Method and device for restoring c++ class structure in binary file

Abstract

The application provides a C++ class structure recovery method and device in a binary file, and the method comprises the following steps: for a candidate function in a binary file to be recovered, constructing an intra-process object flow graph corresponding to the function based on operation instructions of candidate object-related variables in the candidate function; constructing an object flow graph corresponding to the binary file to be recovered based on the intra-process object flow graphs and a call graph of the binary file to be recovered; determining life cycle member functions in the binary file to be recovered based on the object flow graph; and obtaining a C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and the life cycle member functions. The application can effectively recover non-polymorphic classes in real binary files, greatly improves the integrity of class recovery, and is suitable for binary files of two major operating systems, Linux and Windows, under the x86-64 architecture.

Description

Technical Field

[0001] This invention relates to the field of computer software reverse engineering technology, and in particular to a method and apparatus for restoring C++ class structures in binary files. Background Technology

[0002] C++, a widely used programming language in software engineering, supports object-oriented programming through its class mechanism, enabling the encapsulation of data and operations. However, after compilation and the removal of symbolic information, the class structure, object lifecycle, and object access semantics in the original code are lost. Recovering C++ class information from symbol-removed binary files is crucial for security tasks such as vulnerability analysis, malware understanding, and decompiler output optimization.

[0003] Existing binary class recovery methods are mainly based on virtual function tables and virtual function table pointers. These methods have the following drawbacks: Recovering polymorphic classes based on virtual function tables and pointers is ineffective for non-polymorphic classes that do not contain virtual functions, severely impacting the performance of downstream tasks; existing virtual function table-based methods are typically optimized for specific application binary interfaces, limiting their applicability in cross-platform and cross-compiler scenarios; and backtracking reasoning based on logic programming languages ​​suffers from search space explosion on large-scale binary files, resulting in extremely low runtime efficiency. Summary of the Invention

[0004] This invention provides a method and apparatus for restoring C++ class structures in binary files. It addresses the shortcomings of existing methods that rely on virtual function tables and pointers to restore polymorphic classes, which are ineffective for non-polymorphic classes without virtual functions, severely impacting downstream task performance. Furthermore, existing virtual function table-based methods are typically optimized for specific application binary interfaces, limiting their applicability across platforms and compilers. Backtracking reasoning based on logic programming languages ​​suffers from search space explosion on large-scale binary files, resulting in extremely low efficiency. This invention uses lifecycle member functions as reliable anchors for class identification, eliminating the need for virtual function tables. It effectively restores non-polymorphic classes in the actual binary file, significantly improving the completeness of class restoration. Moreover, the object flow graph construction and class component restoration processes do not rely on specific calling conventions or application binary interfaces. It also supports both Itanium ABI and MSVC ABI, two mainstream application binary interfaces, and is suitable for binary files of Linux and Windows operating systems under the x86-64 architecture.

[0005] This invention provides a method for restoring C++ class structures in binary files, comprising the following steps: For candidate functions in the binary file to be recovered, an in-process object flow graph corresponding to the candidate function is constructed based on the operation instructions of the candidate object-related variables in the candidate function; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; Based on the object flow graphs within each process and the call graph of the binary file to be recovered, construct the object flow graph corresponding to the binary file to be recovered; Based on the object flow graph, determine the lifecycle member functions in the binary file to be recovered; Based on the object flow graph and each of the lifecycle member functions, the C++ class structure recovery result corresponding to the binary file to be recovered is obtained.

[0006] According to a method for restoring C++ class structures in a binary file provided by the present invention, the step of constructing an object flow graph corresponding to the binary file to be restored based on the object flow graphs within each process and the call graph of the binary file to be restored includes: determining a first group of candidate lifetime member functions from all candidate functions based on a first function verification rule; the first group of candidate lifetime member functions includes multiple first candidate lifetime member functions; constructing a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifetime member functions, wherein the reverse flow is used to characterize the direction from the first candidate lifetime member function to the caller of the first candidate lifetime member function; and constructing the object flow graph based on the forward flow of the call graph and the reverse object flow graph, wherein the forward flow is used to characterize the direction from the first group of candidate lifetime member functions to the called function of the first group of candidate lifetime member functions.

[0007] According to a method for restoring C++ class structures in a binary file provided by the present invention, the step of constructing a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions includes: determining the caller of the first candidate lifecycle member function based on the call graph; determining the specific object that the caller of the first candidate lifecycle member function and the first candidate lifecycle member function both point to based on the object variable identifier corresponding to the caller of the first candidate lifecycle member function; and constructing the reverse object flow graph based on the specific object, the object flow graphs within each process, and the first group of candidate lifecycle member functions.

[0008] According to a method for restoring C++ class structures in a binary file provided by the present invention, the step of constructing the object flow graph based on the forward flow of the call graph and the reverse object flow graph includes: determining a second group of candidate lifecycle member functions from a first group of candidate lifecycle member functions based on a second function verification rule; the second group of candidate lifecycle member functions includes multiple second candidate lifecycle member functions; determining the called function corresponding to the second candidate lifecycle member function based on the forward flow of the call graph; and constructing the object flow graph based on the called function, the second group of candidate lifecycle member functions, and the reverse object flow graph.

[0009] According to a method for restoring C++ class structures in a binary file provided by the present invention, the step of determining the lifecycle member functions in the binary file to be restored based on the object flow graph includes: verifying a second group of candidate lifecycle member functions in the object flow graph based on lifecycle verification rules to obtain a first lifecycle member function; determining candidate destructors based on the object flow graph; determining a second lifecycle member function based on the memory release operations of the candidate destructors on candidate objects; and / or performing semantic detection on the external function names called by the candidate destructors based on a large language model to obtain a second lifecycle member function; and determining the lifecycle member function based on the first lifecycle member function and the second lifecycle member function.

[0010] According to a method for restoring C++ class structure in a binary file provided by the present invention, the step of obtaining the C++ class structure restoration result corresponding to the binary file to be restored based on the object flow graph and each of the lifecycle member functions includes: determining candidate classes corresponding to each of the lifecycle member functions based on the object flow graph; restoring the class attributes and ordinary member functions of each of the candidate classes based on the object flow graph; determining the static structural relationship between each of the candidate classes, and obtaining the C++ class structure restoration result corresponding to the binary file to be restored based on the class attributes, the ordinary member functions, and the static structural relationship.

[0011] According to a method for restoring C++ class structure in a binary file provided by the present invention, determining the static structural relationship between the candidate classes includes: determining a first group of target lifecycle member functions from all the lifecycle member functions based on virtual function pointers; the first group of target lifecycle member functions includes multiple first target lifecycle member functions; determining a first static structural relationship between the classes corresponding to each first target lifecycle member function based on the virtual function pointers corresponding to each first target lifecycle member function; determining a second static structural relationship between the classes corresponding to a second group of target lifecycle member functions in all the lifecycle member functions; and determining the static structural relationship between the candidate classes based on the first static structural relationship and the second static structural relationship.

[0012] According to a method for restoring C++ class structure in a binary file provided by the present invention, determining the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions includes: determining the third static structural relationship between the classes corresponding to each second target lifecycle member function based on the initialization time point of the member variables in each second target lifecycle member function in the second group of target lifecycle member functions; if there are candidate second target lifecycle member functions in the second group of target lifecycle member functions for which the third static structural relationship is not identified, inputting each candidate second target lifecycle member function and a prompt word for judging the static structural relationship into a large language model to obtain the fourth static structural relationship between the classes corresponding to each candidate second target lifecycle member function; and determining the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions based on the third static structural relationship and the fourth static structural relationship.

[0013] According to the present invention, a method for restoring C++ class structures in a binary file further includes: caching the analysis results corresponding to the callers of the first candidate lifecycle member functions; and directly determining the specific object based on the analysis results when different first candidate lifecycle member functions have the same caller.

[0014] According to the present invention, a method for restoring C++ class structures in a binary file includes a lifecycle member function comprising a constructor and a destructor. The method further includes: locating the constructor of a global object in the binary file to be restored based on the initialization function call chain of the tracing program; establishing a matching relationship between the global object and the destructor registered by the global object based on function call behavior; and tracing the constructor and the destructor.

[0015] The present invention also provides a device for restoring C++ class structures in binary files, comprising the following modules: The first construction module is used to construct an in-process object flow graph corresponding to a candidate function in a binary file to be recovered, based on the operation instructions of the candidate object-related variables in the candidate function; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; The second construction module is used to construct an object flow graph corresponding to the binary file to be recovered based on the object flow graphs in each process and the call graph of the binary file to be recovered. The determination module is used to determine the lifecycle member functions in the binary file to be recovered based on the object flow graph; The recovery module is used to obtain the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions.

[0016] According to the C++ class structure recovery device in a binary file provided by the present invention, the second construction module includes a selection unit, a first construction unit, and a second construction unit: the selection unit is used to determine a first group of candidate lifecycle member functions from all the candidate functions based on a first function verification rule; the first group of candidate lifecycle member functions includes multiple first candidate lifecycle member functions; the first construction unit is used to construct a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions, wherein the reverse flow is used to characterize the direction from the first candidate lifecycle member function to the caller of the first candidate lifecycle member function; the second construction unit is used to construct the object flow graph based on the forward flow of the call graph and the reverse object flow graph, wherein the forward flow is used to characterize the direction from the first group of candidate lifecycle member functions to the called function of the first group of candidate lifecycle member functions.

[0017] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the C++ class structure recovery method in the binary file as described above.

[0018] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the C++ class structure restoration method in a binary file as described above.

[0019] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the C++ class structure restoration method in a binary file as described above.

[0020] This invention provides a method and apparatus for restoring C++ class structures in a binary file. The method involves constructing an in-process object flow graph corresponding to a candidate function in the binary file to be restored, based on the operation instructions of candidate object-related variables within the candidate function. The candidate object-related variables are used to characterize the function's first parameter and / or global object variables. Based on each in-process object flow graph and the call graph of the binary file to be restored, an object flow graph corresponding to the binary file to be restored is constructed. Based on the object flow graph, lifecycle member functions in the binary file to be restored are determined. Based on the object flow graph and each lifecycle member function, the C++ class structure restoration result corresponding to the binary file to be restored is obtained. In this way, by constructing object flow graphs through the in-process object flow graphs and call graphs of each function, the lifecycle member functions in the object flow graphs can be identified. Using lifecycle member functions as reliable anchor points for identifying the existence of classes, without relying on virtual function tables, non-polymorphic classes occupying real binary files can be effectively recovered, greatly improving the completeness of class recovery. Furthermore, the object flow graph construction and class component recovery process does not rely on specific calling conventions or application binary interfaces, and supports two mainstream application binary interfaces, Itanium ABI and MSVC ABI, which are suitable for binary files of the two major operating systems, Linux and Windows, under the x86-64 architecture. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the method for restoring C++ class structures in binary files provided by this invention.

[0023] Figure 2 This is a schematic diagram of the architecture of the binary file recovery system provided by the present invention.

[0024] Figure 3 This is a flowchart illustrating the C++ class structure restoration device in a binary file provided by the present invention.

[0025] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] Existing methods for restoring virtual function tables and virtual function table pointers mainly suffer from the following drawbacks: (1) Difficulty in recovering non-polymorphic classes. Most existing methods rely on virtual function tables and virtual function table pointers to recover polymorphic classes, but are helpless with non-polymorphic classes that do not contain virtual functions. However, empirical studies have found that non-polymorphic classes account for an average of 92.8% of the total number of classes in real binary files, and ignoring the recovery of non-polymorphic classes will seriously affect the performance of downstream tasks.

[0028] (2) Limited applicability to real binary files. Existing methods based on virtual function tables are usually optimized for specific application binary interfaces, and their applicability is limited in cross-platform and cross-compiler scenarios. For example, the recovery effect of dynamic analysis methods is limited by the coverage of test cases; the most advanced static analysis methods currently only support x86 architecture binary files generated by Microsoft C++ compilers, and their backtracking inference based on logic programming languages ​​suffers from search space explosion on large-scale binary files, resulting in extremely low running efficiency.

[0029] Furthermore, existing methods typically employ empirical rules based on offsets to determine inheritance and composition relationships. Specifically, if an object is passed to the internal constructor with a zero offset, it is considered inheritance; otherwise, it is considered composition. However, empirical data shows that in real binary files, member objects are located at the beginning of the host class layout (zero offset). This makes offset-based rules highly unreliable, frequently leading to incorrect determinations of inheritance and composition, and reducing the accuracy of restoring the semantics of the original program.

[0030] To address the aforementioned problems, this invention provides a method for restoring C++ class structures in binary files. It constructs an object flow graph by integrating the in-process object flow graph and call graph of each function, thereby identifying lifecycle member functions within the object flow graph. These lifecycle member functions serve as reliable anchor points for class identification, eliminating the need for virtual function tables. This method effectively restores non-polymorphic classes from the actual binary file, significantly improving the completeness of class restoration. Furthermore, the object flow graph construction and class component restoration process does not rely on specific calling conventions or application binary interfaces. It also supports two mainstream application binary interfaces, Itanium ABI and MSVCABI, and is applicable to binary files from both Linux and Windows operating systems under the x86-64 architecture.

[0031] The following is combined with Figures 1 to 2 This invention describes a method for restoring C++ class structures in binary files. The execution subject of this method can be an electronic device or a C++ class structure restoration device in binary files installed in the electronic device. The C++ class structure restoration device in binary files can be implemented by software, hardware, or a combination of both.

[0032] Figure 1 This is a flowchart illustrating the C++ class structure recovery method in a binary file provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: Step 101: For the candidate functions in the binary file to be recovered, construct the in-process object flow graph corresponding to the candidate functions based on the operation instructions of the candidate object related variables in the candidate functions.

[0033] The candidate object-related variables are used to characterize the first parameter of the function and / or global object variables.

[0034] Here, the binary file to be recovered can be a binary file without debugging information.

[0035] It should be noted that the in-process object flow graph is used to represent the access instructions of functions. The in-process object flow graph contains nodes and edges. Nodes are used to represent functions and other interactive objects, such as variable nodes and constant nodes; edges are used to represent operation instructions, such as arithmetic, memory, move, call, jump, virtual storage, etc.

[0036] For example, the binary file to be recovered contains multiple functions, and the first parameter of each function corresponds to multiple instructions. Therefore, each function has its own corresponding in-process object flow graph.

[0037] Before constructing the object flow graph during the process, the memory alignment address of the read-only data segment in the binary file to be restored can be scanned to identify virtual function table candidates and verify whether they are referenced by the code segment and whether they are subsequent consecutive function pointers, thereby locating the virtual function table of the polymorphic class.

[0038] Step 102: Based on the object flow graphs within each process and the call graph of the binary file to be recovered, construct the object flow graph corresponding to the binary file to be recovered.

[0039] Here, the call graph is used to represent the call relationships between functions and can be obtained from the binary file to be recovered.

[0040] Here, the object flow graph is used to represent the various relationships in the binary file to be recovered. In other words, the object flow graph is another representation of the binary file to be recovered.

[0041] It should be noted that the object flow graph can be constructed directly from the call graph; or it can be constructed by first calling the reverse object flow graph based on the call graph, and then constructing the forward object flow graph based on the reverse object flow graph.

[0042] Further, the step of constructing the object flow graph corresponding to the binary file to be recovered based on the object flow graphs within each process and the call graph of the binary file to be recovered includes: determining a first group of candidate lifecycle member functions from all the candidate functions based on a first function verification rule; the first group of candidate lifecycle member functions includes multiple first candidate lifecycle member functions; constructing a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions, wherein the reverse flow is used to characterize the direction from the first candidate lifecycle member function to the caller of the first candidate lifecycle member function; and constructing the object flow graph based on the forward flow of the call graph and the reverse object flow graph, wherein the forward flow is used to characterize the direction from the first group of candidate lifecycle member functions to the called function of the first group of candidate lifecycle member functions.

[0043] Here, the first group of candidate lifecycle member functions may include constructors or destructors. The first function verification rules may include at least one of the following: load-before-store rule, use-before-call rule, and use-before-call rule.

[0044] For example, the load-before-store rule means that if the member variables of a candidate object in a candidate function are read before they are initialized, then the candidate function does not meet the characteristics of a constructor function; the use-before-call rule is used to determine whether an object has been used before the constructor function is called, and the use-after-call rule is used to determine whether an object is still used after the destructor function is called.

[0045] Here, reverse flow refers to the direction from the callee to the caller, while forward flow refers to the direction from the caller to the callee.

[0046] Here, the caller of the first candidate lifecycle member function refers to the function that calls the first candidate lifecycle member function, and the callee of the first group of candidate lifecycle member functions refers to the function that is called by the first candidate lifecycle member function.

[0047] For example, starting from the first candidate lifecycle member function, trace the caller upwards along the reverse flow of the call graph to construct a reverse object flow graph. Then, along the forward flow of the call graph, start checking downwards whether the candidate lifecycle member function is passed to the called function, and recursively construct the forward object flow graph until the object no longer participates in any calls, thus obtaining the object flow graph.

[0048] It should be noted that when constructing an object flow graph, you can start from the candidate lifecycle member functions in the reverse object flow graph, or you can start from ordinary functions.

[0049] In this embodiment of the invention, starting from the candidate lifecycle member function, the caller is traced upwards along the call graph in reverse to construct a reverse object flow graph. The reverse object flow graph is then constructed in reverse along the call graph. To address the issue of insufficient context caused by recursive function calls, sufficient context is obtained by recursively tracing along the call graph and data flow to the initial definition point of the object to complete the verification.

[0050] Furthermore, constructing the reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions includes: determining the caller of the first candidate lifecycle member function based on the call graph; determining the specific object that the caller of the first candidate lifecycle member function and the first candidate lifecycle member function both point to based on the object variable identifier corresponding to the caller of the first candidate lifecycle member function; and constructing the reverse object flow graph based on the specific object, the object flow graphs within each process, and the first group of candidate lifecycle member functions.

[0051] Here, object variable identifiers refer to variables, pointer symbols, and memory identifiers that store the memory addresses of global / static objects.

[0052] It should be noted that the first candidate lifecycle member function and the caller of the first candidate lifecycle member function may use the same parameter, but the name of the parameter may be different in the two functions. Therefore, it is necessary to determine whether the object variable identifier corresponding to the caller of the first candidate lifecycle member function is the same as the specific object of the first candidate lifecycle member function. Then, based on the specific object, the object flow graph in each process, and the first group of candidate lifecycle member functions, a reverse object flow graph is constructed.

[0053] In this embodiment of the invention, the object variable identifiers at the call point are analyzed to construct a reverse object flow graph, thereby improving the accuracy of the reverse object flow graph.

[0054] Furthermore, constructing the object flow graph based on the forward flow of the call graph and the reverse object flow graph includes: determining a second group of candidate lifecycle member functions from the first group of candidate lifecycle member functions based on the second function verification rules; the second group of candidate lifecycle member functions includes multiple second candidate lifecycle member functions; determining the called function corresponding to the second candidate lifecycle member function based on the forward flow of the call graph; and constructing the object flow graph based on the called function, the second group of candidate lifecycle member functions, and the reverse object flow graph.

[0055] Here, the second function verification rule can be used before or after the call. For constructors, the rule is used before the call to determine if an object already exists before the constructor is called, then the function should not be identified as a constructor. For destructors, the rule is used after the call to determine if an object exists after the destructor is called, then the function should not be identified as a destructor.

[0056] For example, after identifying the second group of candidate lifecycle member functions using rules before or after the call, the called function corresponding to each second candidate lifecycle member function is determined according to the forward flow of the call graph; starting from each second candidate lifecycle member function, a forward object flow graph is recursively constructed until the object no longer participates in any calls, thus obtaining the object flow graph.

[0057] In this embodiment of the invention, the first group of candidate lifecycle member functions are further verified by the second function verification rule, and an object flow graph is constructed based on the second group of candidate lifecycle member functions to improve the accuracy of the object flow graph and the accuracy of the lifecycle member functions.

[0058] Step 103: Based on the object flow graph, determine the lifecycle member functions in the binary file to be recovered.

[0059] Here, the lifecycle member function can be the target constructor or the target destructor, and the lifecycle member function can be determined according to the read / write rules or the calling rules.

[0060] In this embodiment of the invention, an object flow graph is constructed by using the in-process object flow graph and call graph of each function, thereby identifying lifecycle member functions in the object flow graph. Using lifecycle member functions as reliable anchor points for identifying the existence of classes, without relying on virtual function tables, it can effectively recover non-polymorphic classes in the real binary file, greatly improving the completeness of class recovery. Furthermore, the object flow graph construction and class component recovery process does not rely on specific calling conventions or application binary interfaces, and supports two mainstream application binary interfaces, Itanium ABI and MSVC ABI, which are suitable for binary files of the two major operating systems, Linux and Windows, under the x86-64 architecture.

[0061] Further, determining the lifecycle member functions in the binary file to be recovered based on the object flow graph includes: verifying the second group of candidate lifecycle member functions in the object flow graph based on lifecycle verification rules to obtain a first lifecycle member function; determining candidate destructors based on the object flow graph; determining a second lifecycle member function based on the memory release operations of the candidate destructors on the candidate objects; and / or performing semantic detection on the external function names called by the candidate destructors based on a large language model to obtain a second lifecycle member function; and determining the lifecycle member function based on the first lifecycle member function and the second lifecycle member function.

[0062] Here, the lifecycle verification rules include at least one of the following: load-before-store rule, use-before-call rule, use-after-call rule, and memory release semantic detection. The load-before-store rule is used to verify the constructor, the use-before-call rule is used to verify the constructor, and the use-after-call rule and memory release semantic detection are used to verify the destructor.

[0063] Here, the second lifetime member function can be a destructor. If the destructor cannot be determined using read-write rules, a large language model can be used to analyze the semantics of the external function names in the object flow graph to identify functions with memory release semantics, thereby obtaining the destructor.

[0064] For example, there can be one or more first lifecycle member functions and second lifecycle member functions, where each lifecycle member function corresponds to an object.

[0065] After obtaining the lifecycle member functions, the class's member attributes (offsets and types) and ordinary member functions can be restored based on the verified lifecycle member functions.

[0066] In this embodiment of the invention, starting from the lifecycle member functions verified by reverse analysis, it checks whether candidate objects are passed to the called function, and recursively constructs a forward object flow graph until the object no longer participates in any calls. In the forward analysis, read-write rules are further applied to verify the constructor, and the semantics of the external function name are analyzed using a large language model to identify functions with memory release semantics, thereby solving the problem of difficulty in tracking resource release by destructors through external functions.

[0067] Step 104: Based on the object flow graph and each of the lifecycle member functions, obtain the C++ class structure recovery result corresponding to the binary file to be recovered.

[0068] Here, restoration can include the restoration of class attributes, the restoration of ordinary member functions, and the restoration of relationships between classes.

[0069] For example, inter-class relationships can be restored based on virtual function pointers, initialization order, or large language models.

[0070] Furthermore, obtaining the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions includes: determining the candidate classes corresponding to each of the lifecycle member functions based on the object flow graph and each of the lifecycle member functions; recovering the class attributes and ordinary member functions of each of the candidate classes based on the object flow graph; determining the static structural relationship between each of the candidate classes, and obtaining the C++ class structure recovery result corresponding to the binary file to be recovered based on the class attributes, the ordinary member functions and the static structural relationship.

[0071] It should be noted that one lifecycle member function corresponds to one class.

[0072] Here, static structural relationships can include inheritance or composition relationships.

[0073] Here, the class corresponding to the lifecycle member function may be a polymorphic class or a non-polymorphic class.

[0074] For example, based on class attributes, ordinary member functions, and inheritance or composition relationships, the C++ class structure recovery result corresponding to the binary file to be recovered is obtained.

[0075] In this embodiment of the invention, lifecycle member functions are used as reliable anchors to identify the existence of classes. Without relying on virtual function tables, non-polymorphic classes occupying real binary files can be effectively recovered, greatly improving the completeness of class recovery.

[0076] Further, determining the static structural relationship between each of the candidate classes includes: determining a first group of target lifecycle member functions from all the lifecycle member functions based on virtual function pointers; the first group of target lifecycle member functions includes multiple first target lifecycle member functions; determining a first static structural relationship between the classes corresponding to each first target lifecycle member function based on the virtual function pointers corresponding to each first target lifecycle member function; determining a second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions; and determining the static structural relationship between each of the candidate classes based on the first static structural relationship and the second static structural relationship.

[0077] Here, the first group of target lifecycle member functions can be understood as a polymorphic class with virtual function pointers.

[0078] For example, after identifying a polymorphic class with virtual function pointers, inheritance and composition are distinguished based on the strict semantic constraints of virtual function pointer assignment in the polymorphic class constructor. If the virtual function pointer set by the inner constructor is overridden by the outer constructor, it is determined to be an inheritance relationship; otherwise, it is a composition relationship. That is, if the virtual function pointer of the class corresponding to the first constructor is overridden by the virtual function pointer of the class corresponding to the second constructor, the class corresponding to the first constructor and the class corresponding to the second constructor are in an inheritance relationship; otherwise, it is a composition relationship.

[0079] In another example, if one constructor corresponds to a polymorphic class and the other constructor corresponds to a non-polymorphic class, and the non-polymorphic class is called before the recognized polymorphic base class constructor, then it is determined to be a base class relationship, i.e., an inheritance relationship.

[0080] Here, the first group of target lifecycle member functions and the second group of target lifecycle member functions can have the same or different functions.

[0081] Here, the second group of target lifecycle member functions are functions whose inter-class relationships cannot be determined through virtual function pointers.

[0082] After determining the first static structural relationship between the classes corresponding to the first set of target lifecycle member functions, a second set of target lifecycle member functions is determined. The classes corresponding to the second set of target lifecycle member functions are then identified to obtain the second static structural relationship. Based on the first and second static structural relationships, the static structural relationships between each class are determined.

[0083] In this embodiment of the invention, the static structural relationship is first determined by using virtual function pointers, and then the static structural relationship of the class corresponding to the remaining lifetime member functions is further determined. The method of systematically distinguishing the inheritance and composition relationships between polymorphic and non-polymorphic classes through a progressive framework completely solves the relationship confusion problem caused by offset rules in existing methods.

[0084] Further, determining the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions includes: determining the third static structural relationship between the classes corresponding to each second target lifecycle member function based on the initialization time point of the member variables in each second target lifecycle member function in the second group of target lifecycle member functions; if there are candidate second target lifecycle member functions in the second group of target lifecycle member functions for which the third static structural relationship has not been identified, inputting each candidate second target lifecycle member function and the prompt word for judging the static structural relationship into the large language model to obtain the fourth static structural relationship between the classes corresponding to each candidate second target lifecycle member function; and determining the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions based on the third static structural relationship and the fourth static structural relationship.

[0085] It should be noted that the initialization order of member variables can be obtained based on the initialization time of the member variables. According to the C++ standard, a derived class must complete the initialization of all base classes before initializing its own member variables. With this initialization time as the boundary, constructor calls that occur after this time are determined to be composition relationships.

[0086] Here, the candidate second target lifecycle member function refers to the function that cannot determine the class relationship. The candidate second target lifecycle function and the prompt words for determining the static structural relationship are input into the large language model to obtain the fourth static structural relationship between the classes corresponding to the candidate second target lifecycle member function.

[0087] Here, the prompts for determining static structural relationships include task instructions, context learning examples, retyped decompiled code, and class metadata.

[0088] It should be noted that for non-polymorphic class relationships that cannot be determined by static analysis, the code understanding capabilities of the large language model are utilized. By judging the clues of static structural relationships, the large language model is guided to analyze the semantic patterns in the constructors of outer and inner classes to infer their relationships. To mitigate the randomness of the generative model, a majority voting mechanism is employed, such as independent reasoning three times to determine the final result. Simultaneously, a consistency monitor is introduced to check the logical consistency of the reasoning results according to the C++ standard. If a contradiction arises where composition relationships precede inheritance relationships, the erroneous context is fed back to the model for a second round of reasoning.

[0089] For example, after determining the third static structural relationship and the fourth static structural relationship, the third static structural relationship and the fourth static structural relationship are combined to obtain the second static structural relationship between the classes corresponding to the second set of target lifecycle member functions.

[0090] In this embodiment of the invention, deterministic static analysis is combined with the semantic understanding capabilities of a large language model to fully leverage their respective advantages. The large language model is only used to handle boundary cases that cannot be determined by static analysis, and a consistency monitor constrains the output of the large language model, effectively suppressing illusions and ensuring the reliability of the reasoning results.

[0091] Furthermore, the method also includes: caching the analysis results corresponding to the callers of the first candidate lifecycle member functions; and, in the case where different first candidate lifecycle member functions have the same callers, directly determining the specific object based on the analysis results.

[0092] Here, after analyzing the caller of the first candidate lifecycle member function, the analysis results are cached. If other first candidate lifecycle member functions have the same caller, the specific object can be determined directly based on the cached analysis results.

[0093] In this embodiment of the invention, by caching and reusing the analysis results of the same combination of (caller, call point variables), the time overhead of cross-process analysis is significantly reduced by taking advantage of context insensitivity, thereby improving the efficiency of cross-process graph analysis and avoiding state space explosion.

[0094] Furthermore, the lifecycle member functions include constructors and destructors, and the method further includes: locating the constructor of the global object in the binary file to be recovered based on the initialization function call chain of the tracing program; establishing a matching relationship between the global object and the destructor registered by the global object based on function call behavior; and tracing the constructor and the destructor.

[0095] It should be noted that, for global objects (whose constructors run before the main function), the constructors of the global objects in the binary file to be restored are located based on the initialization function call chain of the tracing program; a matching relationship is established between the global object and the destructor registered by the global object based on the function call behavior; and the constructors and destructors are traced.

[0096] For example, in the Itanium ABI, the global object constructor is located by tracing the initialization function call chain in the `.init_array` section, and the global object is matched with its registered destructors by recording `_cxa_atexit` calls. In the MSVC ABI, this is done via the `.CRT` section. The XCU section and the atexit mechanism perform similar tracing, enabling unified cross-platform processing of global objects.

[0097] In this embodiment of the invention, cross-platform unified processing of global objects is achieved by tracing the constructors and destructors of global objects.

[0098] Figure 2 This is a schematic diagram of the architecture of the binary file recovery system provided by the present invention, as shown below. Figure 2 As shown, the binary file recovery system comprises two phases: Phase 1 and Phase 2. Phase 1 is object flow graph-driven class recovery, including in-process graph analysis, backward inter-process graph analysis, and forward inter-process graph analysis, used to construct the object flow graph and recover class components. Phase 2 is progressive class relationship recovery, including virtual function pointer-based routers, initialization order-based routers, large language model-based reasoning, rule-based consistency checks, and reconstructed class relationships. Specifically, after a binary file without debugging information is input into Phase 1, in-process graph analysis is first performed on candidate functions to obtain an in-process object flow graph; then, backward inter-process graph analysis is performed in conjunction with the call graph to obtain a reverse object flow graph; subsequently, forward inter-process graph analysis is performed based on the reverse object flow graph to obtain a complete object flow graph, which is used to identify lifecycle member functions, class attributes, and ordinary member functions. In Phase 2, the object flow graph is input into a router based on virtual function pointers to obtain the first static structural relationship; the classes corresponding to unidentified lifecycle member functions are input into a router based on initialization order to obtain the third static structural relationship; the classes corresponding to still unidentified lifecycle member functions are input into an inference module based on a large language model to obtain the fourth static structural relationship. Rule-based consistency checks are then used to verify the fourth static structural relationship. Finally, the reconstructed class relationships are obtained based on the first, third, and verified fourth static structural relationships. For example, Figure 2 C and B in the class are parent classes of A. Based on the reconstructed class relationships and the restored class components, the restored class is obtained.

[0099] In malware analysis scenarios, this invention can recover class structures from the binary files of ransomware such as WannaCry and LockBit, restoring object lifecycles and access semantics, providing crucial support for understanding the organization and implementation logic of malicious behavior. In vulnerability analysis scenarios, the class information recovered by this system can be used to identify anomalies in object construction and destruction processes, assisting in the detection of memory safety vulnerabilities such as use-after-release. In decompiler optimization scenarios, the class structures output by this system can be re-injected into decompiled code through application programming interfaces provided by existing mainstream disassemblers, improving the readability of the decompiled output and providing richer semantic information for understanding large language models.

[0100] The following describes the C++ class structure recovery device in binary files provided by the present invention. The C++ class structure recovery device in binary files described below can be referred to in correspondence with the C++ class structure recovery method in binary files described above.

[0101] Figure 3 This is a schematic diagram of the C++ class structure recovery device in a binary file provided by the present invention, as shown below. Figure 3 As shown, the C++ class structure restoration device 300 in the binary file includes: The first construction module 310 is used to construct an in-process object flow graph corresponding to a candidate function based on the operation instructions of the candidate object-related variables in the candidate function for the candidate function in the binary file to be recovered; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; The second construction module 320 is used to construct an object flow graph corresponding to the binary file to be recovered based on the object flow graphs in each process and the call graph of the binary file to be recovered. The determination module 330 is used to determine the lifecycle member functions in the binary file to be recovered based on the object flow graph; Recovery module 340 is used to obtain the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions.

[0102] In this embodiment of the invention, the second construction module includes a selection unit, a first construction unit, and a second construction unit: the selection unit is used to determine a first group of candidate lifecycle member functions from all the candidate functions based on a first function verification rule; the first group of candidate lifecycle member functions includes multiple first candidate lifecycle member functions; the first construction unit is used to construct a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions, wherein the reverse flow is used to characterize the direction from the first candidate lifecycle member function to the caller of the first candidate lifecycle member function; the second construction unit is used to construct the object flow graph based on the forward flow of the call graph and the reverse object flow graph, wherein the forward flow is used to characterize the direction from the first group of candidate lifecycle member functions to the called function of the first group of candidate lifecycle member functions.

[0103] In this embodiment of the invention, the first construction unit is specifically used for: determining the caller of the first candidate lifecycle member function based on the call graph; determining the specific object that the caller of the first candidate lifecycle member function and the first candidate lifecycle member function both point to based on the object variable identifier corresponding to the caller of the first candidate lifecycle member function; and constructing the reverse object flow graph based on the specific object, the in-process object flow graphs of each of the above and the first group of candidate lifecycle member functions.

[0104] In this embodiment of the invention, the second construction unit is specifically used for: determining a second group of candidate lifecycle member functions from the first group of candidate lifecycle member functions based on the second function verification rules; the second group of candidate lifecycle member functions includes multiple second candidate lifecycle member functions; determining the called function corresponding to the second candidate lifecycle member function based on the forward flow of the call graph; and constructing an object flow graph based on the called function, the second group of candidate lifecycle member functions, and the reverse object flow graph.

[0105] In this embodiment of the invention, the determining module 330 is specifically configured to: verify the second group of candidate lifecycle member functions in the object flow graph based on lifecycle verification rules to obtain a first lifecycle member function; determine candidate destructors based on the object flow graph; determine a second lifecycle member function based on the memory release operation of the candidate destructors on the candidate objects; and / or, perform semantic detection on the external function names called by the candidate destructors based on a large language model to obtain a second lifecycle member function; and determine the lifecycle member function based on the first lifecycle member function and the second lifecycle member function.

[0106] In this embodiment of the invention, the recovery module is specifically used to: determine the candidate class corresponding to each of the lifecycle member functions based on the object flow graph and each of the lifecycle member functions; recover the class attributes and ordinary member functions of each of the candidate classes based on the object flow graph; determine the static structural relationship between each of the candidate classes, and obtain the C++ class structure recovery result corresponding to the binary file to be recovered based on the class attributes, the ordinary member functions and the static structural relationship.

[0107] In this embodiment of the invention, the recovery module is specifically configured to: determine a first group of target lifecycle member functions from all the lifecycle member functions based on virtual function pointers; the first group of target lifecycle member functions includes multiple first target lifecycle member functions; determine a first static structural relationship between the classes corresponding to each first target lifecycle member function based on the virtual function pointers corresponding to each first target lifecycle member function; determine a second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions; and determine a static structural relationship between each candidate class based on the first static structural relationship and the second static structural relationship.

[0108] In this embodiment of the invention, the recovery module is specifically used to: determine a third static structural relationship between the classes corresponding to each of the second target lifecycle member functions based on the initialization time point of the member variables in each of the second target lifecycle member functions in the second group of target lifecycle member functions; if there are candidate second target lifecycle member functions in the second group of target lifecycle member functions for which the third static structural relationship has not been identified, input each candidate second target lifecycle member function and the prompt word for judging the static structural relationship into the large language model to obtain a fourth static structural relationship between the classes corresponding to each candidate second target lifecycle member function; and determine a second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions based on the third static structural relationship and the fourth static structural relationship.

[0109] In this embodiment of the invention, the C++ class structure recovery device in the binary file further includes a caching module, specifically used for: caching the analysis results corresponding to the callers of the first candidate lifecycle member functions; and directly determining the specific object based on the analysis results when different first candidate lifecycle member functions have the same caller.

[0110] In this embodiment of the invention, the lifecycle member function includes a constructor and a destructor, and the C++ class structure recovery device in the binary file further includes a tracing module, specifically used for: locating the constructor of the global object in the binary file to be recovered based on the initialization function call chain of the tracing program; establishing a matching relationship between the global object and the destructor registered by the global object based on function call behavior; and tracing the constructor and the destructor.

[0111] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a C++ class structure recovery method in a binary file. This method includes: for candidate functions in the binary file to be recovered, constructing an in-process object flow graph corresponding to the candidate functions based on the operation instructions of candidate object-related variables in the candidate functions; the candidate object-related variables are used to characterize the function's first parameter and / or global object variables; constructing an object flow graph corresponding to the binary file to be recovered based on each in-process object flow graph and the call graph of the binary file to be recovered; determining the lifecycle member functions in the binary file to be recovered based on the object flow graph; and obtaining the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each lifecycle member function.

[0112] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the C++ class structure recovery method in the binary file provided by the above methods. The method includes: for candidate functions in the binary file to be recovered, constructing an in-process object flow graph corresponding to the candidate functions based on the operation instructions of candidate object-related variables in the candidate functions; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; constructing an object flow graph corresponding to the binary file to be recovered based on each of the in-process object flow graphs and the call graph of the binary file to be recovered; determining the lifecycle member functions in the binary file to be recovered based on the object flow graph; and obtaining the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions.

[0114] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a method for restoring C++ class structures in a binary file as provided by the methods described above. This method includes: for candidate functions in a binary file to be restored, constructing an in-process object flow graph corresponding to the candidate functions based on operation instructions for candidate object-related variables in the candidate functions; the candidate object-related variables are used to characterize the function's first parameter and / or global object variables; constructing an object flow graph corresponding to the binary file to be restored based on each in-process object flow graph and the call graph of the binary file to be restored; determining lifecycle member functions in the binary file to be restored based on the object flow graph; and obtaining a C++ class structure restoration result corresponding to the binary file to be restored based on the object flow graph and each lifecycle member function.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for restoring C++ class structures in a binary file, characterized in that, include: For candidate functions in the binary file to be recovered, an in-process object flow graph corresponding to the candidate function is constructed based on the operation instructions of the candidate object-related variables in the candidate function; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; Based on the object flow graphs within each process and the call graph of the binary file to be recovered, construct the object flow graph corresponding to the binary file to be recovered; Based on the object flow graph, determine the lifecycle member functions in the binary file to be recovered; Based on the object flow graph and each of the lifecycle member functions, the C++ class structure recovery result corresponding to the binary file to be recovered is obtained.

2. The method for restoring C++ class structures in binary files according to claim 1, characterized in that, The construction of the object flow graph corresponding to the binary file to be recovered, based on the object flow graph within each process and the call graph of the binary file to be recovered, includes: Based on the first function verification rule, a first group of candidate lifecycle member functions is determined from all the candidate functions; the first group of candidate lifecycle member functions includes multiple first candidate lifecycle member functions. Based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions, a reverse object flow graph is constructed. The reverse flow is used to characterize the direction from the first candidate lifecycle member function to the caller of the first candidate lifecycle member function. Based on the forward flow of the call graph and the reverse object flow graph, the object flow graph is constructed. The forward flow is used to characterize the direction from the first candidate lifecycle member function to the called function of the first candidate lifecycle member function.

3. The method for restoring C++ class structures in binary files according to claim 2, characterized in that, The construction of the reverse object flow graph based on the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions includes: Based on the call graph, the caller of the first candidate lifecycle member function is determined; Based on the object variable identifier corresponding to the first candidate lifecycle member function caller, determine the specific object that the first candidate lifecycle member function caller and the first candidate lifecycle member function both point to. Based on the specific object, the object flow graphs within each process, and the first group of candidate lifecycle member functions, the reverse object flow graph is constructed.

4. The method for restoring C++ class structures in binary files according to claim 2, characterized in that, The construction of the object flow graph based on the forward flow of the call graph and the reverse object flow graph includes: Based on the second function verification rule, a second group of candidate lifecycle member functions is determined from the first group of candidate lifecycle member functions; the second group of candidate lifecycle member functions includes multiple second candidate lifecycle member functions. Based on the forward flow of the call graph, the called function corresponding to the second candidate lifecycle member function is determined; An object flow graph is constructed based on the called function, the second group of candidate lifecycle member functions, and the reverse object flow graph.

5. The method for restoring C++ class structures in binary files according to claim 4, characterized in that, The step of determining the lifecycle member functions in the binary file to be recovered based on the object flow graph includes: Based on the lifecycle verification rules, the second group of candidate lifecycle member functions in the object flow graph are verified to obtain the first lifecycle member function; Based on the object flow graph, candidate destructors are determined; Based on the memory release operation of the candidate object by the candidate destructor, the second lifecycle member function is determined; and / or, based on the large language model, semantic detection is performed on the external function name called by the candidate destructor to obtain the second lifecycle member function; The lifecycle member function is determined based on the first lifecycle member function and the second lifecycle member function.

6. The method for restoring C++ class structures in a binary file according to any one of claims 1 to 5, characterized in that, The process of obtaining the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions includes: Based on the object flow graph and each of the lifecycle member functions, determine the candidate classes corresponding to each of the lifecycle member functions; Based on the object flow graph, the class attributes and ordinary member functions of each candidate class are restored; Determine the static structural relationships between the candidate classes. Based on the class attributes, the ordinary member functions, and the static structure relationships, the C++ class structure recovery result corresponding to the binary file to be recovered is obtained.

7. The method for restoring C++ class structures in binary files according to claim 6, characterized in that, Determining the static structural relationships between the candidate classes includes: Based on virtual function pointers, a first group of target lifecycle member functions is determined from all the said lifecycle member functions; the first group of target lifecycle member functions includes multiple first target lifecycle member functions; Based on the virtual function pointers corresponding to each of the first target lifecycle member functions, the first static structural relationship between the classes corresponding to each of the first target lifecycle member functions is determined. Determine the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the aforementioned lifecycle member functions; Based on the first static structural relationship and the second static structural relationship, the static structural relationship between each candidate class is determined.

8. The method for restoring C++ class structures in a binary file according to claim 7, characterized in that, Determining the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the said lifecycle member functions includes: Based on the initialization time point of the member variables in each of the second target lifecycle member functions in the second group of target lifecycle member functions, the third static structural relationship between the classes corresponding to each of the second target lifecycle member functions is determined. If there are candidate second target lifecycle member functions in the second group of target lifecycle member functions that have not been identified as the third static structural relationship, each candidate second target lifecycle member function and the prompt words for judging the static structural relationship are input into the large language model to obtain the fourth static structural relationship between the classes corresponding to each candidate second target lifecycle member function. Based on the third static structural relationship and the fourth static structural relationship, the second static structural relationship between the classes corresponding to the second group of target lifecycle member functions in all the lifecycle member functions is determined.

9. The method for restoring C++ class structures in a binary file according to claim 3, characterized in that, The method further includes: Cache the analysis results corresponding to the caller of the first candidate lifecycle member function; When different first candidate lifecycle member functions have the same caller, the specific object is determined directly based on the analysis results.

10. The method for restoring C++ class structures in a binary file according to claim 1, characterized in that, The lifecycle member functions include constructors and destructors, and the method further includes: Based on the initialization function call chain of the tracing program, locate the constructor of the global object in the binary file to be recovered; Based on function call behavior, a matching relationship is established between the global object and the destructor registered by the global object; The constructor and the destructor are traced.

11. A device for restoring C++ class structures in a binary file, characterized in that, include: The first construction module is used to construct an in-process object flow graph corresponding to a candidate function in a binary file to be recovered, based on the operation instructions of the candidate object-related variables in the candidate function; the candidate object-related variables are used to characterize the first parameter of the function and / or global object variables; The second construction module is used to construct an object flow graph corresponding to the binary file to be recovered based on the object flow graphs in each process and the call graph of the binary file to be recovered. The determination module is used to determine the lifecycle member functions in the binary file to be recovered based on the object flow graph; The recovery module is used to obtain the C++ class structure recovery result corresponding to the binary file to be recovered based on the object flow graph and each of the lifecycle member functions.

12. The C++ class structure recovery device in a binary file according to claim 11, characterized in that, The second building module includes a selection unit, a first building unit, and a second building unit: The selection unit is configured to determine a first group of candidate lifecycle member functions from all the candidate functions based on a first function verification rule; the first group of candidate lifecycle member functions includes multiple first candidate lifecycle member functions. The first construction unit is used to construct a reverse object flow graph based on the reverse flow of the call graph, the object flow graphs within each process, and the first group of candidate lifecycle member functions. The reverse flow is used to characterize the direction from the first candidate lifecycle member function to the caller of the first candidate lifecycle member function. The second construction unit is used to construct the object flow graph based on the forward flow of the call graph and the reverse object flow graph, wherein the forward flow is used to characterize the direction from the first group of candidate lifecycle member functions to the called function of the first group of candidate lifecycle member functions.

Images