Method and apparatus for recompiling decompiled code, and storage medium

Abstract

The present invention provides a method and apparatus for recompiling decompiled code, and a storage medium. The method comprises: acquiring decompiled code: acquiring decompiled code generated by decompiling a target program; checking the decompiled code: acquiring error information generated after parsing and semantically checking the decompiled code; verifying the error information: comparing the error information with a preset ignore rule, and ignoring the error information conforming to the preset ignore rule; optimizing the decompiled code: optimizing the decompiled code on the basis of the remaining error information after ignoring; and generating a subsequent program: performing compilation on the basis of the optimized decompiled code to generate a subsequent program. The technical solution in the embodiments of the present invention can shorten the manual repair cycle from decompilation to recompilation, thereby saving a significant amount of time during security analysis of program packages.

Description

A method, apparatus, and storage medium for recompiling decompiled code. Technical Field

[0001] This invention relates to the field of information security, and in particular to a method, apparatus and storage medium for recompiling decompiled code. Background Technology

[0002] In security research, the target is usually a JAR file, not Java source code. For further analysis, we must first decompile it into Java code because the bytecode in a JAR file is highly inefficient for humans. We hope the decompiled Java code can be recompiled into a JAR file, facilitating modification and dynamic testing of the modified code. Furthermore, some analysis tools typically require analysis of JAR files, and this also allows us to test the performance of the decompiler. However, even the most advanced Java decompilers can produce incompilable Java code, requiring significant time and manpower for manual optimization.

[0003] Summary of the Invention

[0004] To achieve the above objectives, this invention proposes a method, apparatus, and storage medium for recompiling decompiled code, which can shorten the manual repair cycle from decompilation to recompilation and save a lot of time when analyzing program packages for security purposes.

[0005] This invention proposes a method for recompiling decompiled code, comprising: acquiring decompiled code: acquiring decompiled code generated from a target program through decompilation; inspecting decompiled code: acquiring error information generated after parsing and semantic checking of the decompiled code; verifying error information: comparing the error information with preset ignore rules, and ignoring error information that conforms to the preset ignore rules; optimizing decompiled code: optimizing the decompiled code based on the remaining error information after ignoring; and generating subsequent programs: compiling the optimized decompiled code to generate subsequent programs. This method can shorten the manual repair cycle from decompilation to recompilation, saving significant time in security analysis of program packages.

[0006] This invention discloses a decompilation code recompilation device, comprising: a decompiled code acquisition module configured to acquire decompiled code generated from a target program through decompilation; a decompiled code checking module configured to acquire error information generated after parsing and semantic checking of the decompiled code; an error information verification module configured to compare the error information with preset ignore rules and ignore error information that conforms to the preset ignore rules; a decompiled code optimization module configured to optimize the decompiled code based on the remaining error information after ignoring; and a subsequent program generation module configured to compile and generate a subsequent program based on the optimized decompiled code. This device can shorten the manual repair cycle from decompilation to recompilation, saving significant time in security analysis of program packages.

[0007] An electronic device according to an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, the memory being used to store instructions that, when executed by the at least one processor, cause the processor to perform the method described above.

[0008] The present invention provides a computer-readable storage medium storing computer instructions, which, when executed, perform the methods described in any of the above embodiments.

[0009] An embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements the method described in any of the above embodiments. Attached Figure Description

[0010] The following figures are intended only to illustrate and explain the invention and do not limit the scope of the invention.

[0011] Figure 1 is a flowchart illustrating a method 100 for recompiling decompiled code according to an embodiment of the present invention.

[0012] Figure 2 is a schematic diagram of the structure of a code recompilation device 200 according to an embodiment of the present invention.

[0013] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0014] The annotations in the attached figures are explained as follows: Detailed Implementation

[0015] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0016] Numerous specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the invention is not limited to the specific embodiments disclosed below.

[0017] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0018] Typically, security researchers would manually fix all compilation errors after understanding the decompiled Java code. This is quite tedious and takes many hours.

[0019] Therefore, this invention proposes a more effective method, apparatus, and storage medium for decompiling code.

[0020] Figure 1 is a flowchart illustrating a code decompilation method 100 according to an embodiment of the present invention. As shown in Figure 1, the method 100 may include:

[0021] Step S101, Obtain decompiled code: Obtain the decompiled code generated by decompiling the target program.

[0022] Step S102, check the decompiled code: obtain the error information generated after parsing and semantic checking the decompiled code.

[0023] In this embodiment, the semantic check further includes: type check, generic check, and / or anomaly check.

[0024] Step S103, Verify error information: Compare the error information with the preset ignore rules, and ignore the error information that matches the preset ignore rules.

[0025] In this embodiment, the preset ignore rules further include: generic parameter errors and / or bytecode errors.

[0026] In this embodiment, ignoring error information that conforms to the preset ignoring rules further includes: if the error information is consistent with the error type in the preset ignoring rules, then the error information is ignored.

[0027] Specifically, the rules for ignoring remainders can be determined by analyzing the error messages generated during the actual compilation process.

[0028] Specifically, Java generics are known as type erasure, meaning the compiler checks the types provided by the Java code, and if correct, erases all generic types and generates the primitive types in the bytecode. Therefore, a Java decompiler doesn't know the primitive generic types of the Java code. A Java decompiler must compute many generic type parameters that satisfy type constraints. This is a difficult inter-program constraint problem to solve. In fact, most decompilers cannot generate correct generic type parameters. However, by modifying the JDK (compiler) code to relax the checks on generic type constraints, the code generated by the decompiler can be compiled.

[0029] Specifically, Java decompilers typically generate Java code that looks like bytecode but violates certain Java language rules. However, by relaxing some rule checks at the Java compiler (JDK) level, most of the code can be compiled and further analyzed.

[0030] Step S104, optimize the decompiled code: optimize the decompiled code based on the remaining error information after ignoring it.

[0031] In this embodiment, optimizing the decompiled code based on the remaining error information after ignoring it further includes: optimizing the part of the decompiled code corresponding to the error information based on a preset optimization strategy.

[0032] Specifically, the preset optimization strategy can be combined with the analysis of the actual error correction methods.

[0033] Step S105, Generate subsequent program: Compile the optimized decompiled code to generate subsequent program.

[0034] In this embodiment, generating the subsequent program further includes: if the optimized decompiled code does not contain the error information after inspection, then compiling and generating the subsequent program; otherwise, not compiling.

[0035] Figure 2 is a schematic diagram of a code recompilation device 200 according to an embodiment of the present invention. As shown in Figure 2, the device 200 may include:

[0036] The decompiled code acquisition module 201 is configured to acquire the decompiled code generated by the target program through decompilation.

[0037] The decompiled code inspection module 202 is configured to: obtain error information generated after parsing and semantically inspecting the decompiled code.

[0038] The error message verification module 203 is configured to compare the error message with a preset ignore rule and ignore the error message that matches the preset ignore rule.

[0039] The decompiled code optimization module 204 is configured to optimize the decompiled code based on the remaining error information after ignoring it.

[0040] The subsequent program generation module 205 is configured to: compile and generate subsequent programs based on the optimized decompiled code.

[0041] The present invention also proposes an electronic device 300. Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in Figure 3, the electronic device 300 includes a processor 310 and a memory 320, wherein the memory 320 stores instructions, wherein when the instructions are executed by the processor 310, they implement the method 100 described above.

[0042] The present invention also proposes a computer-readable storage medium having computer instructions stored thereon, which, when executed, perform the methods described above.

[0043] The present invention also proposes a computer program product, including a computer program that, when executed by a processor, performs the methods described above.

[0044] Some aspects of the methods and apparatus of this invention can be executed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The aforementioned hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. Furthermore, aspects of this invention may be embodied as computer products located on one or more computer-readable media, including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic tapes, etc.), optical discs (e.g., compact discs (CDs), digital multifunction discs (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0045] Flowcharts are used herein to illustrate the operations performed by the method according to embodiments of this application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from them.

[0046] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0047] The above description is merely an illustrative embodiment of the present invention and is not intended to limit the scope of the invention. Any equivalent changes, modifications, and combinations made by those skilled in the art without departing from the concept and principles of the present invention should fall within the scope of protection of the present invention.

Claims

1. A method for recompiling decompiled code (100), characterized in that, The method further includes: Obtain decompiled code (S101): Obtain the decompiled code generated by decompiling the target program; Check the decompiled code (S102): Obtain the error information generated after parsing and semantically checking the decompiled code; Verify error information (S103): Compare the error information with the preset ignore rules, and ignore the error information that matches the preset ignore rules; Optimize the decompiled code (S104): Optimize the decompiled code based on the remaining error information after ignoring it; Generate subsequent program (S105): Compile the optimized decompiled code to generate subsequent program.

2. The method according to claim 1, characterized in that, The semantic checks further include: type checks, generic checks, and / or anomaly checks.

3. The method according to claim 2, characterized in that, The preset ignore rules further include: generic parameter errors and / or bytecode errors.

4. The method according to claim 3, characterized in that, The step of ignoring error messages that conform to the preset ignoring rules further includes: If the error message matches the error type in the preset ignore rule, then the error message is ignored.

5. The method according to claim 1, characterized in that, Optimizing the decompiled code based on the remaining error information after ignoring it further includes: The code portion of the decompiled code corresponding to the error message is optimized based on a preset optimization strategy.

6. The method according to claim 1, characterized in that, The process of generating subsequent programs further includes: if the optimized decompiled code does not contain the error information after inspection, then compiling and generating subsequent programs; otherwise, not compiling.

7. A recompilation apparatus (200) for decompiling code, characterized in that, The device further includes: The decompiled code acquisition module (201) is configured to: acquire the decompiled code generated by the target program through decompilation; The decompiled code inspection module (202) is configured to: obtain error information generated after parsing and semantically inspecting the decompiled code; The error message verification module (203) is configured to: compare the error message with a preset ignore rule, and ignore the error message that matches the preset ignore rule; The decompiled code optimization module (204) is configured to optimize the decompiled code based on the remaining error information after ignoring it. The subsequent program generation module (205) is configured to: compile and generate the subsequent program based on the optimized decompiled code.

8. Electronic equipment (300), including: At least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions that, when executed by the at least one processor (310), cause the processor (310) to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium having stored thereon computer instructions that, when executed, perform the method according to any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, performs the method according to any one of claims 1-6.

Images