Binary Decompilation for Program Component Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing computer programs are inefficient when dealing with precompiled third-party components, as they lack complete knowledge of the source code and struggle to analyze binary code effectively.
Innovation Solution
A method involving decompiling binary code into intermediate representation code, generating strings from this code, and using string kernel search to identify program components from a reference database, even in the presence of obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If source code analysis methods are used, then complete knowledge of program components is achieved, but inability to analyze precompiled third-party components occurs
Solution Approach 1:
Instead of analyzing source code to understand program components, the patent inverts the approach by decompiling binary code back into intermediate representation that resembles source code structure. This allows analysis of precompiled third-party components by transforming the binary into a readable intermediate form that can be processed by existing analysis tools.
Solution Approach 2:
The patent introduces an intermediary intermediate representation layer between binary code and source code analysis. This intermediate representation serves as a mediator that preserves the structural information of program components while being derivable from binary code, enabling analysis without requiring original source code.
2Adaptability or versatility
If binary code analysis is performed, then precompiled components can be analyzed, but code similarities are lost due to obfuscation and compiler changes
Solution Approach 1:
The patent applies preliminary decompilation action before analysis to transform the binary code into intermediate representation. This preliminary transformation restores the structural information and code similarities that were lost during compilation, enabling accurate identification of program components even when obfuscation or compiler changes are present.
3Loss of information
If decompilation to intermediate representation is performed, then code structure is restored, but processing time increases
Solution Approach 1:
The patent segments the decompilation and analysis process into distinct phases: first decompiling the binary code into intermediate representation, then performing analysis operations on this intermediate form. This segmentation allows optimization of each phase independently and enables parallel processing of different code segments, reducing overall processing time while preserving code structure information.
Data Source
AI summary
A method for automatically analyzing a computer program. The method includes generating intermediate representation code including a sequence of intermediate representation instructions by decompiling binary code of the computer program, generating one or more intermediate representation code strings from the sequence of intermediate representation instructions, searching for reference intermediate representation code strings of a plurality of reference intermediate representation code strings in the one or more intermediate representation code strings by means of a string kernel search, wherein each reference intermediate representation code string belongs to a program component, and ascertaining the program components to which the reference intermediate representation code strings found in the one or more intermediate representation code strings by means of the string kernel comparison belong as the program components present in the computer program.