A binary code security auditing method and related apparatus

Abstract

The application provides a binary code security auditing method and related device, and belongs to the technical field of network security. The binary code to be audited is obtained and is denoted as binary code; a target environment configuration required for running the binary code is obtained; a virtual container is constructed, the binary code and the target environment configuration required for the binary code are loaded in the virtual container, and a running environment of the binary code is obtained; static analysis and dynamic testing are performed on the binary code in the running environment of the binary code, and an auditing result is obtained; based on the auditing result, the security vulnerability of the binary code is analyzed, and a binary code security auditing report is obtained. The application solves the problem of great security risk when the binary code is subjected to security auditing.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a binary code security auditing method and related apparatus. Background Technology

[0002] With the rapid development of the Industrial Internet, a large number of critical infrastructures have adopted embedded systems or industrial control applications. These systems often run in closed environments that are physically isolated from the Internet, and for security and confidentiality reasons, the use of portable storage devices such as USB flash drives and external hard drives for data exchange is usually prohibited.

[0003] However, security auditors need to perform security analysis on these binary codes. Existing technical solutions typically require auditors to bring specialized equipment into the field and copy the code via physical interfaces (such as Joint Test Action Group, serial ports) or mobile storage devices. This not only poses significant security risks, potentially introducing viruses or Trojans, but is also strictly prohibited in many high-security environments.

[0004] Therefore, how to safely and compliantly extract binary code and conduct audits without touching physical devices or using removable storage media has become an urgent problem to be solved. Summary of the Invention

[0005] The purpose of this invention is to provide a binary code security auditing method and related apparatus to solve the problem of significant security risks in the prior art when performing security audits on binary code.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a binary code security auditing method, comprising the following steps: Obtain the binary code to be audited, denoted as binary code; Obtain the target environment configuration required to run the binary code; Build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code; Static analysis and dynamic testing of binary code are performed in the binary code runtime environment to obtain audit results; Based on the audit results, the security vulnerabilities of the binary code are analyzed, and a binary code security audit report is obtained.

[0007] A further improvement of this invention is that the step of obtaining the binary code to be audited, denoted as binary code, specifically involves: The binary code to be audited is obtained using a non-contact method and recorded as binary code; The specific steps for obtaining the target environment configuration required to run the binary code are as follows: A non-contact method is used to obtain the target environment configuration required to run binary code.

[0008] A further improvement of the present invention is that the binary code to be audited includes embedded system firmware, industrial control applications, or dynamic link library files.

[0009] A further improvement of the present invention is that the target environment configuration includes operating system type, version information, hardware architecture information, and a list of dependent libraries.

[0010] A further improvement of the present invention is that the construction of the virtualization container specifically involves: We use the open-source Docker virtualization container technology to build virtualized containers.

[0011] A further improvement of this invention is that, after obtaining the runtime environment of the binary code, the runtime environment of the binary code is checked to confirm whether the configuration information in the runtime environment of the binary code is consistent with the target environment configuration required to run the binary code.

[0012] A further improvement of this invention lies in the fact that the static analysis and dynamic testing of the binary code in the binary code runtime environment to obtain audit results specifically includes: By comprehensively employing static disassembly analysis, dynamic fuzzing, and dynamic taint analysis techniques, the binary code is subjected to static analysis and dynamic testing within the binary code's runtime environment to obtain audit results.

[0013] Secondly, this invention provides a binary code security auditing system, comprising: The first data acquisition module is used to acquire the binary code to be audited, denoted as binary code; The second data acquisition module is used to acquire the target environment configuration required to run binary code; The runtime environment determination module is used to build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code. The audit result determination module is used to perform static analysis and dynamic testing on binary code in the binary code runtime environment to obtain audit results; The analysis module is used to analyze the security vulnerabilities of binary code based on audit results and generate a binary code security audit report.

[0014] Thirdly, the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the binary code security auditing method described above.

[0015] Fourthly, the present invention provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the binary code security auditing method described above.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The binary code security auditing method proposed in this invention constructs a virtualized container, loads the binary code and the target environment configuration required by the binary code into the virtualized container, and obtains the runtime environment of the binary code. It can be seen that this invention avoids the risk of malicious programs attacking and damaging externally from the physical environment level. On the other hand, it performs static analysis and dynamic testing on the binary code in the runtime environment of the binary code to obtain audit results. It can be seen that this invention can not only comprehensively explore the security vulnerabilities of binary code and has a wider audit coverage, but also ensures that all static analysis and dynamic testing operations are performed in the runtime environment of the binary code, and the entire process of dynamic code execution is strictly controlled, effectively avoiding security risks in the auditing process.

[0017] Furthermore, this invention discloses a method that comprehensively employs static disassembly analysis, dynamic fuzzing, and dynamic taint analysis techniques to perform static analysis and dynamic testing on binary code within the binary code's runtime environment, thereby obtaining audit results. It is evident that this invention can comprehensively cover various security issues such as static defects in binary code, dynamic runtime vulnerabilities, and data security risks. Attached Figure Description

[0018] Figure 1 This is a flowchart of the binary code security auditing method of the present invention; Figure 2 This is a schematic diagram of the binary code security auditing system of the present invention; Figure 3 This is a flowchart of the binary code security auditing method in Embodiment 4 of the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device of the present invention. Detailed Implementation

[0019] To further understand the content of this invention, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments are merely illustrative and not limiting of the invention.

[0020] Example 1: The flowchart of the binary code security auditing method of this invention is as follows: Figure 1 As shown, the binary code security auditing method of the present invention includes the following steps: S1. Obtain the binary code to be audited, denoted as binary code; S2. Obtain the target environment configuration required to run the binary code; S3. Build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code; S4. Perform static analysis and dynamic testing on the binary code in the binary code runtime environment to obtain audit results; S5. Based on the audit results, analyze the security vulnerabilities of the binary code and obtain a binary code security audit report.

[0021] Example 2: A schematic diagram of the binary code security auditing system of this invention is shown below. Figure 2 As shown, the binary code security auditing system of the present invention includes: The first data acquisition module is used to acquire the binary code to be audited, denoted as binary code; The second data acquisition module is used to acquire the target environment configuration required to run binary code; The runtime environment determination module is used to build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code. The audit result determination module is used to perform static analysis and dynamic testing on binary code in the binary code runtime environment to obtain audit results; The analysis module is used to analyze the security vulnerabilities of binary code based on audit results and generate a binary code security audit report.

[0022] Example 3: The binary code security auditing method of the present invention includes the following steps: S1. Obtain the binary code to be audited, denoted as binary code.

[0023] This step involves obtaining the binary code to be audited, denoted as binary code, specifically: The binary code to be audited is obtained using a non-contact method and recorded as binary code; The binary code to be audited in this step includes embedded system firmware, industrial control applications, or dynamic link library files.

[0024] S2. Obtain the target environment configuration required to run the binary code.

[0025] This step involves obtaining the target environment configuration required to run the binary code, specifically: A non-contact method is used to obtain the target environment configuration required to run binary code.

[0026] This step involves configuring the target environment, including the operating system type, version information, hardware architecture information, and a list of dependent libraries.

[0027] S3. Build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code.

[0028] This step involves building a virtualized container, specifically: We use the open-source Docker virtualization container technology to build virtualized containers.

[0029] After obtaining the runtime environment of the binary code in this step, the runtime environment of the binary code is checked to confirm whether the configuration information in the runtime environment of the binary code is consistent with the target environment configuration required to run the binary code.

[0030] S4. Perform static analysis and dynamic testing on the binary code in the binary code runtime environment to obtain audit results.

[0031] This step involves performing static analysis and dynamic testing on the binary code within its runtime environment to obtain audit results, specifically: By comprehensively employing static disassembly analysis, dynamic fuzzing, and dynamic taint analysis techniques, the binary code is subjected to static analysis and dynamic testing within the binary code's runtime environment to obtain audit results.

[0032] S5. Based on the audit results, analyze the security vulnerabilities of the binary code and obtain a binary code security audit report.

[0033] Example 4: The binary code security auditing method of this invention is specifically implemented through a binary code security auditing system (hereinafter referred to as the auditing system). The flowchart of the binary code security auditing method of this invention is as follows: Figure 3 As shown below, the method of the present invention will be described in detail. The binary code security auditing method of the present invention includes the following steps: Step 1: Obtain the binary code to be audited using a non-contact method (in this embodiment, the binary code is stored in the form of a code file).

[0034] Binary code includes embedded system firmware, industrial control applications, or dynamic link library files.

[0035] The contactless method includes two implementations: a single-frame transmission method for high-capacity PM-Code three-layer QR codes and a batch transmission method for ordinary QR codes via timed rotation.

[0036] Among them, the high-capacity PM-Code three-layer QR code single-frame transmission method refers to the auditee using PM-Code three-layer QR code technology to generate a color PM-Code three-layer QR code that can store a large amount of information, then packaging the binary code data that needs to be transmitted into a compressed file, inserting it into the PM-Code three-layer QR code, and displaying it on a display screen. Then, the auditors use a scanning device with a camera to identify the QR code on the display screen and extract the compressed data from the QR code.

[0037] The standard QR code timed rotation batch transmission method refers to the audited object using a common QR code as the data carrier. Due to the limited data storage capacity of a single QR code image, the complete binary code file is split into hundreds of standard QR code images carrying fragmented data. The audited device displays all QR code images in a frame-by-frame rotation at fixed time intervals. The auditing end scanning device maintains a synchronous frame rate to read each displayed QR code image in real time. After all images have been read, all fragmented data are extracted in sequence, integrated and spliced ​​into a complete data packet, and finally restored to the original format binary code file, completing contactless data extraction.

[0038] This invention supports both high-capacity single-frame fast transmission of PM-Code, adapting to efficient auditing scenarios, and timed rotation transmission of general-purpose QR codes, adapting to scenarios without dedicated decoding equipment and general-purpose terminals, demonstrating extremely strong compatibility.

[0039] The non-contact method for obtaining the binary code to be audited includes the following steps: A. Packaging binary code files Package the binary code file to be audited and its dependent files into an image file, i.e., an ISO file or a compressed file; B. File Slicing Divide the image file or compressed file into N sub-files according to a preset size unit; C. QR code generation Using a contactless method, N QR code images are generated. The QR code type can be either PM-Code three-layer QR code or ordinary general QR code. D. File Slicing and Packaging The sub-files are inserted into the data fields of the corresponding QR code images to form QR code images containing binary code data, which are then displayed on the screen of the audited device. E. File Slicing Extraction Auditors used a non-contact method, employing a scanning device equipped with a high-definition camera to read the QR code on the display screen, thereby extracting the binary code slice data encapsulated in the QR code; F. File Slicing and Reassembly The extracted data is sorted and recombined into a complete file according to the slice data sequence number, thus realizing non-contact extraction of binary code files.

[0040] In the QR code generation process, when using a common, universal QR code for contactless extraction, the specific steps include: A. File preprocessing and fine-grained slicing: The binary firmware, program or dynamic link library file to be audited is compressed and packaged, and fine-grained slicing is performed equally according to the maximum storage capacity of ordinary QR codes, generating hundreds of binary data slices of uniform size and carrying unique serial numbers. B. Batch QR code generation: Each piece of binary data is sliced ​​and encapsulated separately into the ordinary QR code data area, and a corresponding number of QR code images are generated in batches. All QR codes are uniformly sorted and named according to the slice order to ensure that the sequence is unique and traceable. C. Timed Rotation Display: The audited device's display screen rotates all batch-generated QR code images frame by frame at preset fixed time intervals, with uniform rotation speed throughout the process, no frame skipping, and no repetitive display; D. Synchronous frame rate scanning and acquisition: The high-definition scanning device at the audit end pre-matches the equipment rotation time interval to maintain frame rate synchronization, captures and identifies each displayed QR code image in real time, and synchronously stores the segment data and sequence number corresponding to each image; E. Data Verification and Reassembly: After all QR code images have been collected in a carousel, the auditing system sorts, deduplicates, and verifies the integrity of all data segments according to their sequence numbers, eliminates misidentified and missing data, automatically completes missing segments, and finally splices and integrates them to obtain a complete original binary code file, thus completing contactless and non-interactive data extraction.

[0041] Step 2: Use a non-contact method to obtain the target environment configuration required to run the binary code to be audited.

[0042] The target environment configuration includes the operating system type, version information, hardware architecture information, and a list of dependent libraries.

[0043] Step 3: Build a virtualization container, load the binary code to be audited and the target environment configuration required by the binary code to be audited into the virtualization container, and obtain the runtime environment of the binary code (also known as restoring the runtime environment of the binary code).

[0044] The process involves building a virtualization container, loading the binary code to be audited and the target environment configuration required by the binary code into the virtualization container, thus obtaining the runtime environment for the binary code. Specific steps include: A. Container Setup We will use the open-source Docker virtualization container technology to build a virtualized container (referred to as a virtualized container). B. Environment Loading Load the binary code to be audited and the target environment configuration required by the binary code into the virtualization container to obtain the runtime environment of the binary code; C. Environmental Inspection Check the runtime environment of the binary code to confirm whether the configuration information in the runtime environment of the binary code is consistent with the target environment configuration required to run the binary code.

[0045] Step 4: Perform static analysis and dynamic testing on the binary code in the runtime environment of the binary code in Step 3 to obtain the audit results.

[0046] In the binary code runtime environment of step 3, static analysis and dynamic testing (static analysis and dynamic testing are collectively referred to as security audit analysis) are performed on the binary code to obtain audit results.

[0047] This step involves performing static analysis and dynamic testing on the binary code within its runtime environment to obtain audit results, specifically: By comprehensively employing static disassembly analysis, dynamic fuzzing, and taint analysis techniques, static analysis and dynamic testing of binary code are performed in the binary code's runtime environment to obtain audit results. The following provides a detailed explanation of this method: a. Static disassembly analysis (no code execution, offline auditing) It performs disassembly and decompilation analysis on binary programs, firmware programs, and dynamic link libraries without source code. Specifically, this includes instruction flow analysis, function boundary identification, control flow graph and data flow graph construction, string constant extraction, import and export function traversal, and dependency library interface verification. At the same time, it matches general vulnerability feature libraries, industrial control firmware-specific vulnerability libraries, and code defect rule libraries to statically detect static vulnerabilities such as buffer overflows, integer overflows, null pointer references, out-of-bounds reads and writes, uninitialized variables, illegal privilege calls, hard-coded keys, backdoor instructions, malicious code fragments, insecure function calls, and protocol parsing defects. Basic vulnerability and defect screening can be completed without running the program.

[0048] b. Dynamic fuzz testing (dynamic input fault tolerance auditing) In the real-world operating environment restored by the virtualized container, automated fuzz testing is performed on the input interface of binary code, data parsing module, protocol processing module, file parsing module, and peripheral interaction interface. By autonomously generating unconventional test cases such as malformed data packets, excessively long data, special characters, illegal format parameters, boundary extreme value data, and abnormal protocol messages, these test cases are continuously injected into the program's running ports in batches. The program's running status is monitored in real time, and abnormal behaviors such as program crashes, freezes, abnormal exits, memory leaks, abnormal permissions, data tampering, and abnormal instruction execution are captured. This allows for the precise discovery of dynamic operational security issues such as unknown vulnerabilities, zero-day vulnerabilities, boundary fault tolerance defects, and missing input validation.

[0049] c. Dynamic taint analysis (data flow tracking audit) Using external input data, network transmission data, file reading data, and peripheral input data as taint sources, the system dynamically marks, tracks, and analyzes the propagation of taints throughout the entire binary code execution process. It monitors the flow path of tainted data in memory, registers, function stacks, and business processes. It accurately identifies high-risk vulnerabilities such as direct execution of unfiltered tainted data, illegal flow of sensitive data, unauthorized access to tainted data, code anomalies caused by data pollution, leakage of sensitive information, arbitrary code execution, and memory corruption. It locates the vulnerability triggering chain, pollution nodes, and risk triggering conditions, enabling precise tracing of the vulnerability's cause and propagation path.

[0050] d. Comprehensive audit verification By integrating the audit results of the three types of technologies, duplicate vulnerabilities and false alarm risks are eliminated and verified. Different levels of security vulnerabilities such as high-risk remote code execution, arbitrary file reading, privilege escalation, information leakage, denial of service, local privilege escalation, and data tampering are distinguished, and a full-dimensional and full-process security audit and assessment of binary code is completed.

[0051] Step 5: Based on the audit results obtained in Step 4, analyze the security vulnerabilities of the binary code and obtain a binary code security audit report.

[0052] Based on the audit results obtained in step 4, the security vulnerabilities of the binary code are analyzed, and a binary code security audit report (hereinafter referred to as the security audit report) is obtained.

[0053] Example 5: This embodiment provides two non-contact extraction implementation scenarios, each adapted to different application environments. The two scenarios are described below: Scenario 1: Large-capacity extraction of PM-Code three-layer QR codes in a single frame (efficient auditing scenario) For small and medium-sized industrial control programs and dynamic link library files, PM-Code three-layer QR code technology is used to achieve rapid single-frame extraction. The audited device packages and compresses the industrial control program and its dependent files, encapsulating them into a single color PM-Code three-layer QR code, which is statically displayed on the screen. Auditors use a high-definition scanning device to identify and decode the code in one pass, directly obtaining the complete compressed file data. After decompression, the original binary code file is obtained, completing the non-contact, rapid extraction. The overall process is quick, requires no fragmentation or reconstruction, and has high audit efficiency.

[0054] Scenario 2: Batch extraction of regular QR codes during timed carousel (general device compatibility scenario) For general isolation devices with large embedded firmware files and no dedicated PM-Code decoding equipment, a common QR code timed rotation synchronous acquisition scheme is adopted. The specific steps include: a. File packaging preprocessing The firmware of a certain industrial embedded device was selected as the audit object. The firmware and its supporting dependency library files were packaged into a ZIP archive to ensure file integrity. The size of the compressed file was 8.6MB. b. Refined segmentation processing Based on the maximum storage capacity of 1280 bytes for a single QR code image, the compressed file is evenly divided into 682 data fragments. Each fragment is automatically generated with a unique serial number (001-682), a global MD5 checksum, and a fragment count identifier. c. Batch QR code generation The 682 binary data pieces were divided into segments and encoded one by one to generate 682 standard universal QR code images. All images were archived in order according to their sequence numbers. d. Fixed-interval carousel display The audited isolation device's display screen is set to an automatic carousel mode with a fixed interval of 200ms. Starting from QR code number 001, all 682 QR code images are displayed frame by frame in an orderly manner. There are no frame skips, no repetitions, and no pauses throughout the entire process. The total carousel duration is approximately 136 seconds. e. Synchronous frame rate scanning acquisition The high-definition scanning equipment at the audit end is pre-configured with a 200ms acquisition frame rate, which is precisely synchronized with the equipment's rotation frequency. It automatically captures, decodes, and stores the segmented data and sequence information of each QR code throughout the process, and automatically identifies and removes blurry, reflective, and erroneous abnormal frames. f. Data verification and file reconstruction After the carousel data collection is completed, the auditing system automatically sorts all data segments according to the sequence number 001-682, performs integrity verification through global MD5 checksum, automatically identifies and marks any missing segments, completes the data, and finally splices and reassembles them into a complete 8.6MB firmware compressed package. After decompression, the original embedded firmware binary code file is obtained.

[0055] Example 6: Please see Figure 4 As shown, the present invention also provides an electronic device 100 for a binary code security auditing method; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0056] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the binary code security auditing method described in Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0057] The at least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100, connecting various parts of the electronic device 100 via various interfaces and lines.

[0058] The memory 101 in the electronic device 100 stores multiple instructions to implement a binary code security auditing method, and the processor 102 can execute the multiple instructions to achieve the following: Obtain the binary code to be audited, denoted as binary code; Obtain the target environment configuration required to run the binary code; Build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code; Static analysis and dynamic testing of binary code are performed in the binary code runtime environment to obtain audit results; Based on the audit results, the security vulnerabilities of the binary code are analyzed, and a binary code security audit report is obtained.

[0059] Example 7: If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0060] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0061] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0062] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0063] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A binary code security auditing method, characterized in that, Includes the following steps: Obtain the binary code to be audited, denoted as binary code; Obtain the target environment configuration required to run the binary code; Build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code; Static analysis and dynamic testing of binary code are performed in the binary code runtime environment to obtain audit results; Based on the audit results, the security vulnerabilities of the binary code are analyzed, and a binary code security audit report is obtained.

2. The binary code security auditing method according to claim 1, characterized in that, The process of obtaining the binary code to be audited, denoted as binary code, specifically involves: The binary code to be audited is obtained using a non-contact method and recorded as binary code; The specific steps for obtaining the target environment configuration required to run the binary code are as follows: A non-contact method is used to obtain the target environment configuration required to run binary code.

3. The binary code security auditing method according to claim 1, characterized in that, The binary code to be audited includes embedded system firmware, industrial control applications, or dynamic link library files.

4. The binary code security auditing method according to claim 1, characterized in that, The target environment configuration includes operating system type, version information, hardware architecture information, and a list of dependent libraries.

5. The binary code security auditing method according to claim 1, characterized in that, The construction of the virtualized container specifically involves: We use the open-source Docker virtualization container technology to build virtualized containers.

6. The binary code security auditing method according to claim 1, characterized in that, After obtaining the runtime environment of the binary code, check the runtime environment of the binary code to confirm whether the configuration information in the runtime environment of the binary code is consistent with the target environment configuration required to run the binary code.

7. The binary code security auditing method according to claim 1, characterized in that, The process of performing static analysis and dynamic testing on the binary code within the binary code's runtime environment to obtain audit results specifically includes: By comprehensively employing static disassembly analysis, dynamic fuzzing, and dynamic taint analysis techniques, the binary code is subjected to static analysis and dynamic testing within the binary code's runtime environment to obtain audit results.

8. A binary code security auditing system, characterized in that, include: The first data acquisition module is used to acquire the binary code to be audited, denoted as binary code; The second data acquisition module is used to acquire the target environment configuration required to run binary code; The runtime environment determination module is used to build a virtualization container, load the binary code and the target environment configuration required by the binary code into the virtualization container, and obtain the runtime environment of the binary code. The audit result determination module is used to perform static analysis and dynamic testing on binary code in the binary code runtime environment to obtain audit results; The analysis module is used to analyze the security vulnerabilities of binary code based on audit results and generate a binary code security audit report.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the binary code security auditing method according to any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the binary code security auditing method according to any one of claims 1 to 7.

Images