Binary program analysis method and device, electronic equipment and storage medium

Abstract

The application provides a binary program analysis method and device, electronic equipment and a storage medium. The binary program analysis method comprises the following steps: performing dynamic analysis on a binary program to be analyzed to obtain a dynamic analysis result; performing static analysis on the binary program to be analyzed to obtain a static analysis result; if it is determined that an analysis end condition is not reached based on the static analysis result and the dynamic analysis result, jumping to the step of performing dynamic analysis on the binary program to be analyzed to obtain a dynamic analysis result until the analysis end condition is reached; when jumping to the step of performing dynamic analysis on the binary program to be analyzed to obtain a dynamic analysis result, determining a dynamic analysis strategy by an analysis decision agent, and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy. The application introduces an analysis decision agent to determine a dynamic analysis strategy, combines dynamic analysis and static analysis, accumulates analysis information in round iteration, and accurately analyzes the binary program to be analyzed.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a binary program analysis method, apparatus, electronic device, and storage medium. Background Technology

[0002] Binary program analysis is a technical activity that involves reverse engineering and behavioral research on compiled machine code without source code. Its aim is to understand program logic, detect potential vulnerabilities or malicious behavior, and uncover its internal mechanisms. Existing binary program analysis techniques mainly consist of static analysis and dynamic analysis. Static analysis converts machine code into assembly or pseudocode and performs logical analysis on the code's structure, control flow, and data flow. Dynamic analysis, on the other hand, analyzes the program's behavior during runtime.

[0003] Existing binary programs often exhibit complex obfuscation, rendering static analysis virtually ineffective in handling such situations. Dynamic analysis, on the other hand, suffers from insufficient path coverage, ignoring untriggered branches, and difficulty reaching conditional branches. While existing technologies combine manual analysis with static and dynamic approaches, the quality of the results depends heavily on the analyst's skill level, as different analysts may have different focuses. Furthermore, the analysis process is time-consuming, labor-intensive, and prone to errors. Therefore, there is an urgent need for an automated solution for accurate binary program analysis. Summary of the Invention

[0004] This invention provides a binary program analysis method, apparatus, electronic device, and storage medium to overcome the deficiencies in the prior art.

[0005] This invention provides a binary program analysis method, comprising: Obtain the binary program to be analyzed; The binary program to be analyzed is dynamically analyzed to obtain the dynamic analysis results. Static analysis is performed on the binary program to be analyzed to obtain the static analysis results; If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0006] According to a binary program analysis method provided by the present invention, the step of performing dynamic analysis on the binary program to be analyzed to obtain dynamic analysis results includes: Based on the sandbox, the behavioral information of the binary program to be analyzed is analyzed to obtain the dynamic analysis results; wherein, the behavioral information includes process tree, file behavior, network behavior and permission behavior.

[0007] According to a binary program analysis method provided by the present invention, the step of analyzing the behavioral information of the binary program to be analyzed based on a sandbox to obtain the dynamic analysis result includes: The binary program to be analyzed is run in the sandbox, and the behavior information of the binary program to be analyzed is recorded during its execution. Based on the behavioral information, the program operation intent and execution trajectory of the binary program to be analyzed are determined, and the dynamic analysis results are obtained.

[0008] According to a binary program analysis method provided by the present invention, before the step of jumping to perform dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the method further includes: Obtain the analysis prompt template, and determine the analysis termination condition based on the analysis prompt template; The analytical decision-making agent determines whether the dynamic analysis results and the static analysis results meet the analysis termination conditions.

[0009] According to a binary program analysis method provided by the present invention, the step of determining a dynamic analysis strategy through an analysis decision agent and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy includes: Based on the static analysis results and the dynamic analysis results, the dynamic analysis strategy is determined by the analysis decision-making agent; wherein, the dynamic analysis strategy includes a first analysis strategy based on a sandbox and a second analysis strategy based on debugging. The first analysis strategy is to perform dynamic analysis on the binary program to be analyzed based on the behavior information of the binary program to be analyzed running in the sandbox. The second analysis strategy is to perform dynamic analysis based on the result of step-by-step execution of the program branches in the binary program to be analyzed by the debugger.

[0010] According to a binary program analysis method provided by the present invention, the step of performing dynamic analysis on the binary program to be analyzed to obtain dynamic analysis results includes: Based on the aforementioned analysis and decision-making intelligent agent, the MCP tool corresponding to dynamic analysis is loaded to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results; wherein, the MCP tool corresponding to dynamic analysis includes a sandbox bridging tool and a debugger bridging tool. The static analysis of the binary program to be analyzed, to obtain the static analysis results, includes: Based on the aforementioned analytical decision-making agent, the corresponding MCP tool for static analysis is loaded to perform static analysis on the binary program to be analyzed, and obtain the static analysis results; wherein, the MCP tool corresponding to static analysis includes GraphMCP and IDA-Pro-MCP.

[0011] According to a binary program analysis method provided by the present invention, before performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis result, the method further includes: The binary program to be analyzed is cleaned using a hash algorithm, and basic information is extracted. Configure a dynamic analysis environment based on the aforementioned basic information.

[0012] According to a binary program analysis method provided by the present invention, the step of jumping to perform dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, until the analysis termination condition is met, the method further includes: An analysis report is generated based on the dynamic analysis results and the static analysis results.

[0013] The present invention also provides a binary program analysis apparatus, comprising: The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the binary program analysis method described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the binary program analysis method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the binary program analysis method described above.

[0016] The binary program analysis method, apparatus, electronic device, and storage medium provided by this invention perform dynamic analysis on the binary program to be analyzed, obtaining dynamic analysis results, and static analysis on the binary program to be analyzed, obtaining static analysis results. Based on the obtained static and dynamic analysis results, it is determined whether the analysis termination condition has been met. If not, it jumps to the step of performing dynamic analysis. When jumping to the dynamic analysis step, an analysis decision-making intelligent agent is introduced. The analysis decision-making intelligent agent autonomously determines the dynamic analysis strategy. During the analysis process, multiple rounds of information from dynamic and static analysis are combined as information sources. Analysis information is accumulated in the iteration rounds, so that the analysis of the binary program to be analyzed becomes more accurate as the number of iterations increases. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is one of the flowcharts of the binary program analysis method provided by the present invention.

[0019] Figure 2 This is the second flowchart of the binary program analysis method provided by the present invention.

[0020] Figure 3 This is a schematic diagram of the binary program analysis device provided by the present invention.

[0021] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart illustrating a binary program analysis method according to an exemplary embodiment. For example... Figure 1 As shown in an exemplary embodiment, the binary program analysis method includes steps 110 to 140, which are described in detail below.

[0024] Step 110: Obtain the binary program to be analyzed.

[0025] In this embodiment of the invention, a binary program to be analyzed is obtained from the list of programs to be analyzed.

[0026] Step 120: Perform dynamic analysis on the binary program to be analyzed to obtain dynamic analysis results.

[0027] In this embodiment of the invention, dynamic analysis is performed on the binary program to be analyzed to obtain dynamic analysis results. Specifically, dynamic analysis can be based on debug tracing and behavior monitoring / sandbox testing. Debug tracing uses GDB and OllyDbg to step through execution, monitor registers, memory status, and system calls to locate critical logic. Behavior monitoring / sandbox testing records the behavior information of the binary program through application layer / kernel layer hooks, identifies program operations, and captures the complete execution trajectory and potential attack behaviors.

[0028] Step 130: Perform static analysis on the binary program to be analyzed to obtain the static analysis results.

[0029] In this embodiment of the invention, static analysis is performed on the binary program to be analyzed to obtain the static analysis results. Specifically, static analysis can use tools (such as IDA Pro or Ghidra) to convert machine code into assembly or pseudocode, analyze the control flow graph (CFG) and data dependencies, and identify program logic.

[0030] Step 140: If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, proceed to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0031] In this embodiment of the invention, the analysis termination condition is determined based on the obtained static analysis results and dynamic analysis results. If the condition is not met, the process jumps to the step of performing dynamic analysis until the analysis termination condition is met.

[0032] When re-analyzing the binary program to be analyzed, a dynamic analysis strategy is determined by an analysis decision agent, and dynamic analysis is performed on the binary program to be analyzed based on the determined dynamic analysis strategy.

[0033] The analytical decision-making agent is built upon a large language model. A large language model (LLM) is an artificial intelligence system trained on massive amounts of text data, designed to understand, generate, and manipulate human language. Through pre-training, LLMs acquire grammatical, semantic, and complex reasoning abilities, enabling them to perform tasks such as text generation, translation, summarization, and question answering, and support conversational interactions (such as chatbots).

[0034] In this embodiment of the invention, dynamic analysis is performed on the binary program to be analyzed to obtain dynamic analysis results, and static analysis is performed on the binary program to be analyzed to obtain static analysis results. Based on the obtained static and dynamic analysis results, it is determined whether the analysis termination condition has been met. If not, the process jumps to the step of dynamic analysis. When jumping to the step of dynamic analysis, an analysis decision-making intelligent agent is introduced. The analysis decision-making intelligent agent autonomously determines the dynamic analysis strategy. During the analysis process, multiple rounds of information from dynamic and static analysis are combined as information sources. Analysis information is accumulated in the iteration rounds, so that the analysis of the binary program to be analyzed becomes more accurate as the number of iterations increases.

[0035] In an exemplary embodiment of the present invention, the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results includes: Based on the sandbox, the behavioral information of the binary program to be analyzed is analyzed to obtain the dynamic analysis results; wherein, the behavioral information includes process tree, file behavior, network behavior and permission behavior.

[0036] In this embodiment of the invention, during the first dynamic analysis, dynamic analysis is performed based on a sandbox. For subsequent dynamic analyses, the analysis decision-making agent autonomously chooses whether to perform sandbox analysis or debugging analysis.

[0037] The sandbox provides a secure, isolated environment where the binary program to be analyzed can be run within the sandbox, and all its behaviors can be monitored comprehensively using all means.

[0038] In an exemplary embodiment of the present invention, the step of analyzing the behavioral information of the binary program to be analyzed based on a sandbox to obtain the dynamic analysis result includes: The binary program to be analyzed is run in the sandbox, and the behavior information of the binary program to be analyzed is recorded during its execution. Based on the behavioral information, the program operation intent and execution trajectory of the binary program to be analyzed are determined, and the dynamic analysis results are obtained.

[0039] In this embodiment of the invention, the binary program to be analyzed is run in a sandbox, and its behavior information is recorded. For example, if the binary program to be analyzed is sample_v1.exe, the sandbox automatically monitors its behavior, and the monitored information is as follows: Process tree: sample_v1.exe -> cmd.exe / c schtasks -> reg.exe (attempting scheduled tasks and registry persistence) File behavior: Write to %APPDATA%\svchost.exe (rename and disguise), create the startup item Run\svchost Network behavior: After DNS lookup of two domain names, a TLS connection is initiated to 203.0.xxx.xx:443, requesting the path / beacon; Permission behavior: Attempt to elevate the token failed. Retry three times.

[0040] Specifically, the sandbox monitors the process tree, records which programs the binary program being analyzed launched, such as sample_v1.exe launching cmd.exe and reg.exe, and records the parent-child relationships between programs.

[0041] File behavior records the files created, modified, and deleted by the binary program being analyzed. For example, in the above example, sample_v1.exe disguises itself as svchost.exe and writes to a specific directory. Simultaneously, the sandbox closely monitors the modifications made to the system registry by the binary program being analyzed. For instance, sample_v1.exe attempted to create a startup item (Run\svchost).

[0042] Network behavior monitoring records whether and how the binary program being analyzed connects to the internet. For example, sample_v1.exe connects to a specific IP address via DNS lookup and TLS encryption.

[0043] The permission behavior monitoring records the behavior of the binary program to be analyzed based on permissions, such as sample_v1.exe which performed three token elevations as mentioned above.

[0044] Sandbox-based dynamic analysis involves allowing the binary program to run freely in a secure, isolated environment, monitoring all its behaviors comprehensively using all means, and finally correlating these behaviors to derive the true program operation intent and execution trajectory of the binary program to be analyzed.

[0045] In an exemplary embodiment of the present invention, before the step of jumping to perform dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the method further includes: Obtain the analysis prompt template, and determine the analysis termination condition based on the analysis prompt template; The analytical decision-making agent determines whether the dynamic analysis results and the static analysis results meet the analysis termination conditions.

[0046] In this embodiment of the invention, the prompt template is a structured instruction input by the user to the AI ​​model, used to guide the model to generate expected output (such as text, code, charts, etc.). Essentially, it transforms human needs into executable operational logic for AI through semantic constraints and contextual guidance, thus solving the problem of cognitive ambiguity in AI.

[0047] The analysis prompt template in this invention pre-sets standard analysis processes, result / report requirements, special case handling strategies, etc., with the goal of determining behavior categories, potential risks, persistence / network / self-protection measures, and then generating standardized reports.

[0048] The analysis prompt template can be preset or user-inputted. The analysis termination condition is determined based on the analysis prompt template. The analysis prompt template is then input into the analysis decision agent, which then determines whether the dynamic and static analysis results have met the analysis termination condition.

[0049] In an exemplary embodiment of the present invention, the step of determining a dynamic analysis strategy through an analytical decision-making agent and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy includes: Based on the static analysis results and the dynamic analysis results, the dynamic analysis strategy is determined by the analysis decision-making agent; wherein, the dynamic analysis strategy includes a first analysis strategy based on a sandbox and a second analysis strategy based on debugging. The first analysis strategy is to perform dynamic analysis on the binary program to be analyzed based on the behavior information of the binary program to be analyzed running in the sandbox. The second analysis strategy is to perform dynamic analysis based on the result of step-by-step execution of the program branches in the binary program to be analyzed by the debugger.

[0050] In embodiments of the present invention, such as Figure 2 As shown, the analytical decision-making agent automatically selects dynamic analysis strategies based on its own knowledge base and existing information.

[0051] The dynamic analysis strategy includes a first analysis strategy and a second analysis strategy. The first analysis strategy is sandbox-based dynamic analysis, and the second analysis is debug-based dynamic analysis. Debug analysis uses a debugger (such as x64dbg, OllyDbg, GDB) to step through program branches and observe changes in registers and memory. Through debug analysis, fine-grained operation of program branches can be obtained, bypassing anti-sandbox logic and obtaining runtime memory, encrypted key parameter variables, and other information.

[0052] During dynamic and static analysis, each binary program to be analyzed may have different scenarios. If, during the current round of dynamic and static analysis, the binary program to be analyzed has obfuscation or other anti-analysis measures, or the file paths are too complex, resulting in an incomplete analysis and the analysis termination condition not being met, then multiple rounds of analysis will be repeated.

[0053] Specifically, if the analysis in the current round cannot be further statically analyzed due to confusion, based on the results of dynamic and static analysis, the analysis decision agent can choose the first analysis strategy to perform dynamic analysis in the next round of analysis. When executing the first analysis strategy, dynamic analysis is performed based on the sandbox. During dynamic analysis, a memory snapshot of the binary to be analyzed is captured by the dump program, and static analysis is performed based on the memory snapshot.

[0054] If, based on the results of dynamic and static analysis, it is determined that a certain variable has been complexly encrypted during the current round of analysis, causing the static analysis to reach a bottleneck, then the analysis decision agent can choose the second analysis strategy for dynamic analysis in the next round of analysis. Through debugging analysis, the binary program to be analyzed can be directly run to the place where the decrypted value is finally used to obtain the decrypted variable.

[0055] In an exemplary embodiment of the present invention, the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results includes: Based on the aforementioned analysis and decision-making intelligent agent, the MCP tool corresponding to dynamic analysis is loaded to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results; wherein, the MCP tool corresponding to dynamic analysis includes a sandbox bridging tool and a debugger bridging tool. The static analysis of the binary program to be analyzed, to obtain the static analysis results, includes: Based on the aforementioned analytical decision-making agent, the corresponding MCP tool for static analysis is loaded to perform static analysis on the binary program to be analyzed, and obtain the static analysis results; wherein, the MCP tool corresponding to static analysis includes GraphMCP and IDA-Pro-MCP.

[0056] In this embodiment of the invention, the Model Context Protocol (MCP) is a client-server protocol used for secure and controlled communication between the LLM and external data sources and tools. Communicating with the LLM via the MCP protocol allows natural language to be converted into API calls, thereby enabling the automation of tasks using the LLM.

[0057] Based on the analytical decision-making agent, MCP tools corresponding to static and dynamic analysis are loaded, such as Graph MCP, IDA-Pro-MCP, sandbox bridging tools, and debugging bridging tools. Graph MCP is a tool for running LLMs and interacting with graph databases (such as Neo4j) or graph APIs. A graph is a database that stores data using "nodes" and "relationships," making it very suitable for representing complex relationships (such as social networks, knowledge graphs, and system dependencies). Based on Graph MCP, the analytical decision-making agent can perform static analysis of the binary program to be analyzed based on the graph database or graph API. IDA Pro is an interactive disassembler and debugger. IDA-Pro-MCP is a bridge between IDA Pro (Interactive Disassembler Professional) and the analytical decision-making agent. Based on IDA-Pro-MCP, the code understanding capabilities of LLM are combined with the powerful disassembly capabilities of IDA Pro, greatly improving the efficiency and automation level of the analysis of the binary program to be analyzed. Sandbox bridging tools allow the analytical decision-making agent to run code in an isolated environment (sandbox), and then perform dynamic analysis based on the sandbox. Debug bridging tools are tools that allow analytical decision-making agents to interact with debuggers (such as GDB, x64dbg, OllyDbg), enabling dynamic analysis based on the debugger.

[0058] In this embodiment of the invention, based on the loaded MCP tool, the analytical decision-making agent is able to transcend plain text dialogue and acquire the ability to operate professional software, analyze binary files, and run and debug programs. Complex and repetitive professional tasks are transformed into automated workflows driven by natural language commands, achieving automated and intelligent binary program analysis that combines static and dynamic adjustments through multiple rounds of autonomous self-adjustment.

[0059] In an exemplary embodiment of the present invention, before performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis result, the method further includes: The binary program to be analyzed is cleaned using a hash algorithm, and basic information is extracted. Configure a dynamic analysis environment based on the aforementioned basic information.

[0060] In this embodiment of the invention, a hash algorithm is used to clean the binary program to be analyzed and extract basic information to prepare for dynamic analysis.

[0061] In an exemplary embodiment of the present invention, the step of jumping to perform dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, until the analysis termination condition is met, the method further includes: An analysis report is generated based on the dynamic analysis results and the static analysis results.

[0062] In this embodiment of the invention, if it is determined that the analysis end conditions have been met, the results of several rounds of dynamic and static analysis are combined to produce a high-quality standardized analysis report, which is then archived.

[0063] In this embodiment of the invention, sample_v1.exe is used as an example of the binary program to be analyzed: The analytical decision-making agent loads and registers the MCP tool in the MCP tool registry center, obtains the analysis prompt template, and determines the analysis termination conditions. It selects the binary program to be analyzed, sample_v1.exe, and performs hash deduplication to determine basic information, such as hash: MD5 3f2b1e...c27, SHA256 a9d7...91b2 (no duplicates in the library), basic information: PE 64-bit, compilation timestamp 2025-09-28; entry point .text.

[0064] The dynamic analysis environment is set as follows: Sandbox image: Win10 x64, snapshot isolation, and monitoring points for processes, files, and networks are enabled.

[0065] The behavioral information obtained by using the MCP tool to call the sandbox for automatic dynamic analysis is represented as follows: Process tree: sample_v1.exe -> cmd.exe / c schtasks -> reg.exe (attempting scheduled tasks and registry persistence) File behavior: Write to %APPDATA%\svchost.exe (rename and disguise), create the startup item Run\svchost Network behavior: After DNS lookup of two domain names, a TLS connection is initiated to 203.0.xxx.xx:443, requesting the path / beacon; Permission behavior: Attempt to elevate token failed, retry three times; The resulting dynamic analysis shows that the overall behavior is information feedback type, with persistence and C2 communication, and includes custom configuration.

[0066] The information obtained by statically processing the binary program to be analyzed using IDA is represented as follows: Control flow: Main loop "Initialization -> Configuration decryption -> Heartbeat -> Task distribution -> Result feedback"; Anti-debugging: CheckRemoteDebuggerPresent+PEBBeingDebugged, the specific logic is in the sub-function sub_14001C320; Decryption process configuration restoration: xor_decode; after CRC verification, write to the global g_cfg, and deeply obfuscate the key; Command processing: Supports file enumeration, system information collection, and optional download and execution (requires C2 deployment); IAT / string renaming completed, function prototype correction completed, cross-reference relationship diagram generated; The resulting static analysis showed that the results were consistent with the dynamic results of the sandbox, and a complete remote control command and program logic diagram was summarized, clarifying the anti-debugging logic and the custom configuration encryption logic.

[0067] The analysis and decision-making agent determines, based on dynamic and static analysis results, that there are key parameters and custom configurations (C2 / key) in the binary program to be analyzed that are not clear, but the anti-debugging logic is clear. The analysis does not meet the end conditions and a second round of analysis is required. In the second round of analysis, it is necessary to bypass the anti-debugging and perform debugging analysis.

[0068] Re-establish the dynamic analysis environment: Sandbox image: Win10 x64, snapshot isolation, no need to enable system call tracing.

[0069] The dynamic analysis results obtained by performing debugging-based dynamic analysis on the binary program to be analyzed are expressed as follows: Extracting key parameters: Decrypt the configuration block at 0x140012AF0 after the entry point to obtain: C2 primary domain: c2.example.com, primary IP: 203.0.xxx.xx, path: / beacon, period: 120s. Alternate IP: 198.51.xxx.xx; XOR key: 0x5A; Record memory: Configure the structure address and a snapshot of the decrypted data; Based on the results of the second dynamic analysis, determine whether the analysis termination conditions have been met. Specifically, based on the results of the first round of analysis, determine whether the information integrity loss has been achieved and whether the hindering factors have been bypassed. That is, if the C2 / key / persistent path / command set is clear, anti-debugging has been bypassed, obfuscation is mild, and static data has been basically restored, then the analysis termination conditions have been met. Based on the dynamic and static analysis results, generate an analysis report.

[0070] In this embodiment of the invention, an analytical decision-making agent is introduced, and the MCP protocol is used to enable the analytical decision-making agent to autonomously execute analytical tasks. During the analysis process, multiple rounds of information from dynamic and static analysis are combined as information sources. Analytical information is accumulated in each round of iteration, and the analytical environment, analytical strategy, and analytical purpose are dynamically changed to finally obtain a high-quality, standardized, and usable summary of analytical results.

[0071] During the analysis process, combining multiple pieces of information from the spatial dimension, including: assembly code, pseudocode, and control flow graph information in static analysis; and system call sequences and parameters such as real-time memory, file processes, and networks, as well as advanced behavior report information in dynamic analysis, can compensate for the problems or inherent defects faced by any single analysis method. Simultaneously, combining multiple pieces of information from the temporal dimension, including: targeted conclusions and key information from each dynamic / static analysis, and high-dimensional information such as the process flow and program intent summarized from multiple dynamic / static analyses, can effectively solve the fundamental problem of information gaps in existing analysis methods in single-source, single-instance analyses. Through high-quality analysis prompt templates, the analysis decision-making agent proactively uses MCP to call the analysis interface in multiple rounds, actively combining and understanding information from multiple information sources, thus automatically and intelligently producing structured, standardized, high-quality analysis results, solving the defects and problems of manual analysis.

[0072] Static analysis can utilize tools like IDA to obtain static information such as file type, assembly code, pseudocode, strings, structures, and entry points, effectively revealing the program's basic logic and execution conditions. However, comprehensive analysis becomes difficult when obfuscation, encryption, or large programs are involved. In such cases, dynamic analysis can be used to extract memory dumps, locate the actual entry points, analyze actual execution branches, and obtain key call parameters. Similarly, dynamic analysis using tools like GBD and sandboxes can acquire dynamic information such as program call information, actual runtime memory, encrypted key parameter variables, and advanced behavioral descriptions, effectively revealing the program's runtime logic. However, dynamic analysis becomes challenging when execution condition restrictions, environmental limitations, or anti-debugging / anti-sandbox measures exist. In these situations, static analysis is needed to obtain execution conditions, environment, and strategies for bypassing anti-debugging / anti-sandbox measures. Furthermore, the strategy for a single dynamic analysis is fixed.

[0073] In embodiments of the present invention, such as Figure 2As shown, the analysis decision agent loads and registers the MCP tool, obtains input or a preset analysis prompt template, determines the preset standard process, report requirements, characteristic situation strategies, etc. from the analysis prompt template, and then determines the analysis termination condition. It obtains the binary file corresponding to the binary program to be analyzed, performs hash deduplication on the binary file to be analyzed, obtains basic static information, and prepares the dynamic analysis environment. If the analysis decision agent determines that the current analysis is the first one or that the previous analysis had no prior knowledge, it performs sandbox analysis. If the previous analysis had prior knowledge but needs to be bypassed or key data needs to be obtained, it performs debugging analysis and then calls the static analysis interface to perform analysis. If the static analysis results and dynamic analysis results indicate that there are obfuscation or other adversarial means, or that the file path is too complex, resulting in an incomplete analysis and an unqualified analysis report, it jumps to the step of preparing the dynamic analysis environment until the analysis termination condition is met. It then summarizes the dynamic analysis results and static analysis results, generates a high-quality standardized analysis report, archives it, and then obtains other binary programs for analysis.

[0074] In this embodiment of the invention, the information obtained from static and dynamic analyses is complementary. The two analysis methods are used repeatedly and the strategy is dynamically adjusted to maximize the quality of the analysis. Simultaneously, interfaces for collecting static and dynamic information are encapsulated and autonomously invoked by the analysis and decision-making agent via the MCP protocol. A fixed workflow determines the overall program flow, achieving a combination of static and dynamic analysis for multiple rounds of automated analysis and producing analysis results.

[0075] This invention proposes a general binary program analysis scheme that encapsulates various static and dynamic analysis interfaces to enrich spatial information sources and achieve more accurate analysis. The information source acquisition interface is then provided to the analysis decision-making agent for active invocation via the MCP protocol. Internally, multiple rounds of analysis are iterated to enrich temporal information sources. During this process, the acquired analysis information is combined to adjust the next analysis strategy, resulting in more accurate analysis with increasing iterations. Ultimately, this achieves automated, intelligent, and high-quality binary program analysis with multiple information sources in both time and space. The complementarity of dynamic and static information overcomes the shortcomings of single dynamic / static analysis methods. The mutual verification and complementarity of information across multiple time rounds, along with dynamic adjustment of the analysis strategy, solves the problem of single-round analysis easily getting stuck. The MCP protocol combined with the analysis decision-making agent fully leverages the advantages of the agent, overcoming various shortcomings of manual analysis. The analysis quality no longer depends on the analyst's knowledge and tool usage skills. Only through the Prompt project is it possible to perform repeated analysis and adjustments based on a single program and to automatically and intelligently process multiple programs in batches, producing high-quality analysis results with a unified standard.

[0076] The binary program analysis apparatus provided by the present invention will be described below. The binary program analysis apparatus described below can be referred to in correspondence with the binary program analysis method described above. It should be noted that the apparatus provided in the embodiments below and the method provided in the embodiments above belong to the same concept, and the specific way in which each module and unit performs operations has been described in detail in the method embodiments, and will not be repeated here.

[0077] In one exemplary embodiment of the present invention, please refer to Figure 3 , Figure 3 This is a binary program analysis apparatus according to an exemplary embodiment, comprising the following modules.

[0078] Module 310 is configured to acquire the binary program to be analyzed. The dynamic analysis module 320 is configured to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results. The static analysis module 330 is configured to perform static analysis on the binary program to be analyzed and obtain static analysis results. The jump module 340 is configured to, if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, jump to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0079] In an exemplary embodiment of the present invention, the dynamic analysis module 320 includes: The analysis submodule is configured to be sandbox-based, and analyzes the behavioral information of the binary program to be analyzed to obtain the dynamic analysis results; wherein, the behavioral information includes process tree, file behavior, network behavior and permission behavior.

[0080] In one exemplary embodiment of the present invention, the analysis submodule includes: The running unit is configured to run the binary program to be analyzed in the sandbox and record the behavior information of the binary program to be analyzed during its execution. The determining unit is configured to determine the program operation intent and execution trajectory of the binary program to be analyzed based on the behavioral information, and obtain the dynamic analysis results.

[0081] In one exemplary embodiment of the present invention, the binary program analysis apparatus further includes: The first determining module is configured to obtain an analysis prompt template and determine the analysis termination condition based on the analysis prompt template; The second determining module is configured to determine, through the analysis and decision-making intelligent agent, whether the dynamic analysis results and the static analysis results have met the analysis termination condition.

[0082] In an exemplary embodiment of the present invention, the step of determining a dynamic analysis strategy through an analytical decision-making agent and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy includes: The third determining module is configured to determine the dynamic analysis strategy through the analysis decision-making agent based on the static analysis results and the dynamic analysis results; wherein, the dynamic analysis strategy includes a first analysis strategy based on a sandbox and a second analysis strategy based on debugging. The first analysis strategy is to perform dynamic analysis on the binary program to be analyzed based on the behavior information of the binary program to be analyzed running in the sandbox. The second analysis strategy is to perform dynamic analysis based on the result of step-by-step execution of the program branches in the binary program to be analyzed by the debugger.

[0083] In an exemplary embodiment of the present invention, the dynamic analysis module 320 includes: The dynamic analysis submodule is configured to load the MCP tool corresponding to dynamic analysis based on the analysis decision agent to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results; wherein, the MCP tool corresponding to dynamic analysis includes a sandbox bridging tool and a debugger bridging tool. Static analysis module 330 includes: The static analysis submodule is configured to load the corresponding MCP tool based on the analysis decision agent to perform static analysis on the binary program to be analyzed and obtain the static analysis results; wherein, the MCP tool corresponding to static analysis includes Graph MCP and IDA-Pro-MCP.

[0084] In one exemplary embodiment of the present invention, the binary program analysis apparatus further includes: The data cleaning module is configured to perform data cleaning on the binary program to be analyzed using a hash algorithm and extract basic information. The configuration module is configured to configure a dynamic analysis environment based on the aforementioned basic information.

[0085] In one exemplary embodiment of the present invention, the binary program analysis apparatus further includes: The generation module is configured to generate an analysis report based on the dynamic analysis results and the static analysis results.

[0086] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a binary program analysis method, which includes: acquiring the binary program to be analyzed; The binary program to be analyzed is dynamically analyzed to obtain the dynamic analysis results. Static analysis is performed on the binary program to be analyzed to obtain the static analysis results; If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0087] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0088] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute the binary program analysis method provided by the above methods, the method including: acquiring the binary program to be analyzed; The binary program to be analyzed is dynamically analyzed to obtain the dynamic analysis results. Static analysis is performed on the binary program to be analyzed to obtain the static analysis results; If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0089] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the binary program analysis method provided by the above methods, the method comprising: acquiring the binary program to be analyzed; The binary program to be analyzed is dynamically analyzed to obtain the dynamic analysis results. Static analysis is performed on the binary program to be analyzed to obtain the static analysis results; If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy.

[0090] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0091] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A binary program analysis method, characterized in that, Applied to analytical decision-making agents, including: Obtain the binary program to be analyzed; The binary program to be analyzed is dynamically analyzed to obtain the dynamic analysis results. Static analysis is performed on the binary program to be analyzed to obtain the static analysis results; If it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy. The step of determining a dynamic analysis strategy through an analytical decision-making agent and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy includes: Based on the static analysis results and the dynamic analysis results, the dynamic analysis strategy is determined by the analysis decision-making agent; wherein, the dynamic analysis strategy includes a first analysis strategy based on a sandbox and a second analysis strategy based on debugging. The first analysis strategy is to perform dynamic analysis on the binary program to be analyzed based on the behavior information of the binary program to be analyzed running in the sandbox. The second analysis strategy is to perform dynamic analysis based on the result of step-by-step execution of the program branches in the binary program to be analyzed by the debugger. If, based on the results of dynamic and static analysis, it is determined that the analysis in the current round cannot be further statically analyzed due to confusion, then the analysis decision agent will select the first analysis strategy for dynamic analysis in the next round of analysis. When executing the first analysis strategy, dynamic analysis will be performed based on the sandbox. During dynamic analysis, a memory snapshot of the binary to be analyzed during runtime will be captured by the dump program, and static analysis will be performed based on the memory snapshot. If, based on the results of dynamic and static analysis, it is determined that a certain variable has been complexly encrypted during the current round of analysis, causing the static analysis to reach a bottleneck, then the analysis decision agent will choose the second analysis strategy for dynamic analysis in the next round of analysis. Through debugging analysis, the binary program to be analyzed will be run directly to the place where the decrypted value is finally used to obtain the decrypted variable.

2. The binary program analysis method according to claim 1, characterized in that, The dynamic analysis of the binary program to be analyzed, to obtain the dynamic analysis results, includes: Based on the sandbox, the behavioral information of the binary program to be analyzed is analyzed to obtain the dynamic analysis results; wherein, the behavioral information includes process tree, file behavior, network behavior and permission behavior.

3. The binary program analysis method according to claim 1, characterized in that, Before the step of jumping to the dynamic analysis of the binary program to be analyzed to obtain the dynamic analysis result if it is determined based on the static analysis result and the dynamic analysis result that the analysis termination condition has not been met, the method further includes: Obtain the analysis prompt template, and determine the analysis termination condition based on the analysis prompt template; The analytical decision-making agent determines whether the dynamic analysis results and the static analysis results meet the analysis termination conditions.

4. The binary program analysis method according to claim 1, characterized in that, The dynamic analysis of the binary program to be analyzed, to obtain the dynamic analysis results, includes: Based on the aforementioned analysis and decision-making intelligent agent, the MCP tool corresponding to dynamic analysis is loaded to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results; wherein, the MCP tool corresponding to dynamic analysis includes a sandbox bridging tool and a debugger bridging tool. The static analysis of the binary program to be analyzed, to obtain the static analysis results, includes: Based on the aforementioned analytical decision-making agent, the corresponding MCP tool for static analysis is loaded to perform static analysis on the binary program to be analyzed, and obtain the static analysis results; wherein, the MCP tool corresponding to static analysis includes Graph MCP and IDA-Pro-MCP.

5. The binary program analysis method according to claim 1, characterized in that, Before performing dynamic analysis on the binary program to be analyzed and obtaining the dynamic analysis results, the method further includes: The binary program to be analyzed is cleaned using a hash algorithm, and basic information is extracted. Configure a dynamic analysis environment based on the aforementioned basic information.

6. The binary program analysis method according to any one of claims 1 to 5, characterized in that, If, based on the static analysis results and the dynamic analysis results, it is determined that the analysis termination condition has not been met, the process jumps to the step of performing dynamic analysis on the binary program to be analyzed to obtain dynamic analysis results, until the analysis termination condition is met. The method further includes: An analysis report is generated based on the dynamic analysis results and the static analysis results.

7. A binary program analysis device, characterized in that, Applied to analytical decision-making agents, including: The acquisition module is configured to acquire the binary program to be analyzed. The dynamic analysis module is configured to perform dynamic analysis on the binary program to be analyzed and obtain dynamic analysis results. The static analysis module is configured to perform static analysis on the binary program to be analyzed and obtain static analysis results. The jump module is configured to, if it is determined based on the static analysis results and the dynamic analysis results that the analysis termination condition has not been met, jump to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, until the analysis termination condition is met. When jumping to the step of performing dynamic analysis on the binary program to be analyzed and obtaining dynamic analysis results, a dynamic analysis strategy is determined by an analysis decision agent, and the binary program to be analyzed is dynamically analyzed based on the dynamic analysis strategy. The step of determining a dynamic analysis strategy through an analytical decision-making agent and performing dynamic analysis on the binary program to be analyzed based on the dynamic analysis strategy includes: Based on the static analysis results and the dynamic analysis results, the dynamic analysis strategy is determined by the analysis decision-making agent; wherein, the dynamic analysis strategy includes a first analysis strategy based on a sandbox and a second analysis strategy based on debugging. The first analysis strategy is to perform dynamic analysis on the binary program to be analyzed based on the behavior information of the binary program to be analyzed running in the sandbox. The second analysis strategy is to perform dynamic analysis based on the result of step-by-step execution of the program branches in the binary program to be analyzed by the debugger. If, based on the results of dynamic and static analysis, it is determined that the analysis in the current round cannot be further statically analyzed due to confusion, then the analysis decision agent will select the first analysis strategy for dynamic analysis in the next round of analysis. When executing the first analysis strategy, dynamic analysis will be performed based on the sandbox. During dynamic analysis, a memory snapshot of the binary to be analyzed during runtime will be captured by the dump program, and static analysis will be performed based on the memory snapshot. If, based on the results of dynamic and static analysis, it is determined that a certain variable has been complexly encrypted during the current round of analysis, causing the static analysis to reach a bottleneck, then the analysis decision agent will choose the second analysis strategy for dynamic analysis in the next round of analysis. Through debugging analysis, the binary program to be analyzed will be run directly to the place where the decrypted value is finally used to obtain the decrypted variable.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the binary program analysis method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the binary program analysis method as described in any one of claims 1 to 6.

Images