Binary Program Detection via Assembly Similarity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Device manufacturers face difficulties in detecting N-day vulnerabilities without access to device source codes, necessitating a flexible mechanism to effectively detect applications running on devices.
Innovation Solution
A method and apparatus that disassemble binary programs to generate assembly programs, select candidate functions and variables based on similarity with preset reference functions and variables, and output positional information for detection, using similarity calculations and symbolic execution analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing application detecting methods are used, then detection can be performed, but source codes of the device are required which security manufacturers have difficulty obtaining
Solution Approach 1:
The patent creates a copy of the reference assembly program and modifies it to generate the to-be-recovered assembly program. This copying approach allows the detection system to work with assembled code rather than requiring access to original source codes, thereby resolving the contradiction between detection capability and ease of obtaining source codes
Solution Approach 2:
The patent introduces assembly programs as an intermediary between the binary program and the detection analysis. By converting binary to assembly and using assembly as the working medium for detection, the system bridges the gap between binary execution and source-level analysis without requiring direct access to source codes
2Adaptability or versatility
If binary programs are disassembled to enable detection without source codes, then access to source codes is no longer required, but the complexity of the detection process increases
Solution Approach 1:
The patent performs preliminary actions by pre-generating the to-be-recovered assembly program from the reference assembly program before the actual detection process. This preliminary preparation reduces the complexity during runtime detection, as the system already has the transformed assembly code ready for comparison and analysis
Solution Approach 2:
The patent segments the detection process into distinct phases: binary to assembly conversion, assembly program generation through copying and modification, and detection analysis. This segmentation breaks down the complex detection process into manageable stages, making the overall system more tractable despite the increased complexity
Data Source
AI summary
The present disclosure discloses a method and an apparatus for detecting an application. The method comprises: disassembling a binary program of an application running on a target device to generate a to-be-recovered assembly program; selecting, from the to-be-recovered assembly program, a function having function information consistent with function information of a preset reference function in a reference assembly program to obtain at least one candidate function; selecting, among the at least one candidate function, a candidate function having grammatical and/or semantic information consistent with grammatical and/or semantic information of the preset reference function as an object function; selecting, from the object function, a variable having grammatical and/or semantic information consistent with grammatical and/or semantic information of a preset reference variable in the preset reference function as a target variable; and outputting positional information of the object function and the target variable in the to-be-recovered assembly program as a detection result.