Function boundary identification method and system for target binary program

Abstract

The application provides a function boundary identification method and system of a target binary program, and belongs to the technical field of data processing. The method comprises the following steps: acquiring a dynamic execution instruction sequence of the target binary program; extracting basic function boundary information from the dynamic execution instruction sequence to generate an initial function set; performing multi-round iteration traversal based on the initial function set; checking whether the target address and the known function boundary in the current function set satisfy the tail call association condition for the unconditional jump instruction; updating the target address that meets the condition to the current function set; when no new function boundary is added in the iteration traversal, solidifying the current function set as a global function set; and performing boundary determination based on the global function set to output the function start boundary and the function termination boundary. The application identifies the tail call function boundary through multi-round iteration, analyzes and determines directly by table lookup online, and realizes the collaborative improvement of the function boundary identification integrity and the analysis efficiency.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for identifying function boundaries of a target binary program. Background Technology

[0002] In applications such as software reverse engineering, vulnerability discovery, malware analysis, and program optimization, accurately identifying the boundaries of each function in a binary program without debugging symbols is a fundamental prerequisite for understanding program behavior, restoring instruction semantics, and refactoring code.

[0003] Existing function boundary identification methods typically employ basic dynamic trajectory tracing techniques. This method executes the target program through instrumentation or hardware tracing, capturing call and return instructions in the execution sequence in real time during program execution. It then directly records the address locations of these triggered call instructions and their corresponding return instructions as the start and end boundaries of the corresponding functions, thereby defining the function range of the binary code.

[0004] This existing technology relies solely on explicit call and return instructions to define functions. However, when processing binary programs optimized for tail calls, the compiler optimizes and replaces the call operation at the end of a function with an unconditional jump instruction. This causes control flow to directly enter the new function via the jump instruction, failing to trigger the call instruction monitoring mechanism. This results in a significant underreporting of the starting boundaries of many tail-call functions, leading to highly incomplete and inaccurate function boundary identification results in the final output. Summary of the Invention

[0005] This invention provides a method and system for identifying function boundaries in a target binary program, which addresses the shortcomings of existing technologies and achieves a synergistic improvement in the completeness of function boundary identification and analysis efficiency.

[0006] This invention provides a method for identifying function boundaries in a target binary program, comprising the following steps: Obtain the dynamic execution instruction sequence of the target binary program; Extract basic function boundary information from the dynamically executed instruction sequence to generate an initial function set; The initial function set is used as the current function set, and the dynamic execution instruction sequence is iterated multiple times. In each iteration, for the unconditional jump instruction in the dynamic execution instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy a preset tail call association condition, then the target address is updated as a new function boundary in the current function set. If no new function boundary is added to the current function set when any iteration traversal ends, the iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set; Based on the global function set, the boundary of the dynamically executed instruction sequence is determined to identify the function start boundary and function termination boundary corresponding to the dynamically executed instruction sequence.

[0007] According to the function boundary identification method of the target binary program provided by the present invention, the tail call association condition includes at least one of the following conditions: The target address of the unconditional jump instruction is located in another module that is different from the module where the unconditional jump instruction is located; The target address of the unconditional jump instruction is a known symbol address within the current module, and the known symbol does not belong to the preset internal marker symbol; Between the target address of the unconditional jump instruction and the instruction address of the unconditional jump instruction, there exists a function start boundary of a known function in the current function set.

[0008] According to a method for identifying function boundaries in a target binary program provided by the present invention, the existence of a function start boundary of a known function in the current function set between the target address of the unconditional jump instruction and the instruction address of the unconditional jump instruction includes: Compare the target address with the instruction address of the unconditional jump instruction; If the target address is less than the instruction address, and the target address is located before the function start boundary of the function to which the unconditional jump instruction belongs, then the unconditional jump instruction is determined to satisfy the tail call association condition. If the target address is greater than the instruction address, and the instruction interval between the target address and the instruction address belongs to the same continuous function body, then the unconditional jump instruction is determined to satisfy the tail call association condition, and the target address is used as the new function boundary.

[0009] According to the function boundary identification method of a target binary program provided by the present invention, the termination of iterative traversal includes: Count the number of function boundaries in the current function set at the end of the current iteration; The number of function boundaries in the current iteration is compared with the number of function boundaries at the end of the previous iteration, wherein the number of function boundaries in the previous iteration corresponding to the first iteration is the number of function boundaries in the initial function set. If the number of function boundaries traversed in the current iteration is greater than the number of function boundaries in the previous iteration, then the next iteration is initiated. If the number of function boundaries traversed in the current iteration is equal to the number of function boundaries in the previous iteration, then the iteration ends, and the current function set at the end of the current iteration is taken as the global function set.

[0010] According to the present invention, a method for identifying function boundaries of a target binary program, wherein the boundary determination of the dynamically executed instruction sequence based on the global function set includes: During the traversal of the dynamic execution instruction sequence, the target memory address and the written value of the write memory instruction located before the return instruction are recorded. When the return instruction is read, obtain the stack top address when the return instruction is executed, and the return address stored at the stack top address; If the stack top address is consistent with the recorded target memory address, and the return address is consistent with the recorded write value, then the location of the return instruction is not determined as the function termination boundary of the current function, and the location corresponding to the return address is determined as the new function start boundary.

[0011] According to a method for identifying function boundaries of a target binary program provided by the present invention, the step of determining the boundaries of the dynamically executed instruction sequence based on the global function set further includes: When a call instruction is read, the instruction address of the call instruction and the instruction address of the next instruction in the dynamic execution instruction sequence that follows the call instruction are obtained. Compare the instruction address of the next instruction with the instruction address of the calling instruction; If the instruction address of the next instruction is the same as the instruction address of the calling instruction, then the multiple executions corresponding to the calling instruction will be merged and determined as a single function entry; If the instruction address of the next instruction is different from the instruction address of the calling instruction, then the instruction address of the next instruction is determined as the new function start boundary.

[0012] According to the function boundary identification method for a target binary program provided by the present invention, before determining the instruction address of the next instruction as the new function start boundary, the method further includes: Determine whether the target binary program is a 32-bit address-independent executable program, and whether the target address of the calling instruction is equal to the sum of the instruction address of the calling instruction and the instruction length of the calling instruction; If the target binary program is a 32-bit address-independent executable program, and the target address of the calling instruction is equal to the sum of the instruction address of the calling instruction and the instruction length of the calling instruction, then the calling instruction is not determined to be a function call, and the function start boundary is not updated.

[0013] According to a method for identifying function boundaries of a target binary program provided by the present invention, the step of determining the boundaries of the dynamically executed instruction sequence based on the global function set further includes: Read the indirect jump instructions in the dynamically executed instruction sequence and identify the addressing operands of the indirect jump instructions; If the addressing operand is a memory addressing mode based on the instruction pointer register plus offset, then the indirect jump instruction is determined to be an access to the global offset table, and the indirect jump instruction is determined to be a function call.

[0014] According to the present invention, a method for identifying function boundaries of a target binary program, wherein extracting basic function boundary information from the dynamically executed instruction sequence to generate an initial function set includes: Perform a complete traversal of the dynamically executed instruction sequence, and do not apply the tail call association condition during the complete traversal; During the complete traversal, the function start boundary is determined according to the calling instruction, and the function termination boundary is determined according to the return instruction, thus obtaining the basic function boundary information; The boundary information of the basic functions is summarized and used as the initial function set.

[0015] This invention also provides a function boundary identification system for a target binary program, comprising the following modules: The sequence acquisition module is used to acquire the dynamic execution instruction sequence of the target binary program; The basic information extraction module is used to extract basic function boundary information from the dynamic execution instruction sequence and generate an initial function set; The iterative traversal and update module is used to take the initial function set as the current function set and perform multiple rounds of iterative traversal on the dynamic execution instruction sequence. In each round of iterative traversal, for unconditional jump instructions in the dynamic execution instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy a preset tail call association condition, then the target address is updated to the current function set as a new function boundary. The iteration termination module is used to end the iteration traversal if no new function boundary is added to the current function set when any round of iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set; The boundary determination module is used to perform boundary determination on the dynamic execution instruction sequence based on the global function set, and to determine the function start boundary and function termination boundary corresponding to the dynamic execution instruction sequence.

[0016] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements a function boundary identification method for a target binary program as described above.

[0017] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the function boundary identification method of the target binary program as described above.

[0018] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a function boundary identification method for a target binary program as described above.

[0019] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: By acquiring the dynamic execution instruction sequence of the target binary program, static inference is replaced with the actual execution record during program runtime, eliminating interference from compiler optimization and dynamic linking mechanisms in function boundary determination. Basic function boundary information is extracted from the dynamic execution instruction sequence to generate an initial function set, thus establishing a zero-false-positive function boundary identification benchmark based on the deterministic semantics of call and return instructions, providing reliable known function boundary references for subsequent multi-round iterative traversal. By using the initial function set as the current function set for multi-round iterative traversal of the dynamic execution instruction sequence, and checking whether the target address of unconditional jump instructions satisfies the tail call association condition with the known function boundaries in the current function set during each round of iterative traversal, updating the target address that meets the condition to the current function set, the newly added function boundary information in each round is fed back into the next round of determination, gradually identifying deep tail call function boundaries generated after the compiler replaces call instructions with unconditional jump instructions. By ending the iteration when no new function boundaries are added in any round of iterative traversal and fixing the current function set as a global function set, the iteration is adaptively terminated when the information gain reaches zero, avoiding redundant traversal. By using a global function set to determine the boundaries of dynamically executed instruction sequences and outputting the function start and end boundaries, the online analysis phase can directly complete the determination by looking up a table. This completely limits the computational overhead of multiple iterations to the pre-analysis phase, thereby improving the completeness of function boundary identification and the efficiency of online analysis. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is one of the flowcharts illustrating the function boundary identification method for target binary programs provided by the present invention.

[0022] Figure 2 This is the second flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0023] Figure 3 This is the third flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0024] Figure 4 This is the fourth flowchart of the method for identifying function boundaries of a target binary program provided by the present invention.

[0025] Figure 5 This is the fifth flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0026] Figure 6 This is the sixth flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0027] Figure 7 This is the seventh flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0028] Figure 8 This is the eighth flowchart of the function boundary identification method for the target binary program provided by the present invention.

[0029] Figure 9 This is a schematic diagram of the function boundary recognition system for the target binary program provided by the present invention.

[0030] Figure 10 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0032] It should be noted that in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships according to the accompanying drawings, are only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0033] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0034] The following is combined with Figures 1 to 10 This invention describes the function boundary identification method, system, electronic device, storage medium, and computer program product of the target binary program provided by this invention.

[0035] The execution subject of the method of this invention is a function boundary identification system. Besides a function boundary identification system, the method of this invention is also applicable to computer equipment, binary analysis platforms, or security research workstations integrated with corresponding analysis capabilities. This specification describes the method using the function boundary identification system (hereinafter referred to as the system) as the execution subject.

[0036] This embodiment describes the complete execution flow of a method for identifying function boundaries in a target binary program. The target binary program refers to an executable file that has been compiled and linked and does not contain debug symbols. The file format of the target binary program includes ELF format under the Linux operating system and PE format under the Windows operating system. Without debug symbols, the compiler erases explicit metadata related to function boundaries when generating the final machine code. The system cannot directly obtain the function start and end addresses from the file structure; therefore, it needs to infer them using dynamic execution traces.

[0037] Reference Figure 1 , Figure 1 This is one of the flowcharts illustrating the function boundary identification method for a target binary program provided by the present invention. The method includes steps 110 to 150: Step 110: Obtain the dynamic execution instruction sequence of the target binary program.

[0038] The system uses dynamic execution to capture runtime instructions from the target binary program, obtaining the sequence of instructions triggered sequentially during actual execution—the dynamic execution instruction sequence. This sequence records each instruction actually executed by the target binary program during runtime, along with its corresponding instruction address, reflecting the true control flow path during program execution.

[0039] Unlike static analysis, which infers function boundaries by guessing the control flow structure, the identification method based on the dynamic execution instruction sequence relies on the actual execution of the program, transforming function boundary determination from probabilistic speculation to factual confirmation.

[0040] In this application, dynamic execution instruction sequences can be obtained through instrumentation and hardware-assisted tracing techniques. Instrumentation records instruction execution by embedding monitoring code into the execution path of the target binary program. Intel PIN is a typical implementation of instrumentation, recording the program execution path by monitoring CALL and RET instructions. Hardware-assisted tracing techniques record instruction execution paths using the processor's built-in instruction tracing capabilities. Intel PT technology is a typical implementation of hardware-assisted tracing, directly recording the instruction execution trajectory through processor hardware.

[0041] Step 120: Extract the boundary information of basic functions from the dynamically executed instruction sequence to generate an initial function set.

[0042] The system performs basic function boundary extraction operations on dynamically executed instruction sequences. In the x86 / x64 instruction set architecture, function calls are typically initiated by the CALL instruction, which pushes the return address onto the call stack and jumps to the entry address of the called function; function returns are typically completed by the RET instruction, which pops the return address from the call stack and jumps to the popped return address to continue execution.

[0043] Basic function boundary information refers to the set of function start and end boundaries determined by identifying CALL and RET instructions. The system summarizes the extracted basic function boundary information to form an initial function set. The initial function set includes all function boundary information deterministically identified based on CALL and RET instructions, without considering tail call optimization scenarios.

[0044] Step 130: Use the initial function set as the current function set, and perform multiple rounds of iterative traversal on the dynamic execution instruction sequence; during each round of iterative traversal, for unconditional jump instructions in the dynamic execution instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy the preset tail call association condition, then update the target address as the new function boundary to the current function set.

[0045] Tail Call Optimization (TCO) is a compiler optimization strategy implemented by the compiler to reduce stack space consumption. When the last operation of a function is to call another function, the compiler replaces the CALL instruction that would normally be generated with a JMP instruction and reuses the current function's stack frame. After tail call optimization, the entry point of the called function is no longer marked by a CALL instruction, causing basic function boundary extraction based on CALL / RET rules to fail to identify the starting boundary of such called functions. The unconditional jump instruction corresponds to the JMP instruction in the x86 / x64 instruction set architecture. After the JMP instruction is executed, the processor unconditionally jumps to the target address to continue execution.

[0046] Tail call association conditions are preset criteria used by the system to determine whether an unconditional jump instruction corresponds to a tail call. When the target address of an unconditional jump instruction satisfies the tail call association condition with the known function boundary in the current function set, the system determines that the unconditional jump instruction is a tail call, records the target address as the new function start boundary, and updates the new function start boundary in the current function set.

[0047] The design principle of multi-round iterative traversal is as follows: In the first round of iterative traversal, the current function set only contains function boundaries determined by the CALL / RET basic rules; as each round of iterative traversal progresses, the starting boundaries of newly identified tail call functions are continuously added to the current function set, so that there are more known function boundaries to refer to in subsequent rounds of iterative traversal; through multiple rounds of iteration, the system gradually discovers deep tail call functions that can only be identified by relying on known function boundary information.

[0048] As an alternative to iterative traversal of dynamically executed instruction sequences, the system employs a depth-first strategy for iterative mining of tail calls. Under this strategy, when traversing the dynamically executed instruction sequence and identifying an unconditional jump instruction that satisfies the tail call association condition, the system does not wait for the current traversal to end but immediately performs recursive analysis on the instruction sequence at the target address of the unconditional jump instruction. During this recursive analysis, the system checks subsequent instructions at the target address. If these subsequent instructions are also unconditional jump instructions and also satisfy the tail call association condition, the system continues to recursively delve deeper along the target address of the unconditional jump instruction until a return instruction or a call instruction is encountered during the recursion. The system treats the entire jump chain formed by progressively deepening along the unconditional jump instructions as a logical function call chain and records the target addresses of each unconditional jump instruction in the logical function call chain as new function start boundaries, updating the current function set.

[0049] The alternative implementation using a depth-first search strategy maintains the same final identification result as the breadth-first search approach, differing only in the order of discovery and traversal path of the tail call function boundaries. The depth-first strategy immediately probes deeper along the jump chain upon discovering an unconditional jump instruction in the tail call. The continuous jump chain formed by unconditional jump instructions can be completely identified with a single recursive call, reducing the number of repeated traversals of the dynamic execution instruction sequence.

[0050] Step 140: If no new function boundary is added to the current function set when any iteration traversal ends, the iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set.

[0051] After each iteration, the system checks whether the number of function boundaries in the current function set has increased compared to the previous iteration. If the current iteration does not add any new function boundaries to the current function set, it means that, with the support of the currently known function boundary information, there are no longer any unidentified unconditional jump instructions in the dynamically executed instruction sequence that satisfy the tail call association condition. The iteration converges, the system ends the iteration, and the current function set at the end of the iteration is solidified as the global function set. The global function set covers all function boundary information identified through both basic rules and tail call iteration, and serves as the basic data source for function boundary queries in the subsequent online analysis phase. The global function set is persistently stored in the aota-trace-function-dump file after the pre-analysis phase. Subsequent online analysis phases directly read the global function set, without repeating the pre-analysis iteration, thus improving the execution efficiency of the online analysis phase.

[0052] Step 150: Perform boundary determination on the dynamically executed instruction sequence based on the global function set to determine the function start boundary and function termination boundary corresponding to the dynamically executed instruction sequence.

[0053] The system uses a global function set as a benchmark and performs boundary determination operations on each instruction in the dynamically executed instruction sequence. During the boundary determination process, the system determines the start and end boundaries of the function to which each instruction belongs based on the instruction type and instruction address, combined with the known function boundary information recorded in the global function set. The determination results are recorded as function boundary description data for subsequent analysis tasks such as program understanding, vulnerability location, and code refactoring.

[0054] This embodiment eliminates the root cause of false positives caused by compiler optimization interference in static analysis by constructing a deterministic function boundary identification mechanism based on dynamically executed instruction sequences. By separating the multi-round iterative traversal in the pre-analysis phase from the boundary determination in the online analysis phase, the pre-analysis phase completes the construction of the global function set in the background, while the online analysis phase directly performs table lookups and determinations. This ensures the integrity of tail-call function boundary identification while avoiding the performance overhead of iterative calculations in the online analysis phase, thereby improving identification accuracy and real-time analysis efficiency.

[0055] In one possible implementation, refer to Figure 2 , Figure 2 This is the second flowchart illustrating the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the specific implementation method for extracting basic function boundary information from a dynamically executed instruction sequence and generating an initial function set, specifically including the following steps: Step 210: Perform a full traversal of the dynamically executed instruction sequence, without applying tail call association conditions during the full traversal.

[0056] The system initiates a complete traversal of the dynamically executed instruction sequence. A complete traversal means starting from the first instruction in the dynamically executed instruction sequence and processing each instruction in the order of instruction execution until the last instruction in the dynamically executed instruction sequence has been traversed.

[0057] During the full traversal, the system strictly limits the processing logic, applying only the basic boundary judgment rules based on call and return instructions, and refraining from using tail call association conditions. The reason for not using tail call association conditions is that before the initial function set is established, the known function boundary information upon which the tail call association conditions depend is empty. If tail call association conditions are applied during the full traversal phase, a valid reference to known function boundaries cannot be provided, the judgment results will lack reliability, and it will also lead to confusion in subsequent iteration logic.

[0058] Step 220: During the complete traversal, determine the function start boundary based on the call instruction and the function termination boundary based on the return instruction to obtain the basic function boundary information.

[0059] During the complete traversal of the dynamically executed instruction sequence, the system checks the instruction type of each instruction one by one.

[0060] When the system reads a call instruction, its semantics indicate that the processor is initiating a call to a subroutine. The call instruction pushes the address of the instruction following the current instruction onto the call stack as the return address, and then jumps to the entry address of the called function for execution. Therefore, the address of the instruction immediately following the call instruction is the starting boundary of the called function. The system records the address of the next instruction as the function's starting boundary.

[0061] When the system reads a return instruction, the semantics of the return instruction indicate that the processor is returning from the current subroutine to the caller. The return instruction pops the return address from the call stack and jumps to the popped return address. Therefore, the location of the return instruction is the termination boundary of the current function. The system records the address of the return instruction as the function termination boundary.

[0062] Step 230: Summarize the boundary information of the basic functions to form the initial function set.

[0063] The system aggregates and integrates all function start and end boundaries recorded during the complete traversal to form an initial function set. Each record in the initial function set contains the start and end boundary addresses of a function, representing the complete boundary range of a function that can be deterministically identified through the basic rules of call and return instructions. The initial function set does not include boundary information for functions that were not identified due to tail call optimization where call instructions were replaced with unconditional jump instructions; this information is supplemented and improved in subsequent iterative traversal phases.

[0064] This embodiment ensures that the initial function set is independently established by highly deterministic call and return instruction rules by strictly isolating the application timing of tail call association conditions during the full traversal phase. This provides a function boundary reference benchmark for subsequent multi-round iterative traversal phases, thereby guaranteeing the reliability and accuracy of function boundary information throughout the entire iterative expansion process.

[0065] This embodiment, based on the above embodiments, further describes the specific determination rules for tail call association conditions.

[0066] One method is to determine whether the target address of the unconditional jump instruction is located in a different module than the module where the unconditional jump instruction is located.

[0067] When traversing the sequence of dynamically executed instructions, the system extracts the target address for each unconditional jump instruction and compares the target address with the instruction address of the unconditional jump instruction to determine module affiliation. A module refers to an independent code unit loaded by the target binary program at runtime, including the main executable file itself and the various dynamic link libraries that the main executable file depends on. Cross-module jumps occur when the module to which the target address of an unconditional jump instruction belongs is different from the module to which the instruction address of the unconditional jump instruction belongs. If the target address of an unconditional jump instruction is located in a different module, the system determines that the unconditional jump instruction satisfies the tail call association condition and records the target address as the new function start boundary. Cross-module unconditional jumps necessarily mean that the control flow leaves the current module and enters the function entry point of another module, which is a deterministic tail call behavior.

[0068] Secondly, it determines whether the target address of the unconditional jump instruction is a known symbol address within the current module, and whether the known symbol does not belong to the preset internal marker symbol.

[0069] When the target address belongs to the current module, the system further checks whether the target address corresponds to a known symbol address within the current module. A known symbol refers to a named address marker recorded in the symbol table or dynamic symbol table of the target binary program. When generating the object file, the compiler generates symbol records for locations such as function entry points and global variables; for function internal jump markers, the compiler generates symbols starting with a specific prefix. Symbols starting with ".L" are a typical form of internal marker symbols. These symbols represent local jump targets within a function, rather than the entry address of an independent function. The system excludes symbols belonging to the preset internal marker symbols during the determination process. Only when the target address corresponds to a known symbol that is not an internal marker is the unconditional jump instruction determined to satisfy the tail call association condition, and the target address is recorded as the new function start boundary.

[0070] Thirdly, it determines whether there is a function start boundary of a known function in the current function set between the target address of the unconditional jump instruction and the instruction address of the unconditional jump instruction.

[0071] If the target address is not a known symbolic address, the system further checks whether there exists a function start boundary of a known function already recorded in the current function set within the address range between the target address and the instruction address of the unconditional jump instruction. If a function start boundary of a known function exists within the aforementioned address range, it indicates that the control flow of the unconditional jump instruction crosses the entry point of a known function, constituting a jump behavior that exits the current function's scope. The system determines that the unconditional jump instruction satisfies the tail call association condition and records the target address as a new function start boundary. Meeting any one of the above three conditions determines that the unconditional jump instruction is a tail call.

[0072] As an alternative implementation for determining whether an unconditional jump instruction satisfies the tail call association condition, the system analyzes the changes in the values ​​of critical registers before and after the unconditional jump instruction to determine whether it is a function call. Critical registers are those that, according to the function call convention, are the responsibility of the callee to save and restore; these are called the callee's saved registers. During a function call, the callee's saved registers follow specific usage conventions. The called function must save the original value of the callee's saved registers before using them and restore them before returning, ensuring that the value of the callee's saved registers remains unchanged after the call returns.

[0073] When traversing the dynamically executed instruction sequence, the system checks the saving behavior of critical registers before the execution of an unconditional jump instruction. If there is an instruction that saves the callee's saved registers before the execution of the unconditional jump instruction, and the function logic corresponding to the target address of the unconditional jump instruction restores the callee's saved registers upon return, the system determines that the unconditional jump instruction has the register usage characteristics of a function call, classifies the unconditional jump instruction as a function call, and records the target address of the unconditional jump instruction as the new function start boundary. The system determines whether the function logic corresponding to the target address of the unconditional jump instruction restores the callee's saved registers upon return by analyzing the static characteristics of the instruction sequence at the target address, or by analyzing the historical execution trajectory at the target address in the dynamically executed instruction sequence.

[0074] This embodiment establishes a rule system for determining tail call association conditions from three dimensions: module affiliation, symbol identity, and address space relationship. This enables multi-dimensional and accurate identification of unconditional jump instructions after tail call optimization. The cross-module condition handles tail call scenarios that call functions of external modules; the known symbol condition handles tail call scenarios that call functions with symbol records within the current module; and the address range condition handles tail call scenarios that have no symbol records but have address space associations with known function boundaries. These three conditions work together to cover the main manifestations of tail call optimization in binary programs without debug symbols, effectively reducing the false negative rate of tail call function boundaries.

[0075] In one possible implementation, refer to Figure 3 , Figure 3 This is the third flowchart of the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the specific implementation of determining the tail call association condition based on the address range relationship, specifically including the following steps: Step 310: Compare the target address of the unconditional jump instruction with the instruction address of the unconditional jump instruction.

[0076] The system extracts the target address and instruction address for unconditional jump instructions and compares their values ​​to determine the jump direction. If the target address is less than the instruction address, a forward jump occurs, meaning the jump target is in the code region preceding the current instruction; if the target address is greater than the instruction address, a backward jump occurs, meaning the jump target is in the code region following the current instruction. Different tail call determination logic applies to each jump direction.

[0077] Step 320: If the target address is less than the instruction address, and the target address is located before the function start boundary of the function to which the unconditional jump instruction belongs, then the unconditional jump instruction is determined to satisfy the tail call association condition.

[0078] After confirming that the jump direction is forward, the system further checks the positional relationship between the target address and the function start boundary of the function to which the unconditional jump instruction belongs. The function start boundary of the function to which the unconditional jump instruction belongs refers to the entry address of the function containing the unconditional jump instruction recorded in the current function set.

[0079] If the target address is numerically less than the function start boundary of the function to which the unconditional jump instruction belongs, it means that the jump target of the unconditional jump instruction is located outside the current function's scope and at a lower memory address. The target address does not belong to a loop jump within the current function, but rather a jump to the code region of another function, which is a tail call behavior. The system records the target address as the new function start boundary and updates it in the current function set.

[0080] Step 330: If the target address is greater than the instruction address, and the instruction interval between the target address and the instruction address belongs to the same continuous function body, then the unconditional jump instruction is determined to satisfy the tail call association condition, and the target address is used as the new function boundary.

[0081] After confirming that the jump direction is backward, the system checks whether there are other known function start boundaries within the instruction interval between the target address and the instruction address, in order to determine whether the instruction interval between the target address and the current unconditional jump instruction belongs to the same continuous function body.

[0082] If there are no other known function start boundaries within the instruction interval between the target address and the instruction address, the system determines that the interval where the target address is located is continuous with the current function body. The target address is the forward position within the current function body and the entry point of the called function in the tail call. The system records the target address as the new function start boundary and updates it to the current function set.

[0083] If the instruction interval between the target address and the instruction address contains the starting boundary of another known function, it means that the jump target of the unconditional jump instruction has crossed the entry point of another function. The code region where the target address is located belongs to the scope of an independent function and also satisfies the tail call association condition. The system records the target address as the new function starting boundary and updates it to the current function set.

[0084] This embodiment establishes differentiated tail call determination logic for forward and backward jumps by combining the jump direction of the unconditional jump instruction with the positional relationship of the current function's starting boundary. Forward jumps determine whether an out-of-bounds jump has occurred by comparing the target address with the current function's starting boundary, while backward jumps infer whether a jump is a cross-function jump by checking the continuity of function boundaries in the intermediate interval. Both logics together cover the manifestations of tail call optimization in different jump directions. Supported by the known function boundary information provided by multiple rounds of iterative traversal, it accurately distinguishes between tail call jumps and internal loop jumps, avoiding an excessively large function boundary identification range or missed detections.

[0085] In one possible implementation, refer to Figure 4 , Figure 4 This is the fourth flowchart of the function boundary identification method for the target binary program provided by the present invention. Based on the above embodiments, this embodiment further describes the specific implementation of the iterative traversal termination condition, which specifically includes the following steps: Step 410: Count the number of function boundaries in the current function set at the end of the current iteration.

[0086] After each iteration, the system counts the total number of function boundaries recorded in the current function set. The number of function boundaries refers to the number of independent function boundary records in the current function set; each function boundary record corresponds to the starting boundary address of an identified function. Changes in the number of function boundaries reflect whether any new function boundary information not identified in previous iterations has been added during this iteration.

[0087] Step 420: Compare the number of function boundaries in the current iteration with the number of function boundaries at the end of the previous iteration. The number of function boundaries in the previous iteration corresponding to the first iteration is the number of function boundaries in the initial function set.

[0088] The system compares the number of function boundaries counted in the current iteration with the number of function boundaries recorded at the end of the previous iteration. For the first iteration, the number of function boundaries in the previous iteration is taken as the total number of function boundaries in the initial function set after the completion of the full traversal phase, serving as the benchmark value for the first iteration comparison. For subsequent iterations beyond the first iteration, the number of function boundaries in the previous iteration is taken as the number of function boundaries recorded at the end of the previous iteration.

[0089] Step 430: If the number of function boundaries traversed in the current iteration is greater than the number of function boundaries in the previous iteration, then initiate the next iteration.

[0090] When the comparison results show that the number of function boundaries in the current round is greater than the number of function boundaries in the previous round, the system determines that at least one new function boundary record has been added in this round of iteration. This indicates that the expansion of the function boundary information already included in the current function set has brought new opportunities for tail call identification. There are still tail call unconditional jump instructions in the dynamic execution instruction sequence that can only be identified by the newly added function boundary information. The system initiates the next round of iteration and uses the current function set at the end of the current round as the input for the next round of iteration.

[0091] Step 440: If the number of function boundaries traversed in the current iteration is equal to the number of function boundaries in the previous iteration, then end the iteration and take the current function set at the end of the current iteration as the global function set.

[0092] When the comparison results show that the number of function boundaries in the current round is equal to the number of function boundaries in the previous round, the system determines that no new function boundary records have been added to the current function set in this round of iteration. This indicates that, with the support of the currently known function boundary information, there are no longer any unidentified unconditional jump instructions that satisfy the tail call association condition in the dynamically executed instruction sequence. The iteration process has converged to a stable state, the system ends the iteration, and the current function set at the end of the current round is solidified into a global function set and persistently stored for direct reading and use in the online analysis phase.

[0093] In one possible implementation, refer to Figure 5 , Figure 5 This is the fifth flowchart of the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the boundary determination processing method for scenarios with dynamic return address modification in the online analysis stage, specifically including the following steps: Step 510: During the traversal of the dynamic execution instruction sequence, record the target memory address and the written value of the write memory instruction located before the return instruction.

[0094] As the system iterates through the sequence of dynamically executed instructions, it identifies and records the execution status of instructions written to memory.

[0095] A write instruction is an instruction that writes a value from a register or immediate value to a specified memory address. In the x86 / x64 instruction set architecture, this corresponds to the MOV instruction where the target operand is a memory address. When the system encounters a write instruction, it extracts the target memory address and the value to be written, and records these as key-value pairs. The purpose of recording the target memory address and the value is to identify dynamic return address modifications by comparing them when a return instruction is encountered later.

[0096] Dynamic return address modification refers to the practice of certain special library functions modifying the return address on the call stack to the entry address of another function during execution by writing instructions to memory. This allows the execution of the return instruction to jump to the modified target function's entry point instead of returning to the original caller. The libdl library is a typical example of implementing dynamic return address modification, achieving this special control flow transfer by modifying the return address on the call stack.

[0097] Step 520: When a return instruction is read, obtain the stack top address when the return instruction is executed, and the return address stored at the stack top address.

[0098] When the system traverses the dynamically executed instruction sequence, upon encountering a return instruction, it obtains the address of the top of the processor's call stack at the time the return instruction was executed, as well as the return address value stored in the memory location pointed to by the top of the stack. The top of the stack is determined by the current value of the stack pointer register, which in the x86 / x64 instruction set architecture is either the RSP register or the ESP register.

[0099] Step 530: If the stack top address is consistent with the target memory address recorded, and the return address is consistent with the written value recorded, then the location of the return instruction is not determined as the function termination boundary of the current function, and the location corresponding to the return address is determined as the new function start boundary.

[0100] The system compares the stack top address obtained in step 520 with the target memory address recorded in step 510, and compares the return address stored at the stack top address with the write value recorded in step 510.

[0101] If the stack top address matches the recorded target memory address, and the return address matches the recorded write value, then the system determines that the return behavior of the current return instruction was caused by the previous write memory instruction dynamically modifying the return address. The current return instruction does not represent the normal end of the current function, but rather a special control flow transfer. Under this determination, the system does not record the location of the current return instruction as the function termination boundary of the current function, but instead records the location corresponding to the return address as the new function start boundary. The target function is treated as a sub-function of the currently executing libdl library function, keeping the current function boundary record unchanged, and continuing the subsequent boundary determination process.

[0102] As an alternative approach to boundary determination in scenarios involving dynamic return address modification, the system identifies dynamic return address modification behavior by parsing the exception handling framework information in the target binary program. Exception handling framework information refers to metadata in the target binary program that records the function stack frame layout and exception handling flow, stored in the ELF format executable file in the form of a .eh_frame or .debug_frame segment. Even without debug symbols, some of the function stack frame framework information recorded in the .eh_frame or .debug_frame segment of the target binary program is still preserved.

[0103] When traversing the dynamically executed instruction sequence, the system parses the .eh_frame or .debug_frame segments in the target binary program to extract the exception handling framework information corresponding to the current function. The system checks whether the current function has a corresponding exception handling table and whether the modification of the return address at the top of the call stack conforms to the exception handling process described in the exception handling framework information. If the current function has a corresponding exception handling table, and the modification of the return address at the top of the call stack conforms to the exception handling process described in the exception handling framework information, the system determines that the modification of the current return address is a special boundary behavior that conforms to the exception handling mechanism. Instead of determining the location of the return instruction as the function termination boundary, the system determines the location corresponding to the modified return address as the new function start boundary.

[0104] This embodiment introduces a linkage monitoring and comparison mechanism between write-to-memory instructions and return instructions during the online analysis phase. This accurately identifies complex control flow scenarios where special library functions such as libdl dynamically modify the call stack return address. It avoids misjudging the control flow transfer caused by dynamic return address modification as the termination boundary of the current function, prevents function boundary identification errors and call stack backtracking breaks, and improves the accuracy of function boundary identification results in complex binary programs with dynamic return address modification behavior.

[0105] In one possible implementation, refer to Figure 6 , Figure 6 This is the sixth flowchart of the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the deduplication method for scenarios where page faults cause repeated execution of call instructions during the online analysis stage, specifically including the following steps: Step 610: When a call instruction is read, obtain the instruction address of the call instruction and the instruction address of the next instruction in the dynamic execution instruction sequence that follows the call instruction.

[0106] When the system iterates through the sequence of dynamically executed instructions, it extracts the instruction address of the calling instruction in the sequence of dynamically executed instructions when it reads a calling instruction. At the same time, it reads the next instruction that immediately follows the calling instruction in the sequence of dynamically executed instructions and extracts the instruction address of the next instruction.

[0107] Step 620: Compare the instruction address of the next instruction with the instruction address of the calling instruction.

[0108] The system compares the address of the next instruction with the address of the calling instruction to determine whether the address of the next instruction is the same as the address of the calling instruction.

[0109] Step 630: If the instruction address of the next instruction is the same as the instruction address of the calling instruction, then the multiple executions corresponding to the calling instruction are merged and judged as a single function entry.

[0110] A page fault is an exception in the operating system's memory management mechanism. It is triggered when the memory page accessed by the processor has not yet been loaded into physical memory. After responding to the page fault, the operating system loads the required memory page into physical memory and re-executes the instruction that triggered the page fault.

[0111] During the recording of dynamically executed instruction sequences, if a call instruction triggers a page fault during execution, the operating system will re-execute the call instruction after handling the page fault, resulting in the instruction address of the call instruction appearing twice consecutively in the dynamically executed instruction sequence. When the instruction address of the next instruction is the same as the instruction address of the call instruction, the system determines that a page fault has caused the call instruction to be executed repeatedly. It merges the execution records of the multiple repeated call instructions, classifying them as a single function entry, thus avoiding misclassifying repeated execution records of the same function call as multiple independent function calls.

[0112] Step 640: If the instruction address of the next instruction is different from the instruction address of the calling instruction, then the instruction address of the next instruction is determined as the new function start boundary.

[0113] When the address of the next instruction differs from the address of the calling instruction, the system determines that the current calling instruction is a normal function call execution and there is no instruction duplication caused by a page fault. The address of the next instruction is then determined as the starting boundary of the called function and recorded as the new function starting boundary.

[0114] This embodiment introduces a page fault deduplication mechanism at the call instruction location, which compares the address of the next instruction with the address of the current call instruction. This mechanism automatically identifies and eliminates duplicate execution records of call instructions caused by the operating system's page fault handling mechanism, ensuring the accuracy of function call counts and function boundary records. It also prevents data pollution caused by the operating system's underlying exception handling behavior on the dynamic execution instruction sequence and improves the reliability of function boundary identification results in complex operating system environments.

[0115] In one possible implementation, refer to Figure 7 , Figure 7 This is the seventh flowchart of the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the filtering processing method for special call instructions in 32-bit address-independent executable programs, specifically including the following steps: Step 710: Determine whether the target binary program is a 32-bit address-independent executable program, and whether the target address of the calling instruction is equal to the sum of the instruction address of the calling instruction and the instruction length of the calling instruction.

[0116] Before executing step 640 to determine the address of the next instruction as the new function start boundary, the system first checks the program type of the target binary program to determine whether it is a 32-bit address-independent executable program. A 32-bit address-independent executable program is a code location-independent executable program format compiled under a 32-bit processor architecture. When generating such programs, the compiler uses a special sequence of call instructions to obtain the current instruction address because the 32-bit architecture lacks instructions to directly obtain the program counter value, thus achieving the computational basis for address-independent code.

[0117] When the target binary program is a 32-bit address-independent executable, the system further checks whether the target address of the call instruction is equal to the sum of the call instruction's address and length. The sum of the call instruction's address and length represents the starting address of the instruction following the call instruction. If the target address of the call instruction is equal to the sum of the call instruction's address and length, it means that the call instruction is calling the address immediately following itself. That is, the call instruction is calling the address of the instruction immediately after the call instruction. This is a typical special call instruction pattern used by the compiler to obtain the current value of the program counter in a 32-bit address-independent executable. At the assembly level, this is represented by the jump target address of the CALL instruction being equal to the address of the CALL instruction itself plus the length of the CALL instruction in bytes.

[0118] Step 720: If the target binary program is a 32-bit address-independent executable program, and the target address of the call instruction is equal to the sum of the instruction address of the call instruction and the instruction length of the call instruction, then the call instruction is not determined to be a function call, and the function start boundary is not updated.

[0119] When the system confirms that the target binary program is a 32-bit address-independent executable program, and that the target address of the calling instruction equals the sum of the address of the calling instruction and the length of the calling instruction, it determines that the calling instruction is a special instruction used by the compiler to obtain the program counter value, rather than a true function call instruction. The system does not perform function call determination on the calling instruction, does not update the addresses of subsequent instructions to the new function start boundary, skips the calling instruction, and continues traversing subsequent instructions to avoid misidentification caused by special compilation modes.

[0120] This embodiment adds a pre-check for special calling modes of 32-bit address-independent executable programs to the call instruction boundary determination process. This accurately filters out special calling instructions generated by the compiler to obtain program counter values ​​in order to implement address-independent code, avoids misjudging such special calling instructions as function calls, prevents incorrect updates of function start boundaries, and eliminates interference from special compilation optimization modes on the accuracy of function boundary identification.

[0121] In one possible implementation, refer to Figure 8 , Figure 8 This is the eighth flowchart of the function boundary identification method for target binary programs provided by the present invention. Based on the above embodiments, this embodiment further describes the indirect jump instruction identification and processing method for process link table access during the online analysis stage, specifically including the following steps: Step 810: Read the indirect jump instructions in the dynamically executed instruction sequence and identify the addressing operands of the indirect jump instructions.

[0122] When the system iterates through the dynamically executed instruction sequence, it reads an indirect jump instruction, extracts the target operand of the indirect jump instruction, and analyzes the addressing mode used by the target operand. An indirect jump instruction is a jump instruction whose target address is not directly encoded in the instruction but is indirectly obtained through memory addressing or registers. In the x86 / x64 instruction set architecture, it appears as the JMP instruction in conjunction with a memory operand. The addressing operand is the part of the indirect jump instruction that describes how to calculate the target address, including information such as the base address register, offset, and addressing mode.

[0123] Step 820: If the addressing operand is a memory addressing mode based on the instruction pointer register plus offset, then the indirect jump instruction is determined to be an access to the global offset table, and the indirect jump instruction is determined to be a function call.

[0124] The system checks whether the addressing operand of the indirect jump instruction uses memory addressing mode based on the instruction pointer register plus an offset. Memory addressing mode based on the instruction pointer register plus an offset means that the current value of the instruction pointer register plus a fixed offset is used as the memory address, and the value stored at that memory address is read as the jump target. In the 64-bit mode of the x86 / x64 instruction set architecture, the instruction pointer register is the RIP register, and memory addressing mode based on the instruction pointer register plus an offset means that the current value of the RIP register plus a fixed offset is used as the address to access the global offset table entry.

[0125] The Global Offset Table (GOT) is a data structure in ELF executable files used to support dynamic linking function calls. The GOT stores the actual addresses of each external function in the dynamic link library that are resolved at runtime.

[0126] The Procedure Linkage Table (PLT) is a jump table in an ELF executable file that enables indirect calls to dynamically linked functions. The PLT accesses the addresses of external functions stored in the global offset table to achieve indirect calls to dynamically linked library functions. Each entry in the PLT corresponds to an external dynamically linked function. The calling flow is as follows: when the program calls an external function, it first jumps to the corresponding entry in the PLT. The indirect jump instruction in the PLT entry accesses the actual function address stored in the global offset table using the RIP register plus the offset memory addressing mode, and then jumps to the actual address of the external function to execute the external function.

[0127] When the system recognizes that the addressing operand is a memory addressing mode based on the instruction pointer register plus offset, it confirms that the indirect jump instruction is an access operation of the procedure link table to the global offset table, determines the indirect jump instruction as a function call, and records the entry address of the external function pointed to by the jump target of the indirect jump instruction as the function start boundary.

[0128] This embodiment achieves accurate capture of external function calls under dynamic linking by identifying the characteristic operand form of procedural linking table access in indirect jump instructions, which uses the instruction pointer register plus offset memory addressing mode. The procedural linking table and global offset table are the core mechanisms for implementing external function calls in ELF format dynamic linking programs. The target address of such indirect jumps cannot be determined during static analysis. However, based on the dynamic execution instruction sequence and the identification of the addressing mode, the system accurately determines the external function entry point pointed to by the indirect jump in the procedural linking table at runtime, bringing dynamically linked external functions into the coverage of function boundary identification and avoiding missed external function boundary detection caused by the dynamic linking mechanism.

[0129] Reference Figure 9 , Figure 9 This is a schematic diagram of the function boundary identification system for target binary programs provided by the present invention. The system includes: The sequence acquisition module is used to acquire the dynamic execution instruction sequence of the target binary program; The basic information extraction module is used to extract basic function boundary information from the dynamically executed instruction sequence and generate an initial function set; The iterative traversal and update module is used to take the initial function set as the current function set and perform multiple rounds of iterative traversal on the dynamically executed instruction sequence. During each round of iterative traversal, for unconditional jump instructions in the dynamically executed instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy the preset tail call association condition, then the target address is updated to the current function set as the new function boundary. The iteration termination module is used to end the iteration traversal if no new function boundary is added to the current function set when any iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set; The boundary determination module is used to determine the boundaries of dynamically executed instruction sequences based on the global function set, and to determine the function start boundary and function termination boundary corresponding to the dynamically executed instruction sequence.

[0130] It should be noted that the function boundary identification system for the target binary program provided by the present invention can execute the function boundary identification method for the target binary program of any of the above embodiments during actual operation, which will not be elaborated in this embodiment.

[0131] Figure 10 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 10 As shown, the electronic device may include a processor 1010, a communication interface 1020, a memory 1030, and a communication bus 1040, wherein the processor 1010, the communication interface 1020, and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to execute the function boundary identification method of the target binary program provided in the above embodiments.

[0132] Furthermore, the logical instructions in the aforementioned memory 1030 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0133] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer is able to execute the function boundary identification method of the target binary program provided in the above embodiments.

[0134] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a function boundary identification method for executing the target binary program provided in the above embodiments.

[0135] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0136] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying function boundaries in a target binary program, characterized in that, include: Obtain the dynamic execution instruction sequence of the target binary program; Extract basic function boundary information from the dynamically executed instruction sequence to generate an initial function set; The initial function set is used as the current function set, and the dynamic execution instruction sequence is iterated multiple times. In each iteration, for the unconditional jump instruction in the dynamic execution instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy a preset tail call association condition, then the target address is updated as a new function boundary in the current function set. If no new function boundary is added to the current function set when any iteration traversal ends, the iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set; Based on the global function set, the boundary of the dynamically executed instruction sequence is determined to identify the function start boundary and function termination boundary corresponding to the dynamically executed instruction sequence.

2. The method according to claim 1, characterized in that, The tail call association condition includes at least one of the following conditions: The target address of the unconditional jump instruction is located in another module that is different from the module where the unconditional jump instruction is located; The target address of the unconditional jump instruction is a known symbol address within the current module, and the known symbol does not belong to the preset internal marker symbol; Between the target address of the unconditional jump instruction and the instruction address of the unconditional jump instruction, there exists a function start boundary of a known function in the current function set.

3. The method according to claim 2, characterized in that, The existence of a function start boundary for a known function in the current function set between the target address of the unconditional jump instruction and the instruction address of the unconditional jump instruction includes: Compare the target address with the instruction address of the unconditional jump instruction; If the target address is less than the instruction address, and the target address is located before the function start boundary of the function to which the unconditional jump instruction belongs, then the unconditional jump instruction is determined to satisfy the tail call association condition. If the target address is greater than the instruction address, and the instruction interval between the target address and the instruction address belongs to the same continuous function body, then the unconditional jump instruction is determined to satisfy the tail call association condition, and the target address is used as the new function boundary.

4. The method according to claim 1, characterized in that, The termination of the iteration includes: Count the number of function boundaries in the current function set at the end of the current iteration; The number of function boundaries in the current iteration is compared with the number of function boundaries at the end of the previous iteration, wherein the number of function boundaries in the previous iteration corresponding to the first iteration is the number of function boundaries in the initial function set. If the number of function boundaries traversed in the current iteration is greater than the number of function boundaries in the previous iteration, then the next iteration is initiated. If the number of function boundaries traversed in the current iteration is equal to the number of function boundaries in the previous iteration, then the iteration ends, and the current function set at the end of the current iteration is taken as the global function set.

5. The method according to claim 1, characterized in that, The boundary determination of the dynamically executed instruction sequence based on the global function set includes: During the traversal of the dynamic execution instruction sequence, the target memory address and the written value of the write memory instruction located before the return instruction are recorded. When the return instruction is read, obtain the stack top address when the return instruction is executed, and the return address stored at the stack top address; If the stack top address is consistent with the recorded target memory address, and the return address is consistent with the recorded write value, then the location of the return instruction is not determined as the function termination boundary of the current function, and the location corresponding to the return address is determined as the new function start boundary.

6. The method according to claim 1, characterized in that, The boundary determination of the dynamically executed instruction sequence based on the global function set further includes: When a call instruction is read, the instruction address of the call instruction and the instruction address of the next instruction in the dynamic execution instruction sequence that follows the call instruction are obtained. Compare the instruction address of the next instruction with the instruction address of the calling instruction; If the instruction address of the next instruction is the same as the instruction address of the calling instruction, then the multiple executions corresponding to the calling instruction will be merged and determined as a single function entry; If the instruction address of the next instruction is different from the instruction address of the calling instruction, then the instruction address of the next instruction is determined as the new function start boundary.

7. The method according to claim 6, characterized in that, Before determining the address of the next instruction as the new function start boundary, the process also includes: Determine whether the target binary program is a 32-bit address-independent executable program, and whether the target address of the calling instruction is equal to the sum of the instruction address of the calling instruction and the instruction length of the calling instruction; If the target binary program is a 32-bit address-independent executable program, and the target address of the calling instruction is equal to the sum of the instruction address of the calling instruction and the instruction length of the calling instruction, then the calling instruction is not determined to be a function call, and the function start boundary is not updated.

8. The method according to claim 1, characterized in that, The boundary determination of the dynamically executed instruction sequence based on the global function set further includes: Read the indirect jump instructions in the dynamically executed instruction sequence and identify the addressing operands of the indirect jump instructions; If the addressing operand is a memory addressing mode based on the instruction pointer register plus offset, then the indirect jump instruction is determined to be an access to the global offset table, and the indirect jump instruction is determined to be a function call.

9. The method according to claim 1, characterized in that, The step of extracting basic function boundary information from the dynamically executed instruction sequence to generate an initial function set includes: Perform a complete traversal of the dynamically executed instruction sequence, and do not apply the tail call association condition during the complete traversal; During the complete traversal, the function start boundary is determined according to the calling instruction, and the function termination boundary is determined according to the return instruction, thus obtaining the basic function boundary information; The boundary information of the basic functions is summarized and used as the initial function set.

10. A function boundary identification system for a target binary program, characterized in that, include: The sequence acquisition module is used to acquire the dynamic execution instruction sequence of the target binary program; The basic information extraction module is used to extract basic function boundary information from the dynamic execution instruction sequence and generate an initial function set; The iterative traversal and update module is used to take the initial function set as the current function set and perform multiple rounds of iterative traversal on the dynamic execution instruction sequence. In each round of iterative traversal, for unconditional jump instructions in the dynamic execution instruction sequence, if the target address of the unconditional jump instruction and the known function boundary in the current function set satisfy a preset tail call association condition, then the target address is updated to the current function set as a new function boundary. The iteration termination module is used to end the iteration traversal if no new function boundary is added to the current function set when any round of iteration traversal ends, and the current function set at the end of the iteration traversal is taken as the global function set; The boundary determination module is used to perform boundary determination on the dynamic execution instruction sequence based on the global function set, and to determine the function start boundary and function termination boundary corresponding to the dynamic execution instruction sequence.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the function boundary identification method of the target binary program as described in any one of claims 1 to 9.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the function boundary identification method of the target binary program as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the function boundary identification method of the target binary program as described in any one of claims 1 to 9.

Images