Binary executable file password misuse detection method based on dynamic compiling traceability

Abstract

The invention relates to the technical field of information security, and provides a binary executable file password misuse detection method based on dynamic compilation traceability, which comprises the following steps of: performing local static analysis on an input binary executable file, positioning a sensitive function in the binary executable file and calling a self-defined function of the sensitive function; performing dynamic variation traceability on the parameters of the sensitive function, performing execution by changing parameter values and combining under-constraint dynamic symbols, tracing a real source of the parameters, and performing code accessibility verification in the traceability process to obtain an execution result of the sensitive function; and performing mode matching and constraint solution on the obtained execution result according to a predefined cryptographic security rule, judging whether a password misuse behavior exists or not, and outputting a detection log. Through the technical means of combining dynamic variation traceability and local static analysis, the effect of efficiently and accurately detecting the password misuse behavior in the binary file on the premise of avoiding path explosion is achieved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method for detecting password misuse in binary executable files based on dynamic compilation tracing. Background Technology

[0002] In today's era of rapid internet development and widespread adoption, the importance of cryptography to social development is constantly increasing. Currently, numerous cryptographic algorithms are emerging, with AES, DES, RC4, RSA, and SHA providing security for personal privacy, financial transactions, and corporate secrets during information transmission. However, in the practical application of cryptography, a series of problems arise due to developers' lack of attention to password security, improper use of encryption functions, and misuse of encryption parameters (e.g., using insecure algorithms, excessively short keys, or pseudo-random number generation keys), making it impossible to effectively guarantee program and system security.

[0003] To ensure the security of data transmission, software must be encrypted and protected according to security standards when it is deployed. Accurately identifying and detecting password misuse is crucial for ensuring the correct use of encryption algorithms, improving software security, and enhancing the ability to combat malware.

[0004] Currently, research on password misuse detection mainly focuses on source code (such as Java, C / C++, Go) and binary executable files.

[0005] Source code-based detection technology is relatively mature. Because it has overall information about the program, the analysis is less difficult and more accurate. However, it has inherent limitations. In real-world environments, the source code of software is often unavailable, thus limiting the application scenarios of source code detection. It cannot obtain the dynamic state of the program during runtime, making it difficult to detect runtime memory security issues such as keys not being cleared from memory in a timely manner or pseudo-random number generation keys.

[0006] To address these issues, binary executable file inspection techniques can provide excellent answers. Binary file-based detection can directly analyze the final deployed program, access runtime memory, and reconstruct the system's execution state, thus reflecting the program's dynamic behavior, such as variable passing, memory allocation, and deallocation. However, binary detection faces several serious challenges, including the path explosion problem. The dense structure and complex variable passing of binary code lead to an exponential increase in the number of execution paths when constructing its global control flow graph (CFG), resulting in enormous computational resource consumption and inefficiency, making it difficult to handle large-scale binary files. Parameter tracing is also difficult. Parameters in binary code are passed through registers and stacks, lacking semantic information such as variable names from the source code, making it extremely complex to trace the source and transmission path of parameters in sensitive functions (such as encryption functions). Finally, there is a lack of abuse rules for binary executables. While source code abuse rules focus on API and parameter abuse, binary abuse detection can also address runtime memory issues from the attacker's perspective. Existing research has not fully considered this aspect. Summary of the Invention

[0007] In view of the above-mentioned deficiencies of the prior art, this invention proposes a method for detecting password misuse in binary executable files based on dynamic compilation tracing. This method not only focuses on static code characteristics but also addresses runtime memory safety issues during the detection process. The technical solution designed in this invention includes the following steps: Perform local static analysis on the input binary executable file to locate sensitive functions and user-defined functions that call these sensitive functions; Dynamic mutation tracing is performed on the parameters of sensitive functions. By changing the parameter values ​​and combining them with under-constrained dynamic symbolic execution, the true source of the parameters is traced. Code reachability verification is performed during the tracing process to obtain the execution result of the sensitive functions. Based on predefined cryptographic security rules, the obtained execution results are subjected to pattern matching and constraint solving to determine whether there is any password misuse and output detection logs.

[0008] Preferably, the local static analysis includes: The import table of the binary executable file is traversed, and the function names in the import table are matched with a predefined list of sensitive functions to identify cryptography-related sensitive functions. By scanning binary executable files and parsing jump instructions, we can locate all custom functions that directly or indirectly call sensitive functions.

[0009] Preferably, the dynamic mutation tracing of the parameters of the sensitivity function includes: Starting from the sensitive function, trace back upwards along the function call chain; When a user-defined function that passes parameters to a lower-level function is located, the parameters received by the user-defined function are dynamically mutated, and under-constrained dynamic symbolic execution is performed starting from this. Determine whether the parameter affects the security of the sensitive function based on the execution result; If so, continue tracing back to the caller of the custom function and repeat the above mutation and execution process; If not, the current parameter is determined to be the true source, and its value is recorded as the execution result.

[0010] Preferably, the code reachability verification is performed synchronously during the underconstrained dynamic symbolic execution process, and parameter tracing analysis is performed only on the code paths that are verified to be reachable.

[0011] Preferably, the dynamic mutation tracing is performed based on parameter backtracking analysis using assembly instructions of the X86 architecture.

[0012] Preferably, the predefined cryptographic security rules include at least one of the following: The use of insecure encryption algorithms is prohibited; The key length of the encryption algorithm must meet the minimum security bit requirement; The use of cryptographically insecure pseudo-random number generators is prohibited; The use of insecure network communication protocols is prohibited.

[0013] Preferably, the underconstrained dynamic symbolic execution includes: Starting from the source of the parameter and ending at the sensitive function, symbolic simulation execution is performed on the code path between the two points, and memory, registers and global variables are symbolicized.

[0014] Preferably, the underconstrained dynamic symbolic execution is implemented using the UC-Angr tool.

[0015] Preferably, the step of judging the execution result according to predefined cryptographic security rules is implemented by constraint solving based on the Z3 solver.

[0016] Preferably, the code reachability verification is automatically performed in a dynamic analysis environment through the underconstrained dynamic symbolic execution.

[0017] Beneficial effects: 1. The dynamic source tracing analysis employed in this invention can accurately capture the dynamic behavior of a program during runtime, especially targeting critical variable passing and memory states in cryptographic operations. By combining dynamic mutation source tracing with underconstrained symbolic execution, it can not only accurately trace the transmission path and source of sensitive parameters across functions, but also simultaneously perform reachability verification during the source tracing process, effectively avoiding numerous unreachable paths and misleading information present in binary files. This mechanism ensures that the analysis always simulates the real execution environment, fundamentally overcoming the limitations of traditional static analysis and significantly improving the reliability and accuracy of misuse detection; 2. This invention cleverly avoids the path and state explosion problems inherent in global control flow analysis (CFG) by introducing address reference analysis and local static analysis methods, focusing the analysis scope on the core areas related to cryptographic operations. This design significantly improves analysis efficiency while ensuring high accuracy, making the framework highly scalable and adaptable to detection scenarios of various scales, from simple tools to large and complex binary files. 3. The rule verification module of this invention performs automated judgment based on predefined rule files, possessing strong scalability. This module supports the identification of various cryptographic misuse issues, including insecure encryption algorithms, weak keys, and flawed random number generation. As long as the rule file format requirements are met, the detection rules can be easily customized and extended, enabling the framework to quickly adapt to continuously evolving cryptographic security standards and diverse practical detection needs. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a preferred embodiment of the present invention; Figure 2 This is a schematic diagram illustrating dynamic mutation tracing of a preferred embodiment of the present invention. Detailed Implementation

[0019] The embodiments of the present invention will be described in detail below. The embodiments described below are implemented based on the technical solution of the present invention, and detailed implementation methods and specific operation processes are given. However, the protection scope of the present invention is not limited to the embodiments described below.

[0020] This invention designs a method for detecting password misuse in binary executable files based on dynamic compilation tracing. The technical solution includes the following steps, such as... Figure 1-2 As shown, it specifically includes: Perform local static analysis on the input binary executable file to locate sensitive functions (SINK functions) and user-defined functions that call these sensitive functions; Dynamic mutation tracing is performed on the parameters of sensitive functions. By changing the parameter values ​​and combining them with under-constrained dynamic symbolic execution, the true source of the parameters is traced. Code reachability verification is performed during the tracing process to obtain the execution result of the sensitive functions. Based on predefined cryptographic security rules, the obtained execution results are subjected to pattern matching and constraint solving to determine whether there is any password misuse and output detection logs.

[0021] Specifically, firstly, by performing local static analysis on the input binary executable file, the path explosion problem can be greatly mitigated while maintaining accuracy. Secondly, in dynamic mutation tracing, "dynamic" refers to under-constrained dynamic symbolic execution, and "mutation" refers to changing the values ​​of assigned parameters. That is, by changing the parameter values ​​and then performing under-constrained dynamic symbolic execution, the true source of the sensitive function's parameters can be accurately traced. Starting from this point and ending at the encrypted function, under-constrained dynamic symbolic execution is performed. Simultaneously, during the under-constrained dynamic symbolic execution process, the reachability of the corresponding code segment in actual execution is verified, thereby obtaining the execution result of the sensitive function. For example, in the asymmetric encryption algorithm RSA, it is necessary to find the instruction address that defines the key length through dynamic mutation, then perform under-constrained dynamic symbolic execution and reachability verification to obtain the running result; finally, in the rule verification step, the execution result of "the execution result of the sensitive function" from the dynamic mutation sourcing is received, and then each rule is traversed, and techniques such as pattern matching and constraint solving are used to check whether the running result meets the conditions defined by the rule. For example, it will check whether the called function is a disabled weak encryption algorithm, or check whether the RSA key length parameter meets the requirement of being greater than or equal to 1024 bits.

[0022] Preferably, local static analysis includes: The import table of the binary executable file is traversed, and the function names in the import table are matched with a predefined list of sensitive functions to identify cryptography-related sensitive functions. By scanning binary executable files and parsing jump instructions, we can locate all custom functions that directly or indirectly call sensitive functions.

[0023] Specifically, the import table in a binary executable file records information about external functions that the program needs to call during runtime. By obtaining the import table of the binary file, cryptography-related functions can be parsed out. The import table contains the function names and addresses of external functions. By extracting the function names and matching them with our custom sensitive functions, sensitive functions related to cryptographic misuse can be identified. Secondly, after locating the sensitive functions, locating the custom functions that call these sensitive functions is an important step. This work scans the entire file and calculates various jump instructions. If the target address of the jump is found to be a matched sensitive function, it means that these custom functions directly or indirectly call the sensitive functions. These reference relationships need to be recorded to provide sufficient context information for subsequent parameter tracing and dynamic symbolic execution.

[0024] Furthermore, experimental analysis revealed that directly scanning the entire binary file can improve runtime efficiency compared to constructing a control flow graph (CFG).

[0025] Preferably, dynamic mutation tracing of the parameters of the sensitivity function includes: Starting from the sensitive function, trace back upwards along the function call chain; When a user-defined function that passes parameters to a lower-level function is located, the parameters received by the user-defined function are dynamically mutated, and under-constrained dynamic symbolic execution is performed starting from this. Determine whether the parameter affects the security of sensitive functions based on the execution results; If so, continue tracing back to the caller of the custom function and repeat the above mutation and execution process; If not, the current parameter is determined to be the true source, and its value is recorded as the execution result.

[0026] Preferably, code reachability verification is performed synchronously during the underconstrained dynamic symbolic execution process, and parameter tracing analysis is performed only on code paths that are verified to be reachable.

[0027] Preferably, dynamic mutation tracing is performed using assembly instructions based on the x86 architecture for parameter backtracking analysis.

[0028] Specifically, by locating user-defined functions that call sensitive cryptographic functions, these user-defined functions may also pass their received parameters to the cryptographic functions they call. Dynamic mutation is needed to determine whether these parameters will affect the security of the sensitive functions, thereby further determining whether the parameters of the sensitive functions have reached the true source. User-defined functions may also pass their received parameters to the cryptographic functions they call. Dynamic mutation is needed to determine whether these parameters will affect the security of the sensitive functions, thereby further determining whether the parameters of the sensitive functions have reached the true source.

[0029] Furthermore, if it's discovered that the identified custom function is passing the received parameters down to sensitive cryptographic functions, it's necessary to modify the parameter's value multiple times and perform dynamic symbolic execution from this starting point. The execution results should be used to determine whether the parameter affects the security of the called sensitive cryptographic function, such as the key length. If it does, the parameter of the sensitive cryptographic function needs further backtracking. This indicates that it's necessary to locate the parent custom function that called this custom function. The method for locating this parent function is the same as the algorithm used to locate the custom function that called the sensitive cryptographic function: scanning the entire file and parsing various jump instructions to determine the parent custom function. It's important to note that if the execution results determine that the parameter does not affect the security of the called sensitive cryptographic function, then this is the source of the parameter. Repeating the tracing, mutation, and dynamic execution processes will gradually reveal the true source of the parameter.

[0030] Dynamic mutation techniques can handle parameter passing across functions. In complex binary executables, parameters are often passed not just within a single function, but across multiple functions. Dynamic mutation techniques trace the flow of parameters upstream through the function call chain, ensuring that the original source of the parameter can be found. For example, the key length might be initialized in an upstream function and then passed to the SINK function via a function call. Dynamic mutation can handle such cross-function parameter passing quickly and accurately.

[0031] Furthermore, to improve backtracking efficiency, this work does not use intermediate representation (IR) for parameter analysis, but instead directly performs backtracking based on x86 architecture assembly instructions. This avoids the additional overhead caused by instruction generalization and enables more efficient tracking of parameter initial assignments. Preferably, the predefined cryptographic security rules include at least one of the following: The use of insecure encryption algorithms is prohibited; The key length of the encryption algorithm must meet the minimum security bit requirement; The use of cryptographically insecure pseudo-random number generators is prohibited; The use of insecure network communication protocols is prohibited.

[0032] Preferably, underconstrained dynamic symbolic execution includes: Starting from the source of the parameter and ending at the sensitive function, symbolic simulation execution is performed on the code path between the two points, and memory, registers and global variables are symbolicized.

[0033] Preferably, underconstrained dynamic symbolic execution is implemented using the UC-Angr tool.

[0034] Preferably, the execution result is judged according to predefined cryptographic security rules, which is an implementation of constraint solving based on the Z3 solver.

[0035] Preferably, code reachability verification is performed automatically in a dynamic analysis environment via under-constrained dynamic symbolic execution.

[0036] Specifically, underconstrained dynamic symbolic execution (UDE) is a crucial step in the cryptographic misuse detection process. It simulates the execution of binary files, executing code between manually defined start and end points to accurately detect potential cryptographic misuse issues. Since program paths and state spaces are often enormous, UDE avoids global path explosion by constraining start and end points, allowing the analysis to focus on cryptographically relevant regions.

[0037] Furthermore, underconstrained dynamic symbolic execution (UCSE) analyzes the use of cryptographic functions through local path simulation. This method starts with the parameter source determined by dynamic mutation sourcing and ends with the SINK function, performing symbolic simulation of a portion of the path within the binary program. This avoids the path explosion problem caused by global analysis. The core of UCSE lies in traversing only the code segments related to cryptographic operations, without exploring the complete program path. For example, when detecting the RSA algorithm, starting from the key initialization position and ending at the end of the encryption function call, localized analysis significantly reduces the number of paths. A key aspect of this method is symbolicating memory and register states—retaining them as symbolic variables without assigning specific values—thus enhancing the flexibility of path exploration and covering branches that are difficult to trigger with conventional execution. This paper uses UC-Angr to implement underconstrained execution, which extends UC-KLEE to support dynamic symbolic execution and underconstrained state management. UC-Angr marks insufficiently constrained data as symbolic states, which, when used as pointers, can generate shadow memory regions to track memory and register operations, improving the granularity of analysis. UC-Angr also improves the symbolic processing of global variables. Traditional methods often overlook global variables, potentially missing cryptographic misuses that rely on global state. UC-Angr, by symbolizing global variables, more accurately detects errors such as key or parameter configuration. To control state explosion, UC-Angr limits the number of function branches (e.g., no more than 64), returning directly when this limit is reached to avoid getting stuck in complex branches. This method ultimately detects misuses of encryption algorithms or parameter configurations on limited paths, balancing efficiency and accuracy.

[0038] Finally, after obtaining the execution result of the binary file through underconstrained dynamic symbolic execution, the rule verification module inputs this result, along with the preset security constraint rules, into the z3 solver to determine whether there is any cryptographic misuse in the program. The rule file defines various types of cryptographic misuse and provides specific detection criteria for each type.

[0039] We conducted a more comprehensive review of existing encryption rules in a dynamic analysis environment. The rules are derived from a classification of cryptographic algorithms based on the abuse of binary cryptography. The use of insecure encryption algorithms (such as DES, 2TDEA, RSA-512, MD4, and MD5) is prohibited. Developers are encouraged to prioritize "recommended" encryption algorithms over "acceptable but not recommended" algorithms. The rules impose restrictions on key generation. The use of cryptographically insecure pseudo-random number generators (PRNGs) is prohibited. It is stipulated that keys used in encryption algorithms should be generated by cryptographically secure random number generators. The rules prohibit the use of HTTP and recommend the more secure HTTPS. The rules stipulate that applications must not use older versions of the SSL / TLS protocol that have been proven to have serious security vulnerabilities. The rules specify key length requirements for encryption functions. The security of some encryption APIs depends on key length; RSA encryption is a typical example. Additionally, some rules currently misuse the context; these misuses are not considered in the dynamic analysis context for the time being.

[0040] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for detecting password misuse in binary executable files based on dynamic compilation tracing, characterized in that, include: Perform local static analysis on the input binary executable file to locate sensitive functions and user-defined functions that call these sensitive functions; Dynamic mutation tracing is performed on the parameters of sensitive functions. By changing the parameter values ​​and combining them with under-constrained dynamic symbolic execution, the true source of the parameters is traced. Code reachability verification is performed during the tracing process to obtain the execution result of the sensitive functions. Based on predefined cryptographic security rules, the obtained execution results are subjected to pattern matching and constraint solving to determine whether there is any password misuse and output detection logs.

2. The method for detecting password misuse in binary executable files based on dynamic compilation tracing as described in claim 1, characterized in that, The local static analysis includes: The import table of the binary executable file is traversed, and the function names in the import table are matched with a predefined list of sensitive functions to identify cryptography-related sensitive functions. By scanning binary executable files and parsing jump instructions, we can locate all custom functions that directly or indirectly call sensitive functions.

3. The method for detecting password misuse in binary executable files based on dynamic compilation tracing as described in claim 1, characterized in that, The dynamic mutation tracing of the parameters of the sensitivity function includes: Starting from the sensitive function, trace back upwards along the function call chain; When a user-defined function that passes parameters to a lower-level function is located, the parameters received by the user-defined function are dynamically mutated, and under-constrained dynamic symbolic execution is performed starting from this. Determine whether the parameter affects the security of the sensitive function based on the execution result; If so, continue tracing back to the caller of the custom function and repeat the above mutation and execution process; If not, the current parameter is determined to be the true source, and its value is recorded as the execution result.

4. The method for detecting password misuse in binary executable files based on dynamic compilation tracing as described in claim 1, characterized in that, The code reachability verification is performed synchronously during the underconstrained dynamic symbolic execution process, and parameter tracing analysis is only performed on the code paths that are verified to be reachable.

5. The method for detecting password misuse in binary executable files based on dynamic compilation tracing according to claim 1, characterized in that, The dynamic mutation tracing is based on parameter backtracking analysis using assembly instructions of the X86 architecture.

6. The method for detecting password misuse in binary executable files based on dynamic compilation tracing according to claim 1, characterized in that, The predefined cryptographic security rules include at least one of the following: The use of insecure encryption algorithms is prohibited; The key length of the encryption algorithm must meet the minimum security bit requirement; The use of cryptographically insecure pseudo-random number generators is prohibited; The use of insecure network communication protocols is prohibited.

7. The method for detecting password misuse in binary executable files based on dynamic compilation tracing as described in claim 1, characterized in that, The underconstrained dynamic symbolic execution includes: Starting from the source of the parameter and ending at the sensitive function, symbolic simulation execution is performed on the code path between the two points, and memory, registers and global variables are symbolicized.

8. The method for detecting password misuse in binary executable files based on dynamic compilation tracing as described in claim 1, characterized in that, The underconstrained dynamic symbolic execution is implemented using the UC-Angr tool.

9. The method for detecting password misuse in binary executable files based on dynamic compilation tracing according to claim 1, characterized in that, The step of judging the execution result according to predefined cryptographic security rules is implemented by constraint solving based on the Z3 solver.

10. The method for detecting password misuse in binary executable files based on dynamic compilation tracing according to claim 1, characterized in that, The code reachability verification is automatically performed in the dynamic analysis environment through the under-constrained dynamic symbolic execution.

Images