Binary file instruction segment identification method and device, electronic equipment and medium

Abstract

The invention provides an instruction segment identification method and device of a binary file, electronic equipment and a medium, and relates to the technical field of computers, a target control flow transfer instruction is acquired from a target binary file according to a byte sequence mode of the control flow transfer instruction; determining an instruction point according to the address of the target control flow transfer instruction and the target address; and based on the boundary line of the rectangular region, the address range of the distributed scatter diagram, the width of the distributed scatter diagram and the height of the distributed scatter diagram, obtaining the starting position and the ending position of the instruction segment in the address space so as to identify the instruction segment. When the data segment and the instruction segment are distinguished, the method mainly depends on the centralized distribution characteristic of the control flow transfer instruction. The concentrated distribution feature can remain stable in binary code constructed by a variety of compilation optimization settings relative to byte features of a control flow transfer instruction. According to the invention, the precision of identifying the instruction segment in the binary file is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, electronic device and medium for identifying instruction segments of a binary file. Background Art

[0002] Binary program analysis is mainly carried out on instructions. Usually, the instruction segment information in a binary file can be parsed from the header structure of the binary file. The file headers of executable programs in Portable Executable (PE) format and executable programs in Executable and Linkable Format (ELF) format contain information about the organizational structure of the program file content, indicating the division boundary between the data segment and the code segment in the program. With the help of this auxiliary information stored in the file header, users can easily locate the instruction segment in the binary file (target executable file).

[0003] However, not all binary files to be analyzed contain a known file format for indicating the layout of the file content. For some single firmware developed based on real-time operating systems and used for embedded devices, its executable code and related static data, and even resource files, may be packaged into the same firmware file without a known format.

[0004] The existing method of identifying instruction segments in binary files is to identify the boundary between instruction segments and data segments based on machine learning models. This method uses the byte-level features of binary files, which will be modified or even erased in complex compilation optimization settings. These complex compilation optimization settings are very common in binary files, which makes this solution low in accuracy when processing binary files. Summary of the invention

[0005] The present invention provides a method, device, electronic device and medium for identifying instruction segments in a binary file, so as to solve the defect of low accuracy in identifying instruction segments in a binary file in the prior art and improve the accuracy of identifying instruction segments in a binary file.

[0006] The present invention provides an instruction segment recognition method for a binary file, comprising: obtaining a plurality of target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instruction; obtaining the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; using the own address as an X-axis coordinate and the target address as a Y-axis coordinate, mapping each target control flow transfer instruction into an instruction point, wherein the instruction point is located in a distribution scatter diagram with fixed width and height; identifying a rectangular area in which the instruction points are concentratedly distributed in the distribution scatter diagram, and obtaining the starting position and the ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter diagram, the width of the distribution scatter diagram and the height of the distribution scatter diagram, so as to recognize the instruction segment.

[0007] According to the instruction segment recognition method for binary files provided by the present invention, the boundary line of the rectangular area is obtained based on the following steps: obtaining the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate from all instruction points located in the rectangular area; based on the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate, obtaining the boundary line of the rectangular area.

[0008] According to the instruction segment identification method of the binary file provided by the present invention, the address range of the distribution scatter graph includes an X-axis address range and a Y-axis address range, and the address range of the distribution scatter graph is determined based on the following steps: obtaining a preset maximum X address and a preset maximum Y address of the distribution scatter graph; using [0, the preset maximum X address] as the X-axis address range; and using [0, the preset maximum Y address] as the Y-axis address range.

[0009] According to the instruction segment recognition method of the binary file provided by the present invention, based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph and the height of the distribution scatter graph, the starting position and the ending position of the instruction segment of the target binary file in the address space are obtained, including: based on the ratio of the preset maximum X address and the width of the distribution scatter graph, obtaining the X-axis address range of unit width; based on the ratio of the preset maximum Y address and the height of the distribution scatter graph, obtaining the Y-axis address range of unit height; based on the minimum X-axis coordinate, the X-axis address range of unit width, the minimum Y-axis coordinate and the Y-axis address range of unit height, calculating the starting position; based on the maximum X-axis coordinate, the X-axis address range of unit width, the maximum Y-axis coordinate and the Y-axis address range of unit height, calculating the ending position.

[0010] According to the instruction segment identification method of a binary file provided by the present invention, the calculation formulas of the starting position and the ending position are as follows.

[0011] ; in, is the starting position, is the height, is the width, is the preset maximum Y address, is the minimum Y-axis coordinate, is the minimum X-axis coordinate, is the preset maximum X address, is the end position, is the maximum Y-axis coordinate, is the maximum X-axis coordinate.

[0012] According to the instruction segment recognition method of binary files provided by the present invention, the rectangular area where instruction points are concentrated in the distribution scatter graph is recognized, including: inputting the distribution scatter graph into an image recognition model, obtaining the rectangular area of ​​the distribution scatter graph output by the image recognition model and the boundary line of the rectangular area; wherein the image recognition model is trained based on a preset convolutional network based on a sample distribution scatter graph, a first label of the sample rectangular area and a second label of the boundary line of the sample rectangular area, and the sample distribution scatter graph is obtained based on a sample control flow transfer instruction set.

[0013] According to the instruction segment identification method of binary files provided by the present invention, multiple target control flow transfer instructions are obtained from the target binary file according to the byte sequence pattern of the control flow transfer instruction, including: searching the byte sequence pattern from the target binary file to obtain multiple search positions of the byte sequence pattern; disassembling the target binary file from the multiple search positions to obtain multiple target control flow transfer instructions.

[0014] The present invention also provides an instruction segment identification device for a binary file, comprising: an instruction determination module, used to obtain multiple target control flow transfer instructions from a target binary file according to the byte sequence pattern of the control flow transfer instruction; an address determination module, used to obtain the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; a distribution scatter graph construction module, used to map each target control flow transfer instruction to an instruction point with the own address as the X-axis coordinate and the target address as the Y-axis coordinate, and the instruction point is located in a distribution scatter graph with fixed width and height; an instruction segment identification module, used to identify a rectangular area in which the instruction points are concentrated in the distribution scatter graph, and based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph and the height of the distribution scatter graph, obtain the starting position and the ending position of the instruction segment of the target binary file in the address space to identify the instruction segment.

[0015] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the instruction segment recognition method of any binary file described above is implemented.

[0016] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the instruction segment identification method of any binary file as described above is implemented.

[0017] The method, device, electronic device and medium for identifying the instruction segment of a binary file provided by the present invention obtain multiple target control flow transfer instructions from a target binary file according to the byte sequence pattern of the control flow transfer instruction; obtain the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; use the own address as the X-axis coordinate and the target address as the Y-axis coordinate to map each target control flow transfer instruction to an instruction point, and the instruction point is located in a distribution scatter diagram with fixed width and height; identify the rectangular area where the instruction points are concentrated in the distribution scatter diagram, and obtain the starting position and ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter diagram, the width of the distribution scatter diagram and the height of the distribution scatter diagram to identify the instruction segment. The present invention maps the target control flow transfer instruction to an instruction point according to the own address and the target address, which is conducive to the subsequent accurate identification of the rectangular area, and then obtains the boundary position of the instruction segment and the data segment. When distinguishing between the data segment and the instruction segment, the present invention mainly relies on the centralized distribution characteristics of the control flow transfer instruction. Compared with the byte characteristics of control flow transfer instructions, the concentrated distribution characteristics can remain stable in binary codes constructed by various compilation optimization settings. The present invention improves the accuracy of identifying instruction segments in binary files. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of the instruction segment identification method of a binary file provided by the present invention.

[0020] Figure 2 It is a schematic diagram of the distribution scatter plot and rectangular area provided by the present invention.

[0021] Figure 3 It is a structural schematic diagram of the instruction segment identification device of the binary file provided by the present invention.

[0022] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Combine the following Figure 1-Figure 4 The invention describes a method, device and electronic device for identifying instruction segments of a binary file.

[0025] Figure 1 FIG. 1 is a flow chart of the instruction segment identification method of a binary file provided by the present invention. Figure 1 As shown, the instruction segment identification method of a binary file includes S100 to S400, and each step is specifically as follows.

[0026] S100: Acquire multiple target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instructions.

[0027] Acquire multiple target control flow transfer instructions from a target binary file according to the byte sequence pattern of the control flow transfer instruction, including: searching the byte sequence pattern from the target binary file to obtain multiple search positions of the byte sequence pattern; disassembling the target binary file from the multiple search positions to obtain multiple target control flow transfer instructions.

[0028] A control flow transfer instruction is obtained from a specific instruction set. The specific instruction set includes an Advanced RISC Machine (ARM). The control flow transfer instruction includes a function call instruction and a jump instruction, such as a call instruction and a jmp instruction. A byte sequence pattern of the control flow transfer instruction is obtained. A search is performed in a target binary file according to the byte sequence pattern to obtain a plurality of search positions of the byte sequence pattern. Each search position is used as a position of the control flow transfer instruction. The target binary file is disassembled from each search position to obtain a plurality of target control flow transfer instructions.

[0029] The present invention searches and disassembles the target binary file through the byte sequence pattern of the control flow transfer instruction to obtain the target control flow transfer instruction, thereby realizing the identification of the target control flow transfer instruction (potential real instruction) in the target binary file.

[0030] S200: Acquire the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction.

[0031] Analyze each target control flow transfer instruction, and extract the own address and target address of the target control flow transfer instruction.

[0032] S300: With its own address as the X-axis coordinate and the target address as the Y-axis coordinate, each target control flow transfer instruction is mapped to an instruction point, and the instruction point is located in a distribution scatter diagram with fixed width and height.

[0033] For each target control flow transfer instruction, its own address is used as the X-axis coordinate and its target address is used as the Y-axis coordinate, and it is mapped into a distribution scatter diagram to obtain a distribution scatter diagram containing multiple instruction points.

[0034] The width and height of the distribution scatter plot are fixed, representing fixed pixels. For example, the width of the distribution scatter plot is W pixels, and the height of the distribution scatter plot is H pixels.

[0035] S400: Identify the rectangular area where instruction points are concentrated in the distribution scatter graph, and obtain the starting position and ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph, and the height of the distribution scatter graph to identify the instruction segment.

[0036] Obtain a preset address range of a distribution scatter plot, for example, the address range of the distribution scatter plot includes an X-axis address range and a Y-axis address range. Obtain an X-axis address range of unit width according to a ratio of the X-axis address range to the width of the distribution scatter plot. Obtain a Y-axis address range of unit height according to a ratio of the Y-axis address range to the height of the distribution scatter plot.

[0037] Obtain the rectangular area where the instruction points are concentrated from the distribution scatter plot. Identify the boundary line of the rectangular area. The rectangular area represents the concentrated distribution characteristics of the control flow transfer instructions.

[0038] The starting position and the ending position of the instruction segment of the target binary file in the address space are obtained according to the boundary line of the rectangular area, the X-axis address range of the unit width and the Y-axis address range of the unit height.

[0039] Identify instruction segments in the target binary file based on their start and end locations.

[0040] The instruction segment identification method of the binary file provided by the embodiment of the present invention obtains multiple target control flow transfer instructions from the target binary file according to the byte sequence pattern of the control flow transfer instruction; obtains the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; uses the own address as the X-axis coordinate and the target address as the Y-axis coordinate to map each target control flow transfer instruction to an instruction point, and the instruction point is located in a distribution scatter diagram with fixed width and height; identifies the rectangular area where the instruction points are concentrated in the distribution scatter diagram, and obtains the starting position and the ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter diagram, the width of the distribution scatter diagram, and the height of the distribution scatter diagram to identify the instruction segment. The present invention maps the target control flow transfer instruction to an instruction point according to the own address and the target address, which is conducive to the subsequent accurate identification of the rectangular area, and then obtains the boundary position of the instruction segment and the data segment. The present invention mainly relies on the centralized distribution characteristics of the control flow transfer instruction when distinguishing the data segment from the instruction segment. Compared with the byte characteristics of the control flow transfer instruction, the centralized distribution characteristics can remain stable in the binary code constructed by a variety of compilation optimization settings. The present invention improves the accuracy of identifying instruction segments in binary files.

[0041] Based on the above embodiment, the boundary line of the rectangular area is obtained based on the following steps: obtaining the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate from all instruction points located in the rectangular area; based on the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate, obtaining the boundary line of the rectangular area.

[0042] Get the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate, and the minimum Y-axis coordinate from all instruction points located in the rectangular area.

[0043] Determine the maximum X-axis boundary line based on the maximum X-axis coordinate. Determine the minimum X-axis boundary line based on the minimum X-axis coordinate. Determine the maximum Y-axis boundary line based on the maximum Y-axis coordinate. Determine the minimum Y-axis boundary line based on the minimum Y-axis coordinate.

[0044] The boundary line of the rectangular area is determined according to the maximum X-axis boundary line, the minimum X-axis boundary line, the maximum Y-axis boundary line and the minimum Y-axis boundary line.

[0045] The present invention determines the boundary line of the rectangular area according to the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate, thereby improving the accuracy of determining the boundary line of the rectangular area.

[0046] Based on the above embodiment, the address range of the distribution scatter graph includes an X-axis address range and a Y-axis address range, and the address range of the distribution scatter graph is determined based on the following steps: obtaining a preset maximum X address and a preset maximum Y address of the distribution scatter graph; using [0, the preset maximum X address] as the X-axis address range; and using [0, the preset maximum Y address] as the Y-axis address range.

[0047] When the preset maximum X address of the distribution scatter plot ( ) and the preset maximum Y address ( ) is determined, the X-axis address range is [0, The Y-axis address range is [0, ].

[0048] The present invention determines the X-axis address range according to the preset maximum X address, and realizes the mapping of the maximum self address of the control flow transfer instruction to the X-axis of the distribution scatter diagram. The Y-axis address range is determined according to the preset maximum Y address, and realizes the mapping of the maximum target address of the control flow transfer instruction to the Y-axis of the distribution scatter diagram. The preliminary construction of the distribution scatter diagram is realized according to the X-axis address range and the Y-axis address range.

[0049] Based on the above embodiment, based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph, and the height of the distribution scatter graph, the starting position and the ending position of the instruction segment of the target binary file in the address space are obtained, including: based on the ratio of a preset maximum X address and the width of the distribution scatter graph, obtaining an X-axis address range of unit width; based on the ratio of a preset maximum Y address and the height of the distribution scatter graph, obtaining a Y-axis address range of unit height; based on the minimum X-axis coordinate, the X-axis address range of unit width, the minimum Y-axis coordinate, and the Y-axis address range of unit height, calculating the starting position; based on the maximum X-axis coordinate, the X-axis address range of unit width, the maximum Y-axis coordinate, and the Y-axis address range of unit height, calculating the ending position.

[0050] The calculation formulas for the starting position and the ending position are as follows.

[0051] ; in, is the starting position, is the height, is the width, is the preset maximum Y address, is the minimum Y-axis coordinate, is the minimum X-axis coordinate, is the preset maximum X address, is the end position, is the maximum Y-axis coordinate, is the maximum X-axis coordinate.

[0052] , , , , , , and The units are all pixels. The X-axis address range is unit width. The Y-axis address range is unit height.

[0053] The present invention gives the meaning of the X-axis address to the unit width by determining the X-axis address range of the unit width. The meaning of the Y-axis address is given to the unit height by determining the Y-axis address range of the unit height. The starting position is calculated according to the minimum X-axis coordinate, the X-axis address range of the unit width, the minimum Y-axis coordinate and the Y-axis address range of the unit height, so that the starting position is determined according to the minimum boundary of the rectangular area, and the accuracy of determining the starting position is improved. The ending position is calculated according to the maximum X-axis coordinate, the X-axis address range of the unit width, the maximum Y-axis coordinate and the Y-axis address range of the unit height, so that the accuracy of determining the ending position is improved.

[0054] Based on the above embodiment, the rectangular area where instruction points in the distribution scatter graph are concentrated is identified, including: inputting the distribution scatter graph into an image recognition model, and obtaining the rectangular area of ​​the distribution scatter graph output by the image recognition model and the boundary line of the rectangular area; wherein the image recognition model is trained based on a preset convolutional network based on the sample distribution scatter graph, the first label of the sample rectangular area and the second label of the boundary line of the sample rectangular area, and the sample distribution scatter graph is obtained based on the sample control flow transfer instruction set.

[0055] The image recognition model includes the Mask R-CNN model. The sample instruction points are determined according to multiple sample control flow transfer instructions to obtain a sample distribution scatter plot. The sample rectangular area (first label) and the boundary line of the sample rectangular area (second label) are marked in the sample distribution scatter plot to obtain a training sample with a label.

[0056] The preset convolutional network is trained, tested and verified according to the labeled training samples to obtain the image recognition model.

[0057] The distribution scatter plot is input into the trained image recognition model to obtain the rectangular area and the boundary line of the rectangular area of ​​the distribution scatter plot output by the image recognition model.

[0058] The image recognition model trained under a sample control flow transfer instruction set can be migrated to other instruction sets without secondary training.

[0059] The present invention realizes automatic recognition of the rectangular area and the boundary line of the rectangular area of ​​the distribution scatter diagram according to the image recognition model, which is beneficial to improving the efficiency of recognizing the instruction segment of the binary file.

[0060] The centralized distribution characteristic of the control flow transfer instructions used in the present invention is a highly abstract feature, which can remain stable in a variety of compilation optimization options and is well adapted to the characteristics of a single firmware (target binary file).

[0061] The following is a description of the instruction segment recognition device for a binary file provided by the present invention. The instruction segment recognition device for a binary file described below and the instruction segment recognition method for a binary file described above can be referenced to each other.

[0062] like Figure 3 As shown, an instruction segment identification device for a binary file includes: an instruction determination module 301, which is used to obtain multiple target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instruction.

[0063] The address determination module 302 is used to obtain the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction.

[0064] The distribution scatter plot construction module 303 is used to map each target control flow transfer instruction to an instruction point with its own address as the X-axis coordinate and the target address as the Y-axis coordinate. The instruction point is located in a distribution scatter plot with fixed width and height.

[0065] The instruction segment identification module 304 is used to identify the rectangular area where the instruction points are concentrated in the distribution scatter graph, and obtain the starting position and ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph and the height of the distribution scatter graph to identify the instruction segment.

[0066] The instruction segment identification device of the binary file provided by the embodiment of the present invention obtains multiple target control flow transfer instructions from the target binary file according to the byte sequence pattern of the control flow transfer instruction; obtains the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; uses the own address as the X-axis coordinate and the target address as the Y-axis coordinate to map each target control flow transfer instruction to an instruction point, and the instruction point is located in a distribution scatter diagram with fixed width and height; identifies the rectangular area where the instruction points are concentrated in the distribution scatter diagram, and obtains the starting position and the ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter diagram, the width of the distribution scatter diagram, and the height of the distribution scatter diagram to identify the instruction segment. The present invention maps the target control flow transfer instruction to an instruction point according to the own address and the target address, which is conducive to the subsequent accurate identification of the rectangular area, and then obtains the boundary position of the instruction segment and the data segment. When distinguishing between the data segment and the instruction segment, the present invention mainly relies on the centralized distribution characteristics of the control flow transfer instruction. Compared with the byte characteristics of the control flow transfer instruction, the centralized distribution characteristics can remain stable in the binary code constructed by a variety of compilation optimization settings. The present invention improves the accuracy of identifying instruction segments in binary files.

[0067] In one embodiment, the instruction segment identification module 304 is further used to: obtain the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate from all instruction points located in the rectangular area; and obtain the boundary line of the rectangular area based on the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate and the minimum Y-axis coordinate.

[0068] In one embodiment, the address range of the distribution scatter graph includes an X-axis address range and a Y-axis address range, and the distribution scatter graph construction module 303 is further used to: obtain a preset maximum X address and a preset maximum Y address of the distribution scatter graph; use [0, the preset maximum X address] as the X-axis address range; and use [0, the preset maximum Y address] as the Y-axis address range.

[0069] In one embodiment, the instruction segment identification module 304 is used to: obtain an X-axis address range of unit width based on a ratio of a preset maximum X address and a width of the distribution scatter diagram; obtain a Y-axis address range of unit height based on a ratio of a preset maximum Y address and a height of the distribution scatter diagram; calculate a starting position based on a minimum X-axis coordinate, an X-axis address range of unit width, a minimum Y-axis coordinate, and a Y-axis address range of unit height; and calculate an end position based on a maximum X-axis coordinate, an X-axis address range of unit width, a maximum Y-axis coordinate, and a Y-axis address range of unit height.

[0070] In one embodiment, the calculation formulas for the start position and the end position are as follows.

[0071] ; in, is the starting position, is the height, is the width, is the preset maximum Y address, is the minimum Y-axis coordinate, is the minimum X-axis coordinate, is the preset maximum X address, is the end position, is the maximum Y-axis coordinate, is the maximum X-axis coordinate.

[0072] In one embodiment, the instruction segment identification module 304 is used to: input the distribution scatter plot into the image recognition model, and obtain the rectangular area and the boundary line of the rectangular area of ​​the distribution scatter plot output by the image recognition model; wherein the image recognition model is trained based on a preset convolutional network based on the sample distribution scatter plot, the first label of the sample rectangular area and the second label of the boundary line of the sample rectangular area, and the sample distribution scatter plot is obtained based on the sample control flow transfer instruction set.

[0073] In one embodiment, the instruction determination module 301 is used to: search for a byte sequence pattern from a target binary file to obtain multiple search positions of the byte sequence pattern; and disassemble the target binary file from the multiple search positions to obtain multiple target control flow transfer instructions.

[0074] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the instruction segment identification method of the binary file, the method comprising: obtaining multiple target control flow transfer instructions from the target binary file according to the byte sequence pattern of the control flow transfer instruction; obtaining the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; using the own address as the X-axis coordinate and the target address as the Y-axis coordinate, mapping each target control flow transfer instruction to an instruction point, the instruction point being located in a distribution scatter diagram with fixed width and height; identifying the rectangular area where the instruction points are concentrated in the distribution scatter diagram, and obtaining the starting position and the ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter diagram, the width of the distribution scatter diagram and the height of the distribution scatter diagram to identify the instruction segment.

[0075] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0076] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an instruction segment identification method for a binary file provided by the above-mentioned methods, the method comprising: obtaining multiple target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instruction; obtaining the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; mapping each target control flow transfer instruction to an instruction point with the own address as the X-axis coordinate and the target address as the Y-axis coordinate, and the instruction point is located in a distribution scatter plot with fixed width and height; identifying a rectangular area in which instruction points are concentrated in the distribution scatter plot, and obtaining the starting position and ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter plot, the width of the distribution scatter plot, and the height of the distribution scatter plot to identify the instruction segment.

[0077] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0078] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying instruction segments of a binary file, characterized in that: include: Obtain a plurality of target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instructions; Obtaining the own address of each of the target control flow transfer instructions and the target address of each of the target control flow transfer instructions; Taking the own address as the X-axis coordinate and the target address as the Y-axis coordinate, mapping each of the target control flow transfer instructions into an instruction point, wherein the instruction point is located in a distribution scatter diagram with fixed width and height; Identify the rectangular area in which the instruction points in the distribution scatter graph are concentrated, and based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph, and the height of the distribution scatter graph, obtain the starting position and the ending position of the instruction segment of the target binary file in the address space to identify the instruction segment.

2. The method for identifying instruction segments of a binary file according to claim 1, characterized in that: The boundary line of the rectangular area is obtained based on the following steps: Acquire a maximum X-axis coordinate, a minimum X-axis coordinate, a maximum Y-axis coordinate, and a minimum Y-axis coordinate from all the instruction points located in the rectangular area; A boundary line of the rectangular area is acquired based on the maximum X-axis coordinate, the minimum X-axis coordinate, the maximum Y-axis coordinate, and the minimum Y-axis coordinate.

3. The method for identifying instruction segments of a binary file according to claim 2, characterized in that: The address range of the distribution scatter diagram includes an X-axis address range and a Y-axis address range, and the address range of the distribution scatter diagram is determined based on the following steps: Obtaining a preset maximum X address and a preset maximum Y address of the distribution scatter plot; [0, preset maximum X address] is used as the X-axis address range; [0, preset maximum Y address] is used as the Y-axis address range.

4. The method for identifying instruction segments of a binary file according to claim 3, characterized in that: The step of obtaining the starting position and the ending position of the instruction segment of the target binary file in the address space based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph, and the height of the distribution scatter graph includes: Based on the ratio of the preset maximum X address and the width of the distribution scatter plot, obtaining an X-axis address range of unit width; Based on the ratio of the preset maximum Y address and the height of the distribution scatter plot, a Y-axis address range of unit height is obtained; Calculating the starting position based on the minimum X-axis coordinate, the X-axis address range of the unit width, the minimum Y-axis coordinate, and the Y-axis address range of the unit height; The end position is calculated based on the maximum X-axis coordinate, the X-axis address range of the unit width, the maximum Y-axis coordinate, and the Y-axis address range of the unit height.

5. The method for identifying instruction segments of a binary file according to claim 4, characterized in that: The calculation formulas for the starting position and the ending position are as follows: ； in, is the starting position, is the height, is the width, is the preset maximum Y address, is the minimum Y-axis coordinate, is the minimum X-axis coordinate, is the preset maximum X address, is the end position, is the maximum Y-axis coordinate, is the maximum X-axis coordinate.

6. The method for identifying instruction segments of a binary file according to claim 1, characterized in that: The identifying the rectangular area where the instruction points are concentrated in the distribution scatter diagram includes: Inputting the distribution scatter plot into an image recognition model, and obtaining the rectangular area and the boundary line of the rectangular area of ​​the distribution scatter plot output by the image recognition model; Among them, the image recognition model is trained based on a preset convolutional network, based on a sample distribution scatter plot, a first label of a sample rectangular area, and a second label of a boundary line of the sample rectangular area, and the sample distribution scatter plot is obtained based on a sample control flow transfer instruction set.

7. The method for identifying instruction segments of a binary file according to claim 1, characterized in that: The step of obtaining a plurality of target control flow transfer instructions from a target binary file according to the byte sequence pattern of the control flow transfer instruction comprises: Searching the byte sequence pattern from the target binary file to obtain a plurality of search positions of the byte sequence pattern; The target binary file is disassembled from the plurality of search locations to obtain a plurality of the target control flow transfer instructions.

8. A device for identifying instruction segments of a binary file, characterized in that: include: an instruction determination module, configured to obtain a plurality of target control flow transfer instructions from a target binary file according to a byte sequence pattern of the control flow transfer instructions; An address determination module, used for obtaining the own address of each target control flow transfer instruction and the target address of each target control flow transfer instruction; A distribution scatter plot construction module, used to map each of the target control flow transfer instructions into an instruction point with the own address as the X-axis coordinate and the target address as the Y-axis coordinate, wherein the instruction point is located in a distribution scatter plot with fixed width and height; An instruction segment identification module is used to identify the rectangular area where the instruction points in the distribution scatter graph are concentrated, and based on the boundary line of the rectangular area, the address range of the distribution scatter graph, the width of the distribution scatter graph and the height of the distribution scatter graph, obtain the starting position and the ending position of the instruction segment of the target binary file in the address space to identify the instruction segment.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method for identifying instruction segments of a binary file according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying instruction segments of a binary file according to any one of claims 1 to 7 is implemented.

Images