A model training and task execution method, device, storage medium and equipment

Abstract

The specification discloses a model training and task execution method, device, storage medium and equipment. The model training method comprises: obtaining advanced reduced instruction set (ARM) machine code and inputting a disassembly model, performing mask processing on part of instruction data contained in the ARM machine code to obtain first mask data, determining first features corresponding to the first mask data, and performing mask processing on at least part of data units contained in the instruction data to obtain second mask data and determine second features of the second mask data; determining predicted position information according to the first features, and predicting the data units masked in each instruction data according to the second features corresponding to each instruction data; and training the disassembly model according to the deviation between the predicted value and the actual value corresponding to the masked data units, and the deviation between the predicted position information and the actual position information corresponding to the masked instruction data.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and particularly relates to a model training and task execution method and device, a storage medium and equipment. BACKGROUND

[0002] In recent years, the Advanced RISC Machine (ARM) program architecture has gradually become the mainstream standard of mobile and embedded systems, and plays an increasingly important role in the fields of artificial intelligence, Internet of Things, intelligent driving, etc. In order to ensure the safety and reliability of the business, and to provide more comprehensive protection for private data, it is usually necessary to disassemble the machine code of the ARM architecture (ARM machine code), so as to obtain assembly code that can be understood by the developer, and through analysis of the assembly code, possible vulnerabilities and security risks in the code can be discovered and handled in a timely manner.

[0003] However, due to the complexity of the ARM architecture itself, the richness of the ARM instruction set, and the execution mechanism unique to the ARM architecture, the existing disassembly technology is difficult to accurately restore the actual assembly code corresponding to the ARM machine code, and the obtained assembly code has a large error, and the developer is difficult to accurately analyze the program code based on the assembly code obtained by the existing method.

[0004] Therefore, how to accurately disassemble the ARM machine code to ensure the safety and reliability of the program code is a problem to be solved. SUMMARY

[0005] The present specification provides a model training and task execution method, device, storage medium and equipment. By masking the training sample in multiple masking modes and training the model based on the masked data, the performance of the model is fully improved.

[0006] The present specification adopts the following technical solutions:

[0007] A model training method comprises:

[0008] An Advanced RISC Machine (ARM) machine code is obtained, the ARM machine code contains a plurality of instruction data, and the plurality of instruction data is executed in a predetermined logical execution order;

[0009] inputting the ARM machine code into a preset disassembly model, performing mask processing on at least part of instruction data contained in the ARM machine code by the disassembly model, obtaining first mask data according to the instruction data after mask processing and the instruction data without mask processing, determining feature representation corresponding to the first mask data as first feature, and performing mask processing on at least part of data units contained in each instruction data by the disassembly model to obtain second mask data corresponding to the instruction data, and determining feature representation of the second mask data corresponding to the instruction data as second feature corresponding to the instruction data;

[0010] inputting the first feature into a preset decoding model, so that the decoding model determines position information corresponding to the masked instruction data in the ARM machine code as predicted position information according to the first feature, and inputs the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts the masked data units in each instruction data according to the second feature corresponding to each instruction data to obtain a prediction value;

[0011] determining a target loss function according to deviation between the prediction value and actual value corresponding to the masked data units in each instruction data, and deviation between the predicted position information and actual position information corresponding to the masked instruction data in the ARM machine code, and training at least the disassembly model with minimizing the target loss function as an optimization target.

[0012] Optionally, the feature representation corresponding to the first mask data is determined, and specifically includes:

[0013] the feature representation corresponding to the first mask data is determined by a first feature extraction network arranged in the disassembly model.

[0014] Optionally, the feature representation of the second mask data corresponding to the instruction data is determined as the second feature corresponding to the instruction data, and specifically includes:

[0015] the feature representation of the second mask data corresponding to the instruction data is determined as the second feature corresponding to the instruction data by a second feature extraction network arranged in the disassembly model.

[0016] Optionally, for each instruction data, at least part of data units contained in the instruction data are processed by the disassembly model to obtain the second mask data corresponding to the instruction data, and specifically includes:

[0017] According to the preset mask proportion, at least part of data units contained in the instruction data are masked through the disassembly model to obtain second mask data corresponding to the instruction data.

[0018] Optionally, for each instruction data, at least part of data units contained in the instruction data are masked through the disassembly model to obtain second mask data corresponding to the instruction data, specifically including:

[0019] For each instruction data, according to the data type corresponding to the instruction data, a mask strategy corresponding to the instruction data is determined through the disassembly model.

[0020] According to the mask strategy corresponding to the instruction data, a field type corresponding to the data unit to be masked in the instruction data is determined as a target field type.

[0021] Data units of the instruction field belonging to the target field type in the instruction data are masked to obtain second mask data corresponding to the instruction data.

[0022] Optionally, for each instruction data, at least part of data units contained in the instruction data are masked through the disassembly model to obtain second mask data corresponding to the instruction data, specifically including:

[0023] For each instruction data, at least part of data units contained in the instruction data are masked according to a preset mask proportion through the disassembly model to obtain third mask data corresponding to the instruction data, and for each instruction data, according to the data type corresponding to the instruction data, a mask strategy corresponding to the instruction data is determined; according to the mask strategy corresponding to the instruction data, a field type corresponding to the data unit to be masked in the instruction data is determined as a target field type; data units of the instruction field belonging to the target field type in the instruction data are masked to obtain fourth mask data corresponding to the instruction data.

[0024] According to the third mask data and the fourth mask data corresponding to the instruction data, second mask data corresponding to the instruction data is determined.

[0025] Optionally, the feature representation corresponding to the first mask data is determined as a first feature, specifically including:

[0026] For each instruction data contained in the first mask data, position information corresponding to the instruction data in the first mask data is determined, the position information including position encoding and boundary information of the instruction data in the first mask data, and the boundary information being used to represent a starting character and a terminal character of the instruction data in the first mask data.

[0027] According to the position information corresponding to each instruction data, the first feature is determined.

[0028] Optionally, a feature representation of second mask data corresponding to the instruction data is determined as a second feature corresponding to the instruction data:

[0029] For each data unit contained in the second mask data corresponding to the instruction data, a one-hot encoding corresponding to the data unit and a position encoding corresponding to the data unit in the instruction data to which the data unit belongs are determined;

[0030] According to the one-hot encoding and the position encoding, an initial feature corresponding to the data unit is determined;

[0031] According to a weight between the data unit and each other data unit contained in the second mask data corresponding to the instruction data, and the initial feature corresponding to each data unit contained in the second mask data corresponding to the instruction data, a feature representation corresponding to the data unit is determined;

[0032] According to the feature representation corresponding to each data unit in the instruction data, a second feature corresponding to the data unit is determined.

[0033] Optionally, the method further comprises:

[0034] According to the first feature and the second feature, a target feature corresponding to the ARM machine code is determined;

[0035] According to the target feature, a data type corresponding to each instruction data is determined as a predicted data type;

[0036] According to a deviation between the predicted data type and an actual data type corresponding to each instruction data, a classification loss value is determined;

[0037] The retraining of the disassembly model is performed with the optimization goal of minimizing the classification loss value.

[0038] Optionally, the method further comprises:

[0039] According to the first feature and the second feature, a target feature corresponding to the ARM machine code is determined;

[0040] According to the target feature, function boundary information corresponding to the ARM machine code is determined as predicted function boundary information;

[0041] According to a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, a boundary loss value is determined;

[0042] The decompilation model is retrained with minimization of the boundary loss value as an optimization goal.

[0043] Optionally, the method further includes:

[0044] According to the first feature and the second feature, a target feature corresponding to the ARM machine code is determined.

[0045] According to the target feature, a data type corresponding to each instruction data is determined as a predicted data type, and function boundary information corresponding to the ARM machine code is determined as predicted function boundary information.

[0046] According to the deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, and the deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, a comprehensive loss value is determined.

[0047] The decompilation model is retrained with minimization of the comprehensive loss value as an optimization goal.

[0048] The present specification provides a task execution method, including:

[0049] An ARM machine code that needs to be decompiled is obtained as target machine code.

[0050] The target machine code is input into a pre-trained decompilation model to determine a feature representation corresponding to the target machine code through the decompilation model, wherein the decompilation model is trained through the above-mentioned model training method.

[0051] According to the feature representation corresponding to the target machine code, the target machine code is decompiled to obtain assembly code corresponding to the target machine code, and a task is executed according to the assembly code.

[0052] Optionally, the feature representation corresponding to the target machine code is determined through the decompilation model, specifically including:

[0053] A first feature corresponding to the target machine code is determined through a first feature extraction network set in the decompilation model, and a second feature corresponding to the target machine code is determined through a second feature extraction network set in the decompilation model.

[0054] According to the first feature and the second feature, a target feature corresponding to the ARM machine code is determined.

[0055] Optionally, according to the feature representation corresponding to the target machine code, the target machine code is decompiled to obtain assembly code corresponding to the target machine code, specifically including:

[0056] determining function boundary information corresponding to the target machine code and data types corresponding to each instruction data contained in the target machine code according to the feature representation corresponding to the target machine code;

[0057] performing disassembly on the target machine code according to the function boundary information corresponding to the target machine code and the data types corresponding to each instruction data contained in the target machine code, to obtain the assembly code.

[0058] Optionally, the disassembly on the target machine code to obtain the assembly code according to the function boundary information corresponding to the target machine code and the data types corresponding to each instruction data contained in the target machine code specifically includes:

[0059] for each instruction data, determining whether the data type corresponding to the instruction data is instruction data, the instruction data including ARM instructions and Thumb instructions;

[0060] if yes, performing disassembly on the instruction data.

[0061] Optionally, the method further includes:

[0062] for each instruction data contained in the target machine code, if the data type corresponding to the instruction data is inline data, not performing disassembly on the instruction data.

[0063] The specification provides a model training apparatus, including:

[0064] an obtaining module configured to obtain an advanced reduced instruction set (ARM) machine code, the ARM machine code containing a plurality of instruction data, the plurality of instruction data being executed in a preset logical execution order;

[0065] an inputting module configured to input the ARM machine code into a preset disassembly model, to perform mask processing on at least part of the instruction data contained in the ARM machine code by the disassembly model, to obtain first mask data according to the instruction data after mask processing and the instruction data without mask processing, and determine a feature representation corresponding to the first mask data as a first feature, and for each instruction data, perform mask processing on at least part of the data units contained in the instruction data by the disassembly model, to obtain second mask data corresponding to the instruction data, and determine a feature representation of the second mask data corresponding to the instruction data as a second feature corresponding to the instruction data;

[0066] The prediction module is configured to input the first feature into a preset decoding model, so that the decoding model determines, according to the first feature, position information corresponding to the masked instruction data in the ARM machine code as predicted position information, and input the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts, according to the second feature corresponding to each instruction data, a data unit masked in each instruction data, to obtain a predicted value.

[0067] The training module is configured to determine a target loss function according to a deviation between the predicted value and an actual value corresponding to the data unit masked in each instruction data, and a deviation between the predicted position information and actual position information corresponding to the masked instruction data in the ARM machine code, and train the disassembly model at least with a minimization of the target loss function as an optimization target.

[0068] The present specification provides a task execution apparatus, comprising:

[0069] The acquisition module is configured to acquire an ARM machine code that needs to be disassembled as target machine code.

[0070] The determination module is configured to input the target machine code into a pre-trained disassembly model, so as to determine, by the disassembly model, a feature representation corresponding to the target machine code, wherein the disassembly model is obtained by training the model according to the above model training method.

[0071] The execution module is configured to disassemble the target machine code according to the feature representation corresponding to the target machine code, to obtain an assembly code corresponding to the target machine code, and execute a task according to the assembly code.

[0072] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above model training and task execution method.

[0073] The present specification provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above model training and task execution method when executing the program.

[0074] The above at least one technical solution adopted by the present specification can achieve the following beneficial effects:

[0075] In the model training method provided in the specification, the server obtains advanced reduced instruction set (ARM) machine code and inputs a disassembly model, performs mask processing on part of instruction data contained in the ARM machine code to obtain first mask data, and determines first features corresponding to the first mask data, and performs mask processing on at least part of data units contained in the instruction data to obtain second mask data, and determines second features of the second mask data; according to the first features, the prediction position information is determined, and according to the second features corresponding to each instruction data, the prediction value of the masked data unit in each instruction data is predicted; and the disassembly model is trained according to the deviation between the prediction value and the actual value corresponding to the masked data unit, and the deviation between the prediction position information and the actual position information corresponding to the masked instruction data.

[0076] As can be seen from the above method, in the process of model training, on the one hand, the data units in each instruction data are subjected to mask processing, and on the other hand, the whole instruction data is subjected to mask processing, the position information of the masked data unit and the instruction data is predicted according to the data features determined by the two kinds of mask processing, and then the disassembly model is subjected to self-supervised training. Through the training mode, the disassembly model can fully learn the semantic information between the internal unit structures of the instruction data and the logical relationship between different instructions, thereby having the ability to extract deeper semantic features, and based on the extracted semantic features, the ARM machine code can be subjected to more accurate disassembly tasks. BRIEF DESCRIPTION OF DRAWINGS

[0077] The accompanying drawings used to provide further understanding of the specification, form a part of the specification, the illustrative embodiments of the specification and the description thereof are used to explain the specification, and do not constitute improper limitation on the specification. In the drawings:

[0078] Figure 1 A flowchart of a model training method provided in the specification;

[0079] Figure 2 A program code diagram of an ARM architecture provided in the specification;

[0080] Figure 3 A field structure diagram of machine code provided in the specification;

[0081] Figure 4 A second mask data diagram subjected to field-level mask processing provided in the specification;

[0082] Figure 5 A diagram of the masked data provided in the specification;

[0083] Figure 6A schematic diagram of an overall process for pre-training a KMLM is provided in the specification;

[0084] Figure 7 A schematic diagram of a task execution method is provided in the specification;

[0085] Figure 8 A schematic diagram of a model training device is provided in the specification;

[0086] Figure 9 A schematic diagram of a task execution device is provided in the specification;

[0087] Figure 10 A schematic diagram of an electronic device corresponding to Figure 1 or Figure 7 is provided in the specification. DETAILED DESCRIPTION

[0088] For the purpose of making the purpose, technical scheme and advantages of the specification clearer, the technical scheme of the specification will be described clearly and completely below in combination with specific embodiments of the specification and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the specification, not all the embodiments. Based on the embodiments in the specification, all other embodiments obtained by those of ordinary skill in the art without making creative efforts belong to the scope of protection of the specification.

[0089] There are two main traditional disassembly strategies: linear sweep and recursive traversal. Linear sweep processes all bytes in a code segment linearly. However, since it does not understand control flow information, linear sweep is prone to errors when processing inlined code and instruction set switches, which are common in ARM binaries.

[0090] Recursive traversal starts disassembly at the program's entry point and follows branches as they are taken. Recursive traversal performs better when processing inlined data, but it can miss indirect branches that are determined at runtime and can suffer from low code coverage.

[0091] The technical solutions provided by the embodiments of the specification are described in detail below in combination with the drawings.

[0092] Figure 1 A schematic diagram of a model training method is provided in the specification, including the following steps:

[0093] S100: Obtain advanced reduced instruction set computer (ARM) machine code, wherein the ARM machine code contains a plurality of instruction data, and the plurality of instruction data is executed according to a preset logical execution order.

[0094] Since its inception, the ARM architecture has undergone multiple generations of development, from ARMv4 to the latest ARMv9, with continuous expansion of instruction set functionality. Each CPU architecture version introduces new features and instructions. Developers can select the target CPU architecture for their programs through compilation options (-march).

[0095] The instruction set design of the ARM architecture has undergone multiple evolutions since its inception. The initial ARMv3 introduced a 32-bit Arm instruction set (A32) in the early 1990s. To improve code density, ARMv4T introduced a 16-bit Thumb (T16) instruction set as a subset of A32 in the late 1990s. Thumb gradually expanded to 32-bit with the introduction of ARMv6T2, forming the T32 instruction set. More recently, ARMv8 introduced a 64-bit Arm instruction set (A64) for the new AArch64 execution state in 2011, while maintaining backward compatibility with A32 and T32 to support 32-bit code.

[0096] Among them, the ARM instruction set is known for its fixed-length instruction encoding and rich general-purpose registers. This design enables ARM processors to efficiently perform data processing and calculations, but also presents unique challenges for disassembly. The ARM architecture also includes multiple modes and exception handling mechanisms, which need to be correctly identified and processed during disassembly. For example, ARM processors support multiple operating modes, including user mode, system mode, FIQ (fast interrupt) mode, etc., each with its own specific registers and instruction sets. ARM branch and jump instructions play an important role in program execution, as they can change the execution flow of the program. However, these instructions also make disassembly more complex, as disassemblers need to accurately identify these instructions and track the program's execution path.

[0097] Currently, the ARM architecture has become the mainstream standard for mobile and embedded systems, covering smartphones, tablets, Internet of Things devices, robotic vehicles, etc. However, the firmware software supporting these platforms often remains closed source. Due to the closed nature of firmware software, researchers cannot directly access the source code, making it more difficult to understand the internal logic and structure of binary files. Therefore, it is particularly important to disassemble ARM machine code to obtain assembly code that developers can understand. Disassembly mainly refers to the process of recovering lost high-level program constructs from binary code, such as assembly instructions, function boundaries, function signatures, and control flow graphs, etc.

[0098] Due to the characteristics of ARM architecture, the disassembly of ARM machine code faces many difficulties, for example:

[0099] Runtime instruction set switching: 32-bit ARM architecture provides two instruction sets, ARM and Thumb / Thumb-2. These two instruction sets are usually interleaved in real-world binaries. Instruction set switching can occur explicitly or implicitly at runtime, which poses a great challenge to disassemblers based on static analysis.

[0100] Inline data: In AArch32 / AArch64, inline data is more common than in x86 / x64. Inline data refers to data embedded directly in the code segment rather than stored in a separate data segment. Due to the existence of inline data, disassemblers based on static analysis may mistakenly identify a piece of inline data as a valid instruction set, leading to misleading disassembly of subsequent machine code.

[0101] Implicit function call: Unlike the call instruction in x86 / x64, the Thumb instruction set lacks explicit function call instructions. For example, the BL (Branch with Link) instruction can represent both a direct jump and a function call. This implicit function call mechanism increases the difficulty of disassembly, as the disassembler needs to determine the specific meaning of the BL instruction based on the context.

[0102] Based on this, the present specification provides a model training method, which embeds ARM domain knowledge into model pre-training in the process of training the disassembly model. Through the design of a multi-level masking strategy and the addition of another pre-training target (span boundary object, SBO) for ARM characteristics, the training process of the model is realized.

[0103] ARM binary files (ARM machine code) are randomly masked through multi-level masking, including unit level, field level, and span level. Then, the knowledge is pre-trained unsupervisedly through the masked data, obtaining a knowledge-aware masking language model (KMLM). KMLM is composed of a basic masking model (MLM basic ) and a span masking model (MLM span ), which are optimized together in the pre-training stage. MLM basic can understand the semantic relationship between the internal fields of the instruction, while MLM span aims to capture the logical relationship between consecutive instructions.

[0104] In the present specification, the execution subject for implementing the model training and task execution method can be a specified device such as a server, and for the convenience of description, the model training and task execution method provided in the present specification will be described below by taking the server as an example of the execution subject.

[0105] In the process of training the disassembled model, the server can obtain an advanced reduced instruction set (ARM) machine code, which can be an instruction data sequence containing a plurality of binary instruction data. In actual application, each instruction data in the instruction data sequence is executed in a preset logical execution order.

[0106] For the convenience of understanding, the present specification provides a program code diagram of an ARM architecture, as shown in Figure 2

[0107] Figure 2 The program code diagram of the ARM architecture provided in the present specification.

[0108] In actual application, Figure 2 Each instruction data in the instruction data sequence is executed in a preset logical execution order. The second column indicates the data type corresponding to the instruction data, wherein $a, $t and $d are mapping symbols corresponding to each data type, $a represents an ARM instruction, $t represents a Thumb instruction, and $d represents inline data (Inline Data). Inline data refers to data values directly embedded in the ARM program code, rather than data accessed through the memory address of the referenced data. Inline data does not need to be disassembled in the process of disassembly.

[0109] The third column in the figure indicates the storage address, and the fourth column indicates the ARM machine code, which is obtained by compiling the ARM assembly code. For each ARM instruction data, the instruction data is encoded by 32 fixed-length codes, wherein each character corresponds to a 4-bit data unit.

[0110] Taking the ARM instruction "e08f3003" in the 10th row of Figure 2 as an example, the prefix "0x" indicates that its value is in hexadecimal (Hexadecimal) form. The ARM has a total of 32 bits, and each character in the ARM corresponds to a four-bit binary code representing a data unit.

[0111] The fifth column in the figure indicates the assembly code before compilation. Taking "e08f3003" as an example, the corresponding assembly code is "add, r3, pc, r3", which means adding the values of the program counter (pc) and the register r3 and storing the result back to r3.

[0112] ​It should be noted that all the above data (including data types, machine code and assembly code) can be obtained during model training, and only ARM machine code can be obtained during actual execution of the disassembly task.

[0113] Further, for machine code, different data units correspond to different instruction fields, and the instruction field in each instruction data can include:

[0114] 32-bit ARM instruction:

[0115] (Cond, Special, [Opcode], [Oprnd dest ], [Oprnd src1 ], [Oprnd src2 ]);

[0116] (Cond, Special, Reg dest , Reg src1 , Reg src2 );

[0117] (Cond, Special, Reg dest , Reg src , Imm);

[0118] (Cond, Special, Reg src1 );

[0119] (Cond, Special, Imm).

[0120] 16-bit Thumb instruction:

[0121] (Special, [Cond], [Opcode], [Oprnd src1 ], [Oprnd src2 ], [Oprnd dest ])。

[0122] 32-bit Thumb instruction:

[0123] (Special1, [Opcode], [Oprnd src1 ]),(Special2, [Oprnd src2 ], [Oprnd dest ])。

[0124] Wherein, the Cond field is a condition code, used to specify the condition of execution of the instruction. For example, 'eq' represents "equal" (when equal, execute), 'ne' represents "not equal" (when not equal, execute), etc. If omitted, the instruction is considered to be executed unconditionally.

[0125] Special field refers to certain special instruction flags or prefixes that are used to mark certain non-standard or special purpose instructions, such as specific prefixes for coprocessor instructions, etc.

[0126] Opcode field is the operation code: This is the core part of the instruction, defining the basic operation to be performed. The opcode determines the specific type of operation that the processor will perform, Oprnd dest represents the destination operand, i.e., the register or memory location where the result of the instruction is stored, Oprnd src represents the source operand, i.e., the source of data provided to the instruction for operation.

[0127] [Oprnd_dest] (destination operand): This is the register or memory location where the result of the instruction is stored. In ARM assembly, this is usually a register (such as R0-R15) that indicates where the result of the calculation is stored.

[0128] Reg dest , Reg src1 , Reg src2 field is a more specific description of the operand, where Reg dest specifies the destination register, while Reg src1 and Reg src2 specify the first and second source registers, respectively. These are the registers that are directly operated on when the instruction is executed.

[0129] Imm field is the immediate value: The immediate value is a number that is directly encoded in the instruction and is embedded directly into the machine instruction as part of the operation.

[0130] For ARM instructions, each instruction begins with a 4-bit condition field {Cond} that indicates which condition will be checked. For example, 0000 (mnemonic EQ) indicates that the zero flag must be set. The subsequent 5-8 bit {Opcode} field encodes the operation class, including data processing, branching, and other operations. The rest of the instruction is the {Operand}, which specifies the instruction's operands, including a flexible combination of immediate numbers, registers, and addressing modes.

[0131] The Thumb instruction set (T16) uses a more compact 16-bit encoding. It omits the conditional execution field and reduces {Opcode} to 6 bits, leaving 10 bits for {Operand}, which limits the available operations and addressing modes. To extend the functionality, Thumb-2 (T32) supplements the 16-bit Thumb encodings with new 32-bit formats to support more complex behavior, while preserving the 16-bit Thumb. For ease of understanding, the present specification provides a schematic diagram of the field structure of a machine code as shown in Figure 3

[0132] Figure 3 a schematic diagram of the field structure of a machine code provided in the present specification.

[0133] Here, the ARM instruction data "e08f3003" in Figure 2 is taken as an example, where the data unit "e" corresponds to the four-bit instruction field {Cond} and is encoded as "1110", indicating unconditional execution, the data unit "08" corresponds to the eight-bit instruction field {Opcode} and is encoded as "00000100", and the data units "f" and "3" are register operands, where {Rn} = r3, {Rd} = r15 (indicating pc), and {Rm} = r3.

[0134] In addition, the machine code "ea030a97" in Figure 2 line 8 is taken as an example, where the condition code of the first 4-bit {Cond} field is 1110, indicating that the instruction is executed unconditionally. The encoding of the 5-8 bit {Special} field is 1010, including a reserved bit (101) and a function bit L as 0, indicating that this is a branch (b) instruction without saving the return address. The remaining 24 bits are the immediate value imm32, which is used to calculate the offset of the current program counter (pc).

[0135] S102: input the ARM machine code into a preset disassembly model, to perform mask processing on at least part of the instruction data contained in the ARM machine code through the disassembly model, to obtain first mask data according to the instruction data after mask processing and the instruction data without mask processing, and determine the feature representation of the first mask data as a first feature, and for each instruction data, perform mask processing on at least part of the data units contained in the instruction data through the disassembly model, to obtain second mask data corresponding to the instruction data, and determine the feature representation of the second mask data corresponding to the instruction data as a second feature corresponding to the instruction data.

[0136] ​In the present specification, a knowledge-aware masked language model (KMLM) can be provided in the disassembly model. The instruction-aware masked model is composed of two parts, including a first feature extraction network and a second feature extraction network. The first feature extraction network can be an MLM span (span masked language model) for capturing the logical relationship between consecutive instruction data, and the second feature extraction network can be an MLM basic (basic masked language model) for understanding the relationship between the fields inside the instruction data.

[0137] During the model training process, a masking network can also be provided in the disassembly model. The masking network is used for masking the ARM machine code. Since masking of the target machine code is not required in actual application, the masking network can be deleted after the pre-training of the KMLM is completed.

[0138] Specifically, the masking network in the disassembly model can mask at least part of the instruction data contained in the ARM machine code to determine the first mask data according to the masked instruction data and the unmasked instruction data. For the sake of description, the masking method is described as "cross-instruction masking" hereinafter.

[0139] In the binary analysis task, it is often necessary to infer the relationship between instructions. For example, in the instruction set architecture (ISA) and inline data identification task, the ldreq r0, [r5] instruction precedes the bx r0 instruction, and this order can inform the mapping symbol type of the ldreq instruction $a. For self-supervised learning, it is more challenging to model such dependencies under the unit-level masking, because the original masked language model (MLM) only captures the unit-level relationship.

[0140] Specifically, in the cross-instruction masking process, each 32-bit instruction data is randomly masked. Instead of directly masking the 32-bit data into 8 [MASK] and expecting the model to infer their values, a customized Span Boundary Object (SBO) is introduced to explicitly train the pre-trained model to predict the complete instruction span under the given context instruction. The SBO describes the boundaries of the instructions, forcing the model to learn the overall multi-unit pattern. This makes the modeling of the relationship between instructions more rich.

[0141] In SBO tasks, the model needs to predict the boundary of the masked instruction span, rather than the specific tokens (or instruction data) within the span. This helps the model to understand the relationship between instructions at a higher level, thus better performing tasks that require cross-instruction reasoning. SBO delineates instruction boundaries, forcing the model to learn holistic multi-cell patterns. This enables richer modeling of inter-instruction dependencies compared to individual cell prediction.

[0142] In AArch32 architecture, a 32-bit binary sequence can represent various elements, including an ARM instruction, two 16-bit Thumb instructions, a 32-bit Thumb-2 instruction (for ARMv6 and higher versions of ARM binaries), or an inline data. All cells in the cross-instruction mask are replaced with [MASK].

[0143] For an ARM machine code containing several instruction data, randomly selected 32-bit (8 data cell) aligned instruction data are masked to obtain the first masked data, which can be represented as:

[0144]

[0145] where i∈N, index i is the position of the span (x m_span ,..., x {4i} ) in the input instruction data sequence x _{4i+7} . In this process, the instruction data can be masked at a rate of 15%, but this replacement is performed at the instruction span level, rather than at the individual cell level.

[0146] Unlike MLM basic , which focuses on individual data cells, MLM span focuses on instruction data sequences within a span, i.e., a continuous instruction block (x s ,..., x e ), which is masked as a whole. The model predicts the content of the masked instruction span based on the span embedding stored at the external boundary cells x s-1 and x e+1 . Here, the span embedding contains context information spanning multiple instructions, enabling the model to learn and infer high-level semantics such as inter-register data transfer or control flow conversion, even with instruction set switching. The design of MLM span aims to capture and utilize cross-instruction implicit relationships, which are necessary for understanding complex code sequences.

[0147] In this process, the first feature extraction network can determine, for each instruction data contained in the first mask data, position information corresponding to the instruction data in the first mask data, the position information including position encoding corresponding to the instruction data in the first mask data and boundary information (the boundary information is used to represent the starting character and the ending character of the instruction data in the first mask data), and then determine the first feature according to the position information corresponding to each instruction data.

[0148] Specifically, when given a masked instruction data sequence MASK(x s ,..., x e ), where (s, e) represents the starting and ending positions of the sequence, the first feature extraction network can use the output encoding of the external boundary unit of the span and the position encoding of the target span P i-s+1 to represent each instruction data x i within the span. The server can determine the feature representation y (j) corresponding to the position information through a two-layer feedforward network with a GeLU activation function and layer normalization, as the first feature. The first feature can be represented as:

[0149] y (j) = f(x s-1 , x e+1 , P i-s+1 )

[0150] wherein the position encodings P1, P2,... mark the relative positions of the masked instruction data relative to the left boundary x s-1 . In this specification, the first feature extraction network can first construct a vector h0 containing external boundary information and position encoding, wherein:

[0151] h0 = [x s-1 ; x e+1 ; P i-s+1 ]

[0152] Then, layer normalization and GeLU activation function are applied to update h0 to obtain h1, wherein:

[0153] h1 = LayerNorm(GeLU(w1h0)

[0154] Finally, layer normalization and GeLU activation function are applied again to obtain y (j) , wherein:

[0155] y (j) = LayerNorm(GeLU(w2h1))

[0156] At the same time, for each instruction data contained in the ARM machine code, the masking network can mask at least some of the data units contained in the instruction data, thereby determining the second mask data corresponding to the instruction data based on the masked data units and the unmasked data units in the instruction data.

[0157] Specifically, a masking network can perform cell-level masking on each instruction data, treating each instruction data as a sequence of cells of size n, represented as x = (x1, ..., xn). n For any x i (i∈N), which represents a 4-bit data unit. Each data unit x i ∈x is mapped to a 16-bit one-hot encoded value. For example, an input unit b is encoded as "0000100000000000". In other words, the server can define a total of 18 encodings as a vocabulary, which, in addition to representing hexadecimal numbers through 0-15 bits of one-hot encoding, also include [MASK] and [DATA] representing the masked instruction set (including ARM instructions and Thumb instructions) and the masked inline data, respectively.

[0158] In the process of masking instruction data, the masking network can randomly mask at least a portion of the data units in the instruction data according to a preset masking ratio, thereby obtaining the second mask data corresponding to the instruction data. For ease of description, this masking method will be referred to as "cell-level masking" below. This masking process can be represented as:

[0159] D={x m_unit |(x i MASK unit(xi) , ..., x n ), i∈P unit}

[0160] Where, x m_unit This represents the second mask data, MASK(x) i The function represents masking the i-th data unit in a given instruction data. unit It is the set of masked cell locations in x. Given an ARM machine code containing several instruction data, where |D|=N, the second feature extraction network is trained using the second mask data in D.

[0161] In this specification, the above-mentioned preset mask ratio can be set to 15%, that is, in the ARM machine code, a total of 15% of the data units are masked.

[0162] In the masked mask unit, 80% of the mask units can be replaced with "[MASK]", 10% of the mask units can be replaced with random units, and the remaining 10% can remain unchanged. Of course, the server can also replace all masked instruction units with "[MASK]" and replace all masked inline data with "[DATA]".

[0163] In addition, the mask network can also use another masking strategy to mask the data units in each instruction data, that is, for each instruction data, through the mask network, according to the data type corresponding to the instruction data, determine the mask strategy corresponding to the instruction data, according to the mask strategy corresponding to the instruction data, determine the field type corresponding to the data unit to be masked in the instruction data as the target field type, mask the data unit of the instruction field belonging to the target field type in the instruction data, and obtain the second mask data corresponding to the instruction data. For the sake of description, the following will be collectively referred to as "field-level masking".

[0164] Among them, the data type corresponding to the instruction data includes: ARM instruction and Thumb instruction, and the field type can include: {Cond} field, {Opcode} field, {Operand} field, {Special} field, etc.

[0165] Specifically, for the ARM instruction, the corresponding mask strategy can include:

[0166] For each 32-bit instruction, the data unit corresponding to the 4-bit condition code field {Cond} is always masked;

[0167] For data processing instructions, the data unit corresponding to the mask {Opcode} field;

[0168] For instruction data containing three register operands, the data unit corresponding to each 4-bit {Operand} field can be randomly masked;

[0169] For instruction data with two register operands and an immediate operand, the data units corresponding to the two register fields can be masked, but the data unit corresponding to the immediate number field is not masked;

[0170] For branch instructions with immediate numbers as targets, the data units corresponding to the condition code {Cond} field and the {Special} field can be masked, while the offset remains unchanged.

[0171] Since Thumb (T16) instruction encodings are more compact than A32. For example, most Opcode fields are 2 bits (4 bits in A32), and all register fields are encoded as 3 bits. Unlike in A32 where the condition code Cond is at the start of every instruction, only conditional branch instructions contain {Cond}. To reuse the 4-bit mask [MASK], the server can add padding in the field for alignment.

[0172] Thus, for Thumb instructions, the corresponding mask strategy can include:

[0173] All data units corresponding to {Special} fields can be masked;

[0174] For register {Oprndsrc1}, the server can add a padding number on its least significant bits for masking;

[0175] Data units corresponding to immediate numbers (i.e. offset for operand bit displacement or as branch target) are never masked;

[0176] Data units corresponding to {Opcode} fields in masked conditional branches;

[0177] For push and pop operations, the register list is masked as {Opndsrc1}.

[0178] It is to be noted that all field types corresponding to instruction fields that can be masked in the above mask strategy can be considered as target field types.

[0179] For ease of understanding, the present specification provides a second mask data diagram after field-level masking, as shown in Figure 4 .

[0180] Figure 4 A second mask data diagram after field-level masking is provided in the present specification.

[0181] For instruction data "e08f3003", which contains the instruction add, r3, pc, r3, there are five instruction fields: {cond} (condition code), {ol} (usually part of Opcode or special opcode identifier), {Rn} (second register operand), {Rm} (second register operand, which can be an immediate number for some instructions), and {Rd} (target register). According to the above mask strategy, the data units corresponding to the condition code {cond} are masked, and the register operands are randomly selected for masking.

[0182] For instruction data "ea030a97", the instruction is a Branch instruction, wherein the data unit corresponding to the {cond} field is always masked, and the data unit corresponding to the {special} field is randomly masked.

[0183] In the present specification, the masking network can only perform unit-level masking on the ARM machine code to obtain the second masked data, or only perform field-level masking on the ARM machine code to obtain the second masked data.

[0184] Of course, the disassembly model can perform both unit-level masking and field-level masking on the ARM machine code to obtain the second masked data. For each instruction data, the second masking network is used to mask at least part of the data units contained in the instruction data according to a preset masking ratio to obtain third masked data corresponding to the instruction data, and for each instruction data, a masking strategy corresponding to the instruction data is determined according to the data type corresponding to the instruction data; the field type corresponding to the data unit to be masked in the instruction data is determined as a target field type according to the masking strategy corresponding to the instruction data; the data unit in the instruction field belonging to the target field type is masked to obtain fourth masked data corresponding to the instruction data, and then the third masked data and the fourth masked data are combined to obtain the second masked data.

[0185] In addition, the masking network can first mask the ARM machine code by unit-level masking to obtain unit-level masked data, and then further mask the unit-level masked data by field-level masking to obtain the second masked data, or first mask the ARM machine code by field-level masking to obtain field-level masked data, and then further mask the field-level masked data by unit-level masking to obtain the second masked data.

[0186] It should be noted that in the process of masking by unit-level masking and field-level masking, some instruction fields may contain two or more data units, and therefore each data unit inside each instruction data can be masked by one or more [MASK], i.e., the data unit is masked once by unit-level masking and once by field-level masking.

[0187] After unit-level masking and field-level masking, the structure and syntax knowledge inside each instruction are integrated into the pre-trained data.

[0188] In this way, the model is able to learn facts and knowledge about the ARM instruction set architecture (ISA) and real binary files during the pre-training phase, including the meaning of individual fields of instructions, their relationships, and how they combine to form valid instructions. This helps the model better understand, analyze, and process ARM machine code in subsequent tasks.

[0189] For ease of understanding, the specification provides a diagram of masked data as shown in Figure 5

[0190] Figure 5 A diagram of masked data provided in the specification.

[0191] Where each light-colored square represents a 4-bit data unit, and the dark-colored square is a masked data unit. The first row is the first masked data after cross-instruction-level masking, and the second to fourth rows are the second masked data after field-level masking.

[0192] Four code snippets are used here to show the masking effect:

[0193] $a: ldreq r0, [r5] (0x00009505): This is an ARM instruction, which means "if r5 is equal to 0, then load the content of the memory address pointed by r5 into r0". Here, ARMED can selectively mask certain fields in the instruction, such as the opcode or register identifiers.

[0194] $a: bx r0 (0x10ff2fe1): This is also an ARM instruction, which means "branch to the address pointed by r0 register". Similarly, ARMED can selectively mask certain parts of the instruction to train the model.

[0195] $d: 0x1b6898f0: This is an inline data value, not an instruction. In this case, ARMED can selectively mask certain bits or bytes in the data so that the model can learn the structure and patterns of the data.

[0196] $t: push{r3, lr} (0x0865) and $t: movs{r0, #8} (0x0820): These are Thumb instructions (a subset of the ARM instruction set, used for 16-bit encoded instructions), which mean "push the content of r3 and lr registers onto the stack" and "move the immediate value 8 (which can be a signed number) to r0 register", respectively. Similarly, ARMED can selectively mask certain parts of these instructions to train the model.

[0197] ​The server can further determine, through the second feature extraction network, a feature representation corresponding to the second mask data as the second feature.

[0198] In this process, for each data unit contained in the second mask data, the second feature extraction network can determine a one-hot encoding corresponding to the data unit and a position encoding corresponding to the data unit in the instruction data to which the data unit belongs; determine an initial feature corresponding to the data unit according to the one-hot encoding and the position encoding; determine a feature representation corresponding to the data unit by performing weighted summation on the initial features corresponding to each data unit in the second mask data to which the data unit belongs and the weights between each data unit in the second mask data to which the data unit belongs and the data unit, and then determine the second feature according to the feature representation corresponding to each data unit.

[0199] Among them, the position encoding is used to represent the position information of the data unit in the instruction data to which it belongs, and the weight between each data unit and the data unit is used to represent the association between other data units and the data unit. The greater the association, the greater the weight, and vice versa.

[0200] Specifically, each input data unit is converted into a one-hot vector, and an initial feature is generated in combination with its position embedding. This means that each unit is represented as a 16-bit vector, with only one element being 1 and the rest being 0, to represent a specific 4-bit binary value or a special marker (such as [MASK] or [DATA]). The position encoding is to provide the position of each unit in the sequence in the instruction data.

[0201] The initial feature takes into account the information of other units in the binary sequence, forming a context-aware embedding. This step helps the model understand the dependency between units.

[0202] Next, the Transformer unit in the second feature extraction network dynamically updates the initial feature from the second layer to the last layer through a multi-head self-attention mechanism. The self-attention mechanism allows the model to capture correlations between embeddings at different positions, enhancing the model's understanding of long-range dependencies in the sequence, and outputting deeper second features from the last layer.

[0203] In this specification, the position encoding can be obtained through learning, and then we stack a feedforward network f(x) with one hidden layer to combine the position embedding E pos and the one-hot encoding E unit .

[0204] The mask process can be represented as:

[0205] E 1，i = MLP(concat(Eunit(xi) , E pos(i) ))

[0206] wherein E1, i denotes the embedding representation of xi in the second layer attention mechanism, E unit(xi) denotes the application of the embedding to the one-hot encoded unit xi, while E pos(i) denotes the application of the learned position encoding to x i corresponding position i.

[0207] It should be noted that in the disassembly model in the present specification, only one feature extraction network can also be provided, and the first mask data and the first feature corresponding to the first mask data are obtained through the feature extraction network, and the second mask data and the second feature corresponding to the second mask data are obtained.

[0208] In addition, the unit-level mask, the field-level mask and the cross-instruction mask can be masked by different mask networks respectively, or can be masked by the same mask network. Of course, when training the disassembly model, the disassembly model can also not be added with a mask network, but the ARM machine code is preprocessed by a preset script or an external mask model for mask operation, and then the preprocessed mask data is input into the disassembly model for feature extraction and prediction.

[0209] S106: input the first feature into a preset decoding model, so that the decoding model determines the position information corresponding to the masked instruction data in the ARM machine code as the predicted position information according to the first feature, and inputs the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts the masked data unit in each instruction data according to the second feature corresponding to each instruction data to obtain a prediction value.

[0210] S108: according to the deviation between the prediction value and the actual value corresponding to the masked data unit in each instruction data, and the deviation between the predicted position information and the actual position information corresponding to the masked instruction data in the ARM machine code, a target loss function is determined, and at least the disassembly model is trained with the optimization target of minimizing the target loss function.

[0211] In the process of model training, an additional decoding model can be set, which can be set inside the disassembly model or outside the disassembly model. When it is set inside the disassembly model, the decoding model can be a Softmax network, and the input dimension is the same as the output dimension.

[0212] The first feature extracted by the first feature extraction network can be input into the decoding model, so that the decoding model predicts the original value of the masked data unit according to the first feature y (j) The prediction position information of the masked instruction data in the instruction data sequence contained in the whole ARM machine code is predicted as the prediction position information.

[0213] Of course, the first feature extraction network can also predict the masked data unit through the first feature y (j) The predicted value of the masked data unit can be represented as:

[0214]

[0215] Wherein, is the predicted value of each masked data unit in the span, and the MLM span predicts the masked data unit in each span, which is located in the position set P span .

[0216] The second feature output by the second feature extraction model can also be input into the above decoding model, so that the decoding model predicts the original value of the data unit covered by the [MASK] mark as the predicted value according to the second feature. For each masked data unit, the predicted value corresponding to the data unit can be represented as:

[0217]

[0218] Wherein, is the predicted value corresponding to the masked data unit x i .

[0219] It should be noted that since the masked data unit does not need to be restored in the process of disassembly, the decoding model can not be used in the disassembly process after the training is completed.

[0220] Further, the server can determine the loss function according to the deviation between the predicted value corresponding to the masked data unit and the actual value corresponding to the masked data unit, and the deviation between the predicted position information corresponding to the masked instruction data and the actual position information corresponding to the masked instruction data, and then minimize the loss function as the optimization goal to train the disassembly model.

[0221] Specifically, the server can train the first feature extraction network and the second feature extraction network respectively.

[0222] For the first feature extraction network, the corresponding loss function can be represented as:

[0223]

[0224] where P(y i | y i ) is the feature representation y i based on the span boundary. The prediction result is the probability of the actual position information y i under the condition. The server can minimize the deviation between the predicted position information corresponding to the masked instruction data and the actual position information corresponding to the masked instruction data based on the loss function.

[0225] For the second feature extraction network, the loss function can be represented as:

[0226]

[0227] where, represents the loss function corresponding to the first masking network, D unit represents the ARM machine code containing a plurality of instruction data, P unit is a set of masked unit positions in x, is the predicted value corresponding to the masked data unit x i . The server can minimize the deviation between the predicted value corresponding to the masked data unit and the actual value corresponding to the masked data unit based on the above loss function.

[0228] Of course, in order to optimize the first feature extraction network and the second feature extraction network at the same time, the server can also add the above two losses, thereby jointly training the above two models. Specifically, for any data unit x i , the input embedding used in the first feature extraction network and the second feature extraction network is the same. The target loss function can be represented as:

[0229] L pre(xi) = L MLMbasic(xi) + L MLMspan(xi)

[0230] where L pre(xi) represents the target loss of the knowledge-aware masking language model KMLM, which is optimized by gradient descent method. The two parts here are: L MLMbasic(xi) represents the prediction loss of the data unit x i itself L MLMspan(xi) represents the loss based on position information prediction. This joint optimization strategy ensures that the model not only understands the context of a single instruction field, but also captures high-level semantics spanning multiple instructions, thereby achieving better performance in ARM binary disassembly tasks. In order to facilitate understanding, this specification provides a whole process schematic diagram of pre-training KMLM, as shown in Figure 6 .

[0231] Figure 6 An overall process diagram for pre-training KMLM is provided in the specification.

[0232] Wherein, the server inputs the target machine code into the disassembly model, and the KMLM can pre-process the target machine code, that is, unit-level masking, field-level masking and cross-instruction masking are performed respectively, and then the second mask data processed by the unit-level masking and the field-level masking is input into the second feature extraction network (L MLMbasic ), the first mask data processed by the cross-instruction masking is input into the first feature extraction network (L MLMspan ), and then the KMLM is pre-trained based on the first feature output by the first feature extraction network and the second feature output by the second feature extraction network.

[0233] Further, after pre-training the KMLM, the server can deploy it to the disassembly model and fine-tune the disassembly model.

[0234] In the fine-tuning stage, for the ARM binary disassembly task, two basic tasks are mainly focused on: instruction recognition and function boundary recovery. These two tasks are the basis of disassembly, and other more complex operations such as control flow graph (CFG) and call graph generation all depend on accurate instruction and function recovery results. Therefore, the ARMED framework designs two fine-tuning tasks to assist the disassembly of ARM binary: mapping symbol classification and function boundary detection.

[0235] For the mapping symbol classification task, the server can determine the target feature corresponding to the ARM machine code according to the first feature and the second feature, and then determine the data type corresponding to each instruction data according to the target feature as the predicted data type, and then determine the classification loss value according to the deviation between the predicted data type and the actual data type corresponding to each instruction data, and retrain the disassembly model with the optimization goal of minimizing the classification loss value.

[0236] Specifically, the server can first input a piece of ARM machine code using the pre-trained KMLM, and the KMLM will generate a series of embedding vectors E l (j) = (E l，1 , E l，2 ,..., E l，n ), where each E l，i corresponds to a high-level representation of a certain part of the original code.

[0237] For each fine-tuning task, there is a corresponding ground truth label sequence y, with the same length as the embedding vector sequence, i.e., y = {y (j) |y (j) ∈ C y}. C y denotes the set of all possible classes, and each embedding vector E l , i will be mapped to a label y (j) after processing.

[0238] Among them, the mapping conforms to the classification task aims to identify specific mapping symbols (such as $a, $t and $d) in ARM machine code, and the function boundary detection task focuses on identifying the start and end positions of functions, which is crucial for understanding program structure and logic.

[0239] Due to the characteristics of reduced instruction set computer (RISC) architecture, it is easy to determine the boundary of each ARM instruction, but it is more difficult to distinguish code from data at certain addresses. To solve this problem, ARM uses mapping symbols. Mapping symbols are an architecture-specific extension of the ARM ELF file generated by the compiler, which is used to identify the conversion between instructions (A32, T16 and T32) and inline data. For example, the mapping symbol $t 0x0001043c indicates that the offset 0x0001043c contains Thumb code. There are mainly three types of mapping symbols: (1) $a: the starting address of the ARM code region. (2) $t: the starting address of the Thumb code region. (3) $d: the starting address of the data region.

[0240] Inline data is ubiquitous in ARM binary files. In order to distinguish inline data (including data) from data segment ($d.realdata), we can combine inline data detection and instruction set recognition by merging their labels. In particular, we add a new label D ($d) to the label set |y|, which represents inline data. Therefore, for each 32-bit aligned binary code fragment, the possible class label set |y| = {A, T, D} represents ARM (A) instructions, Thumb (T) instructions or inline data (D), respectively.

[0241] Specifically, by f task denotes the model that needs to be fine-tuned (i.e., disassembly), which receives each embedding E l , i as input, and the label y (j) , where y i = f task (E l，i ). Let f taskdefined by the model parameters Θtask: f task (E l，i ; Θtask), therefore, the goal of training the fine-tuned model f task is to find Θtaskthat minimizes the cross-entropy between the predicted labels and their actual labels for all inputs. In other words, the goal is to optimize the parameters Θtaskso that the model makes label predictions as close as possible to the true label values for each input E l , i The label predictions made by the model are as close as possible to the true label values by minimizing the cross-entropy loss function, which measures the difference between the predicted and true distributions, which can be represented as:

[0242]

[0243] where, represents the predicted value output by f task , i.e.

[0244]

[0245] For the function boundary detection task, the disassembly model can determine the target feature corresponding to the ARM machine code according to the first feature and the second feature; determine the function boundary information corresponding to the ARM machine code as the predicted function boundary information according to the target feature; and further determine the boundary loss value according to the deviation between the predicted function boundary information and the actual function boundary information corresponding to the ARM machine code, and retrain the disassembly model with the optimization goal of minimizing the boundary loss value.

[0246] Specifically, the server can define an end-to-end function boundary detection task, in which all units are divided into three categories: |Cy| = {S, E, N}, representing function start (S), function end (E), and neither function start nor function end (N). The function boundary is calculated based on the probability distribution of the three possible labels, and the predicted label is the one with the highest probability.

[0247] After the preprocessing and pre-training phase, the deep semantics between units, fields, and instruction sequences have been implicitly embedded into the weight parameters of the underlying neural network. To distill the semantics learned for various downstream tasks, the embedding vectors output by the last layer of the pre-trained language model (KMLM) can be stacked with a multi-layer perceptron (MLP) to predict different disassembly subtasks. The specific operation is as follows: for each embedding E l，i in the last layer of the pre-trained model, it is calculated as E l，i = KMLM (xi) .

[0248] Next, we define f task , a function to make classification predictions using these embedding vectors, whose predictions can be represented as:

[0249] f task (E l，i ; θ1, θ2) = Softmax(tanh(E l，i · θ1) · θ2)

[0250] where θ1 is a matrix of shape d emb × d emb , used to transform the embedding vectors, and θ2 is a matrix of shape d emb × |C y |, used for the classification subtask, where d emb is the dimension of the embedding vectors and |C y | is the number of output classes, which can vary depending on the different fine-tuning subtasks.

[0251] Thus, the final output of the MLP has shape n × |C y |, where n is the length of the input instruction data sequence. In this way, the model is able to generate a probability distribution over different classes for each position in the input sequence, suitable for handling downstream tasks such as sequence labeling or classification.

[0252] Of course, the server can also fine-tune the disassembly model through the above two subtasks at the same time, determine a comprehensive loss value according to the classification loss value and the boundary loss value, and take minimizing the comprehensive loss value as the optimization objective to retrain the disassembly model.

[0253] Through the above two fine-tuning tasks, the capabilities of the pre-trained model can be further refined to better adapt to the specific needs of ARM binary disassembly, improving the accuracy and efficiency of disassembly. During the fine-tuning process, model parameters will be adjusted according to specific task objectives to optimize their performance in instruction recognition and function boundary detection.

[0254] When the training and fine-tuning of the disassembly model are completed, the server can deploy the disassembly model to perform disassembly tasks on ARM machine code. For ease of understanding, the present specification provides a flowchart of a task execution method applied to the above disassembly model, as shown in Figure 7 .

[0255] Figure 7 The flowchart of the task execution method provided in the present specification includes the following steps:

[0256] S700: Obtain the ARM machine code that needs to be disassembled as the target machine code.

[0257] In the process of performing the disassembly task, the server usually intelligently obtains binary machine code of the ARM architecture, and obtains assembly code and other information such as assembly instructions, function boundaries, function signatures, and control flow graphs by disassembling the ARM machine code.

[0258] S702: inputting the target machine code into the pre-trained disassembly model to determine the feature representation corresponding to the target machine code through the disassembly model, wherein the disassembly model is trained through the above model training method.

[0259] The server can input the target machine code into the pre-trained disassembly model, determine the first feature corresponding to the target machine code through the first feature extraction network set in the disassembly model, and determine the second feature corresponding to the target machine code through the second feature extraction network set in the disassembly model. Then, according to the first feature and the second feature, the feature representation corresponding to the target machine code is determined.

[0260] For example, the server can determine the weight corresponding to the first feature and the weight corresponding to the second feature through weighted summation, and then perform weighted summation on the first feature and the second feature according to the respective weights of the first feature and the second feature, to obtain the final feature representation. Of course, the server can also directly fuse the first feature and the second feature to obtain the final feature representation.

[0261] S704: disassembling the target machine code according to the feature representation corresponding to the target machine code to obtain the assembly code corresponding to the target machine code, and performing a task according to the assembly code.

[0262] In the process of disassembling the target machine code, the function boundary information corresponding to the target machine code and the data type corresponding to each instruction data contained in the target machine code are determined according to the feature representation corresponding to the target machine code. Then, the target machine code is disassembled according to the function boundary information corresponding to the target machine code and the data type corresponding to each instruction data contained in the target machine code to obtain the assembly code.

[0263] Among them, for each instruction data contained in the target machine code, if the data type corresponding to the instruction data is inline data, the instruction data is not disassembled.

[0264] After obtaining the ARM assembly code, the server can perform a task based on the assembly code. For example, the server can analyze the assembly code to determine a security vulnerability existing therein, and then process the security vulnerability. For another example, the server can analyze the overall logic of the assembly code and optimize the program code according to the analysis result.

[0265] As can be seen from the above method, the scheme designs a multi-level masking strategy for ARM machine code, so that the masking area can represent the common and possible changes between instruction fields in the real ARM instructions. The input ARM binary file is randomly masked by multi-level masking, including unit level, field level and span level. Then, the knowledge is pre-trained unsupervisedly through the masked data, to obtain a knowledge-aware masking language model (KMLM). The KMLM is composed of a basic MLM (MLM basic ) and a span MLM (MLM span ), which are optimized together in the pre-training stage. The MLM basic can understand the changes between the internal fields of the instructions, while the MLM span aims to capture the implicit relationship between consecutive instructions. The disassembly model trained in the above manner can realize accurate disassembly of ARM machine code.

[0266] The above is a method for training or task execution of one or more embodiments of the present specification. Based on the same idea, the present specification also provides a corresponding model training or task execution device, as shown in Figure 8 or Figure 9 .

[0267] Figure 8 A schematic diagram of a model training device provided in the present specification includes:

[0268] The acquisition module 800 is configured to acquire advanced reduced instruction set (ARM) machine code, wherein the ARM machine code contains a plurality of instruction data, and the plurality of instruction data is executed according to a preset logical execution order;

[0269] The input module 802 is configured to input the ARM machine code into a preset disassembly model, so as to perform masking processing on at least part of the instruction data contained in the ARM machine code through the disassembly model, to obtain first masking data according to the instruction data after masking processing and the instruction data without masking processing, and determine the feature representation corresponding to the first masking data as a first feature, and for each instruction data, perform masking processing on at least part of the data units contained in the instruction data through the disassembly model, to obtain second masking data corresponding to the instruction data, and determine the feature representation of the second masking data corresponding to the instruction data as the second feature corresponding to the instruction data;

[0270] The prediction module 804 is configured to input the first feature into a preset decoding model, so that the decoding model determines, according to the first feature, position information corresponding to the masked instruction data in the ARM machine code as predicted position information, and input the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts, according to the second feature corresponding to each instruction data, a data unit masked in each instruction data, to obtain a predicted value.

[0271] The training module 806 is configured to determine a target loss function according to a deviation between the predicted value and an actual value corresponding to the data unit masked in each instruction data, and a deviation between the predicted position information and actual position information corresponding to the masked instruction data in the ARM machine code, and perform training on the disassembly model at least with the optimization target of minimizing the target loss function.

[0272] Optionally, the input module 802 is specifically configured to determine, by a first feature extraction network arranged in the disassembly model, a feature representation corresponding to the first mask data.

[0273] Optionally, the input module 802 is specifically configured to take, as the second feature corresponding to the instruction data, a feature representation of second mask data corresponding to the instruction data by a second feature extraction network arranged in the disassembly model.

[0274] Optionally, the input module 802 is specifically configured to, for each instruction data, perform, by the disassembly model, mask processing on at least part of data units contained in the instruction data according to a preset mask proportion, to obtain second mask data corresponding to the instruction data.

[0275] Optionally, the input module 802 is specifically configured to, for each instruction data, determine, by the disassembly model, a mask strategy corresponding to the instruction data according to a data type corresponding to the instruction data, determine, as a target field type, a field type corresponding to a data unit to be masked in the instruction data according to the mask strategy corresponding to the instruction data, and mask the data unit of the instruction field belonging to the target field type in the instruction data to obtain second mask data corresponding to the instruction data.

[0276] Optionally, the input module 802 is specifically configured to, for each instruction data, perform mask processing on at least part of data units contained in the instruction data according to a preset mask proportion through the disassembly model, to obtain third mask data corresponding to the instruction data, and for each instruction data, determine a mask strategy corresponding to the instruction data according to a data type corresponding to the instruction data; determine a field type corresponding to a data unit to be masked in the instruction data as a target field type according to the mask strategy corresponding to the instruction data; mask data units of instruction fields belonging to the target field type in the instruction data to obtain fourth mask data corresponding to the instruction data; and determine second mask data corresponding to the instruction data according to the third mask data and the fourth mask data corresponding to the instruction data.

[0277] Optionally, the input module 802 is specifically configured to, for each instruction data contained in the first mask data, determine position information corresponding to the instruction data in the first mask data, the position information including a position code and boundary information corresponding to the instruction data in the first mask data, the boundary information being used to indicate a starting character and a terminal character of the instruction data in the first mask data; and determine the first feature according to the position information corresponding to each instruction data.

[0278] Optionally, the input module 802 is specifically configured to, for each data unit contained in the second mask data corresponding to the instruction data, determine a one-hot code corresponding to the data unit and a position code corresponding to the data unit in the instruction data to which the data unit belongs; determine an initial feature corresponding to the data unit according to the one-hot code and the position code; determine a feature representation corresponding to the data unit according to a weight between the data unit and each other data unit contained in the second mask data corresponding to the instruction data and the initial feature corresponding to each data unit contained in the second mask data corresponding to the instruction data; and determine a second feature corresponding to the data unit according to the feature representation corresponding to each data unit in the instruction data.

[0279] Optionally, the training module 806 is further configured to determine a target feature corresponding to the ARM machine code according to the first feature and the second feature; determine a predicted data type corresponding to each instruction data according to the target feature; determine a classification loss value according to a deviation between the predicted data type and an actual data type corresponding to each instruction data; and retrain the disassembly model with the optimization target of minimizing the classification loss value.

[0280] Optionally, the training module 806 is further configured to determine target features corresponding to the ARM machine code according to the first features and the second features, determine function boundary information corresponding to the ARM machine code as predicted function boundary information according to the target features, determine a boundary loss value according to a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, and retrain the disassembly model with the optimization objective of minimizing the boundary loss value.

[0281] Optionally, the training module 806 is further configured to determine target features corresponding to the ARM machine code according to the first features and the second features, determine data types corresponding to each instruction data as predicted data types according to the target features, and determine function boundary information corresponding to the ARM machine code as predicted function boundary information, determine a comprehensive loss value according to a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, and a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code, and retrain the disassembly model with the optimization objective of minimizing the comprehensive loss value.

[0282] Figure 9 A schematic diagram of a model training apparatus provided in the specification includes:

[0283] The acquisition module 900 is configured to acquire an ARM machine code that needs to be disassembled as target machine code.

[0284] The determination module 902 is configured to input the target machine code into a pre-trained disassembly model to determine feature representation corresponding to the target machine code through the disassembly model.

[0285] The execution module 904 is configured to disassemble the target machine code according to the feature representation corresponding to the target machine code to obtain assembly code corresponding to the target machine code, and execute a task according to the assembly code.

[0286] Optionally, the determination module 902 is specifically configured to determine first features corresponding to the target machine code through a first feature extraction network arranged in the disassembly model, determine second features corresponding to the target machine code through a second feature extraction network arranged in the disassembly model, and determine the feature representation corresponding to the target machine code according to the first features and the second features.

[0287] Optionally, the execution module 904 is specifically configured to determine the function boundary information corresponding to the target machine code and the data type corresponding to each instruction data included in the target machine code according to the feature representation corresponding to the target machine code; and perform disassembly on the target machine code according to the function boundary information corresponding to the target machine code and the data type corresponding to each instruction data included in the target machine code, to obtain the assembly code.

[0288] Optionally, the execution module 904 is specifically configured to determine, for each instruction data, whether the data type corresponding to the instruction data is instruction data, the instruction data including ARM instructions and Thumb instructions; and if yes, perform disassembly on the instruction data.

[0289] Optionally, the execution module 904 is further configured to, for each instruction data included in the target machine code, if the data type corresponding to the instruction data is inline data, not perform disassembly on the instruction data.

[0290] The specification also provides a computer-readable storage medium storing a computer program, the computer program being used to execute the above Figure 1 or Figure 7 model training or task execution method.

[0291] The specification also provides a computer program product including a computer program, the computer program being used to execute the above Figure 10 model training or task execution method. Figure 1 or Figure 7 electronic device corresponding to the above Figure 4 model training or task execution method. As described above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory and a non-volatile memory, and of course can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the above Figure 1 or Figure 7 model training or task execution method. Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0292] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0293] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0294] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0295] For the sake of description, the above apparatuses are described in various units with functions respectively. Of course, the functions of the units can be implemented in one or more software and / or hardware in implementing the present specification.

[0296] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system or a computer program product. Therefore, the present specification can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0297] The specification is presented with reference to flow diagrams and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0298] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0299] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus or computer program product according to embodiments of the specification. Flow diagrams and / or block diagrams can also present a method, apparatus or computer program product to achieve functions specified in flow diagrams and / or block diagrams block or blocks.

[0300] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0301] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or volatile / non-volatile random access memory (RAM), among others. The memory is an example of computer-readable media.

[0302] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0303] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0304] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0305] The present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0306] The various embodiments described in this specification are described using a numbering of embodiments approach: these are each individually integrated contributions pertaining to different aspects of the description. For each embodiment, the description focuses on the differences from the other embodiments. Each embodiment is to be read in isolation, with the understanding that the same or similar features from other embodiments can be combined with the features of the respective embodiment. In particular, the description of the system embodiments is kept relatively short, as the system embodiments are largely analogous to the method embodiments.

[0307] The above only describes the embodiments of the present specification and is not intended to limit the present specification. The present specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A model training method, comprising: obtaining advanced reduced instruction set (ARM) machine code, wherein the ARM machine code comprises a plurality of instruction data, and the plurality of instruction data is executed according to a preset logical execution order; inputting the ARM machine code into a preset disassembly model, so as to perform mask processing on at least part of the instruction data comprised in the ARM machine code by the disassembly model, to obtain first mask data according to the instruction data after mask processing and the instruction data without mask processing, and determine a feature representation corresponding to the first mask data as a first feature, and for each instruction data, perform mask processing on at least part of data units comprised in the instruction data by the disassembly model, to obtain second mask data corresponding to the instruction data, and determine a feature representation of the second mask data corresponding to the instruction data as a second feature corresponding to the instruction data; inputting the first feature into a preset decoding model, so that the decoding model determines position information corresponding to the masked instruction data in the ARM machine code as predicted position information according to the first feature, and inputting the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts the masked data units in each instruction data according to the second feature corresponding to each instruction data to obtain a prediction value; determining a target loss function according to a deviation between the prediction value and an actual value corresponding to the masked data units in each instruction data, and a deviation between the predicted position information and actual position information corresponding to the masked instruction data in the ARM machine code, and taking minimizing the target loss function as an optimization target to at least train the disassembly model.

2. The method of claim 1, wherein the feature representation corresponding to the first mask data is determined, specifically comprising: determining the feature representation corresponding to the first mask data by a first feature extraction network arranged in the disassembly model.

3. The method of claim 1, wherein the feature representation of the second mask data corresponding to the instruction data is determined as the second feature corresponding to the instruction data, specifically comprising: determining the feature representation of the second mask data corresponding to the instruction data as the second feature corresponding to the instruction data by a second feature extraction network arranged in the disassembly model.

4. The method of claim 1, wherein for each instruction data, the mask processing is performed on at least part of the data units comprised in the instruction data by the disassembly model to obtain the second mask data corresponding to the instruction data, specifically comprising: for each instruction data, performing mask processing on at least part of the data units comprised in the instruction data according to a preset mask proportion by the disassembly model to obtain the second mask data corresponding to the instruction data.

5. The method of claim 1, wherein for each instruction data, the mask processing is performed on at least part of the data units comprised in the instruction data by the disassembly model to obtain the second mask data corresponding to the instruction data, specifically comprising: For each instruction data, according to a data type corresponding to the instruction data, determine a mask strategy corresponding to the instruction data by the disassembly model; According to the mask strategy corresponding to the instruction data, determine a field type corresponding to a data unit to be masked in the instruction data as a target field type; Mask the data unit in the instruction field belonging to the target field type in the instruction data to obtain the second mask data corresponding to the instruction data.

6. The method of claim 1, for each instruction data, at least part of the data units contained in the instruction data are masked by the disassembly model to obtain the second mask data corresponding to the instruction data, specifically comprising: For each instruction data, at least part of the data units contained in the instruction data are masked according to a preset mask ratio by the disassembly model to obtain the third mask data corresponding to the instruction data, and for each instruction data, according to a data type corresponding to the instruction data, determine a mask strategy corresponding to the instruction data; according to the mask strategy corresponding to the instruction data, determine a field type corresponding to a data unit to be masked in the instruction data as a target field type; mask the data unit in the instruction field belonging to the target field type in the instruction data to obtain the fourth mask data corresponding to the instruction data; According to the third mask data and the fourth mask data corresponding to the instruction data, determine the second mask data corresponding to the instruction data.

7. The method of claim 1, determining the feature representation corresponding to the first mask data as a first feature, specifically comprising: For each instruction data contained in the first mask data, determine the position information corresponding to the instruction data in the first mask data, the position information comprising the position encoding and the boundary information of the instruction data in the first mask data, the boundary information being used to represent the starting character and the ending character of the instruction data in the first mask data; According to the position information corresponding to each instruction data, determine the first feature.

8. The method of claim 1, determining the feature representation of the second mask data corresponding to the instruction data as the second feature corresponding to the instruction data: For each data unit contained in the second mask data corresponding to the instruction data, determine the one-hot encoding corresponding to the data unit and the position encoding of the data unit in the instruction data to which the data unit belongs; According to the one-hot encoding and the position encoding, determine the initial feature corresponding to the data unit; According to the weight between the data unit and each other data unit contained in the second mask data corresponding to the instruction data, and the initial feature corresponding to each data unit contained in the second mask data corresponding to the instruction data, determine the feature representation corresponding to the data unit; According to the feature representation corresponding to each data unit in the instruction data, determine the second feature corresponding to the data unit.

9. The method of claim 1, the method further comprising: determining a target feature corresponding to the ARM machine code according to the first feature and the second feature; determining a data type corresponding to each instruction data as a predicted data type according to the target feature; determining a classification loss value according to a deviation between the predicted data type and an actual data type corresponding to each instruction data; re-training the disassembly model with minimizing the classification loss value as an optimization target.

10. The method of claim 1, further comprising: determining a target feature corresponding to the ARM machine code according to the first feature and the second feature; determining function boundary information corresponding to the ARM machine code as predicted function boundary information according to the target feature; determining a boundary loss value according to a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code; re-training the disassembly model with minimizing the boundary loss value as an optimization target.

11. The method of claim 1, further comprising: determining a target feature corresponding to the ARM machine code according to the first feature and the second feature; determining a data type corresponding to each instruction data as a predicted data type and determining function boundary information corresponding to the ARM machine code as predicted function boundary information according to the target feature; determining a comprehensive loss value according to a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code and a deviation between the predicted function boundary information and actual function boundary information corresponding to the ARM machine code; re-training the disassembly model with minimizing the comprehensive loss value as an optimization target.

12. A task execution method, comprising: obtaining an ARM machine code that needs to be disassembled as a target machine code; inputting the target machine code into a pre-trained disassembly model to determine a feature representation corresponding to the target machine code through the disassembly model, wherein the disassembly model is trained through the method of any one of claims 1-11; disassembling the target machine code according to the feature representation corresponding to the target machine code to obtain an assembly code corresponding to the target machine code, and executing a task according to the assembly code.

13. The method of claim 12, determining a feature representation corresponding to the target machine code through the disassembly model specifically comprises: determining a first feature corresponding to the target machine code through a first feature extraction network arranged in the disassembly model, and determining a second feature corresponding to the target machine code through a second feature extraction network arranged in the disassembly model; determining the feature representation corresponding to the target machine code according to the first feature and the second feature.

14. The method of claim 12, disassembling the target machine code according to the feature representation corresponding to the target machine code to obtain an assembly code corresponding to the target machine code specifically comprises: determine function boundary information corresponding to the target machine code and data types corresponding to each instruction data included in the target machine code according to the feature representation corresponding to the target machine code; perform disassembly on the target machine code according to the function boundary information corresponding to the target machine code and the data types corresponding to each instruction data included in the target machine code, to obtain the assembly code.

15. The method of claim 14, wherein the disassembly on the target machine code according to the function boundary information corresponding to the target machine code and the data types corresponding to each instruction data included in the target machine code, to obtain the assembly code, specifically comprises: for each instruction data, determining whether the data type corresponding to the instruction data is instruction data, wherein the instruction data includes ARM instructions and Thumb instructions; if yes, performing disassembly on the instruction data.

16. The method of claim 15, further comprising: for each instruction data included in the target machine code, if the data type corresponding to the instruction data is inline data, not performing disassembly on the instruction data.

17. A model training apparatus, comprising: an acquisition module configured to acquire an ARM machine code, wherein the ARM machine code includes a plurality of instruction data, and the plurality of instruction data is executed according to a preset logical execution order; an input module configured to input the ARM machine code into a preset disassembly model, so as to perform mask processing on at least part of the instruction data included in the ARM machine code through the disassembly model, to obtain first mask data according to the instruction data after mask processing and the instruction data without mask processing, and determine a feature representation of the first mask data as a first feature, and for each instruction data, perform mask processing on at least part of data units included in the instruction data through the disassembly model, to obtain second mask data corresponding to the instruction data, and determine a feature representation of the second mask data corresponding to the instruction data as a second feature corresponding to the instruction data; a prediction module configured to input the first feature into a preset decoding model, so that the decoding model determines position information of the instruction data after mask processing in the ARM machine code as predicted position information according to the first feature, and input the second feature corresponding to each instruction data into the decoding model, so that the decoding model predicts the data units after mask processing in each instruction data according to the second feature corresponding to each instruction data, to obtain a prediction value; a training module configured to determine a target loss function according to a deviation between the prediction value and an actual value corresponding to the data units after mask processing in each instruction data, and a deviation between the predicted position information and actual position information of the instruction data after mask processing in the ARM machine code, and train at least the disassembly model with a minimization of the target loss function as an optimization target.

18. A task execution apparatus, comprising: An obtaining module is configured to obtain ARM machine code that needs to be disassembled as target machine code; A determining module is configured to input the target machine code into a pre-trained disassembly model to determine a feature representation corresponding to the target machine code through the disassembly model, wherein the disassembly model is trained through the method in any one of claims 1-11. An executing module is configured to disassemble the target machine code according to the feature representation corresponding to the target machine code to obtain assembly code corresponding to the target machine code, and execute a task according to the assembly code. 19.A computer readable storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the method in any one of claims 1-15. 20.An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor implementing the method in any one of claims 1-15 when executing the program.

Images