Code repairing method and device, electronic equipment, storage medium and product

Abstract

The embodiment of the invention provides a code repairing method and device, electronic equipment, a storage medium and a product. Comprising the following steps: extracting binary features of a packed file, inputting a pre-trained convolutional neural network model to obtain target packed features corresponding to the packed file, and shelling the packed file to obtain a shelled file; carrying out decompilation processing on the unshelled file to obtain a decompilation code, and carrying out semantic recognition on the decompilation code through a language recognition model to carry out symbol recovery processing to obtain a symbol recovery code; performing structured processing on logic of the symbol recovery code through an abstract syntax tree technology to obtain a structured code; and compiling and repairing the structured code to obtain a target code. According to the scheme, the target packing type is accurately identified through the pre-trained convolutional neural network model, and targeted repair is automatically performed according to the target packing type, so that the influence of a packing tool on code readability can be accurately repaired, and the code repair accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a code repair method, apparatus, electronic device, storage medium, and product. Background Technology

[0002] In programming applications, source code is compiled into an intermediate language and stored in an assembly. The essential purpose of an intermediate language is to achieve goals such as cross-platform compatibility, code optimization, or modular design by introducing a level of abstraction. The intermediate language can be decompiled back into the source code.

[0003] In practical applications, packers or code obfuscation techniques are used to prevent decompilation, resulting in poor readability of the decompiled code.

[0004] In related technologies, basic formatting of decompiled code is performed manually to repair it. However, this repair method suffers from low accuracy. Summary of the Invention

[0005] This application provides code repair methods, apparatus, electronic devices, storage media, and products to improve the accuracy of code repair.

[0006] In a first aspect, embodiments of this application provide a code repair method, comprising: receiving a repair request, the repair request including a packed file; according to the repair request, extracting binary features of the packed file, inputting the binary features into a pre-trained convolutional neural network model to obtain target packed features corresponding to the packed file, and performing unpacking processing on the packed file according to the target packed features to obtain an unpacked file, wherein the target packed features include at least one of a target packed type and a target packed rule; decompiling the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structured processing on the logic of the symbol recovery code through abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code.

[0007] In one possible implementation, unpacking the packed file according to the target packing type or the target packing rule to obtain an unpacked file includes: determining a first mapping relationship between the packing type and the unpacking tool; determining a corresponding target unpacking tool based on the target packing type and the first mapping relationship; or, determining a second mapping relationship between the packing rule and the unpacking tool; determining a corresponding target unpacking tool based on the target packing rule and the second mapping relationship; determining the application programming interface (API) of the target unpacking tool; and sending the packed file to the target unpacking tool through the API to obtain the unpacked file.

[0008] In one possible implementation, sending the packed file to the target unpacking tool to obtain the unpacked file includes: determining the target code characteristics of the packed file, the target code characteristics including at least one of self-modifying code or jump instructions; determining a third mapping relationship, the third mapping relationship including a mapping relationship between code characteristics and unpacking parameters, and a mapping relationship between packed type and unpacking parameters; determining the corresponding target unpacking parameters based on the target packed type, the target code characteristics, and the third mapping relationship; and sending the packed file and the target unpacking parameters to the target unpacking tool to obtain the unpacked file.

[0009] In one possible implementation, semantic recognition of the decompiled code is performed using a language recognition model to perform symbol recovery processing to obtain symbol recovery code. This includes: determining a pre-trained language recognition model; inputting the unpacked file into the language recognition model so that the language recognition model can identify obfuscated symbols from the unpacked file; determining the predicted probability distribution of variable names and method names of the obfuscated symbols; and replacing the obfuscated symbols according to the predicted probability distribution to obtain the symbol recovery code.

[0010] In one possible implementation, the repair request includes a target language; the symbolic recovery code is structured using abstract syntax tree (AST) technology to obtain structured code, including: parsing the symbolic recovery code to obtain a corresponding initial AST, the initial AST including multiple control flow nodes; identifying the multiple control flow nodes to obtain unstructured logic; converting the unstructured logic into structured logic based on the jump target address of the unstructured logic to generate a structured AST; and performing code conversion processing on the structured AST according to the target language to obtain the structured code.

[0011] In one possible implementation, the structured abstract syntax tree is subjected to code conversion processing to obtain the structured code, including: determining multiple condition judgment nodes, multiple logical nodes, and an adaptive nesting depth threshold of the structured abstract syntax tree; deleting duplicate nodes from the multiple condition judgment nodes, and splitting nodes in the multiple logical nodes whose nesting depth exceeds the nesting depth threshold to obtain an optimized abstract syntax tree; and performing code conversion processing on the optimized abstract syntax tree to obtain the structured code.

[0012] In one possible implementation, the structured code is compiled and repaired to obtain target code, including: compiling the structured code using a compiler to obtain a compilation result, which includes successful compilation or failed compilation; if the compilation result is failed compilation, the error type analysis result output by the compiler is determined; based on the error type analysis result, the structured code is compiled and repaired using preset metadata patching rules and type inference algorithms, and recompiled until the compilation result is successful compilation, wherein the error type analysis result includes at least one of the following: missing metadata or type mismatch; if the compilation result is successful compilation, function-level comments of the structured code are generated, and the target code is determined based on the structured code and the function-level comments.

[0013] Secondly, embodiments of this application provide a code repair device, comprising: a receiving module for receiving a repair request, the repair request including a packed file; a dynamic unpacking module for extracting binary features of the packed file according to the repair request, inputting the binary features into a pre-trained convolutional neural network model to obtain target packed features corresponding to the packed file, and performing unpacking processing on the packed file according to the target packed features to obtain an unpacked file, the target packed features including at least one of target packed type and target packed rule; a recovery module for decompiling the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code; a reconstruction module for structuring the logic of the symbol recovery code through abstract syntax tree technology to obtain structured code; and a compilation repair module for performing compilation repair processing on the structured code to obtain target code.

[0014] In one possible implementation, the dynamic unpacking module is specifically used to determine a first mapping relationship between the packer type and the unpacking tool, and to determine the corresponding target unpacking tool based on the target packer type and the first mapping relationship; or, the dynamic unpacking module is further used to determine a second mapping relationship between the packer rule and the unpacking tool, and to determine the corresponding target unpacking tool based on the target packer rule and the second mapping relationship; the dynamic unpacking module is further used to determine the application programming interface (API) of the target unpacking tool; the dynamic unpacking module is further used to send the packed file to the target unpacking tool through the API to obtain the unpacked file.

[0015] In one possible implementation, the dynamic unpacking module is specifically used to determine the target code characteristics of the packed file, the target code characteristics including at least one of self-modifying code or jump instructions; the dynamic unpacking module is further used to determine a third mapping relationship, the third mapping relationship including a mapping relationship between code characteristics and unpacking parameters, and a mapping relationship between packing type and unpacking parameters; the dynamic unpacking module is further used to determine the corresponding target unpacking parameters based on the target packing type, the target code characteristics, and the third mapping relationship; the dynamic unpacking module is further used to send the packed file and the target unpacking parameters to the target unpacking tool to obtain the unpacked file.

[0016] In one possible implementation, the recovery module is specifically used to determine a pre-trained language recognition model; the recovery module is also specifically used to input the unpacked file into the language recognition model, so that the language recognition model can identify obfuscated symbols from the unpacked file, determine the predicted probability distribution of the variable names and method names of the obfuscated symbols, and replace the obfuscated symbols according to the predicted probability distribution to obtain the symbol recovery code.

[0017] In one possible implementation, the repair request includes a target language; a reconstruction module is specifically configured to parse the symbolic recovery code to obtain a corresponding initial abstract syntax tree, the initial abstract syntax tree including multiple control flow nodes; the reconstruction module is further configured to identify the multiple control flow nodes to obtain unstructured logic; the reconstruction module is further configured to convert the unstructured logic into structured logic according to the jump target address of the unstructured logic to generate a structured abstract syntax tree; the reconstruction module is further configured to perform code conversion processing on the structured abstract syntax tree according to the target language to obtain the structured code.

[0018] In one possible implementation, the reconstruction module is specifically used to determine multiple condition judgment nodes, multiple logical nodes, and an adaptive nesting depth threshold of the structured abstract syntax tree; the reconstruction module is further used to delete duplicate nodes from the multiple condition judgment nodes and split the nodes in the multiple logical nodes whose nesting depth exceeds the nesting depth threshold to obtain an optimized abstract syntax tree; the reconstruction module is further used to perform code conversion processing on the optimized abstract syntax tree to obtain the structured code.

[0019] In one possible implementation, the apparatus further includes: an execution module, configured to compile the structured code using a compiler to obtain a compilation result, the compilation result including successful compilation or failed compilation; the execution module is further configured to, if the compilation result is failed compilation, determine the error type analysis result output by the compiler, and, based on the error type analysis result, perform compilation repair processing on the structured code using preset metadata patching rules and type inference algorithms, and recompile until the compilation result is successful compilation, the error type analysis result including at least one of the following: missing metadata or type mismatch; the execution module is further configured to, if the compilation result is successful compilation, generate function-level comments for the structured code, and determine the target code based on the structured code and the function-level comments.

[0020] Thirdly, embodiments of this application provide a code repair device, including: a memory and a processor;

[0021] The memory stores computer-executed instructions;

[0022] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0023] Fourthly, embodiments of this application provide a non-volatile computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0024] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0025] The code repair method, apparatus, electronic device, storage medium, and product provided in this application include: receiving a repair request, the repair request including a packed file; extracting binary features of the packed file according to the repair request, inputting the binary features into a pre-trained convolutional neural network model to obtain target packed features corresponding to the packed file, and unpacking the packed file according to the target packed features to obtain an unpacked file, wherein the target packed features include at least one of a target packed type and a target packed rule; decompiling the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code using a language recognition model to perform symbol recovery processing to obtain symbol recovery code; structuring the logic of the symbol recovery code using abstract syntax tree technology to obtain structured code; and compiling and repairing the structured code to obtain target code. This solution accurately identifies the target packed type using a pre-trained convolutional neural network model and automatically performs targeted repair based on the target packed type, accurately repairing the impact of packed tools on code readability, thereby improving the accuracy of code repair. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0027] Figure 1 This is a schematic diagram illustrating an application scenario of a code repair method provided in an embodiment of this application;

[0028] Figure 2 A flowchart illustrating a code repair method provided in an embodiment of this application;

[0029] Figure 3 A flowchart illustrating a code repair method provided in an embodiment of this application;

[0030] Figure 4 This is a schematic diagram of the dynamic unpacking process provided in an embodiment of this application;

[0031] Figure 5 A schematic diagram of symbol recovery processing provided in the embodiments of this application;

[0032] Figure 6 A schematic diagram illustrating the compilation and repair process provided in this application embodiment;

[0033] Figure 7 This is a schematic diagram of the structure of a code repair device provided in an embodiment of this application;

[0034] Figure 8 This is a schematic diagram of the structure of a code repair device provided in an embodiment of this application;

[0035] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0036] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0037] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0038] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0039] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation; the embodiments of this application do not specifically limit this. Furthermore, the display interface provided in the embodiments of this application is merely an example, and the display interface may include more or less content.

[0040] It should be noted that the code repair method, apparatus, electronic device, storage medium and product of this application can be used in the field of artificial intelligence technology, or in any field other than artificial intelligence. The application fields of the code repair method, apparatus, electronic device, storage medium and product of this application are not limited.

[0041] Figure 1This is a schematic diagram illustrating an application scenario of a code repair method provided in this application embodiment. An example is given based on the illustrated scenario: the source code is compiled to obtain intermediate language, and the intermediate language is decompiled to restore the source code.

[0042] In practical applications, source code security is enhanced during compilation by obfuscating the source code and packing the executable file. However, when the source code owner, such as a developer, needs it but it is lost, reverse engineering can be used to obtain it. The decompiled code obtained by decompiling the intermediate language through reverse engineering suffers from poor readability. Specifically, packing obscures the code structure and causes metadata loss. Code obfuscation leads to disordered variable or method names and unstructured control flow. Consequently, the decompiled code cannot be directly compiled, its logic is difficult to understand, and it severely hinders reverse engineering and subsequent maintenance. Therefore, remediation is needed to improve the readability of the decompiled code.

[0043] For example, packing involves adding a shell program to the compiled executable file through compression, encryption, or encapsulation. The shell program can directly obtain the valid code logic of the executable file without decompilation.

[0044] For example, code obfuscation involves manipulating source code to obtain an intermediate language by renaming variables / method names, inserting meaningless code, or modifying the control flow structure, while maintaining the functionality. Code obfuscation can reduce the readability of the code recovered through decompilation.

[0045] In related technologies, basic formatting of decompiled code is performed manually to achieve repair. However, this method introduces subjective human error, resulting in low accuracy.

[0046] The code repair method provided in this application is intended to solve the above-mentioned technical problems in the prior art.

[0047] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0048] Figure 2 This application provides a flowchart illustrating a code repair method, which includes the following steps:

[0049] S201. Receive a repair request, which includes a packer file.

[0050] For example, a packed file is a file obtained by packing the compiled executable file. The logic of the internal code cannot be directly obtained through a packed file.

[0051] Optionally, this application can execute a repair request via an electronic device to repair the packed file to obtain readable target code.

[0052] S202. Based on the repair request, extract the binary features of the packed file, input the binary features into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and perform unpacking processing on the packed file according to the target packed features to obtain the unpacked file. The target packed features include the target packed type or the target packed rule.

[0053] For example, unpacking is used to remove the shell program added to an executable file by a packer, thereby removing the protection mechanism and restoring the original, unencrypted executable file.

[0054] In practical applications, there are various packing tools, each with different packing rules or types. In related technologies, packing rules or types are identified manually, and unpacking is performed based on the identification results. However, manual identification is prone to error, and the accuracy of the identification affects the accuracy of the unpacking process.

[0055] For example, binary features can be extracted from the byte sequence and / or structured information of a packed file. These binary features can represent the numerical information of the corresponding packing type or packing rule.

[0056] For example, a pre-trained convolutional neural network model is trained using sample files and their corresponding packing types. It can learn the high-dimensional mapping relationship between the binary features of the sample files and the packing types, thereby accurately determining the target packing type. Accurately determining the target packing type can effectively improve the accuracy of the unpacking process.

[0057] S203. The unpacked file is decompiled to obtain decompiled code, and the decompiled code is semantically recognized using a language recognition model to perform symbol recovery processing, resulting in symbol recovery code.

[0058] For example, during the compilation process, the variable and method names of symbols are obfuscated, resulting in poor readability of the decompiled code. Recovery processing is used to restore the symbol state in the source code, thereby improving the readability of the code.

[0059] Optionally, a code pre-trained model with a Transformer architecture (such as CodeBERT) can be used to probabilistically rename obfuscated identifiers by analyzing the contextual semantics of variables in the control flow graph (CFG) and data flow graph (DFG) to achieve symbol recovery processing.

[0060] Using a scenario example, obfuscating variable and method names replaces them with randomly generated, meaningless strings, leading to logical inconsistencies in the code. Symbol recovery techniques can restore the source code's logic, thereby improving readability.

[0061] S204. The logic of the symbolic recovery code is structured using abstract syntax tree technology to obtain structured code.

[0062] For example, by using control flow reconstruction processing, the unordered jump logic of symbolic recovery code is converted into a structured control flow (such as if-else, while, for, etc.), thereby fixing the logic of the code and improving its readability.

[0063] For example, the Abstract Syntax Tree (AST) technique transforms the logic of symbolic recovery code into a control flow graph, where each node represents a basic block and edges represent jump relationships, thereby accurately identifying the logic of symbolic recovery code and improving the accuracy of the repair.

[0064] S205. Compile and repair the structured code to obtain the target code.

[0065] For example, packers can cause issues such as lost metadata and mismatched variable types. Compilation repair processes automatically identify and fix these problems, resulting in more readable target code.

[0066] For example, this application constructs a closed-loop repair system by integrating multiple professional tools (such as unpacking tools or compilers) and designing an automated scheduling and feedback mechanism. Running the closed-loop repair system via electronic devices can automatically locate and repair problems such as missing metadata and type mismatches without manual intervention.

[0067] The code repair method provided in this application embodiment receives a repair request, which includes a packed file; according to the repair request, it extracts the binary features of the packed file, inputs the binary features into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and unpacks the packed file according to the target packed features to obtain an unpacked file. The target packed features include at least one of a target packed type and a target packed rule; it decompiles the unpacked file to obtain decompiled code, and performs semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code; it performs structured processing on the logic of the symbol recovery code through abstract syntax tree technology to obtain structured code; and it performs compilation and repair processing on the structured code to obtain the target code. This solution accurately identifies the target packed type through a pre-trained convolutional neural network model and automatically performs targeted repair based on the target packed type, which can accurately repair the impact of packed tools on code readability, thereby improving the accuracy of code repair. Testing and verification have shown that the readability of variable and method names (calculated based on the proportion of semantically correct names) in the target code processed by the above solution is improved by more than 90%, and the code compilation pass rate is increased from less than 60% to more than 95%. At the same time, the time required for manual repair is reduced to minutes, achieving efficient and accurate automated code repair.

[0068] Based on any of the above embodiments, the following, in conjunction with Figure 3 The detailed process of code repair is explained.

[0069] Figure 3 This is a flowchart illustrating a code repair method provided in an embodiment of this application. Figure 3 As shown, the method includes:

[0070] S301. Receive a repair request, which includes a packer file.

[0071] It should be noted that the execution process of S301 is the same as that of S201, and will not be repeated here.

[0072] S302. Determine the first mapping relationship between the packer type and the unpacker tool. Based on the target packer type and the first mapping relationship, determine the corresponding target unpacker tool.

[0073] For example, each unpacking tool performs unpacking processing for the corresponding packing type, and a first mapping relationship between packing types and unpacking tools is pre-generated by collecting multiple unpacking tools.

[0074] For example, the target unpacking tool is obtained by matching the target packing type with the first mapping relationship.

[0075] With the example scenario, the target unpacking tool is used to unpack shell programs that are target-packed.

[0076] S303. Determine the second mapping relationship between the packing rules and the unpacking tools, and determine the corresponding target unpacking tool based on the target packing rules and the second mapping relationship.

[0077] It should be noted that the execution process of S303 is the same as that of S302, and will not be repeated here. This application does not limit the execution order of S302 and S303.

[0078] S304, Determine the application programming interface of the target unpacking tool.

[0079] For example, an Application Programming Interface (API) is an interface for interaction between software components, defining how to access and use the functionality of a decryption tool. APIs provide control over the decryption process and the acquisition of results through standardized methods, parameters, and return values.

[0080] For example, through an application programming interface, the target unpacking tool and its functions can be accessed automatically, thereby achieving automated unpacking.

[0081] S305. Send the packed file to the target unpacking tool through the application programming interface to obtain the unpacked file.

[0082] One feasible implementation method for generating an unpacked file includes: determining the target code characteristics of the packed file, where the target code characteristics include at least one of self-modifying code or jump instructions; determining a third mapping relationship, which includes a mapping relationship between code characteristics and unpacking parameters, and a mapping relationship between packed type and unpacking parameters; determining the corresponding target unpacking parameters based on the target packed type, target code characteristics, and the third mapping relationship; and sending the packed file and target unpacking parameters to the target unpacking tool to obtain the unpacked file.

[0083] For example, unpacking parameters indicate the instructions of the unpacking tool, allowing the unpacking tool to specify which operations to perform.

[0084] For example, each unpacking parameter is unpacked according to the corresponding code feature, and each unpacking parameter is unpacked according to the corresponding packing type. A second mapping relationship is generated in advance based on the corresponding relationship.

[0085] For example, self-modifying code is the part of the code that dynamically modifies itself at runtime to achieve a specific function. Jump instructions are the core instructions that control the code flow; obfuscating jump instructions can lead to obfuscation of the code logic flow and affect the readability of the code.

[0086] Below, in conjunction with Figure 4 The dynamic deshelling process is explained.

[0087] Figure 4 This is a schematic diagram of the dynamic unpacking process provided in an embodiment of this application. Figure 4 As shown, for each packed file, the target packing type and target code characteristics are dynamically determined. The corresponding target packing tool is determined based on the target packing type. The corresponding target unpacking parameters are determined based on the target code characteristics. The packed file and target unpacking parameters are sent to the target unpacking tool to obtain the unpacked file. Because the dynamically obtained target unpacking parameters match the packed file, targeted unpacking processing can be performed, improving the accuracy of the unpacked file.

[0088] With the example of the scenario, the target unpacking parameters can be used to explicitly instruct the target unpacking tool to perform targeted processing on the self-modified code and obfuscated jump instructions in the packed file.

[0089] Optionally, a jump instruction is used to point to the memory address of the next execution location, and it can be generated in the following ways: direct jump, relative jump, or indirect jump.

[0090] In this feasible implementation, dynamic target unpacking parameters explicitly instruct the target unpacking tool to perform targeted processing, thereby improving the accuracy of code repair.

[0091] S306. Semantic recognition is performed on the decompiled code using a language recognition model to perform symbolic recovery processing, resulting in symbolic recovery code.

[0092] One feasible implementation method for symbol recovery processing includes: determining a pre-trained language recognition model; inputting decompiled code into the language recognition model to enable the language recognition model to identify obfuscated symbols from the decompiled code, determining the predicted probability distribution of variable names and method names of the obfuscated symbols, and replacing the obfuscated symbols according to the predicted probability distribution to obtain symbol recovery code.

[0093] Optionally, the language recognition model can be a pre-trained code model with a Transformer architecture (such as CodeBERT).

[0094] For example, a language recognition model can identify the context and semantics of decompiled code, thereby identifying obfuscated symbols in the decompiled code and replacing them.

[0095] Below, in conjunction with Figure 5 The symbol recovery process is explained.

[0096] Figure 5 This is a schematic diagram illustrating the symbol recovery process provided in an embodiment of this application. Figure 5As shown, the predicted probability distribution in the decompiled code is identified through a language recognition model, and the obfuscated symbols are replaced according to the predicted probability distribution to obtain the symbol recovery code.

[0097] With scenario examples, static analysis identifies anomalous symbols (such as those that are too short or lack semantic features) in decompiled code. For example, in `int a = b + c`, `a`, `b`, and `c` are marked as obfuscated symbols. The language recognition model analyzes the code logic based on the context of the decompiled code (e.g., `a = b + c` might correspond to: Total = Base Value + Additional Value). It generates predicted probability distributions for each variable and method name, and selects the optimal variable and method names based on these distributions (e.g., if `a` has a probability of 0.95 corresponding to `total` and a probability of 0.05 corresponding to `sum`, then `a` is selected as `total`).

[0098] Optionally, a bidirectional attention mechanism can be used to capture global dependencies of code blocks.

[0099] Optionally, the code can be abstracted into a property graph using a graph neural network to replace the language recognition model's prediction of variable names and method names.

[0100] In this feasible implementation, a pre-trained language recognition model replaces manual methods for automated recognition and replacement, thereby reducing manual operations.

[0101] S307. The logic of symbolic recovery code is structured using abstract syntax tree technology to obtain structured code.

[0102] One feasible implementation method for generating structured code includes: parsing the symbolic recovery code to obtain a corresponding initial abstract syntax tree (API), which includes multiple control flow nodes; identifying the multiple control flow nodes to obtain unstructured logic; converting the unstructured logic into structured logic based on the jump target address of the unstructured logic to generate a structured API; and performing code conversion processing on the structured API according to the target language to obtain structured code.

[0103] The repair request includes the target language. The target language is the language corresponding to the target code indicated in the repair request.

[0104] For example, symbolic recovery code is parsed into an Abstract Syntax Tree (AST), which can include program structure nodes, control flow nodes, or semantic logic nodes. The control flow nodes of the AST are traversed to identify unstructured logic (e.g., goto jumps, label statements). Based on the jump target address of the unstructured logic, it is converted into structured logic (e.g., if-else branches, while loops), generating a structured AST. The structured AST is then converted into the corresponding code in the target language to obtain structured code. Note that goto jumps can disrupt the execution order of the code, making logical branches difficult to trace.

[0105] For example, an abstract syntax tree abstracts away unimportant details in the source code (such as spaces, comments, and specific delimiters), retaining only the core syntactic elements of the program and their relationships.

[0106] Optionally, when users interactively modify decompiled code (e.g., adjust if conditions), the abstract syntax tree is updated locally in real time instead of being fully rebuilt, and affected nodes are located based on the change propagation algorithm. Semantic similarity is calculated for adjacent goto blocks (based on code embedding vectors), and only blocks with a similarity >90% are merged to avoid logical errors caused by over-structuring. Incremental updates can effectively reduce memory overhead.

[0107] In this feasible implementation, unstructured logic can be replaced with structured logic through structuring, which can effectively improve the clarity and readability of the code's control flow.

[0108] One feasible implementation involves performing code transformation on the structured abstract syntax tree (AST) to obtain structured code, including: determining multiple condition judgment nodes, multiple logical nodes, and an adaptive nesting depth threshold in the AST; deleting duplicate nodes from the multiple condition judgment nodes and splitting nodes in the multiple logical nodes whose nesting depth exceeds the nesting depth threshold to obtain an optimized AST; and performing code transformation on the optimized AST to obtain structured code.

[0109] For example, in an abstract syntax tree, conditional nodes and logic nodes are marked as key structures.

[0110] For example, the adaptive nesting depth threshold can be dynamically set based on the nesting depth of each path in the abstract syntax tree and the complexity of the code. This ensures that complex logic retains reasonable nesting while avoiding the over-split of simple logic.

[0111] Optionally, the existing condition judgment nodes are recorded in a symbol table, and the condition judgment nodes are judged to be repeated by comparing the syntax tree structure and semantic features of the nodes.

[0112] Based on the above implementation methods, duplicate code is removed to reduce runtime overhead and maintenance costs. Code readability is improved by reducing nesting depth.

[0113] S308. Compile and repair the structured code to obtain the target code.

[0114] One feasible implementation method involves compiling and repairing the code as follows: The structured code is compiled using a compiler to obtain a compilation result, which may be either successful or unsuccessful. If the compilation result is unsuccessful, the error type analysis result output by the compiler is determined. Based on the error type analysis result, the structured code is repaired using preset metadata patching rules and type inference algorithms, and the compilation is repeated until the compilation result is successful. The error type analysis result includes at least one of the following: missing metadata or type mismatch. If the compilation result is successful, function-level comments for the structured code are generated, and the target code is determined based on the structured code and the function-level comments.

[0115] Below, in conjunction with Figure 6 Explanation of the compilation and repair process.

[0116] Figure 6 This is a schematic diagram illustrating the compilation and repair process provided in an embodiment of this application. For example... Figure 6 As shown, the compiler processes the structured code. If compilation succeeds, the target code is output to complete the code repair. If compilation fails, the error type is analyzed and recompilation is performed. The compiler then uses a loop to check the code until the target code is output.

[0117] For example, function-level comments are comments for functions or methods that describe their functionality, parameters, return values, exception handling, and other information. They help developers understand the code logic and use the function correctly, effectively improving code readability.

[0118] Optionally, the compiler checks the structured code for syntax, type, or linking rules, and obtains the compilation result. Successful compilation indicates that the structured code conforms to the language specification. Failed compilation indicates that the structured code contains syntax errors, type mismatches, or missing metadata.

[0119] For example, by outputting the error type by the compiler, the strategy for compiling and fixing the error can be explicitly indicated, thereby performing automated compiling and fixing.

[0120] Optionally, the compiler can be the Roslyn compiler.

[0121] With the example of Roslyn compiler for compilation repair, the code is automatically repaired using preset metadata patching rules and type inference algorithms. This process is iterated until compilation is successful, thus achieving a closed loop of compilation feedback.

[0122] In this feasible implementation, the compiler enables automatic code repair, thereby reducing manual operations and improving the accuracy of code repair.

[0123] Figure 7 This is a schematic diagram of a code repair device provided in an embodiment of this application. Figure 7 As shown, the code repair device 70 may include: a receiving module 71, a dynamic unpacking module 72, a recovery module 73, a reconstruction module 74, and a compilation repair module 75.

[0124] The receiving module 71 is used to receive repair requests, which include packed files.

[0125] The dynamic unpacking module 72 is used to extract the binary features of the packed file according to the repair request, input the binary features into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and perform unpacking processing on the packed file according to the target packed features to obtain the unpacked file. The target packed features include at least one of the target packed type and the target packed rule.

[0126] Recovery module 73 is used to decompile the unpacked file to obtain decompiled code, and to perform semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code.

[0127] Reconstruction module 74 is used to perform structured processing on the logic of symbolic recovery code using abstract syntax tree technology to obtain structured code.

[0128] The compilation and repair module 75 is used to perform compilation and repair processing on structured code to obtain target code.

[0129] Optionally, the receiving module 71 can perform... Figure 2 S201 in the embodiment.

[0130] Optionally, the dynamic unpacking module 72 can execute... Figure 2 S202 in the embodiment.

[0131] Optionally, recovery module 73 can execute Figure 2 S203 in the embodiment.

[0132] Optionally, rebuild module 74 can be executed. Figure 2 S204 in the embodiment.

[0133] Optionally, the compile-fix module 75 can be executed. Figure 2 S205 in the embodiment.

[0134] It should be noted that the code repair device shown in the embodiments of this application can execute the technical solution shown in the above method embodiments, and its implementation principle and beneficial effects are similar, so they will not be described again here.

[0135] In one possible implementation, the dynamic unpacking module 72 is specifically used for:

[0136] Determine the first mapping relationship between the packer type and the unpacker tool; based on the target packer type and the first mapping relationship, determine the corresponding target unpacker tool; or,

[0137] Determine the second mapping relationship between packing rules and unpacking tools, and determine the corresponding target unpacking tool based on the target packing rule and the second mapping relationship;

[0138] Determine the application programming interface (API) of the target unpacking tool;

[0139] The packed file is sent to the target unpacking tool via the application programming interface (API), and the unpacked file is obtained.

[0140] In one possible implementation, the dynamic unpacking module 72 is specifically used for:

[0141] Determine the target code characteristics of the packed file, which include at least one of self-modifying code or jump instructions;

[0142] Determine the third mapping relationship, which includes the mapping relationship between code features and unpacking parameters, as well as the mapping relationship between packing type and unpacking parameters;

[0143] Based on the target's packing type, target code characteristics, and third-party mapping relationship, determine the corresponding target unpacking parameters;

[0144] Send the packed file and target unpacking parameters to the target unpacking tool to obtain the unpacked file.

[0145] In one possible implementation, the recovery module 73 is specifically used for:

[0146] Determine the pre-trained language recognition model;

[0147] The unpacked file is input into the language recognition model, which then identifies the obfuscated symbols from the file, determines the predicted probability distribution of the variable and method names of the obfuscated symbols, and replaces the obfuscated symbols according to the predicted probability distribution to obtain the symbol recovery code.

[0148] In one possible implementation, the reconstruction module 74 is specifically used for:

[0149] The symbolic recovery code is parsed to obtain the corresponding initial abstract syntax tree, which includes multiple control flow nodes.

[0150] Multiple control flow nodes are identified and processed to obtain unstructured logic;

[0151] Based on the jump target address of the unstructured logic, the unstructured logic is converted into structured logic to generate a structured abstract syntax tree;

[0152] Based on the target language, the structured abstract syntax tree is transformed into structured code.

[0153] In one possible implementation, the reconstruction module 74 is specifically used for:

[0154] Determine multiple conditional decision nodes, multiple logical nodes, and an adaptive nesting depth threshold for the structured abstract syntax tree;

[0155] The optimized abstract syntax tree is obtained by removing duplicate nodes from multiple condition judgment nodes and splitting nodes whose nesting depth exceeds the nesting depth threshold in multiple logical nodes.

[0156] The optimized abstract syntax tree is transformed into structured code.

[0157] Figure 8 This is a schematic diagram of a code repair device provided in an embodiment of this application. Figure 7 Based on the illustrated embodiments, as Figure 8 As shown, the code repair device 70 also includes an execution module 76.

[0158] Execution module 76 is used for:

[0159] The structured code is compiled by a compiler to obtain the compilation result, which includes whether the compilation is successful or not.

[0160] If the compilation result is a compilation failure, the error type analysis result output by the compiler is determined. Based on the error type analysis result, the structured code is repaired through the preset metadata patching rules and type inference algorithm, and the compilation process is repeated until the compilation result is a compilation success. The error type analysis result includes at least one of the following: missing metadata or type mismatch.

[0161] If the compilation is successful, function-level comments for the structured code are generated, and the target code is determined based on the structured code and function-level comments.

[0162] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 9 As shown, the electronic device includes:

[0163] The electronic device includes a processor 291 and a memory 292; it may also include a communication interface 293 and a bus 294. The processor 291, memory 292, and communication interface 293 can communicate with each other via the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke logical instructions stored in the memory 292 to execute the methods of the above embodiments.

[0164] Furthermore, the logic instructions in the aforementioned memory 292 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0165] The memory 292, as a non-volatile computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, it implements the methods in the above-described method embodiments.

[0166] The memory 292 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 292 may include high-speed random access memory and may also include non-volatile memory.

[0167] This application provides a non-volatile computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in the foregoing embodiments.

[0168] This application provides a computer program product, including a computer program that, when executed by a processor, implements the method as described in the foregoing embodiments.

[0169] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0170] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0171] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0172] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0173] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. The processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC. GPUs can be used for hardware acceleration to improve code repair efficiency. Storage units can be any suitable magnetic or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), and hybrid memory cube (HMC), etc.

[0174] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0175] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0176] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.

[0177] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A code repair method, characterized in that, include: Receive a repair request, the repair request including a packed file; According to the repair request, the binary features of the packed file are extracted, the binary features are input into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and the packed file is unpacked according to the target packed features to obtain an unpacked file. The target packed features include at least one of the target packed type and the target packed rule. The unpacked file is decompiled to obtain decompiled code, and the decompiled code is semantically recognized using a language recognition model to perform symbol recovery processing, resulting in symbol recovery code. The logic of the symbol recovery code is structured using abstract syntax tree technology to obtain structured code; The structured code is then compiled and repaired to obtain the target code.

2. The method according to claim 1, characterized in that, The packed file is unpacked according to the target packing type or the target packing rule to obtain an unpacked file, including: Determine a first mapping relationship between the packer type and the unpacker tool; based on the target packer type and the first mapping relationship, determine the corresponding target unpacker tool; or, A second mapping relationship between packing rules and unpacking tools is determined, and the corresponding target unpacking tool is determined based on the target packing rule and the second mapping relationship; Determine the application programming interface (API) of the target unpacking tool; The packed file is sent to the target unpacking tool through the application programming interface, and the unpacked file is obtained.

3. The method according to claim 2, characterized in that, Sending the packed file to the target unpacking tool to obtain the unpacked file includes: Determine the target code characteristics of the packed file, wherein the target code characteristics include at least one of self-modifying code or jump instructions; A third mapping relationship is determined, which includes the mapping relationship between code features and unpacking parameters, and the mapping relationship between packing type and unpacking parameters; Based on the target packing type, the target code characteristics, and the third mapping relationship, determine the corresponding target unpacking parameters; The packed file and the target unpacking parameters are sent to the target unpacking tool to obtain the unpacked file.

4. The method according to claim 1, characterized in that, The decompiled code is semantically identified using a language recognition model to perform symbolic recovery processing, resulting in symbolic recovery code, including: Determine the pre-trained language recognition model; The unpacked file is input into the language recognition model, so that the language recognition model can identify obfuscated symbols from the unpacked file, determine the predicted probability distribution of the variable names and method names of the obfuscated symbols, and replace the obfuscated symbols according to the predicted probability distribution to obtain the symbol recovery code.

5. The method according to claim 1, characterized in that, The repair request includes the target language; The symbolic recovery code is structured using abstract syntax tree (AST) technology to obtain structured code, including: The symbol recovery code is parsed to obtain the corresponding initial abstract syntax tree, which includes multiple control flow nodes; The multiple control flow nodes are identified and processed to obtain unstructured logic; Based on the jump target address of the unstructured logic, the unstructured logic is converted into structured logic to generate a structured abstract syntax tree; Based on the target language, the structured abstract syntax tree is subjected to code conversion processing to obtain the structured code.

6. The method according to claim 5, characterized in that, The structured abstract syntax tree is subjected to code transformation processing to obtain the structured code, including: Determine multiple condition judgment nodes, multiple logical nodes, and an adaptive nesting depth threshold of the structured abstract syntax tree; The duplicate nodes are removed from the multiple condition judgment nodes, and the nodes in the multiple logical nodes whose nesting depth exceeds the nesting depth threshold are split to obtain an optimized abstract syntax tree; The optimized abstract syntax tree is subjected to code transformation processing to obtain the structured code.

7. The method according to any one of claims 1-6, characterized in that, The structured code is compiled and repaired to obtain the target code, including: The structured code is compiled by a compiler to obtain a compilation result, which includes whether the compilation is successful or not. If the compilation result is a compilation failure, the error type analysis result output by the compiler is determined. Based on the error type analysis result, the structured code is repaired by using preset metadata patching rules and type inference algorithms, and then recompiled until the compilation result is a compilation success. The error type analysis result includes at least one of the following: missing metadata or type mismatch. If the compilation result is successful, then function-level comments for the structured code are generated, and the target code is determined based on the structured code and the function-level comments.

8. A code repair device, characterized in that, include: A receiving module is used to receive repair requests, wherein the repair requests include packed files; The dynamic unpacking module is used to extract the binary features of the packed file according to the repair request, input the binary features into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and perform unpacking processing on the packed file according to the target packed features to obtain the unpacked file. The target packed features include at least one of the target packed type and the target packed rule. The recovery module is used to decompile the unpacked file to obtain decompiled code, and to perform semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code. The reconstruction module is used to perform structured processing on the logic of the symbol recovery code using abstract syntax tree technology to obtain structured code; The compilation and repair module is used to compile and repair the structured code to obtain the target code.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

Images