Instruction identification method, apparatus and device, readable storage medium and program product

Abstract

The invention relates to an instruction identification method and device, equipment, a readable storage medium and a program product. The method comprises the following steps: firstly, generating a to-be-tested instruction list according to an instruction format of a target processor, then, carrying out disassembling processing on the to-be-tested instruction list, determining an undefined instruction list of the target processor according to a disassembling processing result, and finally, obtaining an execution result of the target processor on the undefined instruction list, and determining a hidden instruction according to the execution result. By the adoption of the method, the instruction format of the target processor can be recognized, the to-be-tested instruction list can be generated, then the to-be-tested instruction list is disassembled, the undefined instruction list is screened out, and the execution result of the target processor on the undefined instruction list is obtained to obtain the hidden instruction, so that the whole instruction space does not need to be traversed when the to-be-tested instruction list is generated; and the hidden instruction identification efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of hardware security technology, and in particular to an instruction mining method, device, equipment, readable storage medium and program product. Background Art

[0002] With the widespread application of DSP (Digital Signal Processing) in multiple fields such as communications, computers, and consumer electronics, the security issues of DSP have gradually become a hot topic of research. In computer science, hidden instructions refer to a special type of processor instructions that can be recognized and executed by the processor, but are not declared in the official technical documentation of the processor manufacturer. Therefore, due to the lack of support and explanation from official documents, these hidden instructions may become potential security vulnerabilities and can be easily exploited by malicious parties, causing a series of security issues, such as unauthorized access to sensitive data, illegal escalation of system permissions, memory data tampering, and operating system crashes.

[0003] Currently, the existing identification of hidden instructions mainly generates the instructions to be tested by traversing the entire instruction space of the processor. This method causes the search space to be too large, seriously reduces the search efficiency, and the identification efficiency of hidden instructions is low. Summary of the invention

[0004] Based on this, it is necessary to provide an instruction recognition method, device, equipment, readable storage medium and program product that can improve recognition efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides an instruction recognition method, comprising:

[0006] Generate a list of instructions to be tested according to the instruction format of the target processor;

[0007] Disassemble the instruction list to be tested, and determine the undefined instruction list according to the disassembly result;

[0008] Obtain the execution result of the target processor on the undefined instruction list, and determine the hidden instructions of the target processor according to the execution result.

[0009] In one embodiment, generating a list of instructions to be tested according to the instruction format of the target processor includes:

[0010] Determine the instruction code length according to the instruction format of the target processor;

[0011] According to the length of the instruction code, traverse and generate the instruction code list;

[0012] According to the command code list and the preset command database, a command list to be tested is determined.

[0013] In one embodiment, determining the command list to be tested according to the command code list and the preset command database includes:

[0014] For each instruction code in the instruction code list, each instruction code is matched with the instruction database to obtain a matching result corresponding to each instruction code;

[0015] According to the instruction code indicated as an undefined instruction or a special instruction by the matching result, a list of instructions to be tested is determined.

[0016] In one embodiment, disassembling the instruction list to be tested and determining the undefined instruction list according to the disassembly result include:

[0017] For each instruction to be tested in the instruction to be tested list, disassembly processing is performed on each instruction to be tested according to the instruction database to obtain a disassembly processing result corresponding to each instruction to be tested;

[0018] According to the disassembly processing result indicating that the instruction to be tested was not successfully disassembled, a list of undefined instructions is determined.

[0019] In one embodiment, obtaining the execution result of the target processor on the undefined instruction list includes:

[0020] Establishing a communication connection with the target processor through the simulator, and sending the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program, and obtains the execution result of the undefined instruction list;

[0021] Receive the execution result returned by the target processor.

[0022] In one embodiment, determining the hidden instruction of the target processor according to the execution result includes:

[0023] If the execution result of the target instruction is successful, it is determined that the target instruction is a hidden instruction.

[0024] In a second aspect, the present application further provides an instruction recognition device, the device comprising:

[0025] A generation module, used for generating a list of instructions to be tested according to the instruction format of the target processor;

[0026] A first determination module is used to perform a disassembly process on the instruction list to be tested, and determine an undefined instruction list according to the disassembly process result;

[0027] The second determination module is used to obtain the execution result of the target processor on the undefined instruction list, and determine the hidden instructions of the target processor according to the execution result.

[0028] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the instruction recognition method described in any one of the first aspects is implemented.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented: the instruction recognition method described in any one of the first aspects above.

[0030] In a fifth aspect, the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements any instruction recognition method described in the first aspect above.

[0031] The above-mentioned instruction recognition method, device, equipment, readable storage medium and program product first generate a list of instructions to be tested according to the instruction format of the target processor, then disassemble the list of instructions to be tested, determine the list of undefined instructions of the target processor according to the disassembly processing result, and finally obtain the execution result of the target processor on the undefined instruction list, and determine the hidden instruction according to the execution result. In this way, the instruction format of the target processor is identified, the list of instructions to be tested is generated, and then the list of instructions to be tested is disassembled, the list of undefined instructions is screened out, and the execution result of the target processor on the undefined instruction list is obtained to obtain the hidden instruction. In this way, the instruction format of the target processor is identified, the list of instructions to be tested is generated, and then the list of instructions to be tested is disassembled, the list of undefined instructions is screened out, and the execution result of the target processor on the undefined instruction list is obtained to obtain the hidden instruction. In this way, there is no need to traverse the entire instruction space when generating the list of instructions to be tested, which improves the efficiency of hidden instruction recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 is a flow chart of an instruction recognition method in one embodiment;

[0034] Figure 2 is a schematic diagram of an instruction format of a target processor in one embodiment;

[0035] Figure 3 A schematic diagram of a flow chart of steps for determining a list of instructions to be tested in one embodiment;

[0036] Figure 4 A schematic flow chart of a step of determining a list of instructions to be tested in another embodiment;

[0037] Figure 5 is a schematic diagram of the instruction format of a conventional instruction in one embodiment;

[0038] Figure 6 A schematic diagram of an instruction format of a special instruction in an embodiment;

[0039] Figure 7 is another instruction format schematic diagram of a conventional instruction in one embodiment;

[0040] Figure 8 A schematic flow chart of a step of determining a list of instructions to be tested in another embodiment;

[0041] Fig. 9 A flowchart of a step of determining an undefined instruction list in another embodiment;

[0042] Fig.10 A schematic diagram of a flow chart of a disassembly processing step in another embodiment;

[0043] Fig.11 is a flow chart of an instruction recognition method in another embodiment;

[0044] Fig.12 is a flow chart of an instruction recognition method in another embodiment;

[0045] Fig.13 is a structural block diagram of an instruction recognition device in an embodiment;

[0046] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The instruction length of DSP is usually 16 bits or 32 bits. Especially for C6000 series DSP, the instruction length is 32 bits, that is, the size of instruction space is 2 32 , about 4.295 billion different instructions. If we traverse the huge instruction space to search for hidden instructions, the search efficiency is very low.

[0049] In view of this, the present application identifies the instruction format of the target processor, generates a list of instructions to be tested, then disassembles the list of instructions to be tested, filters out a list of undefined instructions, obtains the execution results of the target processor on the list of undefined instructions to obtain hidden instructions. In this way, there is no need to traverse the entire instruction space when generating the list of instructions to be tested, thereby improving the efficiency of hidden instruction identification.

[0050] In an exemplary embodiment, Figure 1 As shown, a command recognition method is provided, and the method is applied to a terminal as an example for explanation. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server, including the following steps:

[0051] Step 101: Generate a list of instructions to be tested according to the instruction format of the target processor.

[0052] Among them, the target processor can be a DSP processor, the instruction list to be tested is all possible instructions of the target processor generated according to the instruction format of the target processor, and the instruction list to be tested may include public instructions and undefined instructions of the target processor. The public instructions are instructions included in the public instruction set document of the target processor, and the undefined instructions are instructions not included in the public instruction set document of the target processor. The undefined instructions and the public instructions together constitute a complete instruction set of the target processor.

[0053] The target processor's instruction format, also known as the machine code format, is as follows Figure 2 As shown, the fixed-length binary machine code can usually be divided into the following four fields: condition field, operand field, opcode field and fixed value field. Among them, the opcode field and the fixed value field are the key to determine the function of the instruction, and constitute the effective part of the instruction, which is recorded as the instruction code. The condition field and the operand field are used to determine the instruction execution condition and the operand, and have no effect on the function of the instruction, and can be regarded as the invalid part of the instruction. Therefore, according to the instruction code of the instruction format, the list of instructions to be tested is generated by traversing based on the length of the instruction code, which can reduce the number of instructions in the generated list of instructions to be tested, thereby reducing the number of instruction searches and improving recognition efficiency.

[0054] Step 102, disassembling the instruction list to be tested, and determining the undefined instruction list according to the disassembly result.

[0055] Among them, the undefined instruction list includes hidden instructions and illegal instructions of the target processor. Hidden instructions are executable instructions, and illegal instructions are unexecutable instructions. In order to filter out the undefined instructions in the instruction list to be tested, all instructions in the instruction list to be tested can be accurately disassembled, and the instructions in the binary machine code in the instruction list to be tested can be converted into instructions in assembly language format. In order to improve the accuracy of disassembly, the instruction set of the target processor can be obtained, and each instruction in the instruction list to be tested can be disassembled according to the instruction set. According to the disassembly results of each instruction, it is determined whether each instruction is a public instruction or an undefined instruction, and the undefined instruction list is obtained according to all the undefined instructions that have been filtered out.

[0056] Step 103, obtaining the execution result of the target processor on the undefined instruction list, and determining the hidden instructions of the target processor according to the execution result.

[0057] Obtain the execution result of the target processor for each undefined instruction in the undefined instruction list. Optionally, if the undefined instruction is an illegal instruction, the execution result is execution failure because the illegal instruction cannot be recognized and executed by the target processor. If the undefined instruction is a hidden instruction, the execution result is execution success. According to the execution results corresponding to each undefined instruction, the hidden instructions of the target processor can be screened out.

[0058] In the above embodiment, first, a list of instructions to be tested is generated according to the instruction format of the target processor, then the list of instructions to be tested is disassembled, and an undefined instruction list including hidden instructions of the target processor is determined according to the disassembly result, and finally, the execution result of the target processor on the undefined instruction list is obtained, and the hidden instruction is determined according to the execution result. In this way, the instruction format of the target processor is identified, the list of instructions to be tested is generated, and then the list of instructions to be tested is disassembled, the list of undefined instructions is screened out, and the execution result of the target processor on the undefined instruction list is obtained to obtain the hidden instruction. In this way, the entire instruction space does not need to be traversed when generating the list of instructions to be tested, which improves the efficiency of hidden instruction identification.

[0059] In an embodiment of the present application, the above step 101 can be performed as follows: Figure 3 As shown, including:

[0060] Step 301, determining the instruction code length according to the instruction format of the target processor.

[0061] According to the above Figure 2 In the instruction format, the instruction code length of the target processor includes the sum of the opcode field and the fixed value field.

[0062] Step 302, traverse and generate an instruction code list according to the instruction code length.

[0063] According to the length of the instruction code, multiple instruction codes in binary format are generated by traversing, and the multiple instruction codes in binary format constitute an instruction code list. For example, for the sake of convenience, taking the instruction code length of 3 as an example, the multiple instruction codes in binary format generated by traversing are 000, 001, 010, 011, 100, 101, 110, 111, and the above instruction codes in binary format constitute an instruction code list.

[0064] Step 303, determining a list of commands to be tested according to the command code list and a preset command database.

[0065] The preset instruction database is constructed according to the public instruction set document of the target processor, and the instruction database may contain all known instruction information, including the condition field, operand field, opcode field, fixed value field, assembly information, and instruction type of each public instruction. The instruction codes in the instruction code list generated by the above traversal may be public instructions or undefined instructions. According to the preset instruction database, each instruction code in the instruction code list is matched to determine the type of the instruction code, filter out the instruction code in the instruction code list that needs to be further processed, and obtain complete instructions, thereby obtaining the instruction list to be tested.

[0066] Optional, such as Figure 4 As shown, the steps of matching and determining the list of instructions to be tested according to the instruction database include:

[0067] Step 401 : For each instruction code in the instruction code list, match each instruction code with an instruction database to obtain a matching result corresponding to each instruction code.

[0068] Among them, each instruction code in the instruction code list is matched with the instruction database in turn, and the matching results may include whether the instruction code is an undefined instruction code, a regular instruction code, or a special instruction code. An undefined instruction code, that is, an instruction code that does not exist in the instruction database, may be used to construct a hidden instruction. For example, a regular instruction code is an instruction code that exists in the database, and at the same time, other fields in the instruction code have no fixed values, such as Figure 5 The special instruction code is the instruction code that exists in the database, but in addition to the instruction code field, other fields also have fixed values, such as Figure 6 The ABS instructions and Figure 7 The CCMATMPY instruction shown.

[0069] Step 402, determining a list of instructions to be tested according to the instruction codes of undefined instructions or special instructions indicated by the matching results.

[0070] In order to identify the hidden instructions of the target processor, the undefined instructions may include hidden instructions. Since other fields of special instructions also have fixed values, only the instruction code is traversed during traversal without traversing other fields. It is possible that some fixed values ​​of special instructions are hidden instructions. Therefore, the instruction to be tested is generated according to the instruction code of the undefined instruction whose matching result is generated, and the instruction to be tested is generated according to the instruction code of the special instruction whose matching result is generated. The above instructions to be tested are combined and deduplicated to obtain a list of instructions to be tested.

[0071] Optionally, in order to form a complete instruction, the operand field of the instruction code that matches an undefined instruction is padded with "0" according to the length of the operand, and the condition field is padded with "0" according to the length of the condition field. If the instruction code matches a special instruction, confirm the fixed position of the special instruction, traverse the fixed position according to the fixed value length, and padded with "0" in other positions to form a complete instruction. Figure 7 The characteristic instructions shown, for conditional execution instructions including fixed values, are traversed according to the length of the fixed values.

[0072] The above process of generating the list of instructions to be tested can be as follows: Figure 8 As shown, an instruction database is built for the public instruction set document of the target processor, and a targeted traversal is performed to generate instruction codes based on the length of the instruction codes, rather than a full-range traversal, which effectively compresses the search space, reduces redundancy, and improves generation efficiency. Then, the instruction database is matched, and undefined instructions are generated into instructions to be tested. At the same time, regular instructions and special instructions are distinguished, and special instructions whose other fields also include fixed values ​​are processed separately. The fixed value position of the special instructions is confirmed, and the instructions to be tested are generated after traversal according to the fixed value length. Based on the above instructions to be tested, a list of instructions to be tested is obtained, which takes special instructions into consideration, improves the instruction generation coverage, and prevents the omission of hidden instructions.

[0073] In one embodiment, the instruction list to be tested is disassembled, and the step of determining the undefined instruction list according to the disassembly result is as follows: Fig. 9 As shown, including:

[0074] Step 901 , for each instruction to be tested in the instruction to be tested list, disassemble each instruction to be tested according to the instruction database to obtain a disassembly result corresponding to each instruction to be tested.

[0075] At present, the main disassembly tools for DSP processors are the disassembler that comes with the DSP development environment Code Composer Studio (CCS) and the general disassembly tool IDA Pro. However, due to the complexity of the instruction set, incomplete support or architectural differences, these two tools cannot accurately disassemble all instructions according to the rules in the official reference manual. Therefore, according to the instruction database generated by the instruction set of the target processor, each instruction to be tested in the instruction list to be tested is disassembled in turn, and matched with the instruction information stored in the instruction database through the linear method or table lookup method. If the match is successful, it means that the instruction to be tested is legal, that is, the disassembly processing of the instruction to be tested is successful. If the match is unsuccessful, the disassembly processing result of the instruction to be tested is unsuccessful, and the instruction to be tested is marked as an undefined instruction.

[0076] Step 902, determining an undefined instruction list according to the instruction to be tested that was not successfully disassembled as indicated by the disassembly processing result.

[0077] After each instruction to be tested in the instruction list to be tested is matched in sequence, an undefined instruction list is generated according to all the instructions to be tested whose disassembly results are unsuccessful. Optionally, the disassembly process of the instruction list to be tested can be as follows: Fig.10 shown.

[0078] In the above embodiment, according to the instruction database, the public instructions in the target processor instruction set can be accurately disassembled, thereby realizing accurate detection of undefined instructions.

[0079] In one embodiment, the execution result of the target processor on the undefined instruction list is obtained, such as Fig.11 As shown, including:

[0080] Step 1101, establish a communication connection with a target processor through the simulator, and send an undefined instruction list and a target program to the target processor.

[0081] Since hidden instructions are instructions that can be recognized and executed by the target processor, on the contrary, illegal instructions cannot be recognized and executed by the target processor, therefore, by using this feature, running tests on the undefined instruction list can identify hidden instructions from the undefined instruction list.

[0082] Optionally, the target program can be an automated test script, for example, the Debug Server Scripting (DSS) function is used to write an automated test script. DSS provides the ability to interact with the CCS basic debugging engine Debug Server, including configuring the debugging environment, starting and stopping debugging sessions, loading programs to the target processor, setting breakpoints in the program, etc.

[0083] Among them, the terminal connects to the target processor through the emulator, stores the undefined instruction list that needs to be screened in the free area of ​​the memory of the target processor, and sends the target program to the target server so that the target processor can execute the instructions in the undefined instruction list according to the target program and obtain the execution result of the undefined instruction list.

[0084] Step 1102, receiving the execution result returned by the target processor.

[0085] Receive the execution result of each undefined instruction in the undefined instruction list executed by the target processor, and determine the type of the undefined instruction according to the execution result of each undefined instruction. Since illegal instructions cannot be executed by the target processor, hidden instructions can be executed by the target processor. Therefore, if the execution result of the target instruction is successful, it is determined that the target instruction is a hidden instruction.

[0086] Optionally, the execution process of the target program may include:

[0087] (1) Set the value of the program counter (PC) to the address of the first instruction to be tested in the list of undefined instructions.

[0088] (2) Set up an exception interrupt service routine to return to the scene when an exception occurs during instruction execution.

[0089] (3) Send a single-step run command to execute each instruction to be tested step by step.

[0090] (4) Check the value of PC after single-step running to determine whether the instruction is executed and the length of the executed instruction; if PC+1 after execution, it means that the machine code of the instruction to be tested is recognized as a 16-bit instruction; if PC+2 after execution, it means that the machine code of the instruction to be tested is recognized as a 32-bit instruction; if it is other cases, it means that the above-mentioned instruction to be tested cannot be recognized and executed by the target processor and is an illegal instruction, and the program jumps to the abnormal interrupt service routine.

[0091] (5) Record the test results and identify hidden instructions and illegal instructions based on the execution results.

[0092] (6) Repeat the above steps until all instructions in the undefined instruction list are traversed.

[0093] Through the above instruction recognition method, the experimental test of DSP chip TMS320F28335 is taken as an example. According to the above instruction method, a total of 3342 undefined instructions are generated, and an undefined instruction list is obtained. The target program, namely the DSS script program, is written to automatically test these undefined instruction lists, and 5 hidden instructions are successfully identified from the 3342 undefined instruction lists.

[0094] In the above embodiment, the undefined instruction list is automatically tested by writing the target program using the debugging service script DSS, and the hidden instructions are identified according to the increase of the PC pointer address during execution. This is applicable to all types of DSP processors, thereby improving the applicability and practicality of the instruction identification method.

[0095] In the embodiments of the present application, Fig.12 FIG. 1 is a schematic diagram of the instruction recognition method proposed in this application, and the steps include:

[0096] Step 1201, determine the instruction code length according to the instruction format of the target processor.

[0097] Step 1202, traverse and generate an instruction code list according to the instruction code length.

[0098] Step 1203, determining a list of instructions to be tested according to the instruction code list and a preset instruction database.

[0099] Step 1204 , for each instruction to be tested in the list of instructions to be tested, disassemble each instruction to be tested according to the instruction database to obtain a disassembly result corresponding to each instruction to be tested.

[0100] Step 1205 , determining an undefined instruction list according to the instruction to be tested that was not successfully disassembled as indicated by the disassembly processing result.

[0101] Step 1206, obtaining the execution result of the target processor on the undefined instruction list, and determining the hidden instructions of the target processor according to the execution result.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides an instruction recognition device for implementing the instruction recognition method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more instruction recognition device embodiments provided below can refer to the limitations of the instruction recognition method above, and will not be repeated here.

[0104] In an exemplary embodiment, Fig.13 As shown, an instruction recognition device 1300 is provided, comprising: a generation module, a first determination module and a second determination module, wherein:

[0105] A generation module, used for generating a list of instructions to be tested according to the instruction format of the target processor;

[0106] A first determination module is used to perform a disassembly process on the instruction list to be tested, and determine an undefined instruction list according to the disassembly process result;

[0107] The second determination module is used to obtain the execution result of the target processor on the undefined instruction list, and determine the hidden instruction according to the execution result.

[0108] In one embodiment, the generation module is specifically used to determine the instruction code length according to the instruction format of the target processor; traverse and generate an instruction code list according to the instruction code length; and determine the instruction list to be tested according to the instruction code list and a preset instruction database.

[0109] In one embodiment, the generation module is specifically used to match each instruction code in the instruction code list with the instruction database to obtain a matching result corresponding to each instruction code; and determine the instruction list to be tested based on the instruction code indicated as an undefined instruction or a special instruction by the matching result.

[0110] In one of the embodiments, the first determination module is specifically used to disassemble each instruction to be tested in the instruction list to be tested according to the instruction database to obtain the disassembly processing result corresponding to each instruction to be tested; and determine the undefined instruction list according to the instruction to be tested that the disassembly processing result indicates that the disassembly is unsuccessful.

[0111] In one of the embodiments, the second determination module is specifically used to establish a communication connection with the target processor through the emulator, and send the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program and obtains the execution result of the undefined instruction list; and receives the execution result returned by the target processor.

[0112] In one embodiment, the second determination module is specifically configured to determine that the target instruction is a hidden instruction if the execution result of the target instruction is successful.

[0113] Each module in the above instruction recognition device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0114] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.14As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an instruction recognition method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0115] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0116] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: generating a list of instructions to be tested according to the instruction format of a target processor; disassembling the list of instructions to be tested, and determining an undefined instruction list according to the disassembly result; obtaining the execution result of the target processor on the undefined instruction list, and determining the hidden instructions of the target processor according to the execution result.

[0117] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining the instruction code length according to the instruction format of the target processor; traversing and generating an instruction code list according to the instruction code length; and determining the instruction list to be tested according to the instruction code list and a preset instruction database.

[0118] In one embodiment, when the processor executes the computer program, the following steps are also implemented: for each instruction code in the instruction code list, each instruction code is matched with the instruction database to obtain a matching result corresponding to each instruction code; based on the instruction code indicated as an undefined instruction or a special instruction by the matching result, a list of instructions to be tested is determined.

[0119] In one embodiment, when the processor executes the computer program, the following steps are also implemented: for each instruction to be tested in the instruction list to be tested, each instruction to be tested is disassembled according to the instruction database to obtain the disassembly processing result corresponding to each instruction to be tested; according to the disassembly processing result indicating the instruction to be tested that failed to be disassembled, an undefined instruction list is determined.

[0120] In one embodiment, when the processor executes the computer program, the following steps are also implemented: establishing a communication connection with the target processor through the emulator, and sending the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program and obtains the execution result of the undefined instruction list; receiving the execution result returned by the target processor.

[0121] In one embodiment, when the processor executes the computer program, the following steps are further implemented: if the execution result of the target instruction is successful, then the target instruction is determined to be a hidden instruction.

[0122] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: generating a list of instructions to be tested according to the instruction format of a target processor; disassembling the list of instructions to be tested, and determining an undefined instruction list according to the disassembly result; obtaining the execution result of the target processor on the undefined instruction list, and determining the hidden instructions of the target processor according to the execution result.

[0123] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the instruction code length according to the instruction format of the target processor; traversing and generating an instruction code list according to the instruction code length; and determining the instruction list to be tested according to the instruction code list and a preset instruction database.

[0124] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: for each instruction code in the instruction code list, each instruction code is matched with the instruction database to obtain a matching result corresponding to each instruction code; based on the instruction code indicated as an undefined instruction or a special instruction by the matching result, a list of instructions to be tested is determined.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: for each instruction to be tested in the instruction list to be tested, each instruction to be tested is disassembled according to the instruction database to obtain the disassembly processing result corresponding to each instruction to be tested; based on the instruction to be tested that the disassembly processing result indicates that the disassembly is unsuccessful, an undefined instruction list is determined.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: establishing a communication connection with the target processor through the emulator, and sending the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program and obtains the execution result of the undefined instruction list; receiving the execution result returned by the target processor.

[0127] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the execution result of the target instruction is successful, then determining that the target instruction is a hidden instruction.

[0128] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the following steps: generating a list of instructions to be tested according to the instruction format of a target processor; disassembling the list of instructions to be tested, and determining an undefined instruction list according to the disassembly result; obtaining an execution result of the target processor on the undefined instruction list, and determining the hidden instructions of the target processor according to the execution result.

[0129] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the instruction code length according to the instruction format of the target processor; traversing and generating an instruction code list according to the instruction code length; and determining the instruction list to be tested according to the instruction code list and a preset instruction database.

[0130] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: for each instruction code in the instruction code list, each instruction code is matched with the instruction database to obtain a matching result corresponding to each instruction code; based on the instruction code indicated as an undefined instruction or a special instruction by the matching result, a list of instructions to be tested is determined.

[0131] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: for each instruction to be tested in the instruction list to be tested, each instruction to be tested is disassembled according to the instruction database to obtain the disassembly processing result corresponding to each instruction to be tested; based on the instruction to be tested that the disassembly processing result indicates that the disassembly is unsuccessful, an undefined instruction list is determined.

[0132] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: establishing a communication connection with the target processor through the emulator, and sending the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program and obtains the execution result of the undefined instruction list; receiving the execution result returned by the target processor.

[0133] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the execution result of the target instruction is successful, then determining that the target instruction is a hidden instruction.

[0134] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0135] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0136] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0137] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for instruction recognition, characterized in that: The method comprises: Generate a list of instructions to be tested according to the instruction format of the target processor; Performing a disassembly process on the instruction list to be tested, and determining an undefined instruction list according to the disassembly process result; Obtain an execution result of the target processor on the undefined instruction list, and determine the hidden instructions of the target processor according to the execution result.

2. The method according to claim 1, characterized in that The step of generating a list of instructions to be tested according to the instruction format of the target processor includes: Determining the instruction code length according to the instruction format of the target processor; According to the length of the instruction code, traverse and generate an instruction code list; The command list to be tested is determined according to the command code list and a preset command database.

3. The method according to claim 2, characterized in that Determining the command list to be tested according to the command code list and a preset command database includes: For each instruction code in the instruction code list, matching each instruction code with the instruction database to obtain a matching result corresponding to each instruction code; The list of instructions to be tested is determined according to the instruction code indicated as an undefined instruction or a special instruction by the matching result.

4. The method according to claim 2, characterized in that: The performing disassembly processing on the instruction list to be tested and determining the undefined instruction list according to the disassembly processing result includes: For each instruction to be tested in the list of instructions to be tested, disassembly processing is performed on each instruction to be tested according to the instruction database to obtain a disassembly processing result corresponding to each instruction to be tested; The undefined instruction list is determined according to the instruction to be tested that is not successfully disassembled as indicated by the disassembly processing result.

5. The method according to claim 1, characterized in that The obtaining the execution result of the target processor on the undefined instruction list includes: Establishing a communication connection with the target processor through the simulator, and sending the undefined instruction list and the target program to the target processor, so that the target processor executes the instructions in the undefined instruction list according to the target program, and obtains the execution result of the undefined instruction list; Receive the execution result returned by the target processor.

6. The method according to claim 5, characterized in that The step of determining the hidden instruction of the target processor according to the execution result includes: If the execution result of the target instruction is successful, it is determined that the target instruction is a hidden instruction.

7. A command recognition device, characterized in that: The device comprises: A generation module, used for generating a list of instructions to be tested according to the instruction format of the target processor; A first determination module, configured to perform a disassembly process on the instruction list to be tested, and determine an undefined instruction list according to the disassembly process result; The second determination module is used to obtain the execution result of the target processor on the undefined instruction list, and determine the hidden instructions of the target processor according to the execution result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images