Firmware vulnerability detection method based on differential symbolic execution

Abstract

The invention discloses a firmware vulnerability detection method based on differential symbolic execution, and belongs to the technical field of vulnerability detection. The method comprises the following steps: acquiring firmware images of different configurations of the same equipment, acquiring firmware images in an image set, extracting executable binary files from the firmware images of different version numbers by using a firmware extraction tool, positioning changed code snippets in the binary files, filtering difference points irrelevant to a target vulnerability type, generating a difference list, and storing the difference list in a database; the difference points in the difference list are mapped into a symbolic execution engine, the marked difference points are subjected to priority ranking, a priority ranking set is established, a binary analysis test model is established, the difference points in the priority ranking set are obtained, differentiation analysis is carried out, and a differentiation analysis result is obtained; locating vulnerabilities according to the differentiation analysis result to generate a vulnerability report. According to the method, potential vulnerabilities and security problems can be found more quickly and accurately, unnecessary analysis work is reduced, and powerful support is provided for security protection of equipment.

Description

Technical Field

[0001] The present invention belongs to the technical field of vulnerability detection, and in particular relates to a firmware vulnerability detection method based on differentiated symbolic execution. Background Art

[0002] With the rapid popularization of Internet of Things (IoT) devices, many embedded systems such as routers, smart home appliances, and industrial controllers have become an indispensable part of network architecture. Such devices generally run dedicated or customized firmware to meet specific functional requirements. However, due to the tight firmware development cycle, high frequency of software updates, and limited hardware resources, there are often potential security risks in the firmware, such as buffer overflows, integer overflows, format string vulnerabilities, and memory out-of-bounds reads and writes. Once these vulnerabilities are maliciously exploited, they will seriously threaten the security and stability of the device and its network, causing user privacy leaks, system paralysis, and even larger-scale network attacks.

[0003] The firmware of devices such as routers and smart gateways often integrates multiple functional modules, such as network management, protocol stacks, and Web servers. These modules interact with each other through system calls, shared libraries, or message mechanisms. Traditional single static analysis methods are difficult to fully simulate the behavior of firmware during real runtime; and using only dynamic analysis methods may be limited by the difficulty of setting up the operating environment, hardware differences, or simulator compatibility, making it difficult to cover key functional paths.

[0004] Symbolic execution can realize automated vulnerability mining to a certain extent by treating program input as symbolic variables, executing along the branch path of the program and collecting constraints. However, as the number of branches increases, symbolic execution will face a serious "path explosion" phenomenon: the number of branches increases exponentially, resulting in a rapid surge in analysis time and resource requirements, making the overall analysis of large-scale firmware unfeasible. Summary of the invention

[0005] Purpose of the invention: To provide a firmware vulnerability detection method based on differentiated symbolic execution, which solves the above-mentioned problems existing in the prior art.

[0006] Technical solution: A firmware vulnerability detection method based on differentiated symbolic execution, comprising the following steps: Get firmware images of different configurations of the same device and mark the firmware images according to their version numbers. bin 1 , bin 2 ,……, bin x Create an image set; Obtain the firmware images in the image set, use the firmware extraction tool to extract the executable binary files from the firmware images with different version numbers, locate the changed code fragments in the binary files, filter the differences that are not related to the target vulnerability type, and generate a difference list; Mark the difference points in the difference list as difference point 1, difference point 2, ..., difference point x After that, it is mapped to the symbolic execution engine, and the marked difference points are prioritized to establish a priority set according to the path priority preset in the symbolic execution engine; Add a difference perception module and dynamically adjust the path scheduling to the existing binary analysis framework to build a binary analysis test model, obtain the difference points in the priority sorting set, perform differential analysis to obtain differential analysis results, locate vulnerabilities based on the differential analysis results, generate vulnerability reports, and archive the branch paths of vulnerability scenarios or difference points; After completing the constraint set archive, check whether the corresponding POC Input or flow, verify the authenticity and triggerability of the vulnerability, and automatically generate the corresponding POC Input or traffic determines whether the vulnerability is real and can be triggered, otherwise it cannot be triggered.

[0007] Preferably, the process of filtering differences that are not related to the target vulnerability type is as follows: First, obtain at least two binary files with different version numbers, and mark the binary programs in the binary files according to the serial numbers. P 1 , P 2 ……、 P x , where the binary program P 1 It contains a set of basic blocks B 1i , binary program P 2 It contains a set of basic blocks B 2i , calculate the basic block by formula (1) B 1i and basic blocks B 2i The hash value of , where formula (1) is as follows: (1); Where: h Represents a hash value; P x Indicates the binary version number; i Indicates the index of the basic block; Identify the difference basic blocks based on the calculated hash value ΔB ,when ΔB={B 2i ∈P_2|h(B 2i )∉{h (B 1i )}} , then the version P 2 The basic blocks in B 2i The hash value in the version P 1 does not exist in , indicating that the basic block is newly added or modified; Filter function that exploits the target vulnerability type F , the identified difference basic blocks ΔB Screening differences ΔB c , and its calculation formula is as follows: (2).

[0008] Preferably, after the difference points are screened, the difference points are classified according to the type of the basic block, and a difference list is generated, which at least includes the location, type and impact range of the difference points.

[0009] Preferably, the difference point priority sorting process is as follows: The basic blocks corresponding to the difference points are assigned high-level priority tags, and the weight of the high-level priority tags is adjusted as the priority weight according to the importance of the difference points, that is, the basic blocks corresponding to the difference points are assigned priority tags from high to low according to importance, secondary importance and universality; The basic blocks corresponding to the indifference points are assigned delay tags.

[0010] Preferably, the difference point priority allocation process is as follows: Pre-assign priority values ​​to the corresponding paths π of the basic blocks Priority ( π ), based on the path π Whether to include differences and their importance w ( B Pxi ), and the pre-assigned priority value is calculated by formula (3) Priority (π) is calculated: (3); Where: I(B Pxi ∈ ΔBc ) represents the indicator function, when B Pxi If it is a difference basic block, it is 1, otherwise it is 0; w (B Pxi ) represents a difference basic block B Pxi The importance weight of .

[0011] Preferably, the process of mapping the difference points to the symbolic execution engine is as follows: The position of the difference point in the binary is mapped to the corresponding node or basic block in the symbolic execution engine, and the binary analysis test model is used to perform difference-guided symbolic execution on the difference point. The process is as follows: Get the difference basic block B Pxi , given the mapping relationship M , the corresponding node of each difference basic block in the symbolic execution engine is N i ,Right now M(B) Pxi ）=N i ; Merge or process the corresponding intermediate representation nodes to obtain the final intermediate representation node N ,Right now M (ΔB) = N , that is, the difference basic block ΔB Mapping to the intermediate representation nodes of the symbolic execution engine N .

[0012] Preferably, the difference-guided symbolic execution process is as follows: Based on the binary analysis test model, in the initial stage, a new path branch is generated according to conventional symbolic execution, and a judgment is made as to whether the new path branch contains a difference mark. If the new path branch contains a difference mark, the new path branch is inserted into the priority queue and its constraints are solved first; otherwise, it is put into the ordinary queue to complete the path priority scheduling; After completing the path priority scheduling, obtain the number of branch nodes in the new path branch, merge the path states with similar or identical constraints, merge or prune the low-priority paths based on the threshold, obtain the new path and establish the optimized branch set Q, add a vulnerability detection assertion at the call of each branch path in the optimized branch set, and when the vulnerability detection assertion meets the trigger condition, record the vulnerability and terminate the execution of the branch path.

[0013] Preferably, during path priority scheduling, a priority function is preset to quantify the importance of the new path, and during symbolic execution, the new path is selected for execution in descending order of priority, wherein the priority function formula is as follows: P ( Q j ) = ω 1 "d" ( Q j ) + oh 2 "k" ( Q j ) − oh 3 «c ( Q j ) Where: Q j Represents a new path in symbolic execution; d ( Q j ) represents the difference perception; k ( Q j ) represents the risk / vulnerability measure; c ( Q j ) represents the cost or complexity of the path; oh 1, oh 2, oh 3 is an adjustable weight used to balance the impact of difference perception, risk level and execution cost; Differentiated symbolic execution is used to determine path merging and pruning, and a similarity function is defined to evaluate the degree of overlap between two paths in terms of constraints or states. The similarity function formula is as follows:

[0014] Where: C( P xi ) indicates the path P xi The constraint set of S( P xi , P （x+1）i ) has a value range of [0,1]; the closer the value is to 1, the P xi and P （x+1）i The more similar the constraints are; Preferably, when incremental analysis of differences after version iteration is performed in an incremental manner, the savings effect is quantified using a repetition analysis rate indicator, wherein the repetition analysis rate calculation formula is as follows:

[0015] Where: bin x Represents the set of paths that have been explored during the analysis of the previous version; P x Represents the set of all potential paths to be explored when analyzing a new version; | bin x ∩ P x|Indicates the number of overlaps between the new and old version paths.

[0016] Preferably, multiple objectives are used to cover the difference areas and vulnerabilities after version iteration. During execution, the target framework includes at least the total number of paths, analysis time, difference coverage, and vulnerability discovery rate. The target is calculated by maximizing the coverage of the difference areas, vulnerabilities, and execution time through formula (4). Formula (4) is as follows: (4); Where: A represents the scheduling algorithm or “execution policy” for symbolic execution; D ( A ) represents the difference coverage under this strategy; VulnFound ( A ) represents the number of vulnerabilities or vulnerability coverage found in the test set; Time ( A ) represents the total analysis time or resource consumption of the strategy; α , β , c It is an adjustable parameter that comprehensively measures the balance between difference coverage, vulnerability discovery effect, and analysis cost.

[0017] Beneficial effects: The present invention relates to a firmware vulnerability detection method based on differential symbolic execution, which obtains multiple versions of firmware images in the firmware, extracts the difference points in the binary files in the firmware images, and reduces the paths that are irrelevant or repeated to the vulnerabilities through differential path scheduling and pruning, thereby reducing the amount of symbolic execution calculation and shortening the analysis time; Secondly, on the basis of the existing symbolic execution framework, we add difference perception to build a binary analysis test model, which can obtain difference points, cooperate with symbolic execution, analyze the difference increments after version iteration, and use the target framework calculation target to maximize the difference area, vulnerability coverage and execution time. Calculate, verify the authenticity and triggerability of the vulnerability and generate a report. When there are multiple versions of firmware images, it can more quickly and accurately discover potential vulnerabilities and security issues, while reducing unnecessary analysis work, providing strong support for the security protection of equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a system block diagram of the present invention; Figure 2 Extract the block diagram of the difference points of the present invention; Figure 3 This is a block diagram of the priority sorting of the differences of the present invention. DETAILED DESCRIPTION

[0019] like Figure 1 to Figure 3As shown, the present invention provides a technical solution: a firmware vulnerability detection method based on differentiated symbolic execution, comprising the following steps: Get firmware images of different configurations of the same device and mark the firmware images according to their version numbers. bin 1 , bin 2 ,……, bin x Establish an image set, obtain the firmware image in the image set, use the firmware extraction tool to extract the executable binary file from the firmware image with different version numbers, and locate the changed code fragment in the binary file. In this embodiment, use the binary diff Analysis or abstract syntax tree level matching is performed to locate code snippets that have changed at the function, basic block, or instruction level in the binary file. Differences that are not related to the target vulnerability type are filtered out through optional static analysis to obtain the final key differences and generate a list of differences. The process of filtering differences that are not related to the target vulnerability type is as follows: First, obtain at least two binary files with different version numbers, and mark the binary programs in the binary files according to the serial numbers. P 1 , P 2 ……、 P x , where the binary program P 1 It contains a set of basic blocks B 1i , binary program P 2 It contains a set of basic blocks B 2i , calculate the basic block by formula (1) B 1i and basic blocks B 2i The hash value of , where formula (1) is as follows: (1); Where: h Represents a hash value; P x Indicates the binary version number; i Indicates the index of the basic block; Identify the difference basic blocks based on the calculated hash value ΔB ,when ΔB={B 2i ∈P_2|h(B 2i )∉{h (B 1i)}} , then the version P 2 The basic blocks in B 2i The hash value in the version P 1 does not exist, indicating that the basic block is newly added or modified. After the difference list is generated, the difference points in the difference list are marked as difference point 1, difference point 2, ..., difference point x After that, it is mapped to the symbolic execution engine, and the marked difference points are prioritized to establish a priority set according to the path priority preset in the symbolic execution engine; Then, a difference perception module and a dynamically adjusted path scheduling are added to the existing binary analysis framework to build a binary analysis test model, the difference points in the priority sorting set are obtained, and differential analysis is performed to obtain differential analysis results. The vulnerability is located based on the differential analysis results to generate a vulnerability report, and the branch paths of the vulnerability scenarios or difference points are archived at the same time; by obtaining multiple versions of firmware images in the firmware, the difference points in the binary files in the firmware images are extracted, and through differential path scheduling and pruning, the paths that are irrelevant to the vulnerability or repeated are reduced, thereby reducing the amount of symbolic execution calculation and shortening the analysis time. Secondly, on the basis of the existing symbolic execution framework, difference perception is added to build a binary analysis test model, which can obtain difference points, cooperate with symbolic execution, and analyze the difference increments after version iteration, and use the target framework calculation target to maximize the calculation of the difference area, vulnerability coverage and execution time, verify the authenticity and triggerability of the vulnerability and generate a report.

[0020] After completing the constraint set archive, check whether the corresponding POC Input or flow, verify the authenticity and triggerability of the vulnerability, and automatically generate the corresponding POC Input or traffic can determine whether the vulnerability is real and triggerable, otherwise it cannot be triggered. When there are multiple versions of firmware images, potential vulnerabilities and security issues can be discovered more quickly and accurately, while reducing unnecessary analysis work, providing strong support for the security protection of the device.

[0021] In a further embodiment, the process of filtering differences irrelevant to the target vulnerability type is as follows: First, obtain at least two binary files with different version numbers, and mark the binary programs in the binary files according to the serial numbers. P 1 , P 2 ……、 P x , where the binary program P 1 It contains a set of basic blocks B1i , binary program P 2 It contains a set of basic blocks B 2i , calculate the basic block by formula (1) B 1i and basic blocks B 2i The hash value of is used to identify and compare the basic blocks and identify the difference basic blocks, where formula (1) is as follows: (1); Where: h Represents a hash value; P x Indicates the binary version number; i Indicates the index of the basic block; Identify the difference basic blocks based on the calculated hash value ΔB ,when ΔB={B 2i ∈P_2|h(B 2i )∉{h (B 1i )}} , then the version P 2 The basic blocks in B 2i The hash value in the version P 1 If it does not exist, it means that the basic block is newly added or modified. For fine-grained difference monitoring, compare each instruction one by one to locate the changes of specific instructions; Filter function that exploits the target vulnerability type F , the identified difference basic blocks ΔB Screening differences ΔB c , and its calculation formula is as follows: (2) After completing the difference point screening, the difference points are classified according to the type of basic block and a difference list is generated. The difference list includes at least the location, type and impact range of the difference point, which is used for subsequent symbolic execution guidance.

[0022] In a further embodiment, the difference point prioritization process is as follows: The basic blocks corresponding to the difference points are assigned high-level priority tags, where the difference point priority assignment process is as follows: Pre-assign priority values ​​to the corresponding paths π of the basic blocks Priority ( π ), based on the path π Whether to include differences and their importancew ( B Pxi ), and the pre-assigned priority value is calculated by formula (3) Priority (π) is calculated: (3); Where: I(B Pxi ∈ ΔBc ) represents the indicator function, when B Pxi If it is a difference basic block, it is 1, otherwise it is 0; w ( B Pxi ) represents a difference basic block B Pxi The importance weight refers to the relative importance of the difference basic block in the entire vulnerability detection, which is determined by the nature of the difference basic block, the impact on the vulnerability or the potential risk. The importance weight is used to reflect the influence of the difference basic block on the detection result. According to the importance of the difference point, the weight of the high-level priority mark is adjusted as the priority weight. Therefore, the priority weight is allocated based on the basic blocks corresponding to the difference points, which are sorted from high to low according to importance, secondary importance and universality. That is, according to the importance of the difference point, the priority weight is adjusted, which can affect how the corresponding difference basic blocks are selected and processed during the symbolic execution process. Therefore, the priority is adjusted according to the influence of the difference basic block and the risk of the vulnerability, and the basic blocks corresponding to the indifferent points are given delay marks or delay processing marks. By performing delay, merging or pruning operations on paths that do not contain difference points or are significantly irrelevant, it is achieved to reduce invalid exploration and unnecessary analysis work.

[0023] In a further embodiment, the process of mapping the difference points into the symbolic execution engine is as follows: The position of the difference point in the binary is mapped to the corresponding node or basic block in the symbolic execution engine, and the binary analysis test model is used to perform difference-guided symbolic execution on the difference point. The process is as follows: Get the difference basic block B Pxi , given the mapping relationship M , the corresponding node of each difference basic block in the symbolic execution engine is N i ,Right now M(B) Pxi ）=N i ; Merge or process the corresponding intermediate representation nodes to obtain the final intermediate representation node N ,Right now M (ΔB) = N , that is, the difference basic block ΔBMapping to the intermediate representation nodes of the symbolic execution engine N , handles mapping issues caused by different compiler optimization levels and binary relocation to ensure accuracy.

[0024] In a further embodiment, the difference-guided symbolic execution process is as follows: Based on the binary analysis test model, in the initial stage, a new path branch is generated according to conventional symbolic execution, and a judgment is made as to whether the new path branch contains a difference mark. If the new path branch contains a difference mark, the new path branch is inserted into the priority queue and its constraints are solved first; otherwise, it is put into the ordinary queue to complete the path priority scheduling; After completing the path priority scheduling, obtain the number of branch nodes in the new path branch, merge the path states with similar or identical constraints, merge or prune the low-priority paths based on the threshold, obtain the new path and establish the optimized branch set Q, add a vulnerability detection assertion at the call of each branch path in the optimized branch set, and when the vulnerability detection assertion meets the trigger condition, record the vulnerability and terminate the execution of the branch path.

[0025] When scheduling paths with priority, the preset priority function quantifies the importance of the new path, and during symbolic execution, the new path is selected for execution from the highest priority to the lowest priority. The priority function formula is as follows: P ( Q j ) = ω 1 "d" ( Q j ) + oh 2 "k" ( Q j ) − oh 3 «c ( Q j ) Where: Q j Represents a new path in symbolic execution; d ( Q j ) represents the difference perception; k ( Q j ) represents the risk / vulnerability measure; c ( Q j ) represents the cost or complexity of the path; oh 1, oh 2, oh3 is an adjustable weight, which is used to balance the influence of difference perception, risk and execution cost. In the scheduling queue, the priority function is calculated for the new path, and the path with the largest Π value is preferentially selected for the next symbolic execution or constraint solving. The scheduling can be completed through multi-angle scheduling strategies such as difference priority and risk priority.

[0026] Differentiated symbolic execution is used to determine path merging and pruning, and a similarity function is defined to evaluate the degree of overlap between two paths in terms of constraints or states. The similarity function formula is as follows:

[0027] Where: C( P xi ) indicates the path P xi The constraint set of S( P xi , P （x+1）i ) has a value range of [0,1]; the closer the value is to 1, the P xi and P （x+1）i The more similar the constraints are, the more similar the paths are. This can significantly reduce the repeated solution of symbolic execution on similar paths.

[0028] When incremental analysis is performed on the differences after version iteration, the savings effect is quantified using the repeated analysis rate indicator, where the repeated analysis rate calculation formula is as follows:

[0029] Where: bin x Represents the set of paths that have been explored during the analysis of the previous version; P x Represents the set of all potential paths to be explored when analyzing a new version; | bin x ∩ P x | indicates the number of overlapping paths between the new and old versions. That is, when the repeated analysis rate is closer to 1, it means that the paths in the new version are highly similar to those in the old version. Incremental execution can greatly reduce the amount of repeated analysis.

[0030] When multiple targets are selected to cover the difference areas and vulnerabilities after version iteration, during execution, the target framework includes at least the total number of paths, analysis time, difference coverage, and vulnerability discovery rate. The target is calculated by maximizing the coverage of difference areas, vulnerabilities, and execution time through formula (4). Formula (4) is as follows: (4); Where: A represents the scheduling algorithm or “execution policy” for symbolic execution; D ( A ) represents the difference coverage under this strategy; VulnFound ( A ) represents the number of vulnerabilities or vulnerability coverage found in the test set; Time ( A ) represents the total analysis time or resource consumption of the strategy; α , β , c It is an adjustable parameter that comprehensively measures the balance between difference coverage, vulnerability discovery effect, and analysis cost, so as to maximize the coverage of difference areas and vulnerabilities while shortening the execution time.

[0031] The preferred embodiments of the present invention are described in detail above; however, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all belong to the protection scope of the present invention.

Claims

1. A firmware vulnerability detection method based on differentiated symbolic execution, characterized in that: The following steps are involved: Get firmware images of different configurations of the same device and mark the firmware images according to their version numbers. bin 1 , bin 2 ,……, bin x Create an image set; Obtain the firmware images in the image set, use the firmware extraction tool to extract the executable binary files from the firmware images with different version numbers, locate the changed code fragments in the binary files, filter the differences that are not related to the target vulnerability type, and generate a difference list; Mark the difference points in the difference list as difference point 1, difference point 2, ..., difference point x After that, it is mapped to the symbolic execution engine, and the marked difference points are prioritized to establish a priority set according to the path priority preset in the symbolic execution engine; Add a difference perception module and dynamically adjust the path scheduling to the existing binary analysis framework to build a binary analysis test model, obtain the difference points in the priority sorting set, perform differential analysis to obtain differential analysis results, locate vulnerabilities based on the differential analysis results, generate vulnerability reports, and archive the branch paths of vulnerability scenarios or difference points; After completing the constraint set archive, check whether the corresponding POC Input or flow, verify the authenticity and triggerability of the vulnerability, and automatically generate the corresponding POC Input or traffic determines whether the vulnerability is real and can be triggered, otherwise it cannot be triggered.

2. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 1, characterized in that: The process of filtering out differences that are not related to the target vulnerability type is as follows: First, obtain at least two binary files with different version numbers, and mark the binary programs in the binary files according to the serial numbers. P 1 , P 2 ……、 P x , where the binary program P 1 Contains a set of basic blocks B 1i , binary program P 2 It contains a set of basic blocks B 2i , calculate the basic block by formula (1) B 1i and basic blocks B 2i The hash value of , where formula (1) is as follows: （1）； Where: h Represents a hash value; P x Indicates the binary version number; i Indicates the index of the basic block; Identify the difference basic blocks based on the calculated hash value ΔB ,when ∆B={B 2i ∈P_2|h(B 2i )∉{h(B 1i )}} , then the version P 2 The basic blocks in B 2i The hash value in the version P 1 does not exist in , indicating that the basic block is newly added or modified; Filter function that exploits the target vulnerability type F , the identified difference basic blocks ΔB Screening differences ΔB c , and its calculation formula is as follows: （2）。 3. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 2, characterized in that: After completing the screening of the difference points, the difference points are classified according to the type of the basic block, and a difference list is generated. The difference list at least includes the location, type and impact range of the difference points.

4. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 2, characterized in that: The process of prioritizing differences is as follows: The basic blocks corresponding to the difference points are assigned high-level priority tags, and the weight of the high-level priority tags is adjusted as the priority weight according to the importance of the difference points, that is, the basic blocks corresponding to the difference points are assigned priority tags from high to low according to importance, secondary importance and universality; The basic blocks corresponding to the indifference points are assigned delay tags.

5. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 4, characterized in that: The process of assigning priority to difference points is as follows: Pre-assign priority values ​​to the corresponding paths π of the basic blocks Priority ( π ), based on the path π Whether to include differences and their importance w ( B Pxi ), and the pre-assigned priority value is calculated by formula (3) Priority (π) is calculated: （3）； Where: I(B Pxi ∈ ΔBc ) represents the indicator function, when B Pxi If it is a difference basic block, it is 1, otherwise it is 0; w ( B Pxi ) represents a difference basic block B Pxi The importance weight of .

6. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 4, characterized in that: The process of mapping the difference points to the symbolic execution engine is as follows: The position of the difference point in the binary is mapped to the corresponding node or basic block in the symbolic execution engine, and the binary analysis test model is used to perform difference-guided symbolic execution on the difference point. The process is as follows: Get the difference basic block B Pxi , given the mapping relationship M , the corresponding node of each difference basic block in the symbolic execution engine is N i ,Right now M(B Pxi ）=N i ; Merge or process the corresponding intermediate representation nodes to obtain the final intermediate representation node N ,Right now M(ΔB)=N , that is, the difference basic block ΔB Mapping to the intermediate representation nodes of the symbolic execution engine N .

7. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 6, characterized in that: The difference-guided symbolic execution process is as follows: Based on the binary analysis test model, in the initial stage, a new path branch is generated according to conventional symbolic execution, and a judgment is made as to whether the new path branch contains a difference mark. If the new path branch contains a difference mark, the new path branch is inserted into the priority queue and its constraints are solved first; Otherwise, it is placed in the normal queue to complete the path priority scheduling; After completing the path priority scheduling, obtain the number of branch nodes in the new path branch, merge the path states with similar or identical constraints, merge or prune the low-priority paths based on the threshold, obtain the new path and establish the optimized branch set Q, add a vulnerability detection assertion at the call of each branch path in the optimized branch set, and when the vulnerability detection assertion meets the trigger condition, record the vulnerability and terminate the execution of the branch path.

8. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 7, characterized in that: In path priority scheduling, the preset priority function quantifies the importance of the new path, and in symbolic execution, the new path is selected for execution from the highest priority to the lowest priority. The priority function formula is as follows: Π ( Q j ) = ω 1« δ ( Q j ) + ω 2« κ ( Q j ) − ω 3« c ( Q j ) Where: Q j Represents a new path in symbolic execution; δ ( Q j ) represents the difference perception; κ ( Q j ) represents the risk / vulnerability measure; c ( Q j ) represents the cost or complexity of the path; ω 1, ω 2, ω 3 is an adjustable weight used to balance the impact of difference perception, risk level and execution cost; Differentiated symbolic execution is used to determine path merging and pruning, and a similarity function is defined to evaluate the degree of overlap between two paths in terms of constraints or states. The similarity function formula is as follows: Where: C ( P xi ) indicates the path P xi The set of constraints; S ( P xi , P （x+1）i ) has a value range of [0,1]; the closer the value is to 1, the P xi and P （x+1）i The more similar the constraints are.

9. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 7, characterized in that: When incremental analysis is performed on the differences after version iteration, the savings effect is quantified using the repeated analysis rate indicator, where the repeated analysis rate calculation formula is as follows: Where: bin x Represents the set of paths that have been explored during the analysis of the previous version; P x Represents the set of all potential paths to be explored when analyzing a new version; | bin x ∩ P x |Indicates the number of overlaps between the new and old version paths.

10. The firmware vulnerability detection method based on differentiated symbolic execution according to claim 7, characterized in that: Multi-objective coverage of the difference areas and vulnerabilities after version iteration is adopted. During execution, the target framework includes at least the total number of paths, analysis time, difference coverage, and vulnerability discovery rate. The target maximization of the coverage of the difference areas, vulnerabilities, and execution time is calculated by formula (4). Formula (4) is as follows: （4）； Where: A represents the scheduling algorithm or "execution strategy" for symbolic execution; D ( Alpha ) represents the difference coverage under this strategy; VulnFound ( Alpha ) represents the number of vulnerabilities or vulnerability coverage found in the test set; Time ( Alpha ) represents the total analysis time or resource consumption of the strategy; α , β , γ It is an adjustable parameter that comprehensively measures the balance between difference coverage, vulnerability discovery effect, and analysis cost.

Images