to obtain the corrected content corresponding to the pseudocode and combine it to obtain the target code. The relevant code resources can also be retrieved from the storage unit 1132 and fed back to the control unit 1131. Then, the control unit 1131 can use the returned code resources to obtain the corrected content corresponding to the pseudocode and combine it to obtain the target code. And pass the target code to the output module 1120.

[0185] The operation unit 1133 may be regarded as a predefined tool library. The renderer and display controls mentioned above may be included in the operation unit 1133 .

[0186] In the example, when the AI ​​agent 1100 needs to render multiple output data, the relevant renderer and display control can be called from the operation unit 1133 and fed back to the control unit 1132. Then, the control unit 1132 can use the feedback renderer and display control to render the first search result and pass the first search result to the output module 1120. It can be understood that although the large language model has excellent language understanding and generation capabilities, it is the same as a human being. Without the help of any tools, the tasks that can be solved are very limited. When the AI ​​agent 1100 is given the ability to call tools, it can achieve tasks such as completing mathematical operations with the help of a calculator, completing data analysis with the help of python, and completing prediction tasks with the help of a search engine.

[0187] In an example, the output module 1120 may output the target code described above.

[0188] The AI ​​agent 1100 according to the embodiment of the present disclosure can simply and effectively improve the level of intelligence, and improve flexibility and versatility.

[0189] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0190] According to an embodiment of the present disclosure, an electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described above.

[0191] According to an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the method described above.

[0192] According to an embodiment of the present disclosure, a computer program product includes a computer program, and when the computer program is executed by a processor, the computer program implements the method described above.

[0193] Fig.12 A schematic block diagram of an example electronic device 1200 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0194] like Fig.12 As shown, the device 1200 includes a computing unit 1201, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1202 or a computer program loaded from a storage unit 1208 into a random access memory (RAM) 1203. In the RAM 1203, various programs and data required for the operation of the device 1200 can also be stored. The computing unit 1201, the ROM 1202, and the RAM 1203 are connected to each other via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0195] A number of components in the device 1200 are connected to the I / O interface 1205, including: an input unit 1206, such as a keyboard, a mouse, etc.; an output unit 1207, such as various types of displays, speakers, etc.; a storage unit 1208, such as a disk, an optical disk, etc.; and a communication unit 1209, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1209 allows the device 1200 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0196] The computing unit 1201 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1201 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1201 performs the various methods and processes described above, such as a code generation method, a training method, or a detection method based on a large model. For example, in some embodiments, a code generation method, a training method, or a detection method based on a large model may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 1208. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1200 via the ROM 1202 and / or the communication unit 1209. When the computer program is loaded into the RAM 1203 and executed by the computing unit 1201, one or more steps of the code generation method, training method, or detection method based on the large model described above may be performed. Alternatively, in other embodiments, the computing unit 1201 may be configured to execute a large model-based code generation method, a training method, or a detection method in any other appropriate manner (eg, by means of firmware).

[0197] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0198] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0199] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0200] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0201] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0202] A computer system may include a client and a server. The client and the server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises through computer programs running on respective computers and having a client-server relationship to each other. The server may be a cloud server, a server in a distributed system, or a server combined with a blockchain.

[0203] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0204] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A code generation method based on a large model, comprising: The pseudo code of the dynamic link library file is segmented to obtain a plurality of pseudo code segments and at least one segmentation position; wherein the pseudo code is obtained by disassembling and reverse analyzing the dynamic link library file; Correcting errors in the plurality of pseudo code snippets respectively based on the large model to generate a plurality of code snippets; and According to the at least one segmentation position, the multiple code fragments are combined to generate a target code; the target code is used to analyze whether it is safe to run the dynamic link library file in the target system.

2. The method according to claim 1, wherein: Said errors include missing fields; The correcting the errors in the plurality of pseudo code snippets based on the large model respectively includes: By using the large model, the missing fields are supplemented based on the function names in each pseudo code fragment and the semantic relationship between each field, so as to generate each code fragment.

3. The method according to claim 1 or 2, wherein: The errors include code structure errors; The correcting the errors in the plurality of pseudo code snippets based on the large model respectively includes: By using the large model, the erroneous code structure is corrected based on the function name in each pseudo code fragment to generate each code fragment.

4. The method according to any one of claims 1 to 3, wherein The errors include: incorrect or missing data types; The correcting the errors in the plurality of pseudo code snippets based on the large model respectively includes: The large model is used to correct the data type of the first target field based on the function name in each pseudo code snippet to generate each code snippet; wherein the first target field represents a field with an incorrect or missing data type.

5. The method according to any one of claims 1 to 4, wherein: The errors include programming language feature errors; The correcting the errors in the plurality of pseudo code snippets based on the large model respectively includes: The large model is used to modify the programming language characteristics of the second target field based on the function name in each pseudo code fragment to generate each code fragment; wherein the second target field represents a field corresponding to at least one of a function template, a macro and an inline assembly.

6. The method according to claim 1, wherein: The pseudo code indicates the name of each function in the dynamic link library file; The pseudo code of the dynamic link library file is segmented to obtain pseudo code fragments and segmentation positions, including: According to the names of the functions, the pseudo code is initially segmented to obtain a plurality of function blocks; In response to a length of a first function block among the plurality of function blocks being less than or equal to a predetermined threshold, determining that the first function block is a first pseudo code fragment, and marking an initial segmentation position for the pseudo code as a first segmentation position; and In response to a length of a second function block among the multiple function blocks being greater than a predetermined threshold, the second function block is split again to obtain a second pseudo code segment, and a split position for the second function block is marked as a second split position.

7. The method according to claim 6, wherein: The pseudo code also indicates the execution logic relationship between the execution statements in the functions in the dynamic link library file; The second function block is further divided to obtain the pseudo code fragment, including: According to the execution logic relationship between the execution statements in the second function block, the second function block is divided again to obtain the second pseudo code fragment; Among them, the execution logic relationship between the execution statements in the second pseudo code fragment is complete.

8. The method according to claim 1, wherein: The step of combining the multiple code fragments according to the at least one segmentation position to generate a target code includes: According to the at least one segmentation position, multiple code snippets corresponding to the same function are combined to generate multiple function blocks; and According to the at least one segmentation position, a plurality of function blocks are combined to generate the target code.

9. A large model training method, comprising: The pseudo code of the sample dynamic link library file is segmented to obtain a plurality of sample pseudo code segments and at least one sample segmentation position; wherein the sample pseudo code is obtained by disassembling and reverse analyzing the sample dynamic link library file; Based on the initial large model, respectively correct the errors in the plurality of sample pseudo code segments to generate a plurality of sample code segments; Based on the target loss function, generating a loss value according to each source code snippet of the sample dynamic link library and each sample code snippet; wherein the segmentation position of each source code snippet is the same as the segmentation position of each sample pseudo code snippet; and The model parameters of the initial large model are adjusted based on the loss value to obtain the large model.

10. A method for detecting a dynamic link library file, comprising: Obtaining an object code of a dynamic link library file, wherein the object code is generated by using the method according to any one of claims 1 to 8; and The target code is detected to generate a detection result; wherein the detection result is used to indicate whether it is safe to run the dynamic link library file in the target system.

11. A code generation device based on a large model, comprising: The first segmentation module is used to segment the pseudo code of the dynamic link library file to obtain multiple pseudo code fragments and at least one segmentation position; wherein the pseudo code is obtained by disassembling and reverse analyzing the dynamic link library file; A first correction module, configured to correct errors in the plurality of pseudo code segments respectively based on the large model to generate a plurality of code segments; and A combination module is used to combine the multiple code fragments according to the at least one segmentation position to generate a target code; the target code is used to analyze whether it is safe to run the dynamic link library file in the target system.

12. The device according to claim 11, wherein Said errors include missing fields; The first correction module comprises: The first correction submodule is used to use the large model to supplement the missing fields based on the function name in each pseudo code fragment and the semantic relationship between each field to generate each code fragment.

13. The device according to claim 11 or 12, wherein: The errors include code structure errors; The first correction module comprises: The second correction submodule is used to use the large model to correct the erroneous code structure based on the function name in each pseudo code fragment to generate each code fragment.

14. The device according to any one of claims 11 to 13, wherein: The errors include incorrect or missing data types; The first correction module comprises: The third correction submodule is used to use the large model to correct the data type of the first target field based on the function name in each pseudo code fragment to generate each code fragment; wherein the first target field represents a field with an incorrect or missing data type.

15. The device according to any one of claims 11 to 14, wherein: The errors include programming language feature errors; The first correction module comprises: The fourth correction submodule is used to use the large model to correct the programming language characteristics of the second target field based on the function name in each pseudo code fragment to generate each code fragment; wherein the second target field represents a field corresponding to at least one of a function template, a macro and an inline assembly.

16. The device according to claim 1, wherein The pseudo code indicates the name of each function in the dynamic link library file; The first segmentation module includes: The first sub-module is used to perform initial segmentation on the pseudo code according to the names of each function to obtain multiple function blocks; a determination submodule, configured to, in response to a length of a first function block among the plurality of function blocks being less than or equal to a predetermined threshold, determine that the first function block is a first pseudo code fragment, and mark an initial segmentation position for the pseudo code as a first segmentation position; and The second segmentation submodule is used to re-segment the second function block in the multiple function blocks to obtain a second pseudo code fragment in response to the length of the second function block being greater than a predetermined threshold, and mark the re-segmentation position for the second function block as the second segmentation position.

17. The device according to claim 16, wherein: The pseudo code also indicates the execution logic relationship between the execution statements in the functions in the dynamic link library file; The second cutting submodule comprises: The first segmentation unit is used to segment the second function block again to obtain the pseudo code fragment, including: A second segmentation unit, configured to segment the second function block again according to the execution logic relationship between the execution statements in the second function block to obtain the second pseudo code fragment; Among them, the execution logic relationship between the execution statements in the second pseudo code fragment is complete.

18. The device according to claim 11, wherein The combined module comprises: A first combining submodule, configured to combine multiple code fragments corresponding to the same function according to the at least one segmentation position to generate multiple function blocks; and The second combining submodule is used to combine multiple function blocks according to the at least one segmentation position to generate the target code.

19. A large model training device, comprising: A second segmentation module is used to segment the pseudo code of the sample dynamic link library file to obtain a plurality of sample pseudo code segments and at least one sample segmentation position; wherein the sample pseudo code is obtained by disassembling and reverse analyzing the sample dynamic link library file; A second correction module is used to correct errors in the plurality of sample pseudo code segments based on the initial large model to generate a plurality of sample code segments; a loss calculation module, configured to generate a loss value based on a target loss function and according to each source code snippet of the sample dynamic link library and each sample code snippet; wherein the segmentation position of each source code snippet is the same as the segmentation position of each sample pseudo code snippet; and An adjustment module is used to adjust the model parameters of the initial large model based on the loss value to obtain the large model.

20. A detection device for a dynamic link library file, comprising: An acquisition module, used for acquiring the target code of the dynamic link library file, wherein the target code is generated by using the method according to any one of claims 1 to 8; The detection module is used to detect the target code and generate a detection result; wherein the detection result is used to indicate whether it is safe to run the dynamic link library file in the target system.

21. An artificial intelligence agent, comprising: An input module, used for receiving input information; a processing module, configured to determine a target task based on the input information received by the input module, determine a large model based on the target task, and obtain output information by calling the large model to execute the method of claims 1 to 10; as well as An output module is used to output the output information obtained by the processing module.

22. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of claims 1 to 10.

23. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 10.

24. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 10.

Images