Automated semantic recovery method, system, computer device and storage medium

Abstract

The present application relates to the technical field of computer software analysis, and particularly relates to a binary program resource encapsulation mode automatic semantic recovery method and system, computer equipment and storage medium. The method comprises: loading a string mapping table, decompiling a target function in a target binary program to generate pseudo code; according to the query result and the text features of the text description, executing a preset naming strategy to generate a semantic name, and performing a global uniqueness check operation on the semantic name; applying the generated semantic name or unique name and formatted annotation to the symbol address corresponding to the data address value, and triggering an analysis tool interface refresh operation. The method solves the problems of low efficiency, high error rate, lack of consistency of results and inability to realize intelligent decision-making in the process of existing binary program static analysis, which relies on manual identification of resource encapsulation mode, extraction of resource identifiers and semantic annotation.

Description

Technical Field

[0001] This invention relates to the field of computer software analysis technology, and in particular to an automated semantic recovery method, system, computer device, and storage medium for resource encapsulation patterns in binary programs. Background Technology

[0002] This is a conventional technique used by analysts to identify and annotate specific string resource encapsulation patterns in binary programs, relying on the basic functions of disassemblers and manual operation. Specifically, analysts must manually browse the pseudocode window generated by the disassembler, visually identifying specific resource constructor call patterns based on personal experience, such as lines of code in the form `ClassName::ClassName(this, data_source, length)`. This entire process depends on the analyst's attention and experience, lacking an automated identification mechanism. After identifying the target code line, analysts must manually parse the constructor call parameters, including extracting the memory address symbol representing the data source (e.g., `byte_4080A0`) and the integer value representing the data length (e.g., `6u`), and manually calculate and jump to the actual memory address using the disassembler's address jump function. After obtaining the address and length, analysts must manually operate the disassembler's data viewing function (e.g., Hex View) to read bytes of data of a specified length starting from the specified address, and manually convert these raw bytes into hexadecimal strings as resource identifiers. Analysts need to open a separate configuration file or table (such as Text.txt) containing the mapping relationship between resource identifiers and string descriptions, outside of the disassembler. They must manually search (usually using a text search function) for the resource identifier obtained in the previous step (such as 48656C6C6F00) in the mapping table to obtain its corresponding readable string description (such as "Hello"). After obtaining the string description, the analyst needs to switch back to the disassembler and perform a series of manual operations: (a) manually locate the corresponding data address; (b) manually enter the comment content, the format of which varies from person to person; (c) if the data address needs to be renamed, the rename command must be manually executed, and a custom name (such as s_Hello) must be entered. This name usually does not have a unified naming convention and must be manually ensured not to conflict with existing names. When there are multiple similar calls in the program, the analyst must repeat all the above manual steps for each call, a tedious and error-prone process. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention proposes an automated semantic recovery method, system, computer device, and storage medium. It aims to solve the problems of low efficiency, high error rate, inconsistent results, and inability to achieve intelligent decision-making in the existing static analysis of binary programs, which relies on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation.

[0004] The technical solution proposed in this invention is: An automated semantic recovery method for resource encapsulation patterns in binary programs, the method comprising: Load a string mapping table, which contains at least one record, each record containing a resource identifier and a text description corresponding to the resource identifier; Decompile the target function in the target binary program to generate pseudocode; Using predefined matching rules, constructor call statements with address parameters and length parameters are identified in the pseudocode, and the data address value and data length value corresponding to the constructor call statement are parsed out. Based on the data address value and the data length value, extract the byte sequence of the corresponding length from the static data area of ​​the target binary program, and convert the byte sequence into a resource identifier in hexadecimal format; The resource identifier is queried in the string mapping table. If the query finds a match, the text description corresponding to the resource identifier is obtained. Based on the query results and the text features of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name; wherein, if the global uniqueness check indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or unique name and formatted annotation are applied to the symbolic address corresponding to the data address value, and the analysis tool interface is refreshed.

[0005] Furthermore, the predefined matching rules are regular expression matching rules, used to match constructor call statements in the form ClassName::ClassName(this, address parameter, length parameter).

[0006] Further, the step of executing a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and performing a global uniqueness check on the semantic name; wherein, if the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name, includes: Determine if the query results match; If the query does not find a match, a base name in the format cmd_resource identifier is generated based on the resource identifier. If the query is successful, it is further determined whether the number of spaces in the text description is less than a preset threshold. If the number of spaces is less than the preset threshold, the text description is processed to be safe characters and the str_ prefix is ​​added to generate a base name; If the number of spaces is greater than or equal to the preset threshold, the first N characters of the text description are extracted, and a basic name is generated after safe character processing. Perform the global uniqueness check operation on the generated base name.

[0007] Furthermore, the secure character processing includes: replacing non-alphanumeric characters with underscore characters, and merging multiple consecutive underscore characters into a single underscore character.

[0008] Furthermore, the global uniqueness verification operation includes: querying whether there is a defined symbol in the current namespace that is the same as the semantic name; if so, appending the hexadecimal representation of the data address value as the address suffix to the semantic name.

[0009] Furthermore, the formatted comments include: if the query is matched, the comment format is a formatted comment consisting of an ID and a corresponding description; if the query is not matched, the comment format is a suggestive comment consisting of an ID and a corresponding description.

[0010] Furthermore, the present invention also provides an automated semantic recovery system for resource encapsulation patterns in binary programs, comprising: A mapping table loading module is used to load a string mapping table, wherein the string mapping table contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier; The code analysis module is used to decompile the target functions in the target binary program and generate pseudocode; The pattern recognition module is used to identify constructor call statements with address parameters and length parameters in the pseudocode using predefined matching rules, and to parse out the data address value and data length value corresponding to the constructor call statement. The identifier extraction module is used to extract a byte sequence of corresponding length from the static data area of ​​the target binary program based on the data address value and the data length value, and convert the byte sequence into a resource identifier in hexadecimal format. The mapping query module is used to query the resource identifier in the string mapping table. If the query is successful, the text description corresponding to the resource identifier is obtained. The intelligent decision-making module is used to execute a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and to perform a global uniqueness check operation on the semantic name; wherein, if the global uniqueness check operation indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The results application module is used to apply the generated semantic name or unique name and formatted annotation to the symbol address corresponding to the data address value, and trigger the analysis tool interface refresh operation.

[0011] Furthermore, the system also includes an address resolution module, used to resolve the address parameters resolved by the pattern recognition module into actual memory address values.

[0012] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0013] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0014] According to the above technical solution, the present invention has the following beneficial effects: A string mapping table is loaded, the string mapping table containing at least one record, each record containing a resource identifier and a text description corresponding to the resource identifier; the target function in the target binary program is decompiled to generate pseudocode; using predefined matching rules, constructor call statements with address parameters and length parameters are identified in the pseudocode, and the data address value and data length value corresponding to the constructor call statement are parsed out; based on the data address value and the data length value, a byte sequence of the corresponding length is extracted from the static data area of ​​the target binary program, and the byte sequence is converted... The resource identifier is converted to hexadecimal format; the resource identifier is queried in the string mapping table. If the query finds a match, the text description corresponding to the resource identifier is obtained; based on the query result and the text characteristics of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name; if the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name; the generated semantic name or the unique name and the formatted annotation are applied to the symbol address corresponding to the data address value, and the analysis tool interface is refreshed. This solves the problems of low efficiency, high error rate, lack of consistency, and inability to achieve intelligent decision-making in the existing static analysis of binary programs, which relies on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation. Attached Figure Description

[0015] Figure 1 This is a flowchart of the automated semantic recovery method provided in the embodiments of the present invention; Figure 2 This is a functional block diagram of the automated semantic recovery system provided in the embodiments of the present invention; Figure 3 This is a schematic block diagram of the structure of a computer device provided by an embodiment of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0017] like Figure 1 As shown in the figure, this invention proposes an automated semantic recovery method for resource encapsulation patterns in binary programs, the method comprising: Step S101: Load the string mapping table, which contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier.

[0018] The mapping relationship between resource identifiers and corresponding text descriptions is read from external files or databases to construct a fast lookup dictionary in memory; the resource identifiers are hexadecimal strings and the text descriptions are human-readable strings.

[0019] Step S102: Decompile the target function in the target binary program to generate pseudocode.

[0020] The decompilation engine is used to decompile the target function in the binary program and generate pseudocode in a high-level language.

[0021] Specifically, the core controller iterates through the function addresses within the current analysis scope. For each function address, the code analysis module calls the ida_hexrays.decompile() function in the IDA Python API to obtain the decompiled object (cfuncptr) of that function, and extracts the formatted pseudocode text stream using str(cfuncptr) as input for subsequent pattern matching.

[0022] Step S103: Using predefined matching rules, identify constructor call statements with address parameters and length parameters in the pseudocode, and parse out the data address value and data length value corresponding to the constructor call statement.

[0023] The call pattern of a specific constructor in the pseudocode is automatically identified by using predefined regular expressions or abstract syntax tree matching rules. The core feature of the call pattern is that it contains two parameters: a memory address parameter pointing to resource data and an integer value parameter specifying the data length. After successful identification, the memory address and data length are parsed and extracted.

[0024] Step S104: Based on the data address value and the data length value, extract the byte sequence of the corresponding length from the static data area of ​​the target binary program, and convert the byte sequence into a resource identifier in hexadecimal format.

[0025] Based on the parsed memory address and data length, read the corresponding byte sequence from the process memory or static data area of ​​the binary program, and convert the byte sequence into a standard hexadecimal string as a resource identifier.

[0026] Specifically, the identifier extraction module, based on the parsed address value 0x004080A0 and length value 6, calls `ida_bytes.get_bytes(0x004080A0, 6)` in the IDAPython API to read the raw byte stream. Assume the raw bytes stored at this address are 48 65 6C 6C 6F 00 (corresponding to the ASCII string "Hello" with a null terminator). The module further calls the `binascii.hexlify()` function to convert this byte sequence into an uppercase hexadecimal string, i.e., the resource identifier 48656C6C6F00.

[0027] Step S105: Query the resource identifier in the string mapping table. If the query is successful, obtain the text description corresponding to the resource identifier.

[0028] The resource identifier is queried in the constructed mapping dictionary. If the query is successful, the corresponding text description is obtained; if the query fails, it is marked as "not found". Then, based on the query results and the characteristics of the text description (including length and number of spaces), intelligent decision-making is performed to generate a semantic name. If the description exists and is concise (e.g., the number of spaces is less than a preset threshold), a semantic name based on the description is generated. If the description exists but is lengthy, the description is truncated and made safe before generating a name. If the description does not exist, an identifier name based on the resource identifier is generated.

[0029] Step S106: Based on the query results and the text features of the text description, execute a preset naming strategy to generate a semantic name, and perform a global uniqueness check operation on the semantic name; wherein, if the global uniqueness check operation indicates that there is a naming conflict, then append an address suffix to the semantic name to generate a unique name.

[0030] Check if the generated semantic name already exists in the global namespace of the current binary program. If it does not exist, apply the name directly. If it exists, automatically add an address suffix (such as _401000) to ensure uniqueness. Perform a renaming operation and add the corresponding comment information to the database of the decompiler.

[0031] Step S107: Apply the generated semantic name or unique name and formatted annotation to the symbolic address corresponding to the data address value, and trigger the analysis tool interface refresh operation.

[0032] This triggers a refresh of the decompiler's user interface, allowing analysts to instantly see the updated semantic code.

[0033] This invention achieves automated identification of resource encapsulation patterns, automated extraction of resource identifiers, and intelligent decision-making for semantic annotation and renaming in binary programs. It solves the problems of low efficiency, high error rate, lack of consistency of results, and inability to achieve intelligent decision-making in the existing static analysis of binary programs, which relies on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation.

[0034] In this embodiment, the predefined matching rule is a regular expression matching rule, which is used to match constructor call statements in the form of ClassName::ClassName(this, address parameter, length parameter).

[0035] This regular expression is used to match C++-style constructor call statements, in the form of `ClassName::ClassName(this, address parameter, length parameter)`. When the pseudocode contains the statement `StringContainer::StringContainer(this, byte_4080A0, 6u);`, the regular expression engine will precisely capture it. First capture group: Class name StringContainer (used to verify matching accuracy); Second capture group: Address parameter symbol byte_4080A0; Third capture group: Length parameter value 6.

[0036] After receiving the symbol byte_4080A0, the address resolution module calls ida_name.get_name_ea(idaapi.BADADDR, “byte_4080A0”) to obtain the actual linear address value of the symbol under the binary load base address, which is recorded as 0x004080A0.

[0037] In this embodiment, the step of executing a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and performing a global uniqueness check on the semantic name; wherein, if the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name, includes: Determine if the query results match; If the query does not find a match, a base name in the format cmd_resource identifier is generated based on the resource identifier. If the query is successful, it is further determined whether the number of spaces in the text description is less than a preset threshold. If the number of spaces is less than the preset threshold, the text description is processed to be safe characters and the str_ prefix is ​​added to generate a base name; If the number of spaces is greater than or equal to the preset threshold, the first N characters of the text description are extracted, and a basic name is generated after safe character processing. Perform the global uniqueness check operation on the generated base name.

[0038] Scenario A (Query Not Hit): The intelligent decision-making module generates a base name in the format "cmd_resource identifier", such as cmd_48656C6C6F00. Scenario B (Query Hit and Concise Description): The module calculates the number of spaces in the text description. If the number of spaces is less than a preset threshold (set to 10 in this embodiment), the description is considered concise. The description text undergoes safe character processing: non-alphanumeric characters (including spaces, punctuation, etc.) are replaced with underscores "", and multiple consecutive underscores are merged into a single underscore. Then, the prefix "str" ​​is added to generate the base name. For example, for the description "Hello World Example", the processed result is str_Hello_World_Example. Scenario C (Query Hit but Long Description): If the number of spaces exceeds a preset threshold, it indicates that the description may be a long sentence, and directly using it as a symbol name might be too long. The module extracts the first N characters (e.g., the first 50 characters) of the description text, performs the above safe character processing, adds the prefix "str_", and generates the base name.

[0039] In this embodiment, the secure character processing includes: replacing non-alphanumeric characters with underscore characters, and merging multiple consecutive underscore characters into a single underscore character.

[0040] In this embodiment, the global uniqueness verification operation includes: querying whether there is a defined symbol in the current namespace that is the same as the semantic name; if so, appending the hexadecimal representation of the data address value as the address suffix to the semantic name.

[0041] The intelligent decision-making module calls `da_name.get_name_ea(idaapi.BADADDR, candidate_name)` in the IDA Python API to check if the generated candidate base name is already occupied in the current IDA database's global namespace. If the return value is equal to `idaapi.BADADDR`, it indicates that the name is available, and the candidate name is determined as the final semantic name. If the return value is not equal to `idaapi.BADADDR`, it indicates that a naming conflict exists. The module automatically extracts the hexadecimal representation of the current data address value (e.g., 0x004080A0) (removing the "0x" prefix, e.g., 4080A0) and appends it as an address suffix to the end of the base name to generate a unique name, such as `str_Hello_World_Example_4080A0`.

[0042] In this embodiment, the formatted annotation includes: if the query is matched, the annotation format is an ID and a corresponding description; if the query is not matched, the annotation format is an ID and a corresponding description.

[0043] Call ida_name.set_name(0x004080A0, final_name, idaapi.SN_CHECK) to replace the original automatically generated symbol (such as byte_4080A0) at data address 0x004080A0 with the final semantic name generated in step S106 (such as str_Hello_World_Example_4080A0).

[0044] Generate formatted comment text. If the mapping query matches, the comment format is "ID 0x{resource identifier} -> '{text description}'" (e.g., "ID 0x48656C6C6F00 -> 'Hello World Example'"); if it does not match, the comment format is "ID 0x{resource identifier} -> Not found". Call ida_bytes.set_cmt(0x004080A0, comment,False) to write the comment to the disassembled database.

[0045] Calling ida_kernwin.refresh_idaview_anyway() forces a redraw of the IDA-View and pseudocode view, so that the updated names and comments are immediately presented to the analyst.

[0046] like Figure 2 As shown, the present invention also provides an automated semantic recovery system for resource encapsulation patterns in binary programs, the system 1 comprising: The mapping table loading module 11 is used to load a string mapping table, which contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier; Code analysis module 12 is used to decompile the target functions in the target binary program and generate pseudocode; The pattern recognition module 13 is used to identify constructor call statements with address parameters and length parameters in the pseudocode using predefined matching rules, and to parse out the data address value and data length value corresponding to the constructor call statement. The identifier extraction module 14 is used to extract a byte sequence of corresponding length from the static data area of ​​the target binary program based on the data address value and the data length value, and convert the byte sequence into a resource identifier in hexadecimal format. The mapping query module 15 is used to query the resource identifier in the string mapping table. If the query is successful, the text description corresponding to the resource identifier is obtained. The intelligent decision module 16 is used to execute a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and to perform a global uniqueness check operation on the semantic name; wherein, if the global uniqueness check operation indicates that there is a naming conflict, an address suffix is ​​added to the semantic name to generate a unique name. The result application module 17 is used to apply the generated semantic name or unique name and formatted annotation to the symbol address corresponding to the data address value, and trigger the analysis tool interface refresh operation.

[0047] In this embodiment, the system is integrated into a disassembler as a plug-in. The disassembler includes, but is not limited to, IDA Pro, Ghidra, Binary Ninja, or Radare2.

[0048] In this embodiment, the system further includes an address resolution module, which is used to resolve the address parameters resolved by the pattern recognition module into actual memory address values.

[0049] This invention achieves automated identification of resource encapsulation patterns, automated extraction of resource identifiers, and intelligent decision-making for semantic annotation and renaming in binary programs. It solves the problems of low efficiency, high error rate, lack of consistency of results, and inability to achieve intelligent decision-making in the existing static analysis of binary programs, which relies on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation.

[0050] like Figure 3As shown, this embodiment of the invention also provides a computer device, which may be a server, and its internal structure may be as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data such as models for automated semantic recovery methods. The network interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an automated semantic recovery method.

[0051] The processor executes the automated semantic recovery method described above in the following steps: loading a string mapping table, wherein the string mapping table contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier; Decompile the target function in the target binary program to generate pseudocode; Using predefined matching rules, constructor call statements with address parameters and length parameters are identified in the pseudocode, and the data address value and data length value corresponding to the constructor call statement are parsed out. Based on the data address value and the data length value, extract the byte sequence of the corresponding length from the static data area of ​​the target binary program, and convert the byte sequence into a resource identifier in hexadecimal format; The resource identifier is queried in the string mapping table. If the query finds a match, the text description corresponding to the resource identifier is obtained. Based on the query results and the text features of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name; wherein, if the global uniqueness check indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or unique name and formatted annotation are applied to the symbolic address corresponding to the data address value, and the analysis tool interface is refreshed.

[0052] Those skilled in the art will understand that Figure 3 The structures shown are merely block diagrams of some structures related to the present invention and do not constitute a limitation on the computer devices on which the present invention is applied.

[0053] The computer device of this invention loads a string mapping table, which contains at least one record, each record containing a resource identifier and a text description corresponding to the resource identifier; decompiles a target function in a target binary program to generate pseudocode; uses predefined matching rules to identify constructor call statements with address parameters and length parameters in the pseudocode, and parses out the data address value and data length value corresponding to the constructor call statement; based on the data address value and the data length value, extracts a byte sequence of the corresponding length from the static data area of ​​the target binary program, and converts the byte sequence into... A resource identifier in hexadecimal format is used. The resource identifier is queried in the string mapping table. If a match is found, the corresponding text description is obtained. Based on the query result and the text characteristics of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name. If the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or the unique name, along with formatted comments, is applied to the symbolic address corresponding to the data address value, triggering a refresh operation on the analysis tool interface. This solves the problems of low efficiency, high error rate, inconsistent results, and inability to achieve intelligent decision-making in existing binary program static analysis processes that rely on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation.

[0054] An embodiment of the present invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements an automated semantic recovery method, specifically: loading a string mapping table, wherein the string mapping table contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier; Decompile the target function in the target binary program to generate pseudocode; Using predefined matching rules, constructor call statements with address parameters and length parameters are identified in the pseudocode, and the data address value and data length value corresponding to the constructor call statement are parsed out. Based on the data address value and the data length value, extract the byte sequence of the corresponding length from the static data area of ​​the target binary program, and convert the byte sequence into a resource identifier in hexadecimal format; The resource identifier is queried in the string mapping table. If the query finds a match, the text description corresponding to the resource identifier is obtained. Based on the query results and the text features of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name; wherein, if the global uniqueness check indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or unique name and formatted annotation are applied to the symbolic address corresponding to the data address value, and the analysis tool interface is refreshed.

[0055] The storage medium of this invention loads a string mapping table, which contains at least one record, each containing a resource identifier and a corresponding text description; decompiles the target function in the target binary program to generate pseudocode; uses predefined matching rules to identify constructor call statements with address and length parameters in the pseudocode, and parses out the data address value and data length value corresponding to the constructor call statement; based on the data address value and the data length value, extracts a byte sequence of the corresponding length from the static data area of ​​the target binary program, and converts the byte sequence into decimal places. A resource identifier in hexadecimal format is used. The resource identifier is queried in the string mapping table. If a match is found, the corresponding text description is obtained. Based on the query result and the text characteristics of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name. If the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or the unique name, along with formatted comments, is applied to the symbolic address corresponding to the data address value, triggering a refresh operation on the analysis tool interface. This solves the problems of low efficiency, high error rate, inconsistent results, and inability to achieve intelligent decision-making in existing binary program static analysis processes that rely on manual identification of resource encapsulation patterns, extraction of resource identifiers, and semantic annotation.

[0056] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the present invention and embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0057] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An automated semantic recovery method for resource encapsulation patterns in binary programs, characterized in that, The method includes: Load a string mapping table, which contains at least one record, each record containing a resource identifier and a text description corresponding to the resource identifier; Decompile the target function in the target binary program to generate pseudocode; Using predefined matching rules, constructor call statements with address parameters and length parameters are identified in the pseudocode, and the data address value and data length value corresponding to the constructor call statement are parsed out. Based on the data address value and the data length value, extract the byte sequence of the corresponding length from the static data area of ​​the target binary program, and convert the byte sequence into a resource identifier in hexadecimal format; The resource identifier is queried in the string mapping table. If the query finds a match, the text description corresponding to the resource identifier is obtained. Based on the query results and the text features of the text description, a preset naming strategy is executed to generate a semantic name, and a global uniqueness check is performed on the semantic name; wherein, if the global uniqueness check indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The generated semantic name or unique name and formatted annotation are applied to the symbolic address corresponding to the data address value, and the analysis tool interface is refreshed.

2. The automated semantic recovery method according to claim 1, characterized in that, The predefined matching rules are regular expression matching rules, used to match constructor call statements in the form ClassName::ClassName(this, address parameter, length parameter).

3. The automated semantic recovery method according to claim 1, characterized in that, The step of executing a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and performing a global uniqueness check on the semantic name; wherein, if the global uniqueness check indicates a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name, includes: Determine if the query results match; If the query does not find a match, a base name in the format cmd_resource identifier is generated based on the resource identifier. If the query is successful, it is further determined whether the number of spaces in the text description is less than a preset threshold. If the number of spaces is less than the preset threshold, the text description is processed to be safe and a str_ prefix is ​​added to generate a base name. If the number of spaces is greater than or equal to the preset threshold, the first N characters of the text description are extracted, and a basic name is generated after safe character processing. Perform the global uniqueness check operation on the generated base name.

4. The automated semantic recovery method according to claim 3, characterized in that, The secure character processing includes: replacing non-alphanumeric characters with underscore characters, and merging multiple consecutive underscore characters into a single underscore character.

5. The automated semantic recovery method according to claim 1, characterized in that, The global uniqueness verification operation includes: querying whether there is a defined symbol in the current namespace that is the same as the semantic name; if so, appending the hexadecimal representation of the data address value as the address suffix to the semantic name.

6. The automated semantic recovery method according to claim 1, characterized in that, The formatted comments include: if the query is matched, the comment format is an ID and a corresponding description; if the query is not matched, the comment format is an ID and a corresponding description.

7. An automated semantic recovery system for resource encapsulation patterns in binary programs, characterized in that, include: A mapping table loading module is used to load a string mapping table, wherein the string mapping table contains at least one record, and each record contains a resource identifier and a text description corresponding to the resource identifier; The code analysis module is used to decompile the target functions in the target binary program and generate pseudocode; The pattern recognition module is used to identify constructor call statements with address parameters and length parameters in the pseudocode using predefined matching rules, and to parse out the data address value and data length value corresponding to the constructor call statement. The identifier extraction module is used to extract a byte sequence of corresponding length from the static data area of ​​the target binary program based on the data address value and the data length value, and convert the byte sequence into a resource identifier in hexadecimal format. The mapping query module is used to query the resource identifier in the string mapping table. If the query is successful, the text description corresponding to the resource identifier is obtained. The intelligent decision-making module is used to execute a preset naming strategy to generate a semantic name based on the query results and the text features of the text description, and to perform a global uniqueness check operation on the semantic name; wherein, if the global uniqueness check operation indicates that there is a naming conflict, an address suffix is ​​appended to the semantic name to generate a unique name. The results application module is used to apply the generated semantic name or unique name and formatted annotation to the symbol address corresponding to the data address value, and trigger the analysis tool interface refresh operation.

8. The automated semantic recovery system according to claim 7, characterized in that, The system also includes an address resolution module, which is used to resolve the address parameters resolved by the pattern recognition module into actual memory address values.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images