Intermediate representation fusion method and device based on large language model

Abstract

The specification provides a large language model-based intermediate representation fusion method and device, the method comprising: obtaining a first intermediate representation and a second intermediate representation corresponding to a target source code; wherein the first intermediate representation is an intermediate representation obtained by compiling the target source code; the second intermediate representation is an intermediate representation converted from executable code corresponding to the target source code; inputting the first intermediate representation and the second intermediate representation into a first large language model, optimizing the second intermediate representation according to the first intermediate representation by the first large language model, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation; determining a fusion intermediate representation corresponding to the target source code that can be used for intermediate representation analysis based on the optimized second intermediate representation.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of artificial intelligence, and more particularly to an intermediate representation fusion method and apparatus based on a large language model. Background Technology

[0002] In software security analysis and defect detection using system-level programming languages ​​such as C / C++, static analysis based on Intermediate Representation (IR) has become a mainstream technical approach. IR is an intermediate form generated by the compiler during the process of converting source code into executable code for the target machine. It is typically closer to the machine than the source code, but retains a certain degree of platform independence and structured information. Compared to direct analysis at the source code level, IR provides a program expression with a moderate level of abstraction, a well-structured and semantically clear form. It effectively shields the syntactic details of the source language and differences in the target platform, facilitating control flow and data flow analysis across processes, modules, and even the entire program. With the help of IR, analysis tools can more accurately identify high-risk issues such as memory safety vulnerabilities, undefined behavior, resource leaks, and concurrency defects, while improving the scalability and engineering feasibility of the analysis.

[0003] Currently, various compiler infrastructures (such as LLVM, GCC, and GHC) provide their own forms of IR (In-Reference Context). Among them, LLVM IR has become a widely adopted analysis tool in industry due to its platform independence, standardized text and memory formats, rich semantic information, and mature toolchain support. However, regardless of the form of IR used, practical applications generally face some common challenges, resulting in limitations in how to obtain and utilize IR for analysis. Summary of the Invention

[0004] In view of the above, one or more embodiments of this specification provide the following technical solutions: According to a first aspect of one or more embodiments of this specification, an intermediate representation fusion method based on a large language model is proposed, the method comprising: Obtain a first intermediate representation and a second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code in reverse engineering. The first intermediate representation and the second intermediate representation are input into the first large language model. The first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. Based on the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis is determined, corresponding to the target source code.

[0005] According to a second aspect of one or more embodiments of this specification, an intermediate representation fusion apparatus based on a large language model is proposed, the apparatus comprising: The acquisition module acquires a first intermediate representation and a second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code in reverse engineering. The fusion module inputs the first intermediate representation and the second intermediate representation into the first large language model, and the first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation; The determination module, based on the optimized second intermediate representation, determines a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code.

[0006] According to a third aspect of one or more embodiments of this specification, an electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; The processor executes the executable instructions to implement the steps of the method as described in any of the above embodiments.

[0007] According to a fourth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in any of the above embodiments.

[0008] According to a fifth aspect of one or more embodiments of this specification, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any of the above embodiments.

[0009] As can be seen from the above embodiments, for the first intermediate representation obtained by compiling the source code of a specific program, and the second intermediate representation converted from the executable code corresponding to the source code, the first intermediate representation and the second intermediate representation can be input into a large language model. The large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. Then, based on the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the source code can be determined.

[0010] Using the above method, intermediate representations obtained through different means can be fused to generate a semantically equivalent, syntactically correct, parsable, and downstream-suitable fused intermediate representation. The generated fused intermediate representation possesses both semantic richness and execution fidelity, providing overlapping but different perspectives on the same program. Furthermore, since the fused intermediate representation is semantically equivalent to the unfused original intermediate representation, the results obtained from analyzing the fused intermediate representation are usually equivalent to the results obtained from analyzing the original intermediate representation. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of an intermediate representation fusion system provided in an exemplary embodiment.

[0012] Figure 2 This is a flowchart of an exemplary embodiment of an intermediate representation fusion method based on a large language model.

[0013] Figure 3 This is a schematic diagram of an intermediate representation fusion process based on a large language model, provided as an exemplary embodiment.

[0014] Figure 4 This is a schematic diagram of the structure of a device provided in an exemplary embodiment.

[0015] Figure 5 This is a block diagram of an intermediate representation fusion device based on a large language model, provided in an exemplary embodiment. Detailed Implementation

[0016] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0017] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of related data shall comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals shall be provided for users to choose to authorize or refuse.

[0018] In software security analysis and defect detection using system-level programming languages ​​such as C / C++, static analysis based on intermediate representations (IR) has become a mainstream technical approach. However, limitations still exist in how to acquire and utilize IR for analysis.

[0019] To address the aforementioned problems, this specification provides one or more embodiments of a technical solution for implementing IR fusion based on a Large Language Model (LLM). This technical solution aims to fuse IRs obtained through different methods, ultimately generating a semantically equivalent, grammatically correct, parsable, and downstream-analyzable fused IR. Semantic equivalence means that two expressions, sentences, programs, or other symbolic structures have the same semantic meaning; that is, they express the same content or produce the same effect in all possible contexts or interpretations. Since the fused IR is semantically equivalent to the original, unfused IR, the results obtained from analyzing the fused IR are generally equivalent to the results obtained from analyzing the original IR.

[0020] It's important to note that large language models are natural language processing models based on deep learning techniques, possessing powerful capabilities in natural language understanding and generation. Large language models typically refer to deep learning models trained on large amounts of text data, which can be used to understand the meaning of natural language text or generate natural language text. Large language models can handle various natural language tasks, such as text classification, named entity recognition (NER), question answering, and dialogue, and represent an important pathway to artificial intelligence.

[0021] In the field of Natural Language Processing (NLP), large-scale text datasets are often referred to as corpora. Corpora can contain various types of text data, such as literary works, academic papers, legal documents, news reports, everyday conversations, emails, and online forum posts. By learning from the text data in corpora, large language models can acquire and understand the rules and patterns of natural language, thereby achieving effective processing and generation of natural language.

[0022] Large language models typically employ the Transformer architecture; that is, large language models are usually deep learning models based on the Transformer architecture. Deep learning models based on the Transformer architecture are a class of neural network models that utilize the Transformer architecture, and these models perform exceptionally well in fields such as natural language processing.

[0023] The Transformer is a neural network model used for sequence-to-sequence modeling. It does not rely on recursive structures, enabling parallel training and inference, thus accelerating model processing. Deep learning models based on the Transformer architecture typically use multi-layered Transformer encoders to extract features from the input sequence and a Transformer decoder to transform the extracted features into an output sequence. These models also often employ self-attention mechanisms to capture long-range dependencies in the input sequence, and residual connections and normalization methods to accelerate training and improve model performance.

[0024] Pre-trained models are large language models pre-trained on massive amounts of unlabeled text data. Pre-trained models are general-purpose models, not designed or optimized for specific tasks. To adapt pre-trained models to specific application scenarios and task requirements, fine-tuning is needed to improve the model's performance on specific tasks. The final large language model deployed is usually a model that has undergone further fine-tuning based on the pre-trained model, using supervised learning on labeled text data. Pre-training and fine-tuning are complementary processes; pre-training enables the model to possess broad language understanding capabilities, while fine-tuning makes the model more specialized and accurate for specific tasks.

[0025] In other words, the training process of a large language model can be divided into two stages: pre-training and fine-tuning. In the pre-training stage, unsupervised learning (e.g., self-supervised learning) can be used to pre-train on large-scale, unlabeled text datasets (e.g., online encyclopedias, online articles, books, etc.). Specifically, it can predict missing parts or the next word based on context, learn semantic, syntactic, and other statistical rules and language structures, and minimize the prediction loss through backpropagation and optimization algorithms (e.g., gradient descent), iteratively updating the model parameters and gradually improving the model's ability to understand language. During the fine-tuning phase, a suitable supervised learning task (e.g., text classification, named entity recognition, question answering systems, dialogue systems, etc.) can be selected based on the specific application scenario and task requirements. A task-specific text dataset is prepared, and the pre-trained model can be used as the starting point for fine-tuning. Supervised learning is employed on this task-specific text dataset, where the task can be executed. Backpropagation and optimization algorithms (e.g., gradient descent) are used to minimize the loss used to measure the model's performance on the specific task, iteratively updating the model parameters to gradually improve its performance. In practical applications, fine-tuning can flexibly choose supervised, unsupervised, or semi-supervised learning methods based on the specific application scenario and the type of available data.

[0026] The language comprehension ability learned by large language models during the pre-training and fine-tuning phases enables them to perform logical inference, knowledge reasoning, or problem-solving by understanding, analyzing, and synthesizing textual information when faced with complex problems or tasks. This ability is often referred to as the reasoning ability of large language models.

[0027] In practical applications, the pre-trained large language model is usually referred to as the base model of the large language model, and the fine-tuned large language model is referred to as the service model of the large language model.

[0028] Large language models typically perform specific tasks under the guidance or stimulation of prompts. A prompt can be an initial text or text fragment provided to the large language model, such as a sentence, a question, or a dialogue, designed to guide or stimulate the model to produce corresponding output. Prompts are key tools for guiding the model's output and can be very simple or quite complex, including instructions, examples, and descriptions of the expected output format. Prompts explicitly tell the large language model what task is expected of it, such as answering a question, simulating a dialogue, writing an article, or translating text. Simultaneously, prompts provide the large language model with necessary background information and context, enabling it to understand the logic, style, theme, or stance that should be followed when generating content. Furthermore, prompts can stimulate the large language model to demonstrate its inherent knowledge or specific language abilities, such as explaining complex concepts, citing rules, or imitating a particular author's writing style.

[0029] Since large language models are primarily used for understanding and generating natural language based on text processing, cues are typically presented in text form. However, in practical applications, large language models can also accept other forms of input as cues, such as images, audio, or even video, provided that the large language model is designed or trained to process multimodal data (e.g., text, images, audio, video, etc.). Multimodal Large Language Models (MLLMs) can process and understand multimodal data. They combine techniques from natural language processing and computer vision to achieve deep fusion and understanding of multimodal data, enabling reasoning, generation, and interaction between different modalities.

[0030] This specification provides one or more embodiments of a technical solution for implementing intermediate representation fusion based on a large language model. In this technical solution, for a first intermediate representation obtained by compiling the source code of a specific program, and a second intermediate representation converted from the executable code corresponding to the source code, the first intermediate representation and the second intermediate representation can be input into a large language model. The large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. Then, based on the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the source code can be determined.

[0031] Using the above method, intermediate representations obtained through different means can be fused to generate a semantically equivalent, syntactically correct, parsable, and downstream-suitable fused intermediate representation. The generated fused intermediate representation possesses both semantic richness and execution fidelity, providing overlapping but different perspectives on the same program. Furthermore, since the fused intermediate representation is semantically equivalent to the unfused original intermediate representation, the results obtained from analyzing the fused intermediate representation are usually equivalent to the results obtained from analyzing the original intermediate representation.

[0032] In practical applications, an intermediate representation fusion system can be built based on a large language model. This intermediate representation fusion system will fuse the IRs obtained through different methods to finally generate a semantically equivalent, syntactically correct, parsable, and suitable fusion IR for downstream analysis.

[0033] refer to Figure 1 , Figure 1 This is a schematic diagram of an intermediate representation fusion system provided in an exemplary embodiment.

[0034] like Figure 1 As shown, the aforementioned intermediate represents that the converged system may include a server and at least one client that accesses the server via any type of wired or wireless network.

[0035] The aforementioned server can correspond to a server containing a single physical host, or a server cluster consisting of multiple independent physical hosts; alternatively, it can correspond to a virtual server, cloud server, etc., hosted by a host cluster.

[0036] The aforementioned client can correspond to terminal devices such as smartphones, tablets, laptops, desktop computers, PCs (Personal Computers), PDAs (Personal Digital Assistants), wearable devices (e.g., smart glasses, smartwatches), smart in-vehicle devices, or game consoles.

[0037] Users can use the intermediate representation fusion service provided by the intermediate representation fusion system through the aforementioned client; the aforementioned client and the aforementioned server can realize user-oriented intermediate representation fusion service through data interaction with each other.

[0038] Specifically, the aforementioned server can be equipped with a large language model, and the aforementioned intermediate representation fusion system can be based on this large language model, which will fuse the IRs obtained through different methods to finally generate a fused IR.

[0039] For example, the aforementioned client can output a corresponding user interface, allowing the user to perform operations such as inputting IRs obtained through different methods, in order to use the intermediate representation fusion service provided by the intermediate representation fusion system. The client can send the user-input IR to the aforementioned server, which can then generate a corresponding fused IR based on the user-input IR and return the fused IR to the client, which can then display the fused IR to the user through the user interface for viewing; alternatively, the server can directly send the fused IR to the downstream analysis system, which will then perform intermediate representation analysis based on the fused IR.

[0040] It should be noted that the aforementioned server can also be equipped with other functional components or subsystems, such as prompt generation components and user interaction components. These components or subsystems can work collaboratively with the large language model mounted on the server to achieve intermediate representation fusion.

[0041] Furthermore, the aforementioned intermediate representation fusion system may have one and only one large language model, which can be used to perform tasks such as function pair semantic difference analysis, intermediate representation optimization, and intermediate representation alignment, depending on actual needs. Alternatively, the intermediate representation fusion system may have multiple large language models, which may include large language models for performing function pair semantic difference analysis, intermediate representation optimization, and intermediate representation alignment tasks, etc.

[0042] refer to Figure 2 , Figure 2 This is a flowchart of an exemplary embodiment of an intermediate representation fusion method based on a large language model.

[0043] In this embodiment, the aforementioned intermediate representation fusion method based on a large language model can be applied to, for example... Figure 1 The middle section shown represents the server side of the fusion system.

[0044] like Figure 2 As shown, the above-mentioned intermediate representation fusion method based on a large language model may include the following steps: Step 202: Obtain the first intermediate representation and the second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code.

[0045] In practical applications, there are multiple ways to obtain the intermediate representation of a specific program. For example, the program's source code can be compiled, and the intermediate representation generated by the compiler during the conversion of the source code into object code can be used as the program's intermediate representation. Another example is binary lifting, which reverse-engineers the program's executable code (usually binary machine code such as x86 or ARM) into a more clearly structured and semantically explicit intermediate representation, such as LLVM IR, REIL, VEX, or a custom IR. Yet another example is decompiling the program's executable code and obtaining the intermediate representation generated by the decompiler during the process of restoring the executable code back to source code. The executable code itself can be obtained by fully compiling the program's source code.

[0046] In this embodiment, if it is necessary to analyze a specific source code (the source code of a specific program, which can be called the target source code), the intermediate representation of the target source code can be obtained in two ways, and the intermediate representations obtained in these two ways can be fused to finally generate a semantically equivalent, syntactically correct, parsable, and suitable for downstream analysis fused intermediate representation (i.e. fused IR).

[0047] That is, we can first obtain the first intermediate representation and the second intermediate representation corresponding to the target source code. The first intermediate representation can be an intermediate representation obtained by compiling the target source code, and the second intermediate representation can be an intermediate representation that is reverse-engineered from the executable code corresponding to the target source code (e.g., executable code obtained by fully compiling the target source code).

[0048] In some embodiments, the first intermediate representation may specifically be an SC-IR obtained through the source compilation to IR (SC-IR), and the second intermediate representation may specifically be a BL-IR obtained through the binary lifting to IR (BL-IR).

[0049] It's important to note that SC-IR refers to the process of directly converting source code into an intermediate representation at the compiler front-end, before back-end code generation. Because this path preserves high-level semantic information in the source code—such as variable names, function names, type information, and structured control flow (e.g., if / else, for / while, etc.)—it enables high-fidelity static analysis of the original program logic. However, this representation does not reflect the actual impact of compiler back-end optimizations, target platform-specific code lowering, or ABI (Application Binary Interface) related transformations, and therefore may exhibit behavioral differences from the final generated executable code.

[0050] BL-IR is obtained by reverse engineering compiled executable code and then converting it back into an intermediate representation using binary decompilation or boosting frameworks (such as McSema, BinRec, RetDec, or Plankton). This path accurately captures the final effects of compiler optimizations, instruction scheduling, calling conventions, and architecture-related transformations, thus more realistically reflecting the program's actual runtime behavior. However, because the executable code itself loses a significant amount of high-level language abstraction, BL-IR typically lacks original symbolic information, a precise type system, and structured control flow. For example, in BL-IR, loops and conditional statements are often reduced to low-level jump instructions, making the control flow graph complex and difficult to understand.

[0051] While SC-IR-based analysis offers rich semantics and a clear structure, it may overlook security-related transformations introduced by compiler optimizations (e.g., inlining, dead code elimination, loop unrolling), leading to false negatives or missed detections. Furthermore, modern production builds typically employ intensive optimizations (e.g., -O2 / -O3), making the resulting SC-IR overly complex for many downstream analysis tools, limiting its applicability in real-world deployments. While BL-IR-based analysis faithfully reflects runtime behavior, the lack of high-level semantic information makes it difficult to support accurate data flow analysis, control flow reconstruction, or vulnerability pattern matching, increasing the difficulty of inferring program intent.

[0052] Therefore, a fused IR that combines semantic richness and execution fidelity can be constructed by fusing SC-IR and BL-IR.

[0053] In some embodiments, the LLVM (Low Level Virtual Machine) compilation framework can be used to compile the target source code to obtain the first intermediate representation, specifically, the first intermediate representation can be the SC-LLVM IR obtained through the source code compilation path using the LLVM compilation framework. Furthermore, the executable code obtained by compiling the target source code using the LLVM compilation framework can be further binary-enhanced to obtain the second intermediate representation, specifically, the second intermediate representation can be the BL-LLVM IR obtained through the binary enhancement path using the LLVM compilation framework. Correspondingly, merging the SC-LLVM IR and the BL-LLVM IR yields a merged LLVM IR.

[0054] Step 204: Input the first intermediate representation and the second intermediate representation into the first large language model. The first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0055] In this embodiment, the first intermediate representation and the second intermediate representation corresponding to the target source code can be input into a large language model (which can be called the first large language model). The first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the original first intermediate representation.

[0056] In practical applications, the aforementioned first large language model can specifically be a service model of a large language model that has been pre-trained and fine-tuned and can be used to perform intermediate representation optimization tasks.

[0057] In some embodiments, considering factors such as scalability, controllability, engineering feasibility, and semantic integrity, intermediate representation optimization can be performed using functions as the basic unit. This approach reduces the inference complexity and context length pressure of large language models. Furthermore, since most functions are independent (except for call relationships), multiple functions can be processed in parallel, significantly improving processing efficiency. Moreover, when the source code or executable code of a function changes, the function can be reprocessed without a complete rewrite. In addition, LLVM IR organizes code in units of functions. While global state (such as global variables and external declarations) is shared across functions, the function body is closed, making functions the natural boundary for static analysis and transformations, and the fundamental granularity for compiler optimization.

[0058] Specifically, the first intermediate representation and the second intermediate representation can be input into the first large language model. The first large language model optimizes the function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units (which can be called second type of function-level units) based on the function-level units in the first intermediate representation (which can be called first type of function-level units), so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0059] It should be noted that for each function, the corresponding function-level unit may include: the function body; and, in order to accurately understand, interpret, or process the function body of a function, those program elements that are defined outside the function but referenced within the function body, such as global variables, types, constants, other function declarations, module imports, class definitions, etc.

[0060] In some embodiments, to improve the efficiency of intermediate representation optimization, the first type of function-level units can be extracted from the first intermediate representation, and the second type of function-level units can be extracted from the second intermediate representation. Function-level units with matching function names in the first and second types of function-level units are identified as function pairs, allowing the first language model to directly utilize these function pairs for intermediate representation optimization. Specifically, for each function pair, the first language model can optimize the second type of function-level units in that function pair based on the first type of function-level units, making the optimized second type of function-level units semantically equivalent to the first type of function-level units. After optimizing the second type of function-level units in all function pairs, the optimization of the second intermediate representation is considered complete.

[0061] In practical applications, executable code can be stripped. Typically, executable code includes debugging symbols and a symbol table by default, including function names, global variable names, etc. Tools (such as strip) can remove this symbol information, making the executable code smaller and more difficult to reverse engineer. Therefore, the executable code used to reverse engineer the aforementioned second intermediate representation can be unstripped, meaning it still retains symbol information such as function names and global variable names, allowing these names to be directly matched with function names in the source code.

[0062] In some embodiments, during the compilation and linking of source code into executable code, the final executable code may contain functions that do not exist in the original source code. These additional functions are automatically introduced by the compiler, linker, or runtime system. Examples include auxiliary functions inserted by the compiler to support language features, standard library functions linked by the linker, runtime startup functions, and functions of specific types instantiated by C++ templates at compile time based on usage. In this case, although the function-level units extracted from the second intermediate representation cannot match the function-level units extracted from the first intermediate representation, the function-level units extracted from the second intermediate representation are still retained to maintain the integrity and resolvability of the final fused intermediate representation.

[0063] In some embodiments, in order to improve the efficiency and accuracy of intermediate representation optimization, after obtaining the above function pairs, each function pair can be further input into a large language model (which may be called a second large language model). The second large language model determines whether the two function-level units in each function pair are semantically equivalent and generates semantic difference information corresponding to each function pair.

[0064] In practical applications, the aforementioned second large language model can specifically be a service model of a large language model that has been pre-trained and fine-tuned and can be used to perform semantic difference analysis tasks.

[0065] For each function pair, when determining whether the two function-level units in the pair are semantically equivalent, the second language model can, on the one hand, ignore differences in function or variable names that do not affect semantics; on the other hand, for pointer types (e.g., i8*, i32*, i64*), they are considered interchangeable as long as they are semantically equivalent and the differences do not affect subsequent analysis (e.g., vulnerability analysis). The semantic difference information generated by the second language model corresponding to the function pair may include information confirming the semantic equivalence of the two function-level units in the pair, or the modifications required to make the two function-level units in the pair semantically equivalent and the corresponding reasons for the modifications.

[0066] In some embodiments, to facilitate automatic processing using the output of the second language model, the output of the second language model can be a strictly structured JSON object.

[0067] In some embodiments, prompts can be constructed to guide the execution function of the second language model to perform semantic difference analysis. Furthermore, the generation performance of the second language model can be improved by carefully designing the content of the prompts.

[0068] Specifically, hints (or first hints) can be constructed based on each function pair. These first hints can include semantic difference analysis strategies. These strategies may include: ignoring differences in function or variable names that do not affect semantics; treating pointer types as interchangeable as long as they are semantically equivalent and the differences do not affect vulnerability analysis; and so on.

[0069] Subsequently, the first prompt can be input into the second language model. Guided by the first prompt, the second language model uses the semantic difference analysis strategy in the first prompt to determine whether the two function-level units in the function pair in the first prompt are semantically equivalent, and generates semantic difference information corresponding to the function pair.

[0070] In some embodiments, after obtaining the semantic difference information corresponding to each function pair, the first intermediate representation, the second intermediate representation, and the semantic difference information corresponding to each function pair can be input into the first large language model. The first large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units based on the first type of function-level units in the first intermediate representation and the corresponding semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0071] Taking the function pair (first type function level unit 1, second type function level unit 1) as an example, the first large language model can optimize the second type function level unit 1 based on the first type function level unit 1 and the semantic difference information corresponding to the function pair, so that the optimized second type function level unit 1 is semantically equivalent to the first type function level unit 1; after completing the optimization of the second type function level units in all function pairs, the optimization of the second intermediate representation can be considered complete.

[0072] In some embodiments, prompts can be used to guide the first language model in performing intermediate representation optimization tasks. Furthermore, the generation performance of the first language model can be improved by carefully designing the content of the prompts.

[0073] Specifically, hints (referred to as second hints) can be constructed based on the aforementioned first intermediate representation, the aforementioned second intermediate representation, and the semantic difference information corresponding to each function pair. The second hints may include intermediate representation optimization strategies. These strategies may include: using BL-IR as a baseline, SC-IR as a semantic reference, and the semantic difference information corresponding to each function pair as guidance; global definitions must not be changed unless explicitly justified; semantic equivalence (e.g., pointer type normalization) must be preserved; strict adherence to IR syntax rules is required, including naming conventions, instruction separation, and SSA form; and so on.

[0074] Subsequently, the second prompt can be input into the first language model. Guided by the second prompt, the first language model optimizes the second type of function-level units in the second intermediate representation based on the intermediate representation optimization strategy in the second prompt and the semantic difference information corresponding to each function pair in the first intermediate representation. This optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0075] In some embodiments, for each function pair, when the first language model optimizes the second type of function-level unit in the function pair based on the first type of function-level unit in the function pair so that the optimized second type of function-level unit is semantically equivalent to the first type of function-level unit, since some statements within the same function-level unit have dependencies on data flow, control flow, or type system, when one of the statements is modified, other related statements can also be adjusted accordingly to maintain semantic consistency and syntactic validity.

[0076] In some embodiments, since the second intermediate representation is essentially derived from binary decompilation, structures such as if, for, and while are typically downgraded to low-level jumps, losing source code-level control flow semantics. Therefore, when optimizing the second intermediate representation, the first language model can utilize the clear logical structure of the first intermediate representation (referred to as the program organization structure, which determines how the IR represents program elements such as control flow, data flow, scope, functions, and variables) to reconstruct the logical structure of the second intermediate representation, making it closer to the intent of the source code.

[0077] In some embodiments, in order to facilitate subsequent automatic processing using the output of the first language model, the output of the first language model can be a strictly structured JSON object containing the updated function IR and necessary metadata.

[0078] Step 206: Based on the optimized second intermediate representation, determine a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code.

[0079] In this embodiment, having obtained the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code can be determined based on the optimized second intermediate representation.

[0080] In some embodiments, to ensure global consistency and prevent potential call target mismatches and global reference errors when refining functions individually, after obtaining the optimized second intermediate representation, the global names in the optimized second intermediate representation can be further aligned with the global names in the first intermediate representation. Global names typically refer to names that uniquely identify an entity (such as a function, global variable, type, etc.) across the entire program or module; these names have global scope, meaning they can be referenced anywhere in the program or module (as long as the declaration is visible), not just within a single function.

[0081] Specifically, the first intermediate representation and the optimized second intermediate representation can be input into a large language model (which can be called a third large language model). The third large language model aligns the global names in the optimized second intermediate representation with the global names in the first intermediate representation. Subsequently, based on the optimized and aligned second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code can be determined.

[0082] In practical applications, the aforementioned third major language model can specifically be a service model of a large language model that has been pre-trained and fine-tuned and can be used to perform intermediate representation alignment tasks.

[0083] When aligning the optimized second intermediate representation with the first intermediate representation, the third language model can, on the one hand, cross-reference global definitions between the first and second intermediate representations; on the other hand, it can, where applicable, coordinate variable names according to the conventions of the binary end (executable code end); and furthermore, it can ensure that the name used in the definition or declaration of each function in the aligned intermediate representation is consistent with the name referenced in all its call points.

[0084] In some embodiments, prompts can be used to guide the third language model in performing intermediate representation alignment tasks. Furthermore, the generation performance of the third language model can be improved by carefully designing the content of the prompts.

[0085] Specifically, a hint (which may be called a third hint) can be constructed based on the first intermediate representation and the optimized second intermediate representation described above. The third hint includes an intermediate representation alignment strategy. This strategy may include: cross-referencing global definitions between the first and second intermediate representations; coordinating variable names according to binary conventions where applicable; and ensuring that the names used in the definition or declaration of each function in the aligned intermediate representation are consistent with the names referenced in all its call points.

[0086] Subsequently, the third prompt can be input into the third language model. Guided by the third prompt, the third language model will align the global name in the optimized second intermediate representation with the global name in the first intermediate representation based on the intermediate representation alignment strategy in the third prompt.

[0087] In some embodiments, IR (especially LLVM IR) has strict type systems, SSA specifications, and module structure constraints. Text generated solely by a large language model may "look reasonable" but contain syntactic errors. Therefore, before determining the optimized second intermediate representation (or the optimized and aligned second intermediate representation) as the fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code, a syntactic check can also be performed on the optimized second intermediate representation (or the optimized and aligned second intermediate representation).

[0088] Taking the optimized second intermediate representation as an example, the optimized second intermediate representation can be determined as the target intermediate representation to be checked, and the legality of the target intermediate representation can be checked.

[0089] Taking LLVM IR as an example, llvm-as is the official LLVM reference implementation, and its IR validity check is the most authoritative and complete. Therefore, when the aforementioned target intermediate representation is LLVM IR, llvm-as can assemble the target intermediate representation and utilize llvm-as's parsing and verification capabilities to perform a validity check on the target intermediate representation during the assembly process.

[0090] If the above-mentioned target intermediate representation passes the validity check, then the target intermediate representation can be determined as a fused intermediate representation that corresponds to the above-mentioned target source code and can be used for intermediate representation analysis.

[0091] If the validity check of the target intermediate representation fails, a validity error message corresponding to that target intermediate representation can be identified. The first intermediate representation, the target intermediate representation, and the validity error message are then re-input into the first language model. The first language model optimizes the target intermediate representation based on the first intermediate representation and the validity error message, ensuring that the optimized target intermediate representation is semantically equivalent to the first intermediate representation. Subsequently, the optimized target intermediate representation can be redefined as a new target intermediate representation; alternatively, the optimized target intermediate representation can be aligned with the first intermediate representation, and the optimized and aligned target intermediate representation can be redefined as a new target intermediate representation. A validity check can then be performed on the new target intermediate representation. This iterative process continues until a syntactically valid target intermediate representation is obtained and identified as a fused intermediate representation corresponding to the target source code, usable for intermediate representation analysis.

[0092] It should be noted that the aforementioned first, second, and third language models can be three different large language models used to perform the tasks of semantic difference analysis of function pairs, intermediate representation optimization, and intermediate representation alignment, respectively. Alternatively, they can refer to the three different functions of semantic difference analysis of function pairs, intermediate representation optimization, and intermediate representation alignment implemented by the same large language model. This specification does not impose any special restrictions on this.

[0093] When the first, second, and third language models mentioned above refer to the same large language model and implement the three different functions of semantic difference analysis, intermediate representation optimization, and intermediate representation alignment, it is usually only necessary to input the first intermediate representation and the second intermediate representation (or the first intermediate representation, the second intermediate representation, and the function pair mentioned above) into the large language model once.

[0094] In such Figure 2 Based on the embodiments shown, refer to Figure 3 , Figure 3 This is a schematic diagram of an intermediate representation fusion process based on a large language model, provided as an exemplary embodiment.

[0095] like Figure 3 For any target source code, on the one hand, a first intermediate representation can be obtained by compiling the target source code; on the other hand, executable code can be obtained by fully compiling the target source code, and then binary promotion can be performed on the executable code to reverse convert the executable code into a second intermediate representation.

[0096] For the first and second intermediate representations mentioned above, these two intermediate representations obtained through different methods can be merged to generate a semantically equivalent, syntactically correct, parsable, and suitable for downstream analysis fused intermediate representation. Since the fused intermediate representation is semantically equivalent to the original unfused intermediate representation, the result obtained from analyzing the fused intermediate representation is usually equivalent to the result obtained from analyzing the original intermediate representation.

[0097] Specifically, firstly, a first type of function-level units can be extracted from the first intermediate representation, and a second type of function-level units can be extracted from the second intermediate representation. Function-level units with matching function names from the extracted first and second types of function-level units are then identified as function pairs. These function pairs containing two matching function-level units can form a list of function pairs.

[0098] Then, a large language model can be used to determine whether the two matching function-level units in each function pair in the function pair list are semantically equivalent, and generate semantic difference information corresponding to each function pair.

[0099] Next, a large language model can be used. Based on the first type of function-level units in the first intermediate representation and the semantic difference information corresponding to each function pair, the large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units. This optimizes the second intermediate representation to be semantically equivalent to the first intermediate representation. After optimizing the second intermediate representation, the optimized second intermediate representation is obtained.

[0100] Next, a large language model can be used to align the global names in the optimized second intermediate representation with the global names in the first intermediate representation. After aligning the optimized second intermediate representation, the aligned second intermediate representation is obtained.

[0101] Finally, the aligned second intermediate representation can be identified as the target intermediate representation to be checked, and its validity is verified. If the target intermediate representation passes the verification, it can be directly identified as the fused intermediate representation corresponding to the target source code and usable for intermediate representation analysis. If the target intermediate representation fails the verification, the validity error information corresponding to the target intermediate representation can be identified, and the first intermediate representation, the target intermediate representation, and the validity error information are re-input into the large language model. The large language model optimizes the target intermediate representation based on the first intermediate representation and the validity error information, making the optimized target intermediate representation semantically equivalent to the first intermediate representation. Subsequently, the optimized target intermediate representation can be re-identified as a new target intermediate representation; or, the optimized target intermediate representation can be aligned with the first intermediate representation, and the optimized and aligned target intermediate representation can be re-identified as a new target intermediate representation; then, the validity of the new target intermediate representation can be verified. Through this iterative process, a syntactically valid target intermediate representation is obtained and identified as the fused intermediate representation corresponding to the target source code and usable for intermediate representation analysis.

[0102] In one or more embodiments of the technical solutions provided in this specification, for a first intermediate representation obtained by compiling the source code of a specific program, and a second intermediate representation converted from the executable code corresponding to the source code, the first intermediate representation and the second intermediate representation can be input into a large language model. The large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. Then, based on the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the source code can be determined.

[0103] Using the above method, intermediate representations obtained through different means can be fused to generate a semantically equivalent, syntactically correct, parsable, and downstream-suitable fused intermediate representation. The generated fused intermediate representation possesses both semantic richness and execution fidelity, providing overlapping but different perspectives on the same program. Furthermore, since the fused intermediate representation is semantically equivalent to the unfused original intermediate representation, the results obtained from analyzing the fused intermediate representation are usually equivalent to the results obtained from analyzing the original intermediate representation.

[0104] Corresponding to the aforementioned embodiments of the intermediate representation fusion method based on a large language model, this specification also provides embodiments of an intermediate representation fusion apparatus based on a large language model.

[0105] refer to Figure 4 , Figure 4This is a schematic diagram of the structure of a device provided in an exemplary embodiment. For example... Figure 4 As shown, device 400 mainly consists of a communication interface 402, a user interface 404, a processor 406, and a data storage 408. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 410. The communication interface 402 enables device 400 to communicate with other devices, access networks, and transmission networks via analog or digital modulation. For example, the communication interface 402 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 402 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, Global Positioning System (GPS), or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 402 can also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 402 may also include multiple physical communication interfaces, such as Wi-Fi, Bluetooth, and wide-area wireless interfaces.

[0106] User interface 404 includes receiving user input and providing output to the user. Therefore, user interface 404 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 404 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 404 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, device 400 may support remote access from other devices via communication interface 402 or another physical interface (not shown). User interface 404 may be configured to receive user input, the position and movement of which may be indicated by an indicator or cursor described herein. User interface 404 may also be configured as a display device for rendering or displaying text fragments.

[0107] Processor 406 may contain one or more general-purpose processors and / or special-purpose processors.

[0108] Data storage 408 may include one or more volatile and / or non-volatile storage components and may be integrated wholly or partially with processor 406. Data storage 408 may include removable and non-removable components.

[0109] Processor 406 is capable of executing program instructions 418 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 408 to perform the various functions described herein. Data storage 408 may comprise a non-transitory computer-readable medium on which program instructions are stored, which, when executed by device 400, enable device 400 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Processor 406 executing program instructions 418 may result in processor 406 using data 412.

[0110] For example, program instructions 418 may include an operating system 422 (e.g., an operating system kernel, device drivers, and / or other modules) installed on device 400 and one or more applications 420 (e.g., a browser, social application, or game application). Similarly, data 412 may include operating system data 416 and application data 414. Operating system data 416 is primarily accessible to the operating system 422, while application data 414 is primarily accessible to one or more applications 420. Application data 414 may reside in a file system visible or hidden from the user of device 400.

[0111] Application 420 can communicate with operating system 422 through one or more application programming interfaces (APIs). These APIs help application 420 read and / or write application data 414, transmit or receive information via communication interface 402, receive or display information on user interface 404, etc.

[0112] In some terminology, application 420 may be simply referred to as "app". Furthermore, application 420 can be downloaded to device 400 through one or more online app stores or app markets. However, applications can also be installed on device 400 in other ways, such as through a web browser or a physical interface on device 400 (e.g., a USB port).

[0113] refer to Figure 5 , Figure 5 This is a block diagram of an intermediate representation fusion apparatus based on a large language model, provided as an exemplary embodiment. This intermediate representation fusion apparatus based on a large language model can be applied to, for example... Figure 4 The device shown is used to implement the technical solution described in this specification.

[0114] The aforementioned intermediate representation fusion device based on a large language model may include: The acquisition module 502 acquires a first intermediate representation and a second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code in reverse engineering. The fusion module 504 inputs the first intermediate representation and the second intermediate representation into the first large language model, and the first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. The determination module 506, based on the optimized second intermediate representation, determines the intermediate representation that corresponds to the target source code and can be used for intermediate processing. In some embodiments, the fusion module is specifically used for: The first intermediate representation and the second intermediate representation are input into the first large language model. The first large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units, based on the first type of function-level units in the first intermediate representation, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0115] In some embodiments, the apparatus further includes an analysis module: Extract a first type of function-level unit from the first intermediate representation, extract a second type of function-level unit from the second intermediate representation, and determine the function-level units whose function names match in the first type of function-level unit and the second type of function-level unit as function pairs; The function pair is input into the second largest language model, which determines whether the two function-level units in the function pair are semantically equivalent and generates semantic difference information corresponding to the function pair. The fusion module is specifically used for: The first intermediate representation, the second intermediate representation, and the semantic difference information are input into the first large language model. The first large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units based on the first type of function-level units in the first intermediate representation and the semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0116] In some embodiments, the analysis module is specifically used for: A first suggestion is constructed based on the function pair; wherein, the first suggestion includes a semantic difference analysis strategy; The first prompt is input into the second language model. Guided by the first prompt, the second language model determines whether the two function-level units in the function pair are semantically equivalent based on the semantic difference analysis strategy, and generates semantic difference information corresponding to the function pair.

[0117] In some embodiments, the fusion module is specifically used for: A second prompt is constructed based on the first intermediate representation, the second intermediate representation, and the semantic difference information; wherein, the second prompt includes an intermediate representation optimization strategy; The second prompt is input into the first large language model. Guided by the second prompt, the first large language model optimizes the second type of function-level units in the second intermediate representation that match the function names of the first type of function-level units in the first intermediate representation, based on the intermediate representation optimization strategy and the semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

[0118] In some embodiments, the device further includes an alignment module: The first intermediate representation and the optimized second intermediate representation are input into the third language model, which then aligns the global names in the optimized second intermediate representation with the global names in the first intermediate representation. In some embodiments, the determining module is specifically used for: Based on the aligned second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code is determined.

[0119] In some embodiments, the alignment module is specifically used for: A third hint is constructed based on the first intermediate representation and the optimized second intermediate representation; wherein, the third hint includes an intermediate representation alignment strategy; The third prompt is input into the third language model, and the third language model, guided by the third prompt, aligns the global name in the optimized second intermediate representation with the global name in the first intermediate representation based on the intermediate representation alignment strategy.

[0120] In some embodiments, the determining module is specifically used for: The optimized second intermediate representation is determined as the target intermediate representation to be inspected; Perform a validity check on the intermediate representation of the target; If the target intermediate representation passes the check, the target intermediate representation is determined as a fused intermediate representation that corresponds to the target source code and can be used for intermediate representation analysis; If the target intermediate representation fails the check, a legality error message corresponding to the target intermediate representation is determined, and the first intermediate representation, the target intermediate representation, and the legality error message are re-input into the first large language model. The first large language model optimizes the target intermediate representation based on the first intermediate representation and the legality error message so that the optimized target intermediate representation is semantically equivalent to the first intermediate representation.

[0121] For ease of description, the above devices are described by dividing them into various modules or units based on their functions. Of course, when implementing one or more of these specifications, the functions of each module or unit can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0122] Based on the same concept as the methods described above, this specification also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor performs the steps of the method as described in any of the above embodiments by executing the executable instructions.

[0123] Based on the same concept as the methods described above, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0124] Based on the same concept as the methods described above, this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0125] What those skilled in the art will understand is: In this specification, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded.

[0126] In this specification, “a,” “an,” and “the” do not specifically refer to the singular, but may also include the plural.

[0127] In this specification, ordinal numbers such as "first," "second," etc., do not necessarily indicate order; they are often used to distinguish between objects. For example, "first server" and "second server" usually refer to two servers. To differentiate between these two servers, they are described as "first server" and "second server." Of course, sometimes these two servers may be the same server.

[0128] In this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can also mean indirect receiving and sending. For example, A receiving data sent by B can be understood as A directly receiving the data sent by B, or it can be understood as A indirectly receiving the data sent by B through other entities such as C. Similarly, B sending data to A can be understood as B sending the data directly to A, or it can be understood as B indirectly sending the data to A through other entities such as C. Here, C can be one entity, or it can be two or more entities.

[0129] In this specification, unless explicitly stated otherwise, the relationships between structures can be direct or indirect. For example, when describing "A is connected to B," unless it is explicitly stated that A and B are directly connected, it should be understood that A can be directly connected to B or indirectly connected to B. Similarly, when describing "A is on top of B," unless it is explicitly stated that A is directly above B (AB is adjacent and A is above B), it should be understood that A can be directly above B or indirectly above B (AB is separated by other elements, and A is above B). And so on.

[0130] This specification uses specific terms to describe embodiments thereof. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described herein, as well as the features of those different embodiments or examples, without contradiction.

[0131] Although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is only one of many possible execution orders and does not represent the only execution order. Therefore, when the claims involve method steps, any changes or adjustments to the order of such steps, or the parallelism between steps, are also within the scope of protection of the claims.

Claims

1. A method for intermediate representation fusion based on a large language model, the method comprising: Obtain a first intermediate representation and a second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code in reverse engineering. The first intermediate representation and the second intermediate representation are input into the first large language model. The first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation. Based on the optimized second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis is determined, corresponding to the target source code.

2. The method according to claim 1, wherein inputting the first intermediate representation and the second intermediate representation into a first large language model, and optimizing the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation, comprises: The first intermediate representation and the second intermediate representation are input into the first large language model. The first large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units, based on the first type of function-level units in the first intermediate representation, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

3. The method according to claim 2, further comprising: Extract a first type of function-level unit from the first intermediate representation, extract a second type of function-level unit from the second intermediate representation, and determine the function-level units whose function names match in the first type of function-level unit and the second type of function-level unit as function pairs; The function pair is input into the second largest language model, which determines whether the two function-level units in the function pair are semantically equivalent and generates semantic difference information corresponding to the function pair. The step of inputting the first intermediate representation and the second intermediate representation into a first large language model, and having the first large language model optimize the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units based on the first type of function-level units in the first intermediate representation, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation, includes: The first intermediate representation, the second intermediate representation, and the semantic difference information are input into the first large language model. The first large language model optimizes the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units based on the first type of function-level units in the first intermediate representation and the semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

4. The method according to claim 3, wherein inputting the function pair into a second large language model, determining by the second large language model whether the two function-level units in the function pair are semantically equivalent, and generating semantic difference information corresponding to the function pair, includes: A first suggestion is constructed based on the function pair; wherein, the first suggestion includes a semantic difference analysis strategy; The first prompt is input into the second language model. Guided by the first prompt, the second language model determines whether the two function-level units in the function pair are semantically equivalent based on the semantic difference analysis strategy, and generates semantic difference information corresponding to the function pair.

5. The method according to claim 3, wherein the step of inputting the first intermediate representation, the second intermediate representation, and the semantic difference information into a first large language model, and the first large language model optimizing the second type of function-level units in the second intermediate representation whose function names match the function names of the first type of function-level units based on the first type of function-level units in the first intermediate representation and the semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation, includes: A second prompt is constructed based on the first intermediate representation, the second intermediate representation, and the semantic difference information; wherein, the second prompt includes an intermediate representation optimization strategy; The second prompt is input into the first large language model. Guided by the second prompt, the first large language model optimizes the second type of function-level units in the second intermediate representation that match the function names of the first type of function-level units in the first intermediate representation, based on the intermediate representation optimization strategy and the semantic difference information, so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation.

6. The method according to claim 1, wherein determining a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code based on the optimized second intermediate representation includes: The first intermediate representation and the optimized second intermediate representation are input into the third language model, which then aligns the global names in the optimized second intermediate representation with the global names in the first intermediate representation. Based on the aligned second intermediate representation, a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code is determined.

7. The method according to claim 6, wherein inputting the first intermediate representation and the optimized second intermediate representation into a third language model, and having the third language model align the global names in the optimized second intermediate representation with the global names in the first intermediate representation, comprises: A third hint is constructed based on the first intermediate representation and the optimized second intermediate representation; wherein, the third hint includes an intermediate representation alignment strategy; The third prompt is input into the third language model, and the third language model, guided by the third prompt, aligns the global name in the optimized second intermediate representation with the global name in the first intermediate representation based on the intermediate representation alignment strategy.

8. The method according to claim 1, wherein determining a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code based on the optimized second intermediate representation includes: The optimized second intermediate representation is determined as the target intermediate representation to be inspected; Perform a validity check on the intermediate representation of the target; If the target intermediate representation passes the check, the target intermediate representation is determined as a fused intermediate representation that corresponds to the target source code and can be used for intermediate representation analysis; If the target intermediate representation fails the check, a legality error message corresponding to the target intermediate representation is determined, and the first intermediate representation, the target intermediate representation, and the legality error message are re-input into the first large language model. The first large language model optimizes the target intermediate representation based on the first intermediate representation and the legality error message so that the optimized target intermediate representation is semantically equivalent to the first intermediate representation.

9. An intermediate representation fusion device based on a large language model, the device comprising: The acquisition module acquires a first intermediate representation and a second intermediate representation corresponding to the target source code; wherein, the first intermediate representation is an intermediate representation obtained by compiling the target source code; and the second intermediate representation is an intermediate representation converted from the executable code corresponding to the target source code in reverse engineering. The fusion module inputs the first intermediate representation and the second intermediate representation into the first large language model, and the first large language model optimizes the second intermediate representation based on the first intermediate representation so that the optimized second intermediate representation is semantically equivalent to the first intermediate representation; The determination module, based on the optimized second intermediate representation, determines a fused intermediate representation that can be used for intermediate representation analysis corresponding to the target source code.

10. An electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the steps of the method as described in any one of claims 1 to 8 by executing the executable instructions.

11. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1 to 8.

12. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1 to 8.

Images