Analysis apparatus, analysis method, and analysis program

Abstract

To properly obtain information on a shared body for binaries of unknown specifications.SOLUTION: An analysis apparatus 100 includes a tagged shared body detection unit 122 and a tagged shared body analysis unit 123. The tagged shared body detection unit 122 detects a tagged shared body based on a test input from a program that has received the test input. The tagged shared body analysis unit 123 analyzes, based on the test input, the tagged shared body detected by the tagged shared body detection unit 122.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an analysis device, an analysis method, and an analysis program. [Background technology]

[0002] [About unions] One of the data types provided by programming languages ​​is the union. A union is a type in which multiple types share the same memory area. This allows flexible management when a value can have multiple types, making it possible to hold values ​​of various types in a single memory area without having to allocate memory areas separately for each type.

[0003] For example, if a variable can potentially hold either an integer or a floating-point number, a simple solution would require one variable to hold an integer and one to hold a floating-point number, but by using a union that can hold both integers and floating-point numbers, a single variable can hold both types.

[0004] [About tagged unions] One of the implementation methods for data structures using unions is the tagged union. This is a data structure that adds information about the type currently held in the memory area of ​​the union to the previously mentioned union. This makes it possible to access the data held by the union in the appropriate type and extract the value.

[0005] For example, in the example of a union that can hold integers and floating-point numbers mentioned above, a tag is added that defines that if the tag is 0, it holds an integer, and if it is 1, it holds a floating-point number. Then, when a value is stored in the union, an appropriate value is set to the tag according to the type of the value. This makes it possible to access the union in the appropriate type by checking the tag when accessing the union, and accessing it as an integer if it is 0, or as a floating-point number if it is 1.

[0006] Here, a specific example of a tagged union will be described with reference to Fig. 1. Fig. 1 is a diagram showing a specific example of pseudo code for a tagged union according to an embodiment. In the pseudo code for the tagged union shown in Fig. 1, lines 2 to 8 are the union part, and line 9 is the tag part.

[0007] The tagged union in the pseudocode example in Figure 1 can have an "integer", "floating-point number", "string", and "function pointer". Also, the interpretation of the type of the value of the union part is determined according to the value of the tag part, such as "tag 0: integer" and "tag 1: floating-point number".

[0008] [About value objects] One example of an implementation using tagged unions is the value objects used by script engines. Value objects hold the values ​​of functions, variables, and constants used in scripts. Value objects are generally implemented using tagged unions because they are required to be able to hold values ​​of various types that can be used in script implementations.

[0009] Therefore, if the structure of a tagged union and the relationship between the value held by the tag and the type of the union are clarified, it is possible, for example, by referencing a value object to determine the type of the value held internally by the script engine, which can be useful for analyzing variables held by the script.

[0010] [Script Analysis] Script analysis techniques are used for a variety of purposes, including compiler optimization for JIT compilation, software testing and debugging, fuzzing, and malware analysis.

[0011] [Importance of obtaining variable information] Obtaining variable information is one of the important elements in analyzing a script. What variables a script holds when it is executed is important information for understanding the function of the script.

[0012] The variable information here includes information such as how many variables exist in what scope, what values ​​each variable holds, and which code part reads and writes to which variable. To obtain such variable information, the script must be analyzed. To achieve this analysis, analysis support functions such as debuggers and bytecode disassemblers are provided, and they can sometimes be used. However, if such functions are not available, it is necessary to analyze the script yourself to obtain variable information, which is not easy.

[0013] [Analysis method] There are two techniques for analyzing programs that contain scripts: static analysis and dynamic analysis. Dynamic analysis is a technique that analyzes the behavior of the program by actually executing it and observing its behavior. Static analysis is a technique that analyzes the functions of the program by interpreting its meaning without executing it. These techniques are used to obtain variable information.

[0014] [The importance of dealing with obfuscation] One technique for hindering analysis is obfuscation. Obfuscation involves applying conversions to programs that make them difficult to interpret, primarily to hinder static analysis. In the case of script obfuscation, for example, parts of the script are encoded or encrypted, and then dynamically decoded or decrypted at run time before being executed. In such cases, it is not clear what type of script will be executed until it is run. This makes static analysis of the script difficult.

[0015] Malicious scripts and protected scripts are generally obfuscated, making static analysis difficult. Software protection is an important technique for protecting the intellectual property rights of creators. Reverse engineering is a technique for clarifying the technology used to implement software. This is a technique for analyzing a program to understand its structure and specifications. Software protection is a technique for protecting software from program analysis for such reverse engineering.

[0016] [Script execution method] Scripts are executed by a crypto engine (also called an interpreter). Scripts are generally converted into bytecode at runtime, and the bytecode is interpreted and executed by a virtual machine (VM). Therefore, the script is analyzed before execution, and the bytecode is analyzed at runtime. Here, as mentioned above, if the script is obfuscated, static analysis before execution becomes difficult. For this reason, it is necessary to dynamically analyze the bytecode and obtain variable information from the information obtained at runtime.

[0017] [About the symbol table] In script engines, constants and variables are generally managed by symbol tables. Symbol tables are tables that store information such as names, values, and types for variables, constants, subroutines, etc., and are created in the semantic analysis phase. Symbol tables in script engines generally hold information such as name, type (variable, constant, subroutine, etc.), scope, attributes (depending on the type, e.g., whether it is a constant or variable, and what type), and value. These symbol tables are generally constructed using value objects.

[0018] Therefore, in order to clarify the information of the variables used by the script, it is necessary to obtain the information of the value objects held in the symbol table. As mentioned above, value objects are generally implemented using tagged unions, so analysis of tagged unions is important.

[0019] [Tagged union analysis] In the above series of descriptions, we have explained the structure of tagged unions and script analysis, but the internal specifications, such as what kind of structure a tagged union has internally and what the type of the union is when the tag holds what value, are not generally disclosed and must be known through analysis. In particular, in the case of proprietary script engines, it is difficult to know without reverse engineering the binary. [Prior art documents] [Non-patent literature]

[0020] [Non-Patent Document 1] Asia Slowinska, Traian Stancescu, and Herbert Bos, Howard: a Dynamic Excavator for Reverse Engineering Data Structures, In Proceedings of the 18th Network and Distributed Systems Security Symposium, 2011 Summary of the Invention [Problem to be solved by the invention]

[0021] However, the above conventional techniques are unable to properly obtain union information for binaries with unknown specifications. For example, the conventional techniques are unable to perform semantic analysis such as the correspondence between tag values ​​and unions, in addition to analyzing which member variables of a tagged union are tags, and are therefore unable to obtain sufficient union information for binaries with unknown specifications. [Means for solving the problem]

[0022] In order to solve the above-mentioned problems and achieve the object, the analysis device of the present invention is characterized by having a tagged union detection unit that detects tagged unions based on the test input from a program that accepts test input, and a tagged union analysis unit that analyzes the tagged union detected by the tagged union detection unit based on the test input. Effect of the Invention

[0023] According to the present invention, it is possible to obtain union information appropriately for a binary whose specifications are unknown. [Brief description of the drawings]

[0024] [Figure 1] FIG. 1 is a diagram showing a specific example of pseudo code for a tagged union according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing a system including an analysis device according to an embodiment. [Diagram 3] FIG. 3 is a diagram showing a specific example of a test input according to the embodiment. [Figure 4] FIG. 4 is a block diagram illustrating an example of the configuration of the analysis device according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of an execution trace according to the embodiment. [Figure 6] FIG. 6 is a flowchart showing an example of an overall process flow of the analysis device according to the embodiment. [Figure 7] FIG. 7 is a flowchart illustrating an example of the execution trace acquisition process according to the embodiment. [Figure 8] FIG. 8 is a flowchart illustrating an example of the tagged union detection process according to the embodiment. [Figure 9] FIG. 9 is a flowchart illustrating an example of the tagged union detection process according to the embodiment. [Figure 10] FIG. 10 is a diagram showing a specific example of the process of extracting the tag part of a tagged union according to the embodiment. [Figure 11]FIG. 11 is a flowchart illustrating an example of a process for identifying a type held by a tagged union according to an embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of a computer that executes an analysis program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] Hereinafter, an embodiment of an analysis device, an analysis method, and an analysis program according to the present application will be described in detail with reference to the drawings. Note that the analysis device, the analysis method, and the analysis program according to the present application are not limited to the embodiment.

[0026] [1. Overall structure] An overall configuration of a system including an analysis device 100 according to the present embodiment will be described. Fig. 2 is a diagram showing a system including an analysis device according to an embodiment. In the system shown in Fig. 2, analysis device 100 and external device 200 are shown, and a test input and a program (analysis target binary) are transmitted from external device 200 to analysis device 100. Here, in the following description, a process will be described in the case where the program is the analysis target binary.

[0027] Analysis device 100 is an information processing device that analyzes a binary to be analyzed by using a test input and analyzes a tagged union structure and a relationship between a tag and a union, and is realized by a computer, etc. Analysis device 100 is connected to external device 200 via wired or wireless communication so as to be able to communicate with external device 200 and transmit and receive information.

[0028] The external device 200 is, for example, an information processing device that transmits a test input and an analysis target binary to the analysis device 100, and is configured by a computer or the like. Here, with reference to FIG. 3, the test input transmitted from the external device 200 and received by the analysis device 100 will be described. FIG. 3 is a diagram showing a specific example of a test input according to an embodiment. Note that in the example of FIG. 3, a script engine and a test script are used for the analysis target binary and the test input, but this is not limited thereto, and any executable binary and test input can be used.

[0029] The test input can specify a value held by the union part of a tagged union used internally by the binary to be analyzed. The test input can also cause the tagged union to hold different tags (specify a type). In the example of FIG. 3, the test input can hold three types of values, "integer", "floating point number", and "character string", so that tags corresponding to each type can be held one-to-one. Here, the value (integer, etc.) held by the union part of the tagged union can be guessed from a general expression method, but the value of the corresponding tag cannot be guessed because there is no specific rule. Therefore, the analysis process by the analysis device 100 clarifies the correspondence between the value held by the union part and the tag value. As an example, the binary to be analyzed in this embodiment interprets a value type consisting of only numbers as an "integer", a value type consisting of only multiple numbers and one decimal point as a "floating point number", and a value type enclosed in double quotation marks as a "character string". Based on such specifications of the binary to be analyzed, the test input can specify a type.

[0030] The example in Figure 3 shows a case where three types of test inputs, each with a different tag, are stored in a tagged union with the mapping shown by the pseudo code in Figure 1. Specifically, the example shows a case where a "test input using an integer value: i=12345678", a "test input using a floating-point value: f=1.2345678", and a "test input using a string value: s="12345678" (the part enclosed in "" is interpreted as a string)" are stored in the tagged union as test inputs.

[0031] A tagged union holds the value of each test input in hexadecimal notation, and the tag holds different values ​​depending on the type of the value of each test input. For example, if "test input using an integer value: i=12345678" is held, the union part holds "0xbc614e (12345678 in decimal)" and the tag part holds "0x0001" (see Figure 1), which is the tag value corresponding to the integer value.

[0032] On the other hand, when "test input using a floating-point value: f=1.2345678" is held, the union portion holds "0x3f9e0651 (1.2345678 in decimal)" and the tag portion holds "0x0002" (see FIG. 1), which is a tag value corresponding to the floating-point value. As shown in the example of FIG. 3, by accepting multiple test input values ​​of different types, the analysis device 100 can compare the tag values ​​when test inputs of each type are held, and therefore can analyze the correspondence between the type held by the tagged union and the tag value.

[0033] The analysis device 100 acquires an execution trace, which will be described later, by executing a plurality of test inputs, each of which specifies a type and a value, on the binary to be analyzed. The analysis device 100 then detects, as a tagged union, a structure that includes values ​​specified in the plurality of test inputs, among structures included in the execution trace. The analysis device 100 then identifies the type indicated in the detected tagged union, based on the value of the test input.

[0034] As a result, the analysis device 100 can analyze the binary to be analyzed using the test input, identify the type indicated in the tagged union, and obtain detailed information about the tagged union, so that even for a binary whose specifications are unknown, it is possible to obtain information about the tagged union used within the binary.

[0035] 2. Configuration of analysis device 100 Next, the configuration of the analysis device 100 shown in Fig. 2 will be described with reference to Fig. 4. Fig. 4 is a block diagram showing an example of the configuration of the analysis device according to the embodiment. Analysis device 100 has an input unit 110, a control unit 120, a storage unit 130, and an output unit 140, and receives a test input and an analysis target binary from an external device 200.

[0036] The input unit 110 is composed of input devices such as a keyboard and a mouse, and receives input of information from the outside and inputs it to the control unit 120. The input unit 110 also has a communication interface for transmitting and receiving various information to and from other devices connected via a wired connection or a network, and receives input of information transmitted from other devices. For example, the input unit 110 receives input of a test input and an analysis target binary, and outputs it to the control unit 120.

[0037] The storage unit 130 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk, and stores a processing program that operates the analysis device 100, data used during execution of the processing program, etc. The storage unit 130 has an execution trace DB 131, which will be described later, and an architecture information DB 132 that stores architecture information acquired by analysis.

[0038] Execution trace DB 131 stores the execution trace acquired by an execution trace acquisition function of analysis device 100. Execution trace DB 131 is managed by analysis device 100. Of course, execution trace DB 131 may be managed by another device (such as a server). In this case, the acquired execution trace is output to a management server of execution trace DB 131 or the like via a communication interface of analysis device 100, and is stored in execution trace DB 131.

[0039] Here, an execution trace will be explained. An execution trace is made up of a branch trace and a memory access trace. A branch trace records the type of branch instruction at the time of execution, the branch source address, and the branch destination address. A memory access trace records the type of memory operation at the time of execution (read / write), and the memory address and value of the operation target. It is also known that branch traces and memory access traces can be obtained by hooking memory operation instructions, inserting code for log output, and executing that code.

[0040] Next, the configuration of an execution trace will be explained. Fig. 5 is a diagram showing an example of an execution trace. As mentioned above, an execution trace is composed of a branch trace and a memory access trace. Fig. 5 shows an excerpt of a part of an execution trace. The configuration of an execution trace will be explained below with reference to Fig. 5.

[0041] An execution trace has an element called "trace." In "trace," it is indicated whether the log line is a branch trace or a memory access trace.

[0042] A branch trace log line has the format shown in lines 1 to 10 of Figure 5, for example, and consists of three elements: type, src, and dst. type indicates whether the executed branch instruction was a call instruction, a jmp instruction, or a ret instruction. src indicates the address of the branch source, and dst indicates the address of the branch destination.

[0043] A log line of a memory access trace has the format shown in lines 11 to 13 of Figure 5, for example, and consists of three elements: type, target, and value. Type indicates whether the memory access is a read or write. Target indicates the memory address that is the target of the memory access. Value stores the result of the memory access.

[0044] Returning to the explanation of Fig. 4, the control unit 120 is realized by a CPU (Central Processing Unit), MPU (Micro Processing Unit), etc., executing various programs stored in a storage device inside the device using a RAM as a working area. The control unit 120 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 120 has an execution trace acquisition unit 121, a tagged union detection unit 122, and a tagged union analysis unit 123.

[0045] The output unit 140 is, for example, a liquid crystal display or a printer, and outputs information about the tagged union identified by the tagged union analysis unit 123 described later. The output unit 140 may be an interface that controls input and output of various data between the output unit 140 and the external device 200, and may output various information to the external device 200.

[0046] Here, the overall process flow of analysis device 100 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of the overall process of the analysis device according to the embodiment. In the following, first, the overall process flow of analysis device 100 will be described, and then each process will be described individually.

[0047] First, the input unit 110 receives a test input and a binary to be analyzed (S11). Then, the execution trace acquisition unit 121 acquires an execution trace of a program that has received a test input specifying a type and a value (S12). Next, the tagged union detection unit 122 detects, from among structures included in the execution trace, a structure that includes a value specified in the test input as a tagged union (S13).

[0048] Next, tagged union analysis unit 123 analyzes the correspondence between the tag value and the type of the detected tagged union based on the test input (S14). After that, output unit 140 outputs the tag value, the member variable that holds the tag, and the correspondence between the tag value and the type (S15), and analysis device 100 ends the process.

[0049] The execution trace acquisition unit 121 acquires an execution trace when a test input with a specified type and value is executed by the binary to be analyzed, and stores the execution trace in the execution trace DB 131. Here, a specific example of the execution trace acquisition process (S12 in FIG. 6) will be described with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the execution trace acquisition process according to the embodiment.

[0050] First, the execution trace acquisition unit 121 receives a test input and an analysis target binary as input (S121). Then, the execution trace acquisition unit 121 hooks the received analysis target binary to acquire a branch trace (S122). The execution trace acquisition unit 121 also hooks the received analysis target binary to acquire a memory access trace (S123).

[0051] Then, the execution trace acquisition unit 121 inputs the received test input in this state to the binary to be analyzed and executes it (S124), and stores the execution trace acquired thereby in the execution trace DB 131 (S125).

[0052] Thereafter, if all the input test inputs have been executed (S126: Yes), the execution trace acquisition unit 121 ends the process. On the other hand, if all the input test inputs have not been executed (S126: No), the execution trace acquisition unit 121 returns to the execution of the test inputs in step S124 and continues the process.

[0053] The tagged union detection unit 122 detects a tagged union based on the test input from a program that has received the test input. Specifically, the tagged union detection unit 122 detects, as a tagged union, a structure that includes a value specified in the test input among structures included in the execution trace of the analysis target binary that has received the test input with the specified type and value. For example, the tagged union detection unit 122 refers to the execution trace stored in the execution trace DB 131 by the execution trace acquisition function described above, and detects, as a tagged union, a structure that is detected by searching for the value of the test input among structures included in the execution trace of the analysis target binary that has received the test input with the specified type and value.

[0054] Furthermore, the tagged union detection unit 122 detects a tagged union from an execution trace of a program that accepts multiple input values ​​as test inputs, each of which can specify a value that the union part of the tagged union internally holds and can hold a different tag depending on the value. For example, the tagged union detection unit 122 detects a tagged union from an execution trace when the following test inputs are accepted: "test input using an integer value: i=12345678", "test input using a floating-point value: f=1.2345678", and "test input using a character string value: s="12345678"" (see FIG. 3).

[0055] Here, a specific example of the process (S13 in FIG. 5) of the tagged union detection unit 122 will be described with reference to Fig. 8 and Fig. 9. Fig. 8 and Fig. 9 are flowcharts showing an example of the tagged union detection process according to the embodiment.

[0056] First, the tagged union detection unit 122 receives a plurality of test inputs and an execution trace (S1301). Then, the tagged union detection unit 122 selects one memory access seen in the memory access trace (S1302). Next, if the memory access uses a base register (S1303; Yes) and does not use an index register (S1304; No), the tagged union detection unit 122 determines that the memory access destination is a member variable of a structure (S1305).

[0057] On the other hand, if the memory access does not use the base register (S1303; No), or if the memory access uses the index register (S1304; Yes), the tagged union detection unit 122 selects the next memory access (S1310) and then returns to the process of S1303 to continue the process.

[0058] After the process of S1305, the tagged union detection unit 122 acquires the base register and the execution address at the time of the memory access (S1306). Next, the tagged union detection unit 122 detects the value of the base register as the start address of the structure of the memory access destination (S1307). Next, the tagged union detection unit 122 calculates the offset of the member variable of the structure of the memory access destination (S1308). Thereafter, if the processes of all memory accesses have not been completed (S1309; No), the tagged union detection unit 122 selects the next memory access (S1310) and then returns to the process of S1303 to continue the process.

[0059] On the other hand, if all memory access processing has been completed (S1309; Yes), the tagged union detection unit 122 selects one test input value (S1311). Next, the tagged union detection unit 122 searches the member variables of the structure for the value of the test input (S1312). Then, if the tagged union detection unit 122 finds the test input in the member variable (S1313; Yes), it determines that the structure holds the test input (S1314). On the other hand, if the test input is not found in the member variable (S1313; No), the tagged union detection unit 122 selects the next test input value (S1317), and then returns to S1311 to continue processing.

[0060] After the process of S1314, if the tagged union detection unit 122 has finished processing all the test input values ​​(S1315; Yes), it compares the structures of the structures holding the test inputs of different types (S1316). On the other hand, if the tagged union detection unit 122 has not finished processing all the test inputs (S1315; No), it selects the next test input value (S1317) and then returns to S1311 to continue the process.

[0061] If the tagged union detection unit 122 finds an identical structure after the process of S1316 (S1318; Yes), it determines that the structure is a tagged union (S1319) and ends the process. On the other hand, if the tagged union detection unit 122 does not find an identical structure (S1318; No), it determines that it has not detected a tagged union and ends the process.

[0062] The tagged union analysis unit 123 analyzes the tagged union detected by the tagged union detection unit 122 based on the test input. For example, the tagged union analysis unit 123 detects differences between tagged unions while associating them with the test input, and identifies member variables in which differences depending on the type of the test input are found as parts that hold tags, thereby detecting tags of tagged unions and identifying the correspondence between the tag values ​​and types.

[0063] Here, the process of extracting the tag part of a tagged union by the tagged union analysis unit 123 will be described with reference to Fig. 10. Fig. 10 is a diagram showing a specific example of the process of extracting the tag part of a tagged union according to the embodiment. Fig. 10 shows an example of the structure of a tagged union in the case where a "test input using an integer value: i=12345678", a "test input using a floating-point value: f=1.2345678", and a "test input using a character string value: s="12345678"" are held as test inputs. Note that Fig. 10 shows only the tag part and union part of the tagged union, but it is assumed that the tagged union also has other member variables.

[0064] For example, if "test input using an integer value: i=12345678" is held, the tagged union will have a part that holds "0xbc614e" which represents 12345678 in decimal, and a tag part that holds the other value, "0x0001." However, it is not easy to distinguish between the tag part of the tagged union and the part of the union that holds the value of the test input.

[0065] Therefore, the tagged union analysis unit 123 determines that the part hit by the match of "0xbc614e" corresponding to the test input is the part of the tagged union that will make a difference depending on the value of the test input (the part that holds the value of the test input). In this way, the tagged union analysis unit 123 detects the part excluding the part that will make a difference depending on the value of the test input.

[0066] Similarly, when "test input using a floating-point number value: f=1.2345678" and "test input using a character string value: s="12345678"" are held as test inputs, the tagged union analysis unit 123 detects the parts excluding the parts that differ depending on the test input value.Then, by comparing the parts excluding the parts that differ depending on the test input value of the structures holding the respective test inputs, the tagged union analysis unit 123 detects the member variables that have differences due to the type of the test input as the parts that hold tags (parts that differ depending on the type).

[0067] In this way, the tagged union analysis unit 123 can appropriately extract the tag part of the tagged union by detecting the part where the difference occurs depending on the type of the test input from the part of the tagged union that is detected by comparing the test input values ​​and excluding the part where the difference occurs depending on the test input value. Note that in the above-mentioned process, the test input value is searched for in detecting the part where the difference occurs depending on the test input value, but this is not limited to this, and for example, the detection process can be performed by using the number of occurrences of the value instead of searching for the value.

[0068] The process using the occurrence count of the above-mentioned value will be described below with a concrete example. For example, by using a test input using 10 integer values, a test input using 20 floating-point numbers, and a test input using 30 character string values, 10 tagged unions with tag values ​​corresponding to the integers, 20 tagged unions with tag values ​​corresponding to the floating-point numbers, and 30 tagged unions with tag values ​​corresponding to the character strings are generated in memory. Therefore, by searching for structures with the same member variables with 10, 20, and 30 identical values, respectively, it is possible to detect tagged unions and parts where differences occur depending on the type of the test input. This makes it possible to detect tagged unions and parts where differences occur depending on the type of the test input, even for types whose values ​​cannot be directly specified, such as boolean types.

[0069] Next, a specific example of the process (S14 in FIG. 6) of the tagged union analysis unit 123 will be described with reference to Fig. 11. Fig. 11 is a flowchart showing an example of a process of specifying a type held by a tagged union according to an embodiment.

[0070] First, the tagged union analysis unit 123 receives a plurality of test inputs and a tagged union (S141). Then, the tagged union analysis unit 123 detects a member variable that holds the value of the test input from the tagged union by matching (S142). Next, the tagged union analysis unit 123 extracts a part of the tagged union that does not depend on the value of the test input (S143). Next, the tagged union analysis unit 123 detects differences between tagged unions while associating them with the test inputs (S144).

[0071] Then, the tagged union analysis unit 123 identifies member variables for which a difference was found depending on the type of the test input as a part that holds a tag (S145). Next, the tagged union analysis unit 123 detects the correspondence between the tag value and the type based on the dependency between the test input type and the tag value (S146). Then, the tagged union analysis unit 123 identifies the type held by the tagged union from the type of the tag value for the test input value (S147), and ends the process.

[0072] The output unit 140 outputs the tag value of the tagged union and the member variable that holds the tag, along with the correspondence between the tag value and type of the tagged union. For example, when the type of "12345678" of the tagged union is input, the tag is "0x0001" (see FIG. 3), and therefore the output unit 140 outputs detailed data regarding the tagged union, such as information that the type of the integer corresponds to the tag "0x0001", information that the tagged union can hold values ​​of the types "integer", "floating point number", and "character string", information on which member variable of the tagged union holds a value, and information on which member variable is a tag.

[0073] 3. Effects of the embodiment As described above, the analysis device 100 according to this embodiment includes the tagged union detection unit 122 and the tagged union analysis unit 123. The tagged union detection unit 122 detects a tagged union from a program that has received a test input, based on the test input. The tagged union analysis unit 123 analyzes the tagged union detected by the tagged union detection unit 122, based on the test input. In this way, the analysis device 100 can appropriately acquire union information for a binary with unknown specifications by analyzing the state of the tagged union when a preset test input is executed by the program.

[0074] In addition, the tagged union detection unit 122 of the analysis device 100 detects, as a tagged union, a structure that contains a value specified in the test input, among structures included in the execution trace of the binary to be analyzed that has received a test input specifying a type and value.

[0075] As a result, the analysis device 100 can analyze detailed information about a tagged union by appropriately detecting the tagged union from the execution trace when a test input with a specified type and value is executed on the binary to be analyzed, and can appropriately obtain union information for binaries whose specifications are unknown.

[0076] Furthermore, tagged union detection unit 122 of analysis device 100 detects a tagged union from an execution trace of a program that receives, as the test input, a plurality of input values ​​that can specify a value that is internally held by the union part of the tagged union and can hold different tags depending on the value. In this way, analysis device 100 can appropriately detect a tagged union from a structure included in the execution trace by inputting a plurality of test inputs each having the above-mentioned two characteristics.

[0077] Furthermore, the tagged union analysis unit 123 of the analysis device 100 detects differences between tagged unions while associating them with test inputs, and identifies member variables in which differences depending on the type of the test input are found as parts that hold tags. This allows the analysis device 100 to extract the tag part from the tagged union and analyze the relationship between the held value and the tag value, thereby enabling semantic analysis such as the relationship between the tag value and the union type.

[0078] The analysis device 100 also includes an output unit 140. The output unit 140 outputs the tag values ​​of the tagged union and the member variables that hold the tags, together with the correspondence relationships identified by the tagged union analysis unit. This allows the analysis device 100 to output semantic analysis information, such as the relationship between the type and the tag value, analyzed for the tagged union, for use in various applications.

[0079] For example, by analyzing a script engine using analysis device 100, a tool for analyzing from the viewpoint of values ​​used in the script can be created. In particular, by analyzing a tagged union that implements a value object in the script engine, type information of the value in the script can be clarified. As a result, the information output by analysis device 100 can be used, for example, to create a debugger or a variable tracer, and can also be used to enhance taint analysis.

[0080] As mentioned above, these tools can be used for software debugging, fuzzing, malware analysis, and the like. Therefore, it can be said that analysis device 100 can output semantic analysis information, such as the relationship between types and tag values, analyzed for tagged unions, and make the information available for various purposes.

[0081] [4. System configuration, etc.] Of the processes described in the above embodiments, some of the processes described as being performed automatically can be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified. For example, the various information shown in each drawing is not limited to the illustrated information.

[0082] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0083] 4 may be held in a storage server or the like, rather than being held by analysis device 100. In this case, analysis device 100 acquires various pieces of information by accessing the storage server.

[0084] [5. Hardware Configuration] 12 is a diagram showing an example of a hardware configuration. The analysis device 100 according to the embodiment described above is realized by a computer 1000 having a configuration as shown in FIG.

[0085] 12 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0086] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0087] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the analysis device 100 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the analysis device 100 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0088] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary, and executes the program.

[0089] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0090] 100 Analyzer 110 Input section 120 Control section 121 Execution trace acquisition unit 122 Tagged union detector 123 Tagged union analysis unit 130 Storage section 131 Execution Trace DB 132 Architecture Information DB 140 Output section 200 External device

Claims

1. a tagged union detection unit that detects a tagged union from a program that receives a test input based on the test input; a tagged union analysis unit that analyzes the tagged union detected by the tagged union detection unit based on the test input; An analysis device comprising:

2. the tagged union detection unit detects, as the tagged union, a structure including a value specified in the test input, among structures included in an execution trace of the analysis target binary that has received the test input specifying a type and a value.

2. The analysis device according to claim 1 .

3. The tagged union detection unit detects the tagged union from an execution trace of the program that receives a plurality of input values ​​as the test inputs, each of which can specify a value internally held by a union part of the tagged union and can hold a different tag depending on the value.

3. The analysis device according to claim 2.

4. the tagged union analysis unit detects differences between the tagged unions from among a plurality of the tagged unions while associating the tagged unions with the test inputs, and identifies a member variable in which a difference is found depending on the type of the test input as a portion that holds a tag; 2. The analysis device according to claim 1 .

5. The tagged union further includes an output unit that outputs a correspondence between the tag value and the type of the tagged union, the tag value of the tagged union, and a member variable that holds the tag.

2. The analysis device according to claim 1 .

6. An analysis method performed by an analysis device, comprising: a tagged union detection step of detecting a tagged union from a program that receives a test input based on the test input; a tagged union analysis step of analyzing the tagged union detected by the tagged union detection step; An analysis method comprising:

7. a tagged union detection step of detecting a tagged union from a program that receives a test input based on the test input; a tagged union analysis step for analyzing tagged unions detected by the tagged union detection step; An analysis program for running the above on a computer.

Images