A method and system for determining immediate number encoding of a binary rewriter

Abstract

The application relates to the technical field of binary program analysis and rewriting, and discloses an immediate number symbolization judgment method and system of a binary rewriting program, which comprises a preprocessing step, a basic evidence analysis step, an intermediate evidence analysis step, a high-level evidence analysis step and a fusion decision step. The preprocessing layer carries out structural analysis and semantic modeling on a binary file, extracts candidate immediate numbers and meta information, the basic evidence layer carries out preliminary weighting based on explicit rules, the intermediate evidence layer carries out quantitative evaluation through heuristics and statistical patterns, the high-level evidence layer carries out high-precision analysis on the immediate numbers with semantic ambiguity, the fusion decision layer summarizes the evidences at all levels, forms a comprehensive tendency value through weighted calculation, classifies the immediate numbers, and generates a final symbolization strategy. The application significantly improves the accuracy and interpretability of symbolization judgment, balances the analysis precision and processing efficiency, and is suitable for binary files of different compilers, platforms and file stripping states.

Description

Technical Field

[0001] This invention relates to the field of binary program analysis and rewriting technology, and in particular to a method and system for determining the immediate value symbolization of a binary rewritten program. Background Technology

[0002] Static binary rewriting is a key technology in fields such as software security, system optimization, and compatibility maintenance. It modifies executable files (binary files) directly without requiring source code, enabling program hardening, instrumentation, performance analysis, or cross-platform migration. A core and critical challenge in this process is the symbolic representation of immediate values.

[0003] Immediate values ​​are constants directly encoded in machine instructions. In binary programs, many immediate values ​​are not ordinary arithmetic constants, but rather represent memory addresses, function entry points, or jump targets. During rewriting, if these critical address-type immediate values ​​are not symbolized (i.e., replaced with symbolic labels that can be adjusted during relocation), these hard-coded addresses will point to incorrect code or data locations after the program is moved or modified, leading to program crashes or control flow errors. Conversely, excessive symbolization, misinterpreting ordinary data constants as addresses and replacing them, will corrupt the semantics of the original data, also causing program errors. Therefore, accurately determining whether immediate values ​​need to be symbolized is the cornerstone of ensuring the correctness of binary rewriting.

[0004] Currently, industry and academia have proposed some methods to solve the problem of immediate number symbolization, but all of them have obvious limitations:

[0005] 1. Methods based on simple heuristics (such as Urboros): These methods rely on a few fixed rules (e.g., determining whether an immediate value falls within the code segment address range) for judgment. This approach has extremely low performance overhead, but the rule coverage is very limited, resulting in insufficient accuracy. For code patterns generated by complex compiler optimizations or binary files stripped of symbol information, these methods can produce a large number of false positives.

[0006] 2. Methods based on complex static analysis (such as Ramblr): To improve accuracy, these methods employ more sophisticated static analysis (such as value set analysis) to track the propagation and use of immediate values. While their decision-making accuracy is improved, they introduce significant performance overhead, and the analysis process is time-consuming, making them difficult to apply to large-scale or complex real-world binary programs, thus limiting their practicality.

[0007] 3. Methods that limit the scope of application (such as Retrowrite): This method circumvents the symbology problem by limiting the rewriting target to position-independent code (PIC) files. This is because PIC code itself uses relative addressing and has less dependence on absolute addresses. However, this strategy severely limits the tool's versatility and cannot handle a large number of non-PIC format commercial software or stripped binary files.

[0008] 4. Methods based on opaque intermediate representations and inference (such as DDIsasm): This method converts binary instructions into intermediate representations (IR) and uses declarative languages ​​such as Datalog to write inference rules to determine immediate attributes. Despite its sophisticated design, its decision-making process is highly embedded and opaque. When symbolic errors occur, developers find it difficult to intuitively understand and debug its internal inference logic, significantly increasing the difficulty of system debugging, feature expansion, and maintenance.

[0009] In summary, existing technologies face a dilemma in simultaneously achieving high accuracy, performance, versatility, and interpretability when dealing with the immediate value symbolization decision problem in binary rewriting. There is a lack of a symbolization decision scheme that can operate efficiently on large-scale binary files while maintaining high accuracy, strong robustness, and a clear and interpretable decision-making process. This is precisely the core technical problem that this invention aims to solve. Summary of the Invention

[0010] To address the aforementioned technical problems, this invention provides a method and system for determining the immediate signification of a binary rewrite program, aiming to improve the accuracy of immediate signification determination, ensure the correctness of binary rewrite operations and program execution security, and achieve acceptable performance overhead.

[0011] To achieve the above objectives, the technical solution of the present invention is as follows:

[0012] A method for determining the immediate signification of a binary rewrite program includes the following steps:

[0013] (1) Preprocessing steps: Parse and semantically model the input binary file, collect candidate immediate values ​​and related meta-information to form structured input;

[0014] (2) Basic evidence analysis steps: Based on the preset explicit rules, the candidate immediate numbers are initially filtered and their credibility is scored, and expandable strong positive / strong negative evidence is introduced to generate initial scores and evidence tags;

[0015] (3) Intermediate evidence analysis steps: Combining heuristic rules and statistical models, semantic analysis and quantitative evaluation of candidate immediate numbers are carried out, and at the same time, expandable heuristic evidence is introduced to generate intermediate scores and evidence tags;

[0016] (4) Fusion decision steps: According to the preset weights, the initial score and intermediate score are weighted and fused to calculate the comprehensive tendency value of each candidate immediate number; according to the comprehensive tendency value, the candidate immediate number is classified into categories of mandatory symbolization, optional symbolization, or prohibited symbolization, and the symbolization determination result is output.

[0017] In the above scheme, the fusion decision step further includes: when the comprehensive propensity value is in a preset ambiguity interval, triggering an advanced evidence analysis step; the advanced evidence analysis step includes: performing control flow graph analysis, local value set analysis, and definition-use chain analysis on the candidate immediate values ​​to obtain more accurate semantic evidence and generate advanced scores and evidence labels; the fusion decision step recalculates the comprehensive propensity value based on the updated evidence scores and completes the final classification.

[0018] In the above scheme, the explicit rules in the basic evidence analysis step include: address range checking rules, function call checking rules, and symbol table information checking rules.

[0019] In the above scheme, the heuristic rules and statistical patterns in the intermediate evidence analysis step include: control flow and function structure related evidence rules, address construction and access pattern related evidence rules, linking and relocation related evidence rules, data organization structure related evidence rules, and abnormal pattern counter-evidence rules used to suppress misjudgments.

[0020] In the above scheme, the fusion decision-making step is equipped with an evidence weighting statistical mechanism, including the following statistical steps:

[0021] (1) Obtain symbolic benchmark data based on the unstripped binary file and the compiled assembly file;

[0022] (2) Statistically analyze the number of candidate immediate numbers under different evidence types and their hit rate in the benchmark data;

[0023] (3) Based on the statistical results, automatically calculate and adjust the weight parameters of various types of evidence in the fusion decision-making step.

[0024] In the above scheme, the semantic modeling in the preprocessing step specifically includes: disassembling the code segment of the binary file, and building a semantic representation model of the program based on it. Subsequently, the disassembly results are organized and modeled using functions as the basic unit to build an instruction-level intermediate representation and record control flow information.

[0025] An immediate signification determination system for binary rewrite programs includes:

[0026] The preprocessing layer is configured to parse and semantically model the input binary file, collect candidate immediate values ​​and related meta-information, and form a structured input.

[0027] The basic evidence layer is configured to perform preliminary filtering and credibility scoring on candidate immediate numbers based on preset explicit rules, and to introduce expandable strong positive / strong negative evidence to generate initial scores and evidence tags.

[0028] The intermediate evidence layer combines heuristic rules and statistical models to perform semantic analysis and quantitative evaluation of candidate immediate numbers. It also introduces expandable heuristic evidence to generate intermediate scores and evidence labels.

[0029] The fusion decision layer is configured to perform weighted fusion of the initial score and intermediate score according to preset weights to calculate the comprehensive tendency value of each candidate immediate number; based on the comprehensive tendency value, the candidate immediate number is classified into categories that must be symbolized, can be symbolized selectively, or are prohibited from being symbolized, and the symbolization determination result is output.

[0030] The above scheme also includes an advanced evidence layer, configured to perform control flow graph analysis, local value set analysis, or definition-use chain analysis on the candidate immediate values ​​when the fusion decision layer determines that the comprehensive propensity value is in a preset ambiguity interval, in order to obtain more accurate semantic evidence, generate advanced scores and evidence labels, and feed them back to the fusion decision layer; the fusion decision layer recalculates the comprehensive propensity value based on the updated evidence scores and completes the final classification.

[0031] The above scheme also includes an evidence weighting statistical mechanism. This mechanism obtains the baseline data of symbolized objects from the unexposed binary files and the compiled assembly files, then parses out all immediate numbers in the baseline data that satisfy a certain piece of evidence, and then automatically calculates the relative weight value of the corresponding evidence by statistically analyzing the number of candidate immediate numbers under different evidence types and their hit ratio in the baseline symbolized data.

[0032] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0033] Through the above technical solution, the immediate signification determination method and system for binary rewriting programs provided by the present invention have the following beneficial effects:

[0034] 1. Significantly improved accuracy in judgment

[0035] By integrating multi-level evidence—including basic explicit rules, intermediate heuristics and statistical evidence, and advanced semantic analysis—a refined decision-making model was constructed. This method can not only quickly identify explicit address constants but also discover potential patterns through intermediate rules and perform in-depth semantic analysis on difficult cases, thus comprehensively covering different scenarios and significantly reducing the misjudgment rate of symbolization decisions (including missed and over-symbolization), providing a fundamental guarantee for the correctness of the rewritten program.

[0036] 2. Excellent overall performance and efficiency

[0037] By employing a hierarchical processing and conditional triggering mechanism, computational overhead is effectively controlled while ensuring accuracy. Most simple cases are quickly determined at the basic and intermediate levels, with only a few ambiguous cases triggering the high-overhead, advanced analysis layer. This design allows the system to maintain acceptable performance overhead when processing large-scale, complex binary files, achieving a balance between analysis accuracy and operational efficiency.

[0038] 3. The system has strong versatility and robustness.

[0039] This method does not rely on specific file formats (such as PIC) or complete symbol information. Its evidence rules and fusion mechanism can adapt to different compilers (such as GCC and Clang), different optimization levels, and binary files with stripped symbols. The modular design allows the evidence rules and weights to be flexibly adjusted and extended, thus possessing good platform adaptability and the ability to cope with new code patterns in the future.

[0040] 4. The decision-making process is explainable and adjustable.

[0041] Each layer of evidence is generated based on explicit rules or a traceable analysis process (such as control flow graphs or data flow chains), and the final judgment is a comprehensive reflection of the weighted evidence from each layer. This provides developers with a clear decision-making path. When symbolic errors occur, the root cause of the problem can be quickly traced back and located to the relevant evidence layer or specific rule, greatly reducing the difficulty of system debugging and maintenance.

[0042] 5. Enhanced automation and adaptability

[0043] The accompanying evidence weighting statistical mechanism can automatically learn and optimize the weight parameters of each layer of evidence based on known samples (such as binary files with debugging information), enabling the system to adapt to different program characteristics and application environments, reducing reliance on manual parameter tuning, and improving the standardization and reproducibility of the method. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0045] Figure 1 This is a schematic diagram of an immediate value symbolization determination system for a binary rewrite program disclosed in an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0047] This invention provides a method and system for determining the immediate signification of binary rewritten programs, the specific implementation of which is as follows:

[0048] I. Overview of the Overall System Framework

[0049] like Figure 1 As shown, the binary immediate value symbolization determination system proposed in this invention is based on a multi-level, progressive evidence fusion framework. This framework sequentially includes a preprocessing layer, a basic evidence layer, an intermediate evidence layer, a high-level evidence layer, and a fusion decision layer. The framework takes a binary file to be analyzed (e.g., ELF format) as input and outputs a symbolization determination strategy (mandatory symbolization / optional symbolization / prohibited symbolization) for all candidate immediate values ​​in the file. The system operates in a pipeline manner, with the output of the previous level serving as the input of the next level, and the fusion decision layer responsible for the final arbitration and output.

[0050] II. Specific Implementation Methods at Each Level

[0051] (a) Preprocessing layer

[0052] Function Overview:

[0053] In the preprocessing layer, the system performs preliminary analysis on the input binary file, extracts basic program information, models the file semantics, collects candidate immediate values ​​and related metadata, and realizes a complete transformation process from the original binary file to a structured semantic representation and a set of candidate immediate values, providing basic data and structured input for subsequent multi-level evidence analysis.

[0054] Technical methods:

[0055] 1. Parse binary files

[0056] The system first parses the input binary file. Taking ELF files as an example, it uses parsing libraries such as elftools to extract the overall file structure information. This step mainly includes: identifying and recording the basic attributes of each program segment and section, such as the position, size, and alignment of code and data segments, with a focus on .text, .rodata, .data, and .bss segments; simultaneously parsing existing static and dynamic symbol tables to collect function symbols, global variable symbols, and their address information; and extracting relevant entries from the relocation table to identify address locations that may need to be corrected during loading or runtime. The output of this step is a structured set of binary metadata, providing a foundation for subsequent instruction-level analysis and semantic modeling.

[0057] 2. Semantic modeling

[0058] After completing the binary structure parsing, the system disassembles the code segment and constructs a semantic representation model of the program based on it. During disassembly, a complete or as complete as possible instruction sequence is obtained. Subsequently, the system organizes and models the disassembly results using functions as the basic unit: identifying the function entry address and its boundary range, recording the function name (if available), starting address, length, binding attributes, etc.; within the function, the semantic information of each instruction is saved in instruction address order, including instruction address, mnemonic, operand string, instruction length, and control flow related attributes. Furthermore, the system can construct preliminary control flow information based on the instruction sequence, such as the set of basic block starting addresses and explicit jump relationships. Through the above process, binary file information—a structured intermediate representation—is generated to describe functions, instructions, and their control flow relationships, providing a unified semantic foundation for subsequent evidence extraction and analysis.

[0059] 3. Collect candidate immediate values ​​and related metadata.

[0060] After semantic modeling, the system systematically collects immediate values ​​at the instruction and data segment levels. Specifically, the system traverses the instruction semantic representation obtained from disassembly, extracts all immediate values ​​appearing in the instruction operands, and records whether these immediate values ​​participate in address calculation or control flow decisions based on the instruction type and addressing mode. Simultaneously, the system scans literals and statically initialized data in the data segment, including values ​​that might be used as addresses in the candidate set. For each candidate immediate value, the system uniformly records its relevant metadata, including the immediate value's magnitude, bit width, sign attribute, instruction address, instruction type, operand role, potential target address, and auxiliary information related to the jump table. The output of this step is a candidate immediate value set covering the entire program, with a structure consistent with the semantic modeling results, which can be directly used as input for multi-level evidence analysis.

[0061] (II) Basic Evidence Layer

[0062] Function Overview:

[0063] The basic evidence layer is used for the first-stage credibility determination of candidate immediate numbers. This layer filters and scores candidate immediate numbers based on explicit and interpretable rules, focusing on identifying cases directly related to control flow and symbolic information. This quickly eliminates immediate numbers that clearly lack pointer semantics and introduces expandable strong positive / strong negative evidence, assigning strong positive / strong negative evidence labels to candidate immediate numbers with high certainty. The basic evidence layer outputs a set of candidate immediate numbers with initial scores and evidence labels, providing a stable and interpretable input foundation for subsequent intermediate and advanced evidence layers.

[0064] Technical methods:

[0065] Address range check: Determines whether the candidate immediate value corresponds to a valid target address range. If the target address obtained after address calculation of the immediate value is not within the program's valid address range, the immediate value is deemed to lack pointer or jump target semantics and is treated as strong counter-evidence, thereby reducing its symbolic credibility.

[0066] Function call check: Analyze whether candidate immediate values ​​appear in function call class control flow instructions. If an immediate value is used as a direct operand of a call instruction, it indicates that the immediate value is very likely to represent the function entry address or jump target. This is considered strong evidence, and the corresponding candidate immediate value is given a positive score.

[0067] Symbol table information check: The target address corresponding to the candidate immediate value is compared with the symbol table information of the program. When the target address is completely consistent with the symbol address in the static or dynamic symbol table, it indicates that the immediate value has a clear association with an existing symbol. This association is considered strong evidence and is used to further increase its symbolization priority.

[0068] (III) Intermediate Level of Evidence

[0069] Function Overview:

[0070] The intermediate evidence layer, building upon the results of the basic evidence screening, performs further semantic analysis and quantitative evaluation of candidate immediate values. This layer combines heuristic rules and statistical models to assess the likelihood of candidate immediate values ​​as pointers or address constants from the perspectives of control flow relationships, address construction methods, and data organization. It generates a corresponding intermediate score and evidence label for each candidate immediate value. The intermediate evidence layer does not directly make symbolic decisions; its output is uniformly submitted to the fusion decision layer. The fusion decision layer combines the weighted results of the basic and intermediate evidence to determine whether a candidate immediate value needs to proceed to the higher evidence layer for further analysis.

[0071] Technical methods:

[0072] Evidence rules related to control flow and function structure: These rules focus on whether immediate values ​​directly participate in the construction and transfer of program control flow. Specifically, the system analyzes whether the immediate value is referenced by jump or call instructions to determine whether it is used as a control flow target address. Simultaneously, the target address of the immediate value is matched with the resolved function entry address; if they match, it indicates that the immediate value is highly related to the function-level control structure. Furthermore, for indirect call scenarios implemented through the procedure link table (.plt), if the immediate value points to an identified plt entry, it is also considered to have explicit control flow semantics. This type of evidence typically indicates that the immediate value is directly related to the program execution path and is an important manifestation of address semantics.

[0073] Evidence rules related to address construction and access patterns: These rules analyze the semantics of instructions to determine whether immediate values ​​are used in explicit address calculations. The system focuses on identifying immediate values ​​constructed using address calculation instructions in the form of "base address plus offset," and distinguishes different semantic scenarios based on the base address register type. Examples include relative address construction based on the program counter, local object access based on the stack frame base address, and potential address operations based on general-purpose registers. Simultaneously, the system analyzes the existence of program counter-related memory access patterns and stack base address-based offset access patterns to determine whether immediate values ​​participate in address generation or address references. These rules reflect typical patterns in compiler generation of address-related code.

[0074] Linking and Relocation-Related Evidence Rules: These rules utilize information left over from the linking phase to determine whether immediate values ​​possess potential address semantics. The system analyzes whether the byte range corresponding to the immediate value or the instruction it resides in is affected by relocation entries. If valid relocation support exists, it indicates that the immediate value requires address correction during program loading or linking, typically implying its association with global symbols or addresses. Furthermore, the system combines the structural information of the global offset table (.got) and its extended forms (such as .got.plt) to determine whether the immediate value's target address falls within the range of relevant table entries. This type of evidence provides link-level support information for the address attributes of immediate values.

[0075] Evidence rules related to data organization structure: These rules primarily analyze immediate values ​​in the data segment. The system identifies typical data structures such as jump tables and determines whether immediate values ​​serve as the base address or entry of the jump table in the implementation of multi-branch control flow. Simultaneously, it analyzes whether there are immediate values ​​in the data segment pointing to the start address of instructions in the code segment, thereby identifying potential function pointers or code pointers. It should be noted that specific entries in the jump table typically depend on the correct identification of the jump table base address; therefore, they participate in the judgment as subordinate information, rather than being the sole basis for the final symbolic decision.

[0076] Anomaly Patterns and Counter-Evidence Rules: To avoid mistakenly symbolizing non-address constants, the intermediate evidence layer introduces a set of suppression rules to reduce the weight of immediate values ​​that clearly lack address semantics. The system identifies whether immediate values ​​better conform to the patterns of floating-point constants or string encoding through simple features, and accordingly reduces their tendency to be symbolized. Simultaneously, it checks target addresses pointing to data segments but not satisfying common alignment constraints, treating them as auxiliary counter-evidence that is detrimental to address determination. These rules are used to balance positive evidence and prevent excessive symbolization.

[0077] After evaluating the aforementioned intermediate evidence rules, the intermediate evidence layer generates a corresponding evidence score and evidence tag for each candidate immediate number, characterizing its credibility as an address or pointer constant. The intermediate evidence results are then submitted to the fusion decision layer, which combines the weighted results of the basic and intermediate evidence to determine the path for each candidate immediate number: candidate immediate numbers with a significantly positive evidence tendency are directly determined as objects that must be symbolized; candidate immediate numbers with a significantly negative evidence tendency are determined as objects that are prohibited from being symbolized; only candidate immediate numbers whose evidence falls within the middle range and still has semantic ambiguity are triggered to enter the advanced evidence layer for further control flow analysis, data flow tracing, and range analysis to obtain more refined judgment criteria.

[0078] (iv) Advanced layer of evidence

[0079] Function Overview:

[0080] The advanced evidence layer is used to further analyze candidate immediate values ​​whose scores in the intermediate evidence layer fall within the middle range and still have semantic ambiguity. This layer introduces a more costly but more accurate program semantic analysis method to obtain reliable evidence from multiple perspectives, including control flow, data flow, and value range constraints, to determine whether the candidate immediate value truly participates in address calculation, control flow transfer, or critical memory access, thus providing highly credible support for the final symbolic decision. It should be noted that the advanced evidence layer is not uniformly activated for all candidate immediate values, but only for those candidates that the intermediate evidence layer cannot clearly determine and have not been directly confirmed or rejected, to achieve a balance between analytical accuracy and overall efficiency. The results of control flow analysis, local value set analysis, and Def-Use chain analysis are uniformly abstracted into advanced positive evidence or advanced negative evidence by the advanced evidence layer, generating advanced scores and evidence labels, which are then fed back to the fusion decision layer.

[0081] Technical methods:

[0082] Control Flow Graph Analysis: The advanced evidence layer constructs control flow graphs at the function or module level, precisely locating instructions containing candidate immediate values ​​and analyzing their propagation paths within the program control flow. Through control flow structure analysis, it determines whether immediate values ​​might influence the program execution path, such as whether they are potential targets for indirect jumps, indirect calls, or multi-branch control flows.

[0083] Local value set analysis: The advanced evidence layer introduces local value set analysis to approximate the possible value range of registers or memory locations related to immediate values. Through constraint propagation and path pruning, it determines whether the address pointed to by the candidate immediate value might fall within the legal code area, data area, or the range of identified function entry points, thereby eliminating cases that are only similar at the numerical level but do not have a valid address meaning in semantics.

[0084] Def-Use Chain Analysis: Def-Use chain analysis is performed on candidate immediate values ​​to trace their definition locations and subsequent usage relationships. The system focuses on analyzing whether the immediate value propagates through registers or memory and ultimately participates in indirect call instructions, indirect jump instructions, or critical memory access instructions. If the immediate value still directly affects the above semantically sensitive operations after multi-level propagation, it indicates that it has explicit address or pointer semantics.

[0085] (v) Integrating the decision-making level

[0086] Function Overview:

[0087] The fusion decision layer is used to uniformly summarize and comprehensively judge the evidence results output from the basic evidence layer, intermediate evidence layer, and advanced evidence layer. It is the core module for realizing multi-level evidence fusion and final symbolic decision-making in this invention. This layer does not directly participate in immediate semantic analysis, but rather forms a stable and interpretable symbolic judgment strategy based on the evidence results from each layer.

[0088] Technical methods:

[0089] The fusion decision layer first aggregates evidence scores and evidence tags from different evidence layers for each candidate immediate value. Then, based on pre-calculated evidence weights, it weights and sums the scores of each type of evidence to form a comprehensive propensity value for that candidate immediate value. This comprehensive propensity value characterizes the overall credibility of the immediate value as an address or pointer constant.

[0090] After obtaining the overall propensity score, the fusion decision layer classifies candidate immediate values ​​according to a preset judgment interval: when the overall propensity score is significantly higher than the symbolization threshold, the candidate immediate value is determined to be a must-symbolize object; when the overall propensity score is significantly lower than the rejection threshold, the candidate immediate value is determined to be a prohibited symbolization object; when the overall propensity score is between the above two thresholds and a clear judgment cannot be made, the fusion decision layer marks the candidate immediate value as an uncertain object and triggers it to enter the advanced evidence layer for further control flow analysis, data flow tracing, and value range analysis. Based on the analysis results returned by the advanced evidence layer, the fusion decision layer again performs evidence aggregation and weighted calculation, and completes the final symbolization determination based on the updated overall propensity score. This ensures the accuracy of symbolization while avoiding unnecessary high-cost analysis processes, improving overall analysis and rewriting performance.

[0091] To obtain weight parameters for various types of evidence, a corresponding evidence weighting statistical mechanism is established at the decision-making level. This mechanism obtains baseline data of symbolic objects from unexposed binary files and compiled assembly files, then parses out all immediate numbers in the baseline data that satisfy a certain piece of evidence. It then automatically calculates the relative weight value of the corresponding evidence by statistically analyzing the occurrence count of candidate immediate numbers under different evidence types and their hit ratio in the baseline symbolic data. Both the candidate immediate numbers and the baseline symbolic data adopt a unified structured representation, covering instruction type, immediate number value, target address, and jump table information. Jump table entries are only used as derived information in the analysis and are not used as independent weighting objects. The evidence weighting statistical process can be automatically executed through a unified script, thereby ensuring standardization, repeatability, and interpretability under different program samples and experimental conditions.

[0092] A method for determining the immediate signification of a binary rewrite program includes the following steps:

[0093] (1) Preprocessing steps: Parse and semantically model the input binary file, collect candidate immediate values ​​and related meta-information to form structured input;

[0094] (2) Basic evidence analysis steps: Based on the preset explicit rules, the candidate immediate numbers are initially filtered and their credibility is scored, and expandable strong positive / strong negative evidence is introduced to generate initial scores and evidence tags;

[0095] (3) Intermediate evidence analysis steps: Combining heuristic rules and statistical models, semantic analysis and quantitative evaluation of candidate immediate numbers are carried out, and at the same time, expandable heuristic evidence is introduced to generate intermediate scores and evidence tags;

[0096] (4) Fusion decision steps: According to the preset weights, the initial score and intermediate score are weighted and fused to calculate the comprehensive tendency value of each candidate immediate number; according to the comprehensive tendency value, the candidate immediate numbers are classified into categories that must be symbolized, can be symbolized, or are prohibited from being symbolized, and the symbolization judgment result is output.

[0097] The fusion decision-making step also includes: triggering an advanced evidence analysis step when the overall propensity score is in a preset ambiguity range; the advanced evidence analysis step includes: performing control flow graph analysis, local value set analysis, and definition-use chain analysis on candidate immediate values ​​to obtain more accurate semantic evidence and generate advanced scores and evidence labels; the fusion decision-making step recalculates the overall propensity score based on the updated evidence scores and completes the final classification.

[0098] After the user inputs the binary file into the analysis framework of this invention, the system will execute the above levels sequentially, from basic evidence to fusion decision, gradually generating candidate immediate values ​​and corresponding symbolization strategies. The generated strategies are used to guide the binary rewriting tool in symbolization processing, ensuring that immediate values ​​that must be symbolized are correctly identified and processed, while avoiding the symbolization of unnecessary immediate values ​​as much as possible, thereby improving the overall analysis and rewriting efficiency.

[0099] Users can customize the symbolic analysis process by adjusting the weight parameters of each analysis layer or enabling / disabling specific rules according to their actual needs, thereby achieving flexibility and controllability in different application scenarios.

[0100] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for determining the immediate signification of a binary rewrite program, characterized in that, Includes the following steps: (1) Preprocessing steps: Parse and semantically model the input binary file, collect candidate immediate values ​​and related meta-information to form structured input; (2) Basic evidence analysis steps: Based on the preset explicit rules, the candidate immediate numbers are initially filtered and their credibility is scored, and expandable strong positive / strong negative evidence is introduced to generate initial scores and evidence tags; (3) Intermediate evidence analysis steps: Combining heuristic rules and statistical models, semantic analysis and quantitative evaluation of candidate immediate numbers are carried out, and at the same time, expandable heuristic evidence is introduced to generate intermediate scores and evidence tags; (4) Fusion decision-making steps: Based on the preset weights, the initial score and the intermediate score are weighted and fused to calculate the comprehensive tendency value of each candidate immediate number; Based on the comprehensive tendency value, the candidate immediate numbers are classified into categories of mandatory symbolization, optional symbolization, or prohibited symbolization, and the symbolization determination result is output. The explicit rules in the basic evidence analysis steps include: address range checking rules, function call checking rules, and symbol table information checking rules; The heuristic rules and statistical patterns in the intermediate evidence analysis steps include: evidence rules related to control flow and function structure, evidence rules related to address construction and access patterns, evidence rules related to linking and relocation, evidence rules related to data organization structure, and anomaly pattern counter-evidence rules used to suppress misjudgments.

2. The immediate signification determination method for a binary rewrite program according to claim 1, characterized in that, The fusion decision step further includes: triggering an advanced evidence analysis step when the comprehensive propensity value is in a preset ambiguity interval; the advanced evidence analysis step includes: performing control flow graph analysis, local value set analysis, and definition-use chain analysis on the candidate immediate values ​​to obtain more accurate semantic evidence and generate advanced scores and evidence tags; the fusion decision step recalculates the comprehensive propensity value based on the updated evidence scores and completes the final classification.

3. The immediate signification determination method for a binary rewrite program according to claim 1, characterized in that, The fusion decision-making step is equipped with an evidence weighting statistical mechanism, including the following statistical steps: (1) Obtain symbolic benchmark data based on the unstripped binary file and the compiled assembly file; (2) Statistically analyze the number of candidate immediate numbers under different evidence types and their hit rate in the benchmark data; (3) Based on the statistical results, automatically calculate and adjust the weight parameters of various types of evidence in the fusion decision-making step.

4. The immediate signification determination method for a binary rewrite program according to claim 1, characterized in that, The semantic modeling in the preprocessing step specifically includes: disassembling the code segments of the binary file, constructing a semantic representation model of the program based on this, and then organizing and modeling the disassembly results using functions as the basic unit to construct an instruction-level intermediate representation and record control flow information.

5. A system for determining the immediate signification of a binary rewrite program, employing the method described in claim 1, characterized in that, include: The preprocessing layer is configured to parse and semantically model the input binary file, collect candidate immediate values ​​and related meta-information, and form a structured input. The basic evidence layer is configured to perform preliminary filtering and credibility scoring on candidate immediate numbers based on preset explicit rules, and to introduce expandable strong positive / strong negative evidence to generate initial scores and evidence tags. The intermediate evidence layer combines heuristic rules and statistical models to perform semantic analysis and quantitative evaluation of candidate immediate numbers. It also introduces expandable heuristic evidence to generate intermediate scores and evidence labels. The fusion decision layer is configured to perform weighted fusion of the initial score and the intermediate score according to preset weights, and calculate the comprehensive tendency value of each candidate immediate number; Based on the comprehensive tendency value, the candidate immediate number is classified into categories such as mandatory symbolization, optional symbolization, or prohibited symbolization, and the symbolization determination result is output.

6. The immediate signification determination system for a binary rewrite program according to claim 5, characterized in that, It also includes an advanced evidence layer, configured to perform control flow graph analysis, local value set analysis, or definition-use chain analysis on the candidate immediate values ​​when the fusion decision module determines that the comprehensive propensity value is in a preset ambiguity interval, in order to obtain more accurate semantic evidence, generate advanced scores and evidence tags, and feed them back to the fusion decision module; the fusion decision step recalculates the comprehensive propensity value based on the updated evidence scores and completes the final classification.

7. The immediate signification determination system for a binary rewrite program according to claim 5, characterized in that, It also includes an evidence weighting statistical mechanism, which obtains the baseline data of symbolized objects from the unexposed binary files and the compiled assembly files, then parses out all immediate numbers in the baseline data that satisfy a certain piece of evidence, and then automatically calculates the relative weight value of the corresponding evidence by statistically analyzing the number of candidate immediate numbers under different evidence types and their hit ratio in the baseline symbolized data.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.

Images