CN1818863A - Static library decompiling recognition of built-in software - Google Patents

Abstract

An embedded static-base function identify realization method in software anti-translation, the invention is combining the processing characteristic of the anti-translation, matching the function module in the static-base and the base function in the compiler, the function entrance address in transfer function processing code of the middle code change to the corresponding name of the base function, to achieve the identification of the function in the static-base. The advantage is better for anti-translation by changing the aiming code to the corresponding high-grade language.

Description

Static library function identification implementation method in the embedded software decompiling

Technical field

The present invention relates to embedded software inverse compiling technique field, particularly relate to the static library function identification implementation method in a kind of embedded software decompiling.

Background technology

Reverse-engineering is that object of analysis sees how it works, and purpose is in order to duplicate or to strengthen this object.It is a practice of bringing from older industry, and present tense is everlasting and uses on computer hardware and the software.For instance, in car industry, a manufacturer may buy rival's vehicle, decomposes it, and the weld that checks vehicles, and other compositions of sealing lead and vehicle are to reach the purpose of using similar parts to strengthen their automobile.

Software inverse engineering comprises that the machine code that makes program (being sent to a string 0 and 1 character string of logic processor) oppositely gets back to the source code that is written into, the statement of service routine design language.Software inverse engineering may want to reach following purpose: because the loss of former code, so want to obtain again the former code of program; How search procedure moves specific operation; The performance of improvement program; Repair a program error (when source code is unavailable, correcting a mistake of program); Being identified in the content of the malice in the program, similarly is virus; Or be adapted for program that a microprocessor writes to adapt to a microprocessor that design is different.For the reverse-engineering of this unique purpose of reproducer constitutes copyright violation and is illegal.

In some cases, reverse-engineering is forbidden in the licensed-in use of software clearly.The people who does software inverse engineering may use some instruments to decompose a program.An instrument is the hexadecimal tripper, and it is with the binary digit of sexadesimal system form (this reads easily than two-symbol form) printing or display routine.By form and the instruction length of knowing the position of representing processor instruction, reverse-engineering teacher can discern the specific part of a program and see how they work.

Common instrument in addition is a resolver.Resolver is read two-symbol code and is shown each executable instruction with textual form then.Resolver can not be differentiated the difference between executable instruction and the data used by program, thus debugger by usefulness, its allows resolver to avoid the data division of decomposing program.These instruments may be used for revising code by a cracker and obtain the right of ingress of a computer system or cause other injury.

The hardware reverse-engineering comprises that taking a device apart sees how it works.For instance, if how the processor that processor manufacturer wants to see the rival works, they can buy rival's processor, decompose it, make a similar processor then.Yet this process is illegal in many countries.Substantially, the hardware reverse-engineering needs a lot of professional technique and quite expensive.Another kind of reverse-engineering relates to the 3-D figure (when its blueprint is unavailable) of the part that generation made so that make this part again.For a part is carried out reverse-engineering, this part is measured with measurement of coordinates device (CMM).When it was measured, 3-D wire frame image was produced and is shown on a monitor.After mensuration was finished, the wire frame image was measured.Use any part of these methods can carry out reverse-engineering.

And the dynamic tracking debugging can realize the tracking of program and operation one by one, and this is a reason of having utilized single step interruption and breakpoint to interrupt in fact, and present most of trace debug softwares all are to have utilized this two interruptions.

(INT1) interrupted in single step is a kind of interruption that is caused by the machine intimate state, when the TF of system sign register indicates that (single step tracking mark) is when being set, will produce a single step automatically and interrupt, make CPU after carrying out an instruction, to stop, and show the content of each register.

It is a kind of soft interruption that breakpoint interrupts (INT3), and soft interruption is called self-trapping instruction again, when CPU carries out self-trapping instruction, just enters the breakpoint interrupt service routine, finishes demonstration to each content of registers of breakpoint place by the breakpoint interrupt service routine.

Decompiling is a kind of object code to be converted into the technology of higher level lanquage fotmat code of equal value, and it is an important component part in the software inverse engineering.Decompiling is divided into based on Decompilation of Executive Program with based on the decompiling of virtual machine instructions.The identification of built-in function is an important component part of whole decompiling process.

Summary of the invention

The object of the present invention is to provide the static library function identification implementation method in a kind of embedded software decompiling.

The technical scheme that the present invention solves its technical matters employing is as follows:

1) intermediate code identification

Utilize the assembly code of the corresponding relation generation executable program of assembly instruction and machine instruction;

2) extract function module

Function module finally all is that the form with " CALL address A " appears at A start address place, address, so the recognition function module just identifies the module that address A in " CALL address A " begins, by seeking the start address and the termination address of function module, determine function module;

3) discern used compiler

The dynamic base name that different compilers carry is different, and other specific informations that compiling is produced by compiler can reach the purpose of discerning the used compiler of executive routine well;

4) extract the corresponding static storehouse

The static library of each compiler can obtain by checking its user manual, can obtain the information such as function name, function code of all functions in the library file by the Study document form, sets up a static database of its static library function;

5) identification built-in function

For one section given function module code, from the database that static library is set up, find out a function and equate with the instruction length and the sequence of opcodes of this section function module code.

The present invention compares with background technology, and the useful effect that has is:

The present invention is the static library function identification implementation method in a kind of embedded software decompiling, its major function is the whole process characteristics in conjunction with decompiling, to mating between the built-in function of static library with user's function module and compiler, function entrance address in the call function process code form in the intermediate code changes corresponding built-in function name into, to realize the identification to the static library function.

(1) high efficiency.This method has realized the static library function identification in the embedded software decompiling, helps accelerating the speed of decompiling work, improves the efficient of decompiling.

(2) practicality.To mating between the built-in function of static library with user's function module and compiler, help the decompiling work that object code is converted into higher level lanquage form of equal value.

Description of drawings

Accompanying drawing is an implementation process synoptic diagram of the present invention;

Embodiment

The present invention is the static library function identification implementation method in a kind of embedded software decompiling, below in conjunction with its specific implementation process of description of drawings.

1) intermediate code identification

It is a key point of carrying out built-in function identification that executive routine is converted to corresponding intermediate code, and this step also is the dis-assembling process in the decompiling.The present invention utilizes the corresponding relation of assembly instruction and machine instruction to generate the assembly code of executable program, and the code after the dis-assembling of generation is as shown in the table:

01006CB2：50	push eax
		01006CB3：FF 75 08	push dword ptr[ebp+8]
01006CB6：FF 15 D0 10 00 01	call dword ptr ds：[010010D0h]
		01006CBC：59	pop ecx
01006CBD：59	pop ecx
		01006CC1：FF 7508	push dword ptr[ebp+8]
01006CC4：FF 15 FC 10 00 01	call dword ptr ds：[010010FCh]

The first above-mentioned row shape is the code loading address as " 01006CBC's ", and secondary series shape is the binary coding of instruction as " FF 75 08 ", and and then " push " of back is the operational code of corresponding assembly instruction, is exactly the operand of this instruction at last.

2) extract function module

Extracting function module is exactly that the function module that occurs in the intermediate code is identified, for intermediate code, because finally all being the form with " CALL address A ", function module appears at A start address place, address, so the recognition function module just identifies the module that address A in " CALL address A " begins.Characteristics according to the definition and the compiling of function, the function of intermediate code form all is to return with the form of " retn " at last, so flow process according to program itself, with " retn " form of returning is foundation, can identify the function module that occurs in all the CALL instructions in the intermediate code.

3) discern used compiler

The dynamic base name that different compilers carry is different, and other specific informations that compiling is produced by compiler can reach the purpose of discerning the used compiler of executive routine well; According to the characteristics of actual executive routine,, just can identify corresponding compiler by its dynamic base if executive routine has been quoted dynamic base.

4) extract the corresponding static storehouse

The static library of each compiler can obtain by checking its user manual, can obtain the information such as function name, function code of all functions in the library file by the Study document form, as for a function " fopen ", can obtain as shown in the table by this method:

-fopen：
		00000000：6A 40	push 40h
00000002：FF 74 24 0C	push dword ptr[esp+0Ch]
		00000006：FF 74 24 0C	push dword ptr[esp+0Ch]
0000000A：E8 00 00 00 00	call 0000000F
		0000000F：83 C4 0C	add esp，0Ch
00000012：C3	ret

By function name, the function code of all built-in functions of obtaining, just can set up a static database of its static library function, the database ground form of foundation is as shown in the table:

Function name	Instruction length	Sequence of opcodes
			fopen	17	pushpushpushcalladdret
isalpha	46	cmpjlepushpushcallpoppopretmovmovmovandret

Because compiler can be taked the reorientation operation in binding, above-mentioned similarly " call 0000000F " instruction last operation number can change, so above-mentioned process of building the storehouse does not just have the typing operand.

5) identification built-in function

For one section given function module code, from the database that static library is set up, find out a function and equate with the instruction length and the sequence of opcodes of this section function module code.

Claims (1)

1. the static library function in the embedded software decompiling is discerned implementation method, it is characterized in that:

1) intermediate code identification

Utilize the assembly code of the corresponding relation generation executable program of assembly instruction and machine instruction;

2) extract function module

Function module finally all is that the form with " CALL address A " appears at A start address place, address, so the recognition function module just identifies the module that address A in " CALL address A " begins, by seeking the start address and the termination address of function module, determine function module;

3) discern used compiler

The dynamic base name that different compilers carry is different, and other specific informations that compiling is produced by compiler can reach the purpose of discerning the used compiler of executive routine well;

4) extract the corresponding static storehouse

The static library of each compiler can obtain by checking its user manual, can obtain the information such as function name, function code of all functions in the library file by the Study document form, sets up a static database of its static library function;

5) identification built-in function

For one section given function module code, from the database that static library is set up, find out a function and equate with the instruction length and the sequence of opcodes of this section function module code.