Code repair method and device, electronic equipment, storage medium and product

Abstract

Embodiments of the present application provide a code repair method and device, electronic equipment, storage medium and product. The method comprises: extracting binary features of a packed file, inputting a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, performing unpacking processing on the packed file to obtain an unpacked file; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code. The above scheme accurately identifies the target packing type by using the pre-trained convolutional neural network model, automatically performs targeted repair according to the target packing type, can accurately repair the influence of the packing tool on the readability of the code, and thus improves the accuracy of code repair.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a code repair method and device, electronic equipment, storage medium and product. BACKGROUND

[0002] In a programming application scenario, source code is compiled into an intermediate language and stored in an assembly. The essential purpose of the intermediate language is to achieve cross-platform compatibility, code optimization, or modular design by introducing an abstraction level. Through decompilation, the intermediate language can be restored to source code.

[0003] In actual applications, a shell tool or code obfuscation technology is used to prevent decompilation, resulting in poor readability of the code obtained through decompilation.

[0004] In related technologies, the decompiled code is formatted in an artificial manner to repair the decompiled code. However, this repair method has the problem of low accuracy. SUMMARY

[0005] Embodiments of the present application provide a code repair method and device, electronic equipment, storage medium and product to improve the accuracy of code repair.

[0006] In a first aspect, an embodiment of the present application provides a code repair method, including: receiving a repair request, the repair request including a shell file; extracting a binary feature of the shell file according to the repair request, inputting the binary feature into a pre-trained convolutional neural network model to obtain a target shell feature corresponding to the shell file, and performing shell removal processing on the shell file according to the target shell feature to obtain a shell-removed file, the target shell feature including at least one of a target shell type and a target shell rule; performing decompilation processing on the shell-removed file to obtain decompiled code, and performing semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol-recovered code; performing structural processing on the logic of the symbol-recovered code through abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code.

[0007] In a possible implementation, the un-compiled file is obtained by performing un-compiling on the compiled file according to the target compiling type or the target compiling rule, including: determining a first mapping relationship between a compiling type and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling type and the first mapping relationship; or determining a second mapping relationship between a compiling rule and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling rule and the second mapping relationship; determining an application programming interface of the target un-compiling tool; and sending the compiled file to the target un-compiling tool through the application programming interface to obtain the un-compiled file.

[0008] In a possible implementation, the un-compiled file is obtained by performing un-compiling on the compiled file according to the target compiling type or the target compiling rule, including: determining a first mapping relationship between a compiling type and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling type and the first mapping relationship; or determining a second mapping relationship between a compiling rule and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling rule and the second mapping relationship; determining an application programming interface of the target un-compiling tool; and sending the compiled file to the target un-compiling tool through the application programming interface to obtain the un-compiled file.

[0009] In a possible implementation, the un-compiled file is obtained by performing un-compiling on the compiled file according to the target compiling type or the target compiling rule, including: determining a first mapping relationship between a compiling type and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling type and the first mapping relationship; or determining a second mapping relationship between a compiling rule and an un-compiling tool, and determining a corresponding target un-compiling tool according to the target compiling rule and the second mapping relationship; determining an application programming interface of the target un-compiling tool; and sending the compiled file to the target un-compiling tool through the application programming interface to obtain the un-compiled file.

[0010] In a possible implementation, the repair request includes a target language; the structured code is obtained by performing structural processing on the logic of the symbol recovery code through an abstract syntax tree technology, including: performing parsing processing on the symbol recovery code to obtain a corresponding initial abstract syntax tree, the initial abstract syntax tree including a plurality of control flow nodes; performing identification processing on the plurality of control flow nodes to obtain unstructured logic; converting the unstructured logic into structured logic according to a jump target address of the unstructured logic to generate a structured abstract syntax tree; and performing code conversion processing on the structured abstract syntax tree according to the target language to obtain the structured code.

[0011] In a possible implementation, the code conversion processing is performed on the structured abstract syntax tree to obtain the structured code, including: determining a plurality of conditional judgment nodes, a plurality of logic nodes, and a self-adaptive nesting depth threshold of the structured abstract syntax tree; deleting duplicate nodes from the plurality of conditional judgment nodes, and splitting nodes with a nesting depth exceeding the nesting depth threshold in the plurality of logic nodes to obtain an optimized abstract syntax tree; and performing code conversion processing on the optimized abstract syntax tree to obtain the structured code.

[0012] In a possible implementation, the compiling repair processing is performed on the structured code to obtain the target code, including: performing compiling processing on the structured code by using a compiler to obtain a compiling result, the compiling result including a compiling pass or a compiling fail; if the compiling result is the compiling fail, determining an error type analysis result output by the compiler, performing compiling repair processing on the structured code by using a preset metadata repair rule and a type inference algorithm according to the error type analysis result, and performing compiling processing again until the compiling result is the compiling pass, the error type analysis result including at least one of the following: metadata missing or type mismatch; and if the compiling result is the compiling pass, generating a function-level annotation of the structured code, and determining the target code according to the structured code and the function-level annotation.

[0013] In a second aspect, an embodiment of the present application provides a code repair apparatus, including: a receiving module configured to receive a repair request, the repair request including a packed file; a dynamic unpacking module configured to extract a binary feature of the packed file according to the repair request, input the binary feature into a pre-trained convolutional neural network model to obtain a target packed feature corresponding to the packed file, and perform unpacking processing on the packed file according to the target packed feature to obtain an unpacked file, the target packed feature including at least one of a target packed type and a target packed rule; a recovery module configured to perform decompilation processing on the unpacked file to obtain a decompiled code, and perform semantic recognition on the decompiled code by using a language recognition model to perform symbol recovery processing to obtain a symbol recovered code; a reconstruction module configured to perform structured processing on a logic of the symbol recovered code by using an abstract syntax tree technology to obtain a structured code; and a compiling repair module configured to perform compiling repair processing on the structured code to obtain a target code.

[0014] In a possible implementation, the dynamic unpacking module is specifically configured to determine a first mapping relationship between a packing type and an unpacking tool, determine a corresponding target unpacking tool according to the target packing type and the first mapping relationship, or determine a second mapping relationship between a packing rule and an unpacking tool, determine a corresponding target unpacking tool according to the target packing rule and the second mapping relationship, determine an application programming interface of the target unpacking tool, and send the packed file to the target unpacking tool through the application programming interface to obtain the unpacked file.

[0015] In a possible implementation, the dynamic unpacking module is specifically configured to determine a target code feature of the packed file, the target code feature including at least one of self-modifying code or a jump instruction, determine a third mapping relationship including a mapping relationship between a code feature and an unpacking parameter and a mapping relationship between a packing type and an unpacking parameter, determine a corresponding target unpacking parameter according to the target packing type, the target code feature, and the third mapping relationship, and send the packed file and the target unpacking parameter to the target unpacking tool to obtain the unpacked file.

[0016] In a possible implementation, the recovery module is specifically configured to determine a pre-trained language recognition model, input the unpacked file into the language recognition model to enable the language recognition model to recognize an obfuscated symbol from the unpacked file, determine a predicted probability distribution of a variable name and a method name of the obfuscated symbol, and replace the obfuscated symbol according to the predicted probability distribution to obtain the symbol recovery code.

[0017] In a possible implementation, the repair request includes a target language, the reconstruction module is specifically configured to perform parsing processing on the symbol recovery code to obtain a corresponding initial abstract syntax tree, the initial abstract syntax tree including a plurality of control flow nodes, perform identification processing on the plurality of control flow nodes to obtain unstructured logic, convert the unstructured logic into structured logic according to a jump target address of the unstructured logic to generate a structured abstract syntax tree, and perform code conversion processing on the structured abstract syntax tree according to the target language to obtain the structured code.

[0018] In a possible implementation, the reconstruction module is specifically configured to determine the plurality of conditional judgment nodes, the plurality of logical nodes, and the adaptive nesting depth threshold of the structured abstract syntax tree; the reconstruction module is further configured to delete duplicate nodes from the plurality of conditional judgment nodes, and split nodes whose nesting depth exceeds the nesting depth threshold in the plurality of logical nodes to obtain an optimized abstract syntax tree; and the reconstruction module is further configured to perform code conversion processing on the optimized abstract syntax tree to obtain the structured code.

[0019] In a possible implementation, the apparatus further includes an execution module configured to perform compilation processing on the structured code by using a compiler to obtain a compilation result, the compilation result including a compilation pass or a compilation fail; the execution module is further configured to, if the compilation result is the compilation fail, determine an error type analysis result output by the compiler, perform compilation repair processing on the structured code according to the error type analysis result by using a preset metadata repair rule and a type inference algorithm, and perform re-compilation processing until the compilation result is the compilation pass, the error type analysis result including at least one of the following: metadata missing or type mismatch; and the execution module is further configured to, if the compilation result is the compilation pass, generate a function-level annotation of the structured code, and determine the target code according to the structured code and the function-level annotation.

[0020] In a third aspect, an embodiment of the present application provides a code repair device, including: a memory, a processor;

[0021] The memory stores computer execution instructions.

[0022] The processor executes the computer execution instructions stored in the memory, so that the processor performs the first aspect and / or various possible implementation manners of the first aspect.

[0023] In a fourth aspect, an embodiment of the present application provides a nonvolatile computer readable storage medium, the nonvolatile computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, and the computer program is executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0025] The code repair method, device, electronic equipment, storage medium and product provided by the embodiments of the present application, the method comprises: receiving a repair request, the repair request comprising a packed file; extracting a binary feature of the packed file according to the repair request, inputting the binary feature into a pre-trained convolutional neural network model to obtain a target packing feature corresponding to the packed file, and performing unpacking processing on the packed file according to the target packing feature to obtain an unpacked file, the target packing feature comprising at least one of a target packing type and a target packing rule; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code. The above scheme accurately identifies the target packing type through the pre-trained convolutional neural network model, automatically performs targeted repair according to the target packing type, can accurately repair the influence of the packing tool on the code readability, and thus improves the accuracy of code repair. BRIEF DESCRIPTION OF DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0027] Figure 1 An application scenario diagram of a code repair method provided by the embodiments of the present application;

[0028] Figure 2 A flowchart of a code repair method provided by the embodiments of the present application;

[0029] Figure 3 A flowchart of a code repair method provided by the embodiments of the present application;

[0030] Figure 4 A diagram of dynamic unpacking processing provided by the embodiments of the present application;

[0031] Figure 5 A diagram of symbol recovery processing provided by the embodiments of the present application;

[0032] Figure 6 A diagram of compilation repair provided by the embodiments of the present application;

[0033] Figure 7 A structural diagram of a code repair device provided by the embodiments of the present application;

[0034] Figure 8 A structural diagram of a code repair device provided by the embodiments of the present application;

[0035] Figure 9 FIG. 1 is a structural schematic diagram of an electronic device according to an embodiment of the present application.

[0036] The specific embodiments of the present application have been shown and described in the above-described drawings, and will be described in more detail hereinafter. These drawings and detailed description are not intended to limit the scope of the present application concept in any way, but to illustrate the present application concept to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0037] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same or similar components are denoted by the same or similar reference numerals throughout the drawings and the detailed description, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0038] In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0039] It should be noted that "at the time of" in the embodiments of the present application can be at the moment when a certain condition occurs, or within a period of time after a certain condition occurs, which is not limited in the embodiments of the present application. In addition, the display interface provided by the embodiments of the present application is only an example, and the display interface can also include more or less content.

[0040] It should be noted that the code repair method, device, electronic device, storage medium and product provided by the embodiments of the present application can be used in the field of artificial intelligence technology, and can also be used in any field other than artificial intelligence. The application field of the code repair method, device, electronic device, storage medium and product provided by the embodiments of the present application is not limited.

[0041] Figure 1An application scenario of a code repair method provided by an embodiment of the present application is shown in the figure. The scenario is exemplified as follows: source code is compiled to obtain intermediate language, and the intermediate language is decompiled to restore the source code.

[0042] In actual applications, in the process of compiling, the source code is processed by code obfuscation, and the executable file of the source code is processed by shell processing, so as to improve the security of the source code. However, when a code owner, for example, a developer needs to use the source code, and the source code is lost, the source code can be obtained by reverse engineering, and the decompiled code obtained by decompiling the intermediate language by reverse engineering has the problem of poor readability, which is specifically manifested as: the shell processing causes the code structure to be hidden and the metadata to be lost. Code obfuscation causes variables or method names to be disordered and control flow to be unstructured. Further, the decompiled code cannot be directly compiled, and the logic is difficult to understand, which seriously hinders reverse engineering and subsequent maintenance. Therefore, repair processing is needed to improve the readability of the decompiled code.

[0043] The shell processing is that the executable file of the source code after compilation is compressed, encrypted or encapsulated, and a shell program is attached.

[0044] The code obfuscation is that the source code is processed by renaming variables / method names, inserting meaningless code, modifying control flow structure and the like to obtain the intermediate language, while the function remains unchanged. The code obfuscation can reduce the readability of the code restored by the decompilation processing.

[0045] In the related art, the decompiled code is processed by manual formatting to achieve repair, which introduces subjective errors of human beings and causes the problem of low accuracy.

[0046] The method for code repair provided by the present application aims to solve the above technical problems of the prior art.

[0047] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail in specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0048] Figure 2 A flowchart of a code repair method provided by an embodiment of the present application is shown in the figure, and the method comprises the following steps:

[0049] S201, receiving a repair request, the repair request comprising a shell file.

[0050] Exemplarily, the packed file is a file obtained by performing a packing operation on an executable file after code compilation. The internal code logic cannot be directly obtained through the packed file.

[0051] Optionally, the application can perform a repair request through an electronic device to repair the packed file to obtain readable target code.

[0052] S202, according to the repair request, extracting the binary features of the packed file, inputting the binary features into the pre-trained convolutional neural network model to obtain the target packing features corresponding to the packed file, and performing unpacking processing on the packed file according to the target packing features to obtain an unpacked file, the target packing features including a target packing type or a target packing rule.

[0053] Exemplarily, the unpacking processing is used to remove the shell program added to the executable file by the packing tool, to remove the protection mechanism, and thus to restore to the original, unencrypted executable file.

[0054] In practical applications, there are various packing tools, and the packing rules or packing types corresponding to each packing tool are different. In the related art, the packing rules or packing types are identified in an artificial manner, and the unpacking processing is performed according to the identification result. However, artificial identification has errors, and the accuracy of the identification affects the accuracy of the unpacking processing.

[0055] Exemplarily, the binary features are extracted from the byte sequence and / or structured information of the packed file, and the binary features can represent the numerical information of the corresponding packing type or packing rule.

[0056] Exemplarily, the pre-trained convolutional neural network model is trained through sample files and corresponding sample packing types, can learn the high-dimensional mapping relationship between the binary features of the sample files and the sample packing types, and thus accurately determine the target packing type. After accurately determining the target packing type, the accuracy of the unpacking processing can be effectively improved.

[0057] S203, performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code.

[0058] Exemplarily, the code will confuse the variable name and method name of the symbol during the compilation process, and thus the readability of the decompiled code is poor. The recovery processing is used to restore the symbol state in the source code, and thus the readability of the code is improved.

[0059] Optionally, a code pre-training model using a Transformer structure (for example, CodeBERT) is used to probabilistically rename the obfuscated identifiers to achieve the symbolic recovery processing by analyzing the context semantics of the variables in the control flow graph (CFG) and the data flow graph (DFG).

[0060] In combination with the scene examples, the obfuscated variable names and method names are the replacement of the variable names and method names of the source code with randomly generated meaningless strings, resulting in the logic confusion of the code. The symbolic recovery processing can restore the logic of the source code, thereby improving the readability of the code.

[0061] S204, the logic of the symbolic recovery code is structurally processed through the abstract syntax tree technology to obtain the structured code.

[0062] For example, through the control flow reconstruction processing, the out-of-order jump logic of the symbolic recovery code is converted into structured control flow (such as if-else, while, for, etc.), thereby repairing the logic of the code to improve the readability of the code.

[0063] For example, the abstract syntax tree technology converts the logic of the symbolic recovery code into a control flow graph, each node representing a basic block and the edge representing the jump relationship, thereby accurately identifying the logic of the symbolic recovery code to improve the accuracy of the repair.

[0064] S205, the structured code is subjected to the compilation repair processing to obtain the target code.

[0065] For example, the shell tool can cause problems such as metadata loss and variable type mismatch. The compilation repair processing is used to automatically identify and repair the problems, thereby obtaining the target code with enhanced readability.

[0066] For example, the present application integrates multiple professional tools (such as a shell tool or a compiler) and designs an automatic scheduling and feedback mechanism to build a closed-loop repair system. By running the closed-loop repair system on an electronic device, the problems such as metadata loss and type mismatch can be automatically located and repaired without human intervention.

[0067] The code repair method provided in the embodiments of the present application comprises the following steps: receiving a repair request, wherein the repair request comprises a packed file; extracting binary features of the packed file according to the repair request, inputting the binary features into a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, and performing unpacking processing on the packed file according to the target packing features to obtain an unpacked file, wherein the target packing features comprise at least one of a target packing type and a target packing rule; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by using a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by using an abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code. According to the above scheme, the target packing type is accurately recognized by using the pre-trained convolutional neural network model, and targeted repair is automatically performed according to the target packing type, so that the influence of the packing tool on the readability of the code can be accurately repaired, thereby improving the accuracy of code repair. According to test verification, the readability (calculated according to the proportion of semantic compliance) of variable names and method names of the target code processed by the above scheme is improved by more than 90%, and the code compilation pass rate is improved from less than 60% to more than 95%. At the same time, the time required for manual repair is shortened to the minute level, and efficient and accurate automatic code repair is realized.

[0068] On the basis of any one of the above embodiments, the following will be described in combination with Figure 3 The detailed process of code repair is described.

[0069] Figure 3 A flowchart of a code repair method provided in the embodiments of the present application is shown in FIG. 1. As shown in FIG. 1, the method comprises the following steps. Figure 3

[0070] S301, receiving a repair request, wherein the repair request comprises a packed file.

[0071] It should be noted that the execution process of S301 is described in S201, which will not be described here.

[0072] S302, determining a first mapping relationship between a packing type and an unpacking tool, and determining a corresponding target unpacking tool according to the target packing type and the first mapping relationship.

[0073] For example, each unpacking tool performs unpacking processing on the corresponding packing type, and the first mapping relationship between the packing type and the unpacking tool is generated by collecting a plurality of unpacking tools in advance.

[0074] For example, the target unpacking tool is obtained by matching the target packing type in the first mapping relationship.

[0075] ​With the scene example, the target unshelling tool is used for unshelling processing on the shell program of the target shelling type.

[0076] S303, determine the second mapping relationship between the shelling rule and the unshelling tool, and determine the corresponding target unshelling tool according to the target shelling rule and the second mapping relationship.

[0077] It should be noted that the execution process of S303 is referred to S302, which will not be repeated here. The execution order of S302 and S303 is not limited in this application.

[0078] S304, determine the application programming interface of the target unshelling tool.

[0079] Exemplarily, the application programming interface is an interface for interaction between software components, which defines how to access and use the functions of the unshelling tool. The application programming interface provides control of the unshelling process and acquisition of the results through standardized methods, parameters and return values.

[0080] Exemplarily, through the application programming interface, the target unshelling tool and the functions of the target unshelling tool can be automatically accessed and used, so as to realize automatic unshelling processing.

[0081] S305, send the shelled file to the target unshelling tool through the application programming interface, and obtain the unshelled file.

[0082] A feasible implementation manner can generate the unshelled file by the following method, including: determining the target code feature of the shelled file, the target code feature including at least one of self-modifying code or jump instruction; determining the third mapping relationship, the third mapping relationship including the mapping relationship between the code feature and the unshelling parameter, and the mapping relationship between the shelling type and the unshelling parameter; determining the corresponding target unshelling parameter according to the target shelling type, the target code feature and the third mapping relationship; sending the shelled file and the target unshelling parameter to the target unshelling tool to obtain the unshelled file.

[0083] Exemplarily, the unshelling parameter indicates the instruction of the unshelling tool, which makes the unshelling tool execute which operation through the unshelling parameter.

[0084] Exemplarily, each unshelling parameter is used for unshelling processing of the corresponding code feature, each unshelling parameter is used for unshelling processing of the corresponding shelling type, and the second mapping relationship is generated according to the corresponding relationship in advance.

[0085] Exemplarily, the self-modifying code is the part of the code that dynamically modifies itself during runtime to achieve specific functions. The jump instruction is the core instruction to control the code flow, and the jump instruction confusion will lead to the confusion of the code logic flow, affecting the readability of the code.

[0086] In the following,Figure 4 The dynamic deshelling process is explained.

[0087] Figure 4 This is a schematic diagram of the dynamic unpacking process provided in an embodiment of this application. Figure 4 As shown, for each packed file, the target packing type and target code characteristics are dynamically determined. The corresponding target packing tool is determined based on the target packing type. The corresponding target unpacking parameters are determined based on the target code characteristics. The packed file and target unpacking parameters are sent to the target unpacking tool to obtain the unpacked file. Because the dynamically obtained target unpacking parameters match the packed file, targeted unpacking processing can be performed, improving the accuracy of the unpacked file.

[0088] With the example of the scenario, the target unpacking parameters can be used to explicitly instruct the target unpacking tool to perform targeted processing on the self-modified code and obfuscated jump instructions in the packed file.

[0089] Optionally, a jump instruction is used to point to the memory address of the next execution location, and it can be generated in the following ways: direct jump, relative jump, or indirect jump.

[0090] In this feasible implementation, dynamic target unpacking parameters explicitly instruct the target unpacking tool to perform targeted processing, thereby improving the accuracy of code repair.

[0091] S306. Semantic recognition is performed on the decompiled code using a language recognition model to perform symbolic recovery processing, resulting in symbolic recovery code.

[0092] One feasible implementation method for symbol recovery processing includes: determining a pre-trained language recognition model; inputting decompiled code into the language recognition model to enable the language recognition model to identify obfuscated symbols from the decompiled code, determining the predicted probability distribution of variable names and method names of the obfuscated symbols, and replacing the obfuscated symbols according to the predicted probability distribution to obtain symbol recovery code.

[0093] Optionally, the language recognition model can be a pre-trained code model with a Transformer architecture (such as CodeBERT).

[0094] For example, a language recognition model can identify the context and semantics of decompiled code, thereby identifying obfuscated symbols in the decompiled code and replacing them.

[0095] Below, in conjunction with Figure 5 The symbol recovery process is explained.

[0096] Figure 5 This is a schematic diagram of the symbol recovery process provided in an embodiment of this application. Figure 5As shown, the prediction probability distribution in the decompiled code is identified by the language recognition model, the obfuscated symbols are replaced according to the prediction probability distribution, and the symbol recovery code is obtained.

[0097] In combination with a scene example, abnormal symbols (such as too short length and no semantic features) in the decompiled code are identified by static analysis. For example, a, b, and c in int a = b + c are marked as obfuscated symbols. The language recognition model analyzes the code logic according to the context of the decompiled code (such as a = b + c may correspond to total = base value + additional value). The prediction probability distribution of each variable name and method name is generated, and the optimal variable name and method name are selected according to the probability distribution (for example, the probability of a corresponding to total is 0.95, and the probability of a corresponding to sum is 0.05, so a is selected as total).

[0098] Optionally, the global dependency relationship of the code block is captured by using a bidirectional attention mechanism.

[0099] Optionally, the code is abstracted into an attribute graph by a graph neural network, so as to replace the language recognition model to predict the variable name and the method name.

[0100] In this feasible implementation manner, the pre-trained language recognition model replaces the manual mode to realize automatic identification and replacement, so as to reduce manual operation.

[0101] S307, the logic of the symbol recovery code is structurally processed by the abstract syntax tree technology, and the structured code is obtained.

[0102] A feasible implementation manner can generate structured code by the following method, including: performing parsing processing on the symbol recovery code to obtain a corresponding initial abstract syntax tree, the initial abstract syntax tree including a plurality of control flow nodes; performing identification processing on the plurality of control flow nodes to obtain unstructured logic; converting the unstructured logic into structured logic according to the jump target address of the unstructured logic, to generate a structured abstract syntax tree; and performing code conversion processing on the structured abstract syntax tree according to a target language, to obtain structured code.

[0103] The repair request includes a target language. The target language is the language corresponding to the target code indicated by the repair request.

[0104] Exemplarily, the symbol recovery code is parsed into an Abstract Syntax Tree (AST), which can include program structure nodes, control flow nodes, or semantic logic nodes. The control flow nodes of the Abstract Syntax Tree are traversed to identify unstructured logic (for example, goto jump, label statement). According to the jump target address of the unstructured logic, the unstructured logic is converted into structured logic (such as if-else branch, while loop), and a structured Abstract Syntax Tree is generated. The structured Abstract Syntax Tree is converted into code corresponding to the target language to obtain structured code. The goto jump logic will disrupt the execution order of the code, making it difficult to track the logic branches.

[0105] Exemplarily, the Abstract Syntax Tree abstracts away unimportant details in the source code (such as spaces, comments, and specific delimiters), and only retains the core syntax elements of the program and their relationships.

[0106] Optionally, when the user interactively modifies the decompiled code (such as adjusting if conditions), the Abstract Syntax Tree is updated in real time in a partial manner rather than being fully reconstructed, and the affected nodes are located based on a Change Propagation Algorithm. Semantic similarity calculation is performed on adjacent goto blocks (based on code embedding vectors), and only blocks with a similarity greater than 90% are merged to avoid logical errors caused by excessive structuring. It can be understood that incremental updating can effectively reduce memory overhead.

[0107] In this feasible implementation manner, through the structured processing, the unstructured logic can be replaced by structured logic, which can effectively improve the clarity and readability of the control flow of the code.

[0108] In a feasible implementation manner, the structured Abstract Syntax Tree can be processed by the following method to obtain structured code, including: determining a plurality of condition judgment nodes, a plurality of logic nodes, and an adaptive nesting depth threshold of the structured Abstract Syntax Tree; deleting duplicate nodes from the plurality of condition judgment nodes, and splitting nodes in the plurality of logic nodes whose nesting depth exceeds the nesting depth threshold to obtain an optimized Abstract Syntax Tree; and performing code conversion processing on the optimized Abstract Syntax Tree to obtain structured code.

[0109] Exemplarily, in the Abstract Syntax Tree, the condition judgment nodes and the logic nodes are marked as key structures.

[0110] Exemplarily, the adaptive nesting depth threshold can be dynamically set according to the nesting depth and code complexity of each path in the Abstract Syntax Tree. This ensures that complex logic is reasonably nested, and simple logic is not excessively split.

[0111] Optionally, the conditional judgment nodes that have appeared are recorded in a symbol table, and whether the conditional judgment nodes are repeated is determined by comparing the syntax tree structure and semantic features of the nodes.

[0112] Based on the above embodiments, the running overhead and maintenance cost are reduced by deleting the repeated code. The readability of the code is improved by reducing the nesting depth.

[0113] S308, the structured code is compiled and repaired to obtain the target code.

[0114] A feasible implementation manner can be performed by the following method, including: the structured code is compiled and repaired by a compiler to obtain a compilation result, the compilation result includes a compilation pass or a compilation failure; if the compilation result is a compilation failure, the error type analysis result output by the compiler is determined, and the structured code is compiled and repaired according to the error type analysis result, a preset metadata repair rule and a type inference algorithm, and the compilation is performed again until the compilation result is a compilation pass. The error type analysis result includes at least one of the following: metadata missing or type mismatch; if the compilation result is a compilation pass, the function-level annotation of the structured code is generated, and the target code is determined according to the structured code and the function-level annotation.

[0115] Next, the above-mentioned embodiments will be described in detail. Figure 6 The compilation repair is described.

[0116] Figure 6 The schematic diagram of the compilation repair provided by the embodiments of the present application is shown in FIG. 1. Figure 6 As shown in FIG. 1, the structured code is compiled by a compiler, if the compilation is passed, the target code is output to complete the code repair. If the compilation is failed, the error type is analyzed for recompilation, and the compiler is used for loop judgment until the target code is output.

[0117] For example, the function-level annotation is an annotation for a function or a method, which is used to describe the function, parameters, return value, exception handling and other information, to help developers understand the code logic and correctly use the function, and can effectively improve the code readability.

[0118] Optionally, the syntax, type or link rules of the structured code are checked by the compiler to obtain a compilation result. The compilation pass indicates that the structured code conforms to the language specification. The compilation failure indicates that there are syntax errors, type mismatches or metadata missing in the structured code.

[0119] For example, the error type output by the compiler can clearly indicate the strategy of the compilation repair, so as to perform the automatic compilation repair.

[0120] Optionally, the compiler can be the Roslyn compiler.

[0121] With the example of Roslyn compiler for compilation repair, the code is automatically repaired using preset metadata patching rules and type inference algorithms. This process is iterated until compilation is successful, thus achieving a closed loop of compilation feedback.

[0122] In this feasible implementation, the compiler enables automatic code repair, thereby reducing manual operations and improving the accuracy of code repair.

[0123] Figure 7 This is a schematic diagram of a code repair device provided in an embodiment of this application. Figure 7 As shown, the code repair device 70 may include: a receiving module 71, a dynamic unpacking module 72, a recovery module 73, a reconstruction module 74, and a compilation repair module 75.

[0124] The receiving module 71 is used to receive repair requests, which include packed files.

[0125] The dynamic unpacking module 72 is used to extract the binary features of the packed file according to the repair request, input the binary features into a pre-trained convolutional neural network model to obtain the target packed features corresponding to the packed file, and perform unpacking processing on the packed file according to the target packed features to obtain the unpacked file. The target packed features include at least one of the target packed type and the target packed rule.

[0126] Recovery module 73 is used to decompile the unpacked file to obtain decompiled code, and to perform semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code.

[0127] Reconstruction module 74 is used to perform structured processing on the logic of symbolic recovery code using abstract syntax tree technology to obtain structured code.

[0128] The compilation and repair module 75 is used to perform compilation and repair processing on structured code to obtain target code.

[0129] Optionally, the receiving module 71 can perform... Figure 2 S201 in the embodiment.

[0130] Optionally, the dynamic unpacking module 72 can execute... Figure 2 S202 in the embodiment.

[0131] Optionally, recovery module 73 can execute Figure 2 S203 in the embodiment.

[0132] Optionally, the reconstruction module 74 can perform Figure 2 S204 in the embodiment.

[0133] Optionally, the compiling repair module 75 can perform Figure 2 S205 in the embodiment.

[0134] It should be noted that the code repair apparatus shown in the embodiment of the present application can perform the technical solutions shown in the above method embodiments, and the implementation principles and beneficial effects are similar, which will not be described here in detail.

[0135] In a possible implementation, the dynamic unpacking module 72 is specifically configured to:

[0136] determine a first mapping relationship between the shell types and the unpacking tools, and determine the corresponding target unpacking tool according to the target shell type and the first mapping relationship; or

[0137] determine a second mapping relationship between the shell rules and the unpacking tools, and determine the corresponding target unpacking tool according to the target shell rule and the second mapping relationship;

[0138] determine an application programming interface of the target unpacking tool;

[0139] send the shell file to the target unpacking tool through the application programming interface, and obtain the unpacked file.

[0140] In a possible implementation, the dynamic unpacking module 72 is specifically configured to:

[0141] determine a target code feature of the shell file, the target code feature including at least one of self-modifying code or a jump instruction;

[0142] determine a third mapping relationship, the third mapping relationship including a mapping relationship between the code feature and the unpacking parameter, and a mapping relationship between the shell type and the unpacking parameter;

[0143] determine the corresponding target unpacking parameter according to the target shell type, the target code feature, and the third mapping relationship;

[0144] send the shell file and the target unpacking parameter to the target unpacking tool, and obtain the unpacked file.

[0145] In a possible implementation, the recovery module 73 is specifically configured to:

[0146] determine a pre-trained language recognition model;

[0147] The decompiled file is input into the language recognition model, so that the language recognition model recognizes the obfuscated symbols from the decompiled file, determines a prediction probability distribution of variable names and method names of the obfuscated symbols, and replaces the obfuscated symbols according to the prediction probability distribution to obtain a symbol recovery code.

[0148] In a possible implementation, the reconstruction module 74 is specifically configured to:

[0149] The symbol recovery code is parsed to obtain a corresponding initial abstract syntax tree, and the initial abstract syntax tree includes a plurality of control flow nodes.

[0150] The plurality of control flow nodes are identified to obtain unstructured logic.

[0151] The unstructured logic is converted into structured logic according to a jump target address of the unstructured logic, to generate a structured abstract syntax tree.

[0152] The structured abstract syntax tree is code-converted according to a target language to obtain structured code.

[0153] In a possible implementation, the reconstruction module 74 is specifically configured to:

[0154] A plurality of conditional judgment nodes, a plurality of logic nodes, and an adaptive nesting depth threshold of the structured abstract syntax tree are determined.

[0155] Repeated nodes are deleted from the plurality of conditional judgment nodes, and nodes with a nesting depth exceeding the nesting depth threshold are split in the plurality of logic nodes, to obtain an optimized abstract syntax tree.

[0156] The optimized abstract syntax tree is code-converted to obtain structured code.

[0157] Figure 8 A structural diagram of a code repair device provided by an embodiment of the present application is shown in FIG. 1. Figure 7 Based on the embodiment shown in FIG. 1, the code repair device 70 further includes an execution module 76, as shown in FIG. 2. Figure 8 The execution module 76 is configured to:

[0158] The structured code is compiled by a compiler to obtain a compilation result, and the compilation result includes a compilation pass or a compilation failure.

[0159]

[0160] ​If the compilation result is that the compilation fails, a type analysis result of an error output by the compiler is determined, according to the type analysis result of the error, the structured code is processed for compilation repair through preset metadata repair rules and type inference algorithms, and re-compilation processing is performed until the compilation result is that the compilation passes, and the type analysis result of the error includes at least one of the following: metadata missing, or type mismatch;

[0161] If the compilation result is that the compilation passes, function-level annotations of the structured code are generated, and target code is determined according to the structured code and the function-level annotations.

[0162] Figure 9 A structural schematic diagram of an electronic device provided in an embodiment of the present application is shown in FIG. 1. Figure 9 As shown in FIG. 1, the electronic device includes:

[0163] A processor 291, and the electronic device further includes a memory 292; and can further include a communication interface 293 and a bus 294. The processor 291, the memory 292, and the communication interface 293 can complete communication with each other through the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke a logical instruction in the memory 292 to execute the method of the above-described embodiment.

[0164] In addition, the logical instruction in the memory 292 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium.

[0165] The memory 292 is a non-volatile computer readable storage medium, which can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 291 executes the functions of the application and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, implements the method in the above-described method embodiment.

[0166] The memory 292 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created according to the use of the terminal device, etc. In addition, the memory 292 can include a high-speed random access memory, and can also include a non-volatile memory.

[0167] The embodiment of the present application provides a non-volatile computer readable storage medium, and the non-volatile computer readable storage medium stores computer execution instructions. When the computer execution instructions are executed by a processor, the computer execution instructions are used to implement the method of the above-described embodiment.

[0168] The embodiment of the present application provides a computer program product comprising a computer program, which, when executed by a processor, implements the method of the foregoing embodiment.

[0169] It should be noted that, for the foregoing method embodiments, in order to simply describe, the foregoing method embodiments are all described as a combination of a series of actions, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to optional embodiments, and the actions and modules involved are not necessarily necessary for the present application.

[0170] It should be further noted that, although each step in the flowchart is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise stated in this article, the execution of these steps has no strict order limit, and these steps can be executed in other order. Moreover, at least part of the steps in the flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with other steps or sub-steps or stages of other steps.

[0171] It should be understood that the above-mentioned device embodiments are only schematic, and the device of the present application can also be realized by other manners. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and another division manner can be used in actual implementation. For example, a plurality of units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0172] In addition, each functional unit / module in each embodiment of the present application can be integrated in one unit / module, or each unit / module can exist physically, or two or more units / modules can be integrated together. The integrated unit / module can be realized in the form of hardware or in the form of software program module.

[0173] If the integrated units / modules are implemented in the form of hardware, the hardware can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. The processor can be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, and an ASIC, etc. Among them, the GPU can be used for hardware acceleration to improve the efficiency of code repair. The storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0174] If the integrated units / modules are implemented in the form of software program modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0175] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. The technical features of the above embodiments can be combined arbitrarily, and in order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combination of these technical features does not exist contradictory, it should be considered as the scope of the present application.

[0176] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0177] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A code fix method, characterized by, The method comprises the following steps: receiving a repair request, the repair request comprising a packed file; extracting binary features of the packed file according to the repair request, inputting the binary features into a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, and performing unpacking processing on the packed file according to the target packing features to obtain an unpacked file, wherein the target packing features comprise at least one of a target packing type and a target packing rule; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code; wherein the repair request comprises a target language; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code comprises: performing parsing processing on the symbol recovery code to obtain a corresponding initial abstract syntax tree, wherein the initial abstract syntax tree comprises a plurality of control flow nodes; performing identification processing on the plurality of control flow nodes to obtain unstructured logic; converting the unstructured logic into structured logic according to the jump target address of the unstructured logic to generate a structured abstract syntax tree; and performing code conversion processing on the structured abstract syntax tree according to the target language to obtain the structured code; performing compilation repair processing on the structured code to obtain target code.

2. The method of claim 1, wherein, performing unpacking processing on the packed file according to the target packing type or the target packing rule to obtain an unpacked file, comprising: determining a first mapping relationship between a packing type and an unpacking tool, determining a corresponding target unpacking tool according to the target packing type and the first mapping relationship; or determining a second mapping relationship between a packing rule and an unpacking tool, and determining a corresponding target unpacking tool according to the target packing rule and the second mapping relationship; determining an application programming interface of the target unpacking tool; sending the packed file to the target unpacking tool through the application programming interface to obtain the unpacked file.

3. The method of claim 2, wherein, sending the packed file to the target unpacking tool to obtain the unpacked file, comprising: determining target code features of the packed file, wherein the target code features comprise at least one of self-modifying code or jump instructions; determining a third mapping relationship, wherein the third mapping relationship comprises a mapping relationship between code features and unpacking parameters, and a mapping relationship between a packing type and unpacking parameters; determining a corresponding target unpacking parameter according to the target packing type, the target code features, and the third mapping relationship; sending the packed file and the target unpacking parameter to the target unpacking tool to obtain the unpacked file.

4. The method of claim 1, wherein, performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code, comprising: determining a pre-trained language recognition model; The decompiled code is input into the language recognition model, so that the language recognition model identifies the obfuscated symbols from the decompiled code, determines a predicted probability distribution of variable names and method names of the obfuscated symbols, and replaces the obfuscated symbols according to the predicted probability distribution to obtain the symbol recovery code.

5. The method of claim 1, wherein, The structured abstract syntax tree is subjected to code conversion processing to obtain the structured code, including: determining a plurality of conditional judgment nodes, a plurality of logic nodes, and an adaptive nesting depth threshold of the structured abstract syntax tree; deleting duplicate nodes from the plurality of conditional judgment nodes and splitting nodes with a nesting depth exceeding the nesting depth threshold in the plurality of logic nodes to obtain an optimized abstract syntax tree; the optimized abstract syntax tree is subjected to code conversion processing to obtain the structured code.

6. The method according to any one of claims 1-5, characterized in that, The structured code is subjected to compilation repair processing to obtain target code, including: compiling the structured code through a compiler to obtain a compilation result, the compilation result including a compilation pass or a compilation failure; if the compilation result is a compilation failure, determining an error type analysis result output by the compiler, and according to the error type analysis result, performing compilation repair processing on the structured code through a preset metadata repair rule and a type inference algorithm, and recompiling until the compilation result is a compilation pass, the error type analysis result including at least one of the following: metadata missing or type mismatch; if the compilation result is a compilation pass, generating function-level annotations of the structured code, and determining the target code according to the structured code and the function-level annotations.

7. A code fix apparatus, comprising: including: a receiving module configured to receive a repair request, the repair request including a packed file; a dynamic unpacking module configured to extract binary features of the packed file according to the repair request, input the binary features into a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, and perform unpacking processing on the packed file according to the target packing features to obtain an unpacked file, the target packing features including at least one of a target packing type and a target packing rule; a recovery module configured to perform decompilation processing on the unpacked file to obtain decompiled code, and perform semantic recognition on the decompiled code through a language recognition model to perform symbol recovery processing to obtain symbol recovery code; a reconstruction module configured to perform structured processing on the logic of the symbol recovery code through abstract syntax tree technology to obtain structured code; The repair request includes a target language; the reconstruction module is specifically configured to perform parsing processing on the symbol recovery code to obtain a corresponding initial abstract syntax tree, and the initial abstract syntax tree includes a plurality of control flow nodes; the reconstruction module is specifically further configured to perform identification processing on the plurality of control flow nodes to obtain unstructured logic; the reconstruction module is specifically further configured to convert the unstructured logic into structured logic according to a jump target address of the unstructured logic to generate a structured abstract syntax tree; and the reconstruction module is specifically further configured to perform code conversion processing on the structured abstract syntax tree according to the target language to obtain the structured code. The compiling repair module is configured to perform compiling repair processing on the structured code to obtain target code.

8. An electronic device, comprising: Comprise: A processor, and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-6.

9. A non-transitory computer readable storage medium, comprising: The non-volatile computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method in any one of claims 1-6.

Images