A data structure reconstruction method, apparatus, electronic device, and readable storage medium

Abstract

This application provides a data structure reconstruction method, apparatus, electronic device, and readable storage medium. The method includes: performing static analysis on a UEFI firmware binary file to initially reconstruct the initial data structure of the UEFI firmware input data; constructing a UEFI structured rule knowledge base, wherein the UEFI structured rule knowledge base contains multiple structure definitions; matching the initial data structure with each structure definition in the UEFI structured rule knowledge base to determine the target structure definition with the highest matching degree; and correcting the initial data structure using the structure definition fields in the target structure definition to obtain the reconstructed target data structure of the UEFI firmware input data. This method improves the reconstruction accuracy when reconstructing the data structure of UEFI firmware input data.

Description

Technical Field

[0001] This application relates to the fields of binary reverse engineering and program analysis technology, and in particular to a data structure reconstruction method, apparatus, electronic device and readable storage medium. Background Technology

[0002] UEFI (Unified Extensible Firmware Interface) firmware is the first software that runs when a computer starts up. It is responsible for initializing hardware devices, loading drivers, and providing a stable boot environment for the operating system when the computer starts up.

[0003] As UEFI firmware plays an increasingly central role in modern computer systems, its security research has become a focus of the industry. However, reverse engineering the data structure of UEFI firmware input data still faces significant challenges. Currently, reverse engineering the data structure of UEFI firmware input data mainly relies on traditional decompilation tools (which are static analysis tools). Because traditional decompilation tools are general-purpose tools, they cannot perfectly adapt to the characteristics of UEFI firmware, resulting in limited reconstruction accuracy when using traditional decompilation tools (static analysis tools) to reconstruct the data structure of UEFI firmware input data. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a data structure reconstruction method, apparatus, electronic device and readable storage medium to improve the reconstruction accuracy when reconstructing the data structure of input data of UEFI firmware.

[0005] In a first aspect, embodiments of this application provide a data structure reconstruction method, including:

[0006] Static analysis of the UEFI firmware binary file is performed to initially reconstruct the initial data structure of the input data of the UEFI firmware.

[0007] Construct a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions;

[0008] The initial data structure is matched with each structure definition in the UEFI structured rule knowledge base, and the target structure definition with the highest matching degree is determined from the UEFI structured rule knowledge base;

[0009] The initial data structure is modified using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0010] In conjunction with the first aspect, this application provides a first possible implementation of the first aspect, wherein static analysis is performed on the UEFI firmware binary file using a static analysis method to initially reconstruct the initial data structure of the UEFI firmware input data, including:

[0011] The UEFI firmware binary file is input into the adjusted disassembler engine, which parses the UEFI firmware binary file to obtain an intermediate representation of the UEFI firmware; wherein, the disassembler engine is adjusted based on the data structure in the UEFI firmware binary file.

[0012] Based on the intermediate representation, memory access instructions for each access object are determined during the operation of the UEFI firmware; wherein, the memory access instructions contain multiple memory access fields; the memory access fields contain the access object and offset corresponding to the memory access field, as well as the base address of the access object;

[0013] For each accessed object, by analyzing each memory access field in the memory access instruction of the accessed object, the frequency of different offset access patterns and different offset memory access fields for the same base address are obtained; wherein, the offset access pattern is determined based on the offset and bit width of the memory access field; different offset memory access fields correspond to different offsets;

[0014] For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the initial data structure of the input data of the UEFI firmware corresponding to the access object is initially reconstructed.

[0015] In conjunction with the first possible implementation of the first aspect, this application provides a second possible implementation of the first aspect, wherein, for memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the initial data structure of the input data of the UEFI firmware corresponding to the access object is initially reconstructed, including:

[0016] For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the data structure to be adjusted for the input data of the UEFI firmware corresponding to the access object is initially reconstructed.

[0017] Based on the frequency of different offset access modes corresponding to the access object, the offset access mode with the highest frequency is selected, and the number of bits of the data structure to be adjusted is adjusted according to the number of bits corresponding to the offset access mode with the highest frequency, so as to obtain the initial data structure of the input data of the UEFI firmware corresponding to the access object.

[0018] In conjunction with the first possible implementation of the first aspect, this application provides a third possible implementation of the first aspect, wherein constructing a UEFI structured rule knowledge base includes:

[0019] Extract header files from the open-source UEFI project, parse the structure definitions in the header files, and determine the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each structure definition field contained in the structure definition.

[0020] For each processor architecture used to run the UEFI firmware, a default alignment rule is determined for different processor architectures;

[0021] Determine the alignment constraints of the specified special structure in the UEFI firmware;

[0022] Based on the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each field in the structure definition, as well as the default alignment rules for different processor architectures and the alignment constraints for specific structures, a UEFI structured rule knowledge base is constructed.

[0023] In conjunction with the third possible implementation of the first aspect, this application provides a fourth possible implementation of the first aspect, wherein matching the initial data structure with each of the structure definitions in the UEFI structured rule knowledge base includes:

[0024] For each structure definition in the UEFI structured rule knowledge base, calculate the similarity between the offset of each field in the initial data structure and the offset of each structure definition field in the structure definition, and obtain the similarity result;

[0025] Determine whether the length of each field in the initial data structure matches the length of each field in the structure definition to obtain the first determination result;

[0026] Determine whether the initial data structure conforms to the memory alignment rules to obtain a second determination result; wherein, the memory alignment rules include the type alignment rules, the default alignment rules, and the alignment constraints;

[0027] Based on the similarity result, the first judgment result, and the second judgment result, the matching degree between the initial data structure and the structure definition is determined.

[0028] In conjunction with the fourth possible implementation of the first aspect, this application provides a fifth possible implementation of the first aspect, wherein the initial data structure is modified using the structure definition field in the target structure definition to obtain the target data structure of the reconstructed UEFI firmware input data, including:

[0029] When the matching degree is greater than or equal to the first threshold, if the number of fields contained in the initial data structure is less than the number of structure definition fields in the target structure definition, then the missing fields in the initial data structure are filled in using the structure definition fields in the target structure definition.

[0030] The offsets in the fields contained in the initial data structure are corrected using the offsets in the structure definition fields of the target structure definition;

[0031] The field types of each structure definition field in the target structure definition are filled into each field in the initial data structure to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0032] In conjunction with the fifth possible implementation of the first aspect, this application provides a sixth possible implementation of the first aspect, wherein, by modifying the initial data structure using the structure definition field in the target structure definition to obtain the target data structure of the reconstructed input data of the UEFI firmware, the implementation further includes:

[0033] When the matching degree is greater than or equal to the second threshold and less than the first threshold, a manual review suggestion is generated, and the initial data structure is specially marked; the first threshold is greater than the second threshold.

[0034] When the matching degree is less than the second threshold, the optimization rule of the static analysis method is triggered to optimize the static analysis method.

[0035] Secondly, embodiments of this application also provide a data structure reconstruction apparatus, comprising:

[0036] The reconstruction module is used to perform static analysis on the UEFI firmware binary file using static analysis methods, and to initially reconstruct the initial data structure of the input data of the UEFI firmware.

[0037] A construction module is used to build a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions;

[0038] The matching module is used to match the initial data structure with each of the structure definitions in the UEFI structured rule knowledge base, and to determine the target structure definition with the highest matching degree from the UEFI structured rule knowledge base;

[0039] The correction module is used to correct the initial data structure using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0040] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps in any of the possible implementations of the first aspect described above are performed.

[0041] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps in any of the possible implementations of the first aspect described above.

[0042] This application provides a data structure reconstruction method, apparatus, electronic device, and readable storage medium. After reconstructing the initial data structure of the input data for UEFI firmware using a static analysis method, the initial data structure is matched against each structure definition in the UEFI structured rule knowledge base to determine the target structure definition with the highest matching degree. The initial data structure is then corrected using the structure definition fields in the target structure definition, thereby making the target data structure of the obtained UEFI firmware input data more accurate. Therefore, the reconstruction method of this embodiment can improve the reconstruction accuracy when reconstructing the data structure of the input data for UEFI firmware.

[0043] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1A flowchart of a data structure reconstruction method provided in an embodiment of this application is shown;

[0046] Figure 2 A flowchart of another data structure reconstruction method provided in an embodiment of this application is shown;

[0047] Figure 3 This paper shows a schematic diagram of the structure of a data structure reconstruction device provided in an embodiment of this application;

[0048] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0050] Currently, the reverse reconstruction of the data structure of UEFI firmware input data mainly relies on traditional decompilation tools (which are static analysis tools). Since these tools are general-purpose and cannot perfectly adapt to the characteristics of UEFI firmware, the reconstruction accuracy is limited when using them to reconstruct the data structure of UEFI firmware input data. Therefore, this application provides a data structure reconstruction method, apparatus, electronic device, and readable storage medium to improve the reconstruction accuracy of the data structure of UEFI firmware input data. The following embodiments describe these embodiments.

[0051] To facilitate understanding of this embodiment, a data structure reconstruction method disclosed in this application will first be described in detail. For example... Figure 1 As shown, the process includes the following steps S101-S104:

[0052] S101: Static analysis is performed on the UEFI firmware binary file to initially reconstruct the initial data structure of the input data of the UEFI firmware.

[0053] In this embodiment, a static structure reconstruction tool is used to perform static analysis on the UEFI firmware binary file to initially reconstruct the initial data structure of the UEFI firmware input data. The input data refers to the input of the UEFI firmware.

[0054] In one possible implementation, when performing step S101, such as Figure 2 As shown, the specific steps S1011-S1014 can be performed as follows:

[0055] S1011: Input the UEFI firmware binary file into the adjusted disassembler engine, and parse the UEFI firmware binary file through the disassembler engine to obtain the intermediate representation of the UEFI firmware; wherein, the disassembler engine is adjusted based on the data structure in the UEFI firmware binary file.

[0056] In this embodiment, the UEFI firmware binary file is input into the adjusted disassembler engine. The disassembler engine parses the UEFI firmware binary file by loading a predefined UEFI-specific ABI rule library to obtain an intermediate representation of the UEFI firmware.

[0057] Because the disassembler engine is based on adjustments to the data structures in the UEFI firmware binary file, the adjusted disassembler engine can more accurately parse the UEFI firmware's intermediate representation (IR). The intermediate representation is a program representation at an abstraction level between high-level programming languages ​​and machine code. As an intermediate layer in the compiler chain, it is used to transfer and process code between different compilation stages.

[0058] S1012: Based on the intermediate representation, determine the memory access instruction for each access object during the UEFI firmware operation; wherein, the memory access instruction contains multiple memory access fields; the memory access field contains the access object and offset corresponding to the memory access field, as well as the base address of the access object.

[0059] For example, memory access instructions include: {mov[base address a + offset 1], accessed object A}, {mov[base address a + offset 2], accessed object A}, {mov[base address b + offset 1], accessed object B}, {mov[base address b + offset 2], accessed object B}, and {mov[base address c + offset 2], accessed object C}. As can be seen, the memory access instructions in this example include five memory access fields. The base address is the access address of the accessed object.

[0060] S1013: For each access object, by analyzing each memory access field in the memory access instruction of the access object, the frequency of different offset access modes and different offset memory access fields for the same base address are obtained; wherein, the offset access mode is determined based on the offset and bit width of the memory access field; different offset memory access fields correspond to different offsets.

[0061] For example, the number of bits can be 16 bits or 32 bits. Offset 1, 32 bits memory access field corresponds to one offset access mode; offset 2, 32 bits memory access field corresponds to another offset access mode; similarly, offset 2, 16 bits memory access field also corresponds to other offset access modes.

[0062] Continuing with the previous example, each memory access field corresponds to its own bit width. For example, the memory access field {mov[base address a + offset 1], accessed object A} has a bit width of 16 bits; the memory access field {mov[base address a + offset 2], accessed object A} has a bit width of 16 bits; the memory access field {mov[base address b + offset 1], accessed object B} has a bit width of 32 bits; the memory access field {mov[base address b + offset 2], accessed object B} has a bit width of 32 bits; and the memory access field {mov[base address a + offset 2], accessed object A} has a bit width of 16 bits.

[0063] Therefore, in this example, the frequency of the offset access mode (offset 1, 32 bits) is 1 / 5. The frequency of the offset access mode (offset 1, 16 bits) is 1 / 5. The frequency of the offset access mode (offset 2, 32 bits) is 1 / 5. The frequency of the offset access mode (offset 2, 16 bits) is 2 / 5.

[0064] Furthermore, in this example, the memory access fields for different offsets of the same base address a are: {mov[base address a + offset 1], access object A}, {mov[base address a + offset 2], access object A}, and {mov[base address a + offset 2], access object A}.

[0065] The memory access fields for different offsets of the same base address b are: {mov[base address b + offset 1], accessed object B} and {mov[base address b + offset 2], accessed object B}.

[0066] S1014: For memory access fields with different offsets at the same base address, determine adjacent memory access fields belonging to the same structure, and based on the data access length of the access object corresponding to the base address, initially reconstruct the initial data structure of the input data of the UEFI firmware corresponding to the access object.

[0067] For example, the data access length of the access object corresponding to the base address can be 16 bits or 32 bits. If the data access length of the access object corresponding to base address a is 16 bits, then the initial data length of the input data structure of the UEFI firmware corresponding to the initially reconstructed access object A is 16 bits.

[0068] In one possible implementation, when performing step S1014, the following steps S10141-S10142 can be performed:

[0069] S10141: For memory access fields with different offsets at the same base address, determine adjacent memory access fields belonging to the same structure, and based on the data access length of the access object corresponding to the base address, initially reconstruct the data structure to be adjusted for the input data of the UEFI firmware corresponding to the access object.

[0070] S10142: Based on the frequency of different offset access modes corresponding to the access object, select the offset access mode with the highest frequency, and adjust the bit width of the data structure to be adjusted according to the bit width corresponding to the offset access mode with the highest frequency, so as to obtain the initial data structure of the input data of the UEFI firmware corresponding to the access object.

[0071] For example, if the data access length of the access object A corresponding to base address a is 16 bits, then the data length of the initially reconstructed data structure to be adjusted is 16 bits. As can be seen from the example in step S1013 above, among the frequencies of different offset access modes corresponding to access object A, the most frequent offset access mode is the offset access mode (offset 2, bit length 16 bits). Therefore, there is no need to adjust the bit length of the data structure to be adjusted at this time.

[0072] Suppose that among the different offset access modes corresponding to access object A, the most frequent offset access mode is the offset access mode (offset 2, bit length 32 bits), then the bit length of the data structure to be adjusted can be adjusted based on the 32 bits, so that the initial data structure of the input data of the UEFI firmware corresponding to access object A has a data length of 32 bits.

[0073] S102: Construct a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions.

[0074] In this embodiment, the structure definitions included in the UEFI structured rule knowledge base can be understood as standard structures. Each structure definition contains multiple structure definition fields, the offset of each structure definition field, and the number of bits in each structure definition field.

[0075] In one possible implementation, the UEFI structured rule knowledge base can be executed according to the following steps S1021-S1024:

[0076] S1021: Extract header files from open-source UEFI projects, parse the structure definitions in the header files, and determine the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each structure definition field contained in the structure definition.

[0077] S1022: Determine the default alignment rules for different processor architectures for each processor used to run UEFI firmware.

[0078] S1023: Determine the alignment constraints of a specified special structure in the UEFI firmware.

[0079] S1024: Based on the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each structure definition field contained in the structure definition, as well as the default alignment rules for different processor architectures and the alignment constraints for specified special structures, a UEFI structured rule knowledge base is constructed.

[0080] S103: Match the initial data structure with each structure definition in the UEFI structured rule knowledge base, and determine the target structure definition with the highest matching degree from the UEFI structured rule knowledge base.

[0081] In one possible implementation, when performing step S103, the following steps S1031-S1034 can be specifically performed:

[0082] S1031: For each structure definition in the UEFI structured rule knowledge base, calculate the similarity between the offset of each field in the initial data structure and the offset of each field in the structure definition, and obtain the similarity result.

[0083] S1032: Determine whether the length of each field in the initial data structure matches the length of each field in the structure definition, and obtain the first judgment result;

[0084] S1033: Determine whether the initial data structure conforms to the memory alignment rules and obtain the second judgment result; wherein, the memory alignment rules include type alignment rules, default alignment rules and alignment constraints;

[0085] S1034: Based on the similarity results, the first judgment result, and the second judgment result, determine the matching degree between the initial data structure and the structure definition.

[0086] In this embodiment, the similarity result and the matching degree are positively correlated. When the first judgment result is that the length of each field in the initial data structure matches the length of each field in the structure definition, the matching degree between the initial data structure and the structure definition is higher; conversely, when the first judgment result is that the length of each field in the initial data structure does not match the length of each field in the structure definition, the matching degree between the initial data structure and the structure definition is lower.

[0087] Similarly, when the second judgment result is that it conforms to the memory alignment rule, the higher the degree of matching between the initial data structure and the structure definition, the lower the degree of matching between the initial data structure and the structure definition.

[0088] S104: Modify the initial data structure using the structure definition fields in the target structure definition to obtain the target data structure of the input data for the reconstructed UEFI firmware.

[0089] In one possible implementation, when performing step S104, the following steps S1041-S1043 can be specifically performed:

[0090] S1041: When the matching degree is greater than or equal to the first threshold (e.g., 85%), if the number of fields contained in the initial data structure is less than the number of fields in the target structure definition, then the missing fields in the initial data structure are filled in using the fields in the target structure definition.

[0091] For example, assuming the initial data structure contains 3 fields and the target structure definition has 5 fields, the 2 missing fields in the initial data structure can be filled using the structure definition fields in the target structure definition.

[0092] S1042: Correct the offsets in the fields contained in the initial data structure using the offsets in the structure definition fields of the target structure definition.

[0093] In this embodiment, for each field in the initial data structure, the offset in that field is corrected using the offset in the corresponding structure definition field in the target structure definition.

[0094] S1043: Complete the field types of each structure definition field in the target structure definition into each field in the initial data structure to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0095] In existing technologies, the field types of each field in the initial data structure are completed by manual marking. In this embodiment, the completion method is automated, which helps to reduce the amount of manual work.

[0096] In one possible implementation, when performing step S104, the following steps may also be performed:

[0097] S1044: When the matching degree is greater than or equal to the second threshold (e.g., 60%) and less than the first threshold (e.g., 85%), generate a manual review suggestion and specially mark the initial data structure; the first threshold is greater than the second threshold.

[0098] In this embodiment, the special marker may be to highlight the initial data structure in yellow, etc., and this application does not limit it in this way.

[0099] S1045: When the matching degree is less than the second threshold, the optimization rule of static analysis is triggered to optimize the static analysis.

[0100] In this embodiment, when the matching degree is less than the second threshold, the optimization rules of the static structure reconstruction tool are triggered to optimize the static analysis. The optimized static structure reconstruction tool is then used to reconstruct the initial data structure, which is the subsequent step.

[0101] Based on the same technical concept, embodiments of this application also provide a data structure reconstruction apparatus, such as... Figure 3 As shown, the device includes:

[0102] The reconstruction module 301 is used to perform static analysis on the UEFI firmware binary file using static analysis methods to initially reconstruct the initial data structure of the input data of the UEFI firmware.

[0103] Module 302 is used to construct a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions;

[0104] The matching module 303 is used to match the initial data structure with each of the structure definitions in the UEFI structured rule knowledge base, and determine the target structure definition with the highest matching degree from the UEFI structured rule knowledge base;

[0105] The correction module 304 is used to correct the initial data structure using the structure definition field in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0106] Optionally, when the reconstruction module 301 performs static analysis on the UEFI firmware binary file using a static analysis method to initially reconstruct the initial data structure of the input data of the UEFI firmware, it is specifically used for:

[0107] The UEFI firmware binary file is input into the adjusted disassembler engine, which parses the UEFI firmware binary file to obtain an intermediate representation of the UEFI firmware; wherein, the disassembler engine is adjusted based on the data structure in the UEFI firmware binary file.

[0108] Based on the intermediate representation, memory access instructions for each access object are determined during the operation of the UEFI firmware; wherein, the memory access instructions contain multiple memory access fields; the memory access fields contain the access object and offset corresponding to the memory access field, as well as the base address of the access object;

[0109] For each accessed object, by analyzing each memory access field in the memory access instruction of the accessed object, the frequency of different offset access patterns and different offset memory access fields for the same base address are obtained; wherein, the offset access pattern is determined based on the offset and bit width of the memory access field; different offset memory access fields correspond to different offsets;

[0110] For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the initial data structure of the input data of the UEFI firmware corresponding to the access object is initially reconstructed.

[0111] Optionally, when the reconstruction module 301 determines adjacent memory access fields belonging to the same structure for memory access fields at different offsets of the same base address, and initially reconstructs the initial data structure of the input data of the UEFI firmware corresponding to the access object based on the data access length of the access object corresponding to the base address, it is specifically used for:

[0112] For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the data structure to be adjusted for the input data of the UEFI firmware corresponding to the access object is initially reconstructed.

[0113] Based on the frequency of different offset access modes corresponding to the access object, the offset access mode with the highest frequency is selected, and the number of bits of the data structure to be adjusted is adjusted according to the number of bits corresponding to the offset access mode with the highest frequency, so as to obtain the initial data structure of the input data of the UEFI firmware corresponding to the access object.

[0114] Optionally, when building the UEFI structured rule knowledge base, the construction module 302 is specifically used for:

[0115] Extract header files from the open-source UEFI project, parse the structure definitions in the header files, and determine the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each structure definition field contained in the structure definition.

[0116] For each processor architecture used to run the UEFI firmware, a default alignment rule is determined for different processor architectures;

[0117] Determine the alignment constraints of the specified special structure in the UEFI firmware;

[0118] Based on the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each field in the structure definition, as well as the default alignment rules for different processor architectures and the alignment constraints for specific structures, a UEFI structured rule knowledge base is constructed.

[0119] Optionally, when matching the initial data structure with each of the structure definitions in the UEFI structured rule knowledge base, the matching module 303 is specifically used for:

[0120] For each structure definition in the UEFI structured rule knowledge base, calculate the similarity between the offset of each field in the initial data structure and the offset of each structure definition field in the structure definition, and obtain the similarity result;

[0121] Determine whether the length of each field in the initial data structure matches the length of each field in the structure definition to obtain the first determination result;

[0122] Determine whether the initial data structure conforms to the memory alignment rules to obtain a second determination result; wherein, the memory alignment rules include the type alignment rules, the default alignment rules, and the alignment constraints;

[0123] Based on the similarity result, the first judgment result, and the second judgment result, the matching degree between the initial data structure and the structure definition is determined.

[0124] Optionally, when the correction module 304 corrects the initial data structure using the structure definition fields in the target structure definition to obtain the target data structure of the reconstructed input data of the UEFI firmware, it is specifically used for:

[0125] When the matching degree is greater than or equal to the first threshold, if the number of fields contained in the initial data structure is less than the number of structure definition fields in the target structure definition, then the missing fields in the initial data structure are filled in using the structure definition fields in the target structure definition.

[0126] The offsets in the fields contained in the initial data structure are corrected using the offsets in the structure definition fields of the target structure definition;

[0127] The field types of each structure definition field in the target structure definition are filled into each field in the initial data structure to obtain the target data structure of the input data of the reconstructed UEFI firmware.

[0128] Optionally, when the correction module 304 corrects the initial data structure using the structure definition fields in the target structure definition to obtain the target data structure of the reconstructed input data of the UEFI firmware, it is further configured to:

[0129] When the matching degree is greater than or equal to the second threshold and less than the first threshold, a manual review suggestion is generated, and the initial data structure is specially marked; the first threshold is greater than the second threshold.

[0130] When the matching degree is less than the second threshold, the optimization rule of the static analysis method is triggered to optimize the static analysis method.

[0131] Figure 4 The present application provides a schematic diagram of the structure of an electronic device, including: a processor 401, a memory 402 and a bus 403. The memory 402 stores machine-readable instructions that can be executed by the processor 401. When the electronic device runs the above-described information processing method, the processor 401 and the memory 402 communicate through the bus 403. The processor 401 executes the machine-readable instructions to perform the method steps in Embodiment 1.

[0132] This application also provides a computer-readable storage medium storing a computer program, which is executed by a processor to perform the method steps in Embodiment 1.

[0133] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, electronic devices, and computer-readable storage media described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0134] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, electronic devices, and computer-readable storage media can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0135] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0136] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0137] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0138] Finally, it should be noted that the above embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the technical scope disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A data structure reconstruction method, characterized in that, include: Static analysis of the UEFI firmware binary file is performed to initially reconstruct the initial data structure of the input data of the UEFI firmware. Construct a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions; The initial data structure is matched with each structure definition in the UEFI structured rule knowledge base, and the target structure definition with the highest matching degree is determined from the UEFI structured rule knowledge base; The initial data structure is modified using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware.

2. The method according to claim 1, characterized in that, Static analysis of the UEFI firmware binary file is performed to reconstruct the initial data structure of the UEFI firmware input data, including: The UEFI firmware binary file is input into the adjusted disassembler engine, which parses the UEFI firmware binary file to obtain an intermediate representation of the UEFI firmware; wherein, the disassembler engine is adjusted based on the data structure in the UEFI firmware binary file. Based on the intermediate representation, memory access instructions for each access object are determined during the operation of the UEFI firmware; wherein, the memory access instructions contain multiple memory access fields; the memory access fields contain the access object and offset corresponding to the memory access field, as well as the base address of the access object; For each accessed object, by analyzing each memory access field in the memory access instruction of the accessed object, the frequency of different offset access patterns and different offset memory access fields for the same base address are obtained; wherein, the offset access pattern is determined based on the offset and bit width of the memory access field; different offset memory access fields correspond to different offsets; For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are determined, and based on the data access length of the access object corresponding to the base address, the initial data structure of the input data of the UEFI firmware corresponding to the access object is initially reconstructed.

3. The method according to claim 2, characterized in that, For memory access fields with different offsets at the same base address, adjacent memory access fields belonging to the same structure are identified, and based on the data access length of the access object corresponding to the base address, the initial data structure of the input data of the UEFI firmware corresponding to the access object is initially reconstructed, including: For memory access fields with different offsets at the same base address, determine adjacent memory access fields belonging to the same structure, and based on the data access length of the access object corresponding to the base address, initially reconstruct the data structure to be adjusted for the input data of the UEFI firmware corresponding to the access object; Based on the frequency of different offset access modes corresponding to the access object, the offset access mode with the highest frequency is selected, and the number of bits of the data structure to be adjusted is adjusted according to the number of bits corresponding to the offset access mode with the highest frequency, so as to obtain the initial data structure of the input data of the UEFI firmware corresponding to the access object.

4. The method according to claim 2, characterized in that, Construct a UEFI structured rules knowledge base, including: Extract header files from the open-source UEFI project, parse the structure definitions in the header files, and determine the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each structure definition field contained in the structure definition. For each processor architecture used to run the UEFI firmware, a default alignment rule is determined for different processor architectures; Determine the alignment constraints of the specified special structure in the UEFI firmware; Based on the offsets, field types, field bit lengths, compilation instructions, and type alignment rules of each field in the structure definition, as well as the default alignment rules for different processor architectures and the alignment constraints for specific structures, a UEFI structured rule knowledge base is constructed.

5. The method according to claim 4, characterized in that, Matching the initial data structure with each of the structure definitions in the UEFI structured rules knowledge base includes: For each structure definition in the UEFI structured rule knowledge base, calculate the similarity between the offset of each field in the initial data structure and the offset of each structure definition field in the structure definition, and obtain the similarity result; Determine whether the length of each field in the initial data structure matches the length of each field in the structure definition to obtain the first determination result; Determine whether the initial data structure conforms to the memory alignment rules to obtain a second determination result; wherein, the memory alignment rules include the type alignment rules, the default alignment rules, and the alignment constraints; Based on the similarity result, the first judgment result, and the second judgment result, the matching degree between the initial data structure and the structure definition is determined.

6. The method according to claim 5, characterized in that, The initial data structure is modified using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware, including: When the matching degree is greater than or equal to the first threshold, if the number of fields contained in the initial data structure is less than the number of fields in the structure definition of the target structure, then the missing fields in the initial data structure are filled in using the fields in the structure definition of the target structure. The offsets in the fields contained in the initial data structure are corrected using the offsets in the structure definition fields of the target structure definition; The field types of each structure definition field in the target structure definition are filled into each field in the initial data structure to obtain the target data structure of the input data of the reconstructed UEFI firmware.

7. The method according to claim 6, characterized in that, The initial data structure is modified using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware, and further includes: When the matching degree is greater than or equal to the second threshold and less than the first threshold, a manual review suggestion is generated, and the initial data structure is specially marked; the first threshold is greater than the second threshold. When the matching degree is less than the second threshold, the optimization rule of the static analysis method is triggered to optimize the static analysis method.

8. A data structure reconstruction device, characterized in that, The device includes: The reconstruction module is used to perform static analysis on the UEFI firmware binary file using static analysis methods, and to initially reconstruct the initial data structure of the input data of the UEFI firmware. A construction module is used to build a UEFI structured rule knowledge base; wherein, the UEFI structured rule knowledge base contains multiple structure definitions; The matching module is used to match the initial data structure with each of the structure definitions in the UEFI structured rule knowledge base, and to determine the target structure definition with the highest matching degree from the UEFI structured rule knowledge base; The correction module is used to correct the initial data structure using the structure definition fields in the target structure definition to obtain the target data structure of the input data of the reconstructed UEFI firmware.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions that can be executed by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of any one of claims 1 to 7.

Images