CN114519127A - Disassembling file processing method, device, equipment and storage medium - Google Patents
Disassembling file processing method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN114519127A CN114519127A CN202210030173.2A CN202210030173A CN114519127A CN 114519127 A CN114519127 A CN 114519127A CN 202210030173 A CN202210030173 A CN 202210030173A CN 114519127 A CN114519127 A CN 114519127A
- Authority
- CN
- China
- Prior art keywords
- file
- target
- character
- recognized
- matched
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 20
- 238000000034 method Methods 0.000 claims abstract description 53
- 238000000605 extraction Methods 0.000 claims abstract description 19
- 230000006870 function Effects 0.000 claims description 19
- 230000000903 blocking effect Effects 0.000 abstract 1
- 238000010586 diagram Methods 0.000 description 8
- 230000001343 mnemonic effect Effects 0.000 description 7
- 238000013500 data storage Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
- G06F16/90335—Query processing
- G06F16/90344—Query processing by using string matching techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/901—Indexing; Data structures therefor; Storage structures
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02W—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO WASTEWATER TREATMENT OR WASTE MANAGEMENT
- Y02W90/00—Enabling technologies or technologies with a potential or indirect contribution to greenhouse gas [GHG] emissions mitigation
Landscapes
- Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Character Input (AREA)
Abstract
The application discloses a disassembled file processing method, a disassembled file processing device, equipment and a storage medium, wherein the processing method comprises the following steps: acquiring a target disassembly file; reading a file line in the target disassembly file; performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized; under the condition that the object to be identified is matched in any file line, marking the object starting position and the object ending position of the object to be identified in the matched target file line; extracting a target character segment corresponding to the matched object to be recognized according to the object starting position and the object ending position of the matched object to be recognized in the target file line; the extracted target character segments are stored in a blocking mode based on the preset array storage structure, recognition, extraction and storage of objects to be recognized in the disassembled file are achieved, storage efficiency is improved, and assembly instruction elements can be used in the follow-up process.
Description
Technical Field
The present application relates to the field of automatic identification of disassembled files, and in particular, to a disassembled file processing method, apparatus, device, and storage medium.
Background
In the formal authentication process, file rows in a disassembled file need to be identified and extracted to obtain specified information, such as extracting and storing assembly instructions and instruction addresses, and removing disassembled file information except the assembly instructions and the instruction addresses, for example, removing disassembled file information such as source codes, comments, blank lines and the like.
Therefore, a solution for processing a disassembled file is needed to reduce the authentication cost for the disassembled file and to improve the storage efficiency.
Disclosure of Invention
In order to solve the problems in the prior art, embodiments of the present application provide a technical solution for a disassembled file processing method, an apparatus, a device, and a storage medium, where the technical solution is as follows:
in one aspect, a disassembled file processing method is provided, and the method includes:
acquiring a target disassembly file;
reading a file row in the target disassembly file;
performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized;
under the condition that the object to be recognized is matched in any file line, marking the object starting position and the object ending position of the object to be recognized in the matched target file line;
extracting a target character segment corresponding to the matched object to be recognized according to the object starting position and the object ending position of the matched object to be recognized in the target file line;
and carrying out block storage on the extracted target character segments based on a preset array storage structure.
Further, the object to be identified comprises an instruction address, a machine code and an assembly instruction.
Further, the extracting, according to the object start position and the object end position of the matched object to be recognized in the object file line, the target character segment corresponding to the matched object to be recognized includes:
determining a target extraction position of the object to be identified according to the object starting position and the object ending position;
and copying the character segment corresponding to the target extraction position to obtain the target character segment corresponding to the matched object to be recognized.
Further, before the character matching of the file line in the target disassembly file based on the starting character and the ending character of the object to be recognized, the method further comprises:
constructing a corresponding relation between a preset function pointer and a starting character and an ending character of at least one object to be recognized to obtain a target function pointer;
performing character matching on the file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized, including:
and performing character matching on file lines in the target disassembly file through the target function pointer.
Further, the method further comprises:
and stopping reading the file line in the target disassembly file when the end character of the file is identified.
Further, before reading the file line in the disassembled file, the method further comprises:
initializing the target disassembly file;
and under the condition that the target disassembly file fails to be initialized, generating alarm information and sending the alarm information to a target terminal.
Further, the character matching of the file line in the target disassembly file based on the starting character and the ending character of the object to be recognized includes:
performing character matching on file lines in the target disassembly file based on initial characters of an object to be recognized;
and under the condition that the target starting character corresponding to the starting character is matched, matching characters behind the target starting character based on the ending character until the target ending character corresponding to the ending character is matched.
In another aspect, there is provided a processing apparatus for disassembling an assembly file, the apparatus including:
an acquisition module: the target disassembly file is obtained;
a reading module: the file line reading module is used for reading a file line in the target disassembly file;
a character matching module: the target disassembly file is used for performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized;
a position marking module: the method comprises the steps that when the object to be recognized is matched in any file line, the object starting position and the object ending position of the object to be recognized in the matched target file line are marked;
the extraction module of the target character segment: the target character segment corresponding to the matched object to be recognized is extracted according to the object starting position and the object ending position of the matched object to be recognized in the target file line;
a storage module: and the storage module is used for storing the extracted target character segments in blocks based on a preset array storage structure.
Another aspect provides a disassembled file processing device, which comprises a processor and a memory, wherein the memory stores at least one instruction, at least one program, a set of codes or a set of instructions, and the at least one instruction, the at least one program, the set of codes or the set of instructions are loaded and executed by the processor to realize the disassembled file processing method.
Another aspect provides a computer readable storage medium having stored therein at least one instruction, at least one program, set of codes or set of instructions, which is loaded and executed by a processor to implement a disassembled file processing method as described above.
The disassembling file processing method, the disassembling file processing device and the storing medium have the following technical effects:
according to the method, the target disassembly file is obtained, the file lines in the target disassembly file are read, and character matching is carried out on the file lines in the target disassembly file based on the initial characters and the end characters of the object to be recognized, so that useless information except the object to be recognized in the disassembly file is removed, and the file lines are simplified; under the condition that the object to be identified is matched in any file line, marking the object starting position and the object ending position of the object to be identified in the matched target file line; according to the object starting position and the object ending position of the matched object to be recognized in the object file line, the object character segment corresponding to the matched object to be recognized is extracted, the extracted object character segment is stored in a block mode based on a preset array storage structure, the object to be recognized in the disassembled file is further extracted and stored in a recognition mode, storage efficiency is improved, the follow-up running time of the file line in the object disassembled file is shortened, assembly instruction elements are used, and the method has high application value.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a schematic flowchart of a disassembled file processing method according to an embodiment of the present application;
fig. 2 is a schematic flowchart of a method for initializing a disassembled file according to an embodiment of the present application;
fig. 3 is a schematic flowchart of a character matching method in an object to be recognized according to an embodiment of the present application;
fig. 4 is a schematic flowchart of a method for acquiring a target character segment in an object to be recognized according to an embodiment of the present application;
fig. 5 is a schematic structural diagram of a disassembled document processing device according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of an apparatus corresponding to the method shown in fig. 4 according to an embodiment of the present disclosure;
fig. 7 is a schematic structural diagram of an apparatus corresponding to the method shown in fig. 2 according to an embodiment of the present disclosure;
fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without making creative efforts shall fall within the protection scope of the present application.
It is noted that the present specification provides the method steps as described in the examples or flowcharts, but may include more or less steps based on routine or non-inventive labor. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of orders, and does not represent the only order in which the steps can be performed. In practice, the system or server product may be implemented in sequential or parallel execution according to the embodiments or methods shown in the drawings.
Please refer to fig. 1, which is a schematic flow chart of a disassembling file processing method according to an embodiment of the present application, and the disassembling file processing method can realize identification, extraction, and storage of an object to be identified in a disassembling file, thereby improving storage efficiency, so as to shorten a subsequent running time of a file line in a target disassembling file, and use an assembly instruction element, and has a high application value, and the processing method specifically includes the following steps:
s101: and acquiring the target disassembly file.
S102: and reading the file line in the target disassembly file.
In the embodiment of the present application, the target disassembly file may also be a target assembly file, and the target disassembly file or a file line in the target assembly file is read, so as to extract and store an object to be identified in the file line, and remove disassembly file information other than the object to be identified, for example, remove disassembly file information such as a source code, a comment, an empty line, and the like in the file line, so as to shorten a subsequent operation time for the file line in the target disassembly file or the target assembly file, and have a high application value.
In an optional implementation manner, as shown in fig. 2, which is a flowchart of a method for initializing a disassembled file according to an embodiment of the present application, before executing step S102, the method for processing a disassembled file may further include:
s1011: and initializing the target disassembly file.
S1012: and under the condition that the initialization of the target disassembly file fails, generating alarm information and sending the alarm information to the target terminal.
In the embodiment of the present application, in the initialization, that is, an initial value is set for a variable in a target disassembly file, and only after the initialization, it is possible to allocate appropriate resources in a memory, and if an unused object is not cleaned in time and the memory resources are recycled, an overflow problem is likely to occur. Specifically, under the condition that the target disassembly file is successfully initialized, reading a file row in the target disassembly file according to a preset reading mode so as to ensure accurate identification of an object to be identified in the file row, and if the target disassembly file is failed to be initialized, displaying alarm information corresponding to the failed initialization through a target terminal so as to monitor the target disassembly file.
S103: and performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized.
In the embodiment of the application, the starting character is a character at a starting position in an object to be recognized, the ending character is a character at an ending position in the object to be recognized, the matched characters are extracted through character matching between the starting character and the ending character, the extracted characters are stored according to a preset sequence, the preset sequence is an arrangement sequence of data in a disassembly file, the object to be recognized is stored under the condition that the arrangement sequence of the object to be recognized in the disassembly file is not changed, and convenience is brought to subsequent operation of the object to be recognized.
In an alternative embodiment, the object to be identified includes an instruction address, machine code, and assembly instructions.
In one embodiment, the instruction address, the machine code and the assembly instruction in the disassembly file are matched and identified, the matched instruction address, the machine code and the assembly instruction are stored in a preset array storage structure, wherein the assembly instruction can comprise a mnemonic character and an operand, and in a specific embodiment, the instruction address, the machine code, the mnemonic character, the operand and the like are stored in the preset array storage structure, when the disassembly file is executed, the object to be identified in the preset array storage structure is directly called without executing disassembly data except the object to be identified in the disassembly file, so that the execution time for executing the disassembly file is shortened, the authentication cost for the disassembly file is reduced, and the application value is high.
In an optional implementation manner, as shown in fig. 3, which is a schematic flow chart of a character matching method in an object to be recognized according to an embodiment of the present application, a specific step S103 may include:
s1031: and performing character matching on file lines in the target disassembly file based on the starting characters of the object to be recognized.
S1032: and under the condition that the target starting character corresponding to the starting character is matched, matching characters after the target starting character based on the ending character until the target ending character corresponding to the ending character is matched.
In one embodiment, the instruction address, the machine code, the mnemonic and the operand each have a start character and an end character, and in the case of matching the target start character, the characters following the target start character are continuously matched until the target end character corresponding to the end character is matched. In the process of matching the target file line, if the target initial character is not matched within the preset time, or under the condition that the target initial character is matched, matching characters behind the target initial character based on the end character, but the target end character corresponding to the end character is not matched, the matching is failed. And under the condition of failed matching, interrupting the matching process of the object to be recognized in the current target file line, and marking the current target file line so as to check the object to be recognized in the target file line and ensure that the file line in the target disassembly file is operated smoothly subsequently.
In an optional embodiment, before step S103, the disassembled file processing method may further include:
s10311: and constructing a corresponding relation between a preset function pointer and the starting character and the ending character of at least one object to be recognized to obtain a target function pointer.
Correspondingly, step S103 may further include:
s10312: and performing character matching on the file lines in the target disassembly file through the target function pointer.
In the embodiment of the present application, the target function pointer is used for matching characters in objects to be recognized in a file line, where the target function pointer is obtained by constructing a corresponding relationship between a preset function pointer and a start character and an end character of at least one object to be recognized, that is, the target function pointer can match characters between the start character and the end character in any object to be recognized, and can also match information other than characters in the object to be recognized, such as a source code, a comment, and a space. In the whole matching process, the target function pointer is only used as a matching interface of the object to be recognized, the matching interface does not need to be replaced, character matching under multiple recognition modes is achieved, the situation that the matching interface corresponding to the object to be recognized is replaced when different modes are matched is avoided, the matching time of the object to be recognized is shortened, and the method has high application value.
S104: and under the condition that the object to be recognized is matched in any file line, marking the object starting position and the object ending position of the object to be recognized in the matched target file line.
In a specific embodiment, the starting position and the ending position of the instruction address, the machine code, the mnemonic character and the operand in the target file line are marked, so that the instruction address, the machine code, the mnemonic character and the operand are stored in a preset array storage structure according to the marked positions of the instruction address, the machine code, the mnemonic character and the operand, and accurate extraction and storage of an object to be identified are achieved.
S105: and extracting a target character segment corresponding to the matched object to be recognized according to the object starting position and the object ending position of the matched object to be recognized in the target file line.
In an optional implementation manner, as shown in fig. 4, which is a schematic flowchart of a method for acquiring a target character segment in an object to be recognized according to an embodiment of the present application, step S105 may include:
s1051: and determining the target extraction position of the object to be identified according to the object starting position and the object ending position.
S1052: and copying the character segment corresponding to the target extraction position to obtain a target character segment corresponding to the matched object to be recognized.
In the embodiment of the application, the starting position and the ending position of an object are taken as boundary lines, and a target character segment between the starting position and the ending position of the object is extracted so as to eliminate information except the object to be recognized, wherein the target character segment corresponding to the object to be recognized is a character segment corresponding to an instruction address, a machine code, a mnemonic character and an operand. Specifically, the extraction of the target character segment in the object to be recognized is realized by copying the character segment corresponding to the target extraction position, and the extracted target character segment is stored in a preset array storage structure.
S106: and carrying out block storage on the extracted target character segments based on a preset array storage structure.
In the embodiment of the application, the preset array storage structure is a three-dimensional character array storage structure, the matched target character segments corresponding to the objects to be recognized are stored through the three-dimensional character array storage structure, the three-dimensional character array storage structure stores characters in the objects to be recognized based on the three-dimensional array storage structure, the first dimension represents file lines in a disassembled file, the second dimension represents the objects to be recognized in the file lines, and the third dimension represents the characters in the objects to be recognized, so that the objects to be recognized are stored under the condition that the arrangement sequence corresponding to the target character segments in the original objects to be recognized is not changed. In a specific embodiment, different identification objects in the objects to be identified in each file line are stored in blocks according to the form of a three-dimensional character array storage structure, when the disassembled file is operated, only the matched objects to be identified need to be operated, information except the objects to be identified does not need to be operated, operation steps are saved, and the operation time of the target disassembled file or the file lines in the target assembled file is shortened.
Specifically, for example, the object to be recognized stored in blocks based on the three-dimensional character array storage structure is represented as
Where abc and jkl represent instruction addresses, def and mno represent machine codes, ghi and pqr represent assembly instructions, i represents a first dimension, j represents a second dimension, and k represents a third dimension, then the character a in the instruction address abc may be represented by str [0 ]][0][0]To indicate that the character b in the instruction address can be str [0 ]][0][1]To express, the character d in the machine code def can be str [0 ]][1][0]To indicate jstr [1 ] in the instruction address jkl][0][0]By analogy, the extracted target character segments are stored in blocks through the three-dimensional character array storage structure, the storage efficiency of the object to be recognized is effectively improved, and the authentication cost of the disassembled file is reduced.
In an optional embodiment, the disassembled file processing method may further include:
in the event that an end-of-file character is identified, reading of the file line in the target disassembly file is stopped.
In the embodiment of the application, if the ending character is matched, reading of the object to be recognized in the file row is stopped, so that the extracted object to be recognized is guaranteed to be executable data.
According to the technical scheme of the embodiment of the application, the target disassembly file is obtained, the file lines in the target disassembly file are read, and the character matching is carried out on the file lines in the target disassembly file based on the starting characters and the ending characters of the object to be recognized, so that useless information except the object to be recognized in the disassembly file is removed, and the simplification processing of the file lines is realized; under the condition that the object to be identified is matched in any file line, marking the object starting position and the object ending position of the object to be identified in the matched target file line; according to the object starting position and the object ending position of the matched object to be recognized in the object file line, the object character section corresponding to the matched object to be recognized is extracted, the extracted object character section is stored in a block mode based on a preset array storage structure, recognition, extraction and storage of the object to be recognized in the disassembled file are further achieved, storage efficiency is improved, so that the follow-up running time of the file line in the object disassembled file is shortened, the assembly instruction element is used, and the application value is high.
The embodiment of the present application further provides a processing apparatus for disassembling documents, where the apparatus is shown in fig. 5, and is a schematic structural diagram of the apparatus for processing disassembling documents provided in the embodiment of the present application, and the apparatus specifically includes the following modules:
the acquisition module 10: for obtaining the target disassembly file.
The reading module 20: for reading the file lines in the target disassembly file.
The character matching module 30: the method is used for performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized.
The position marking module 40: and when the object to be identified is matched in any file line, marking the object starting position and the object ending position of the object to be identified in the matched target file line.
The extraction module 50 of the target character segment: and the method is used for extracting the target character segment corresponding to the matched object to be recognized according to the object starting position and the object ending position of the matched object to be recognized in the target file line.
The storage module 60: and the storage module is used for storing the extracted target character segments in blocks based on a preset array storage structure.
Further, the object to be recognized includes an instruction address, a machine code, and an assembly instruction.
Further, as shown in fig. 6, and a schematic structural diagram of an apparatus corresponding to the method shown in fig. 4 provided in the embodiment of the present application, the extraction module 50 of the target character segment may include:
the target extraction position determination sub-module 501: the target extraction position is used for determining the target to be identified according to the starting position and the ending position of the target;
determination of target character segment submodule 502: and the method is used for copying the character segment corresponding to the target extraction position to obtain the target character segment corresponding to the matched object to be recognized.
Further, the apparatus may further include:
the objective function pointer determination module 70: the method comprises the steps of constructing a corresponding relation between a preset function pointer and a starting character and an ending character of at least one object to be recognized to obtain a target function pointer;
accordingly, the character matching module 30 may further include:
matching sub-module 301: the method is used for performing character matching on file lines in the target disassembly file through the target function pointer.
Further, the apparatus may further include:
the judging module 80: for stopping reading the file line in the target disassembly file if the end-of-file character is identified.
Further, as shown in fig. 7, which is a schematic structural diagram of an apparatus corresponding to the method shown in fig. 2 provided in the embodiment of the present application, the apparatus may further include:
the initialization module 90: the system is used for initializing the target disassembly file;
the warning information generation module 100: and the method is used for generating alarm information and sending the alarm information to the target terminal under the condition that the target disassembly file is failed to initialize.
Further, the character matching module 30 may further include:
character matching sub-module 301: the system comprises a target disassembly file, a target disassembly file and a recognition module, wherein the target disassembly file is used for performing character matching on file lines in the target disassembly file based on starting characters of an object to be recognized;
the target end character determination sub-module 302: and the method is used for matching the characters after the target starting character based on the ending character under the condition that the target starting character corresponding to the starting character is matched until the target ending character corresponding to the ending character is matched.
With regard to the apparatus in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be described in detail here.
The embodiment of the application provides a disassembled file processing device, which comprises a processor and a memory, wherein at least one instruction, at least one program, a code set or an instruction set is stored in the memory, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to realize the disassembled file processing method provided by the embodiment of the method.
The memory may be used to store software programs and modules, and the processor may execute various functional applications and data processing by operating the software programs and modules stored in the memory. The memory can mainly comprise a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs needed by functions and the like; the storage data area may store data created according to use of the apparatus, and the like. Further, the memory may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, the memory may also include a memory controller to provide the processor access to the memory.
The disassembled document processing device may be an electronic device running the method, and an embodiment of the present application further provides a schematic structural diagram of an electronic device running the method, please refer to fig. 8, where the electronic device 800 is configured to implement the detection method provided in the embodiment. The electronic device 800, which may vary significantly due to configuration or performance, may include one or more processors 810 (e.g., one or more processors) and storage 830, one or more storage media 820 (e.g., one or more mass storage devices) that store applications 823 or data 822. Memory 830 and storage medium 820 may be, among other things, transient or persistent storage. The program stored in storage medium 820 may include one or more modules, each of which may include a sequence of instructions operating on electronic device 800. Further, the processor 810 may be configured to communicate with the storage medium 820 to execute a series of instruction operations in the storage medium 820 on the electronic device 800. The electronic device 800 may also include one or more power supplies 860, one or more wired or wireless network interfaces 840, one or more input-output interfaces 840, and/or one or more operating systems 821, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and so forth.
Embodiments of the present application further provide a computer-readable storage medium, which may be disposed in an electronic device to store at least one instruction, at least one program, a code set, or a set of instructions related to implementing a method for processing a disassembled file in the method embodiments, where the at least one instruction, the at least one program, the code set, or the set of instructions are loaded and executed by the processor to implement a method for processing a disassembled file provided in the method embodiments.
It should be noted that: the sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And specific embodiments thereof have been described above. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system and server embodiments, since they are substantially similar to the method embodiments, the description is simple, and reference may be made to some descriptions of the method embodiments for relevant points.
The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. A disassembled file processing method, comprising:
acquiring a target disassembly file;
reading a file row in the target disassembly file;
performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized;
under the condition that the object to be recognized is matched in any file line, marking the object starting position and the object ending position of the object to be recognized in the matched target file line;
extracting a target character segment corresponding to the matched object to be recognized according to the object starting position and the object ending position of the matched object to be recognized in the target file line;
and carrying out block storage on the extracted target character segments based on a preset array storage structure.
2. The method of claim 1, wherein the objects to be identified comprise instruction addresses, machine code, and assembly instructions.
3. The method according to claim 1, wherein extracting the target character segment corresponding to the matched object to be recognized according to the object start position and the object end position of the matched object to be recognized in the target file line comprises:
determining a target extraction position of the object to be identified according to the object starting position and the object ending position;
and copying the character segment corresponding to the target extraction position to obtain the target character segment corresponding to the matched object to be recognized.
4. The method of claim 1, wherein prior to said character matching a line of documents in the object disassembly document based on a start character and an end character of an object to be recognized, the method further comprises:
constructing a corresponding relation between a preset function pointer and a starting character and an ending character of at least one object to be recognized to obtain a target function pointer;
performing character matching on the file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized, including:
and performing character matching on the file lines in the target disassembly file through the target function pointer.
5. The method of claim 1, further comprising:
and stopping reading the file line in the target disassembly file when the end character of the file is identified.
6. The method of claim 1, wherein prior to reading a file line in the disassembled file, the method further comprises:
initializing the target disassembly file;
and generating alarm information under the condition that the initialization of the target disassembly file fails, and sending the alarm information to a target terminal.
7. The method of claim 1, wherein the character matching of the file line in the object disassembly file based on the start character and the end character of the object to be recognized comprises:
performing character matching on file lines in the target disassembly file based on initial characters of an object to be recognized;
and under the condition that the target starting character corresponding to the starting character is matched, matching characters behind the target starting character based on the ending character until the target ending character corresponding to the ending character is matched.
8. A device for processing a disassembled file, the device comprising:
an acquisition module: the target disassembly file is obtained;
a reading module: the file line reading module is used for reading a file line in the target disassembly file;
a character matching module: the target disassembly file is used for performing character matching on file lines in the target disassembly file based on the starting character and the ending character of the object to be recognized;
a position marking module: the method comprises the steps that when the object to be recognized is matched in any file line, the object starting position and the object ending position of the object to be recognized in the matched target file line are marked;
the extraction module of the target character segment: the target character segment corresponding to the matched object to be recognized is extracted according to the object starting position and the object ending position of the matched object to be recognized in the target file line;
a storage module: and the storage module is used for storing the extracted target character segments in blocks based on a preset array storage structure.
9. A disassembled file processing device comprising a processor and a memory, wherein the memory has stored therein at least one instruction, at least one program, set of codes or set of instructions, which is loaded and executed by the processor to implement the disassembled file processing method as claimed in any one of claims 1 to 7.
10. A computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, and the at least one instruction or the at least one program is loaded by a processor and executed to implement the disassembly file processing method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210030173.2A CN114519127A (en) | 2022-01-12 | 2022-01-12 | Disassembling file processing method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210030173.2A CN114519127A (en) | 2022-01-12 | 2022-01-12 | Disassembling file processing method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114519127A true CN114519127A (en) | 2022-05-20 |
Family
ID=81597336
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210030173.2A Pending CN114519127A (en) | 2022-01-12 | 2022-01-12 | Disassembling file processing method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114519127A (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102622558A (en) * | 2012-03-01 | 2012-08-01 | 北京邮电大学 | Excavating device and excavating method of binary system program loopholes |
| CN106529296A (en) * | 2016-11-16 | 2017-03-22 | 武汉工程大学 | Method for attacking software protection virtual machine based on fuzzy clustering |
| CN111857681A (en) * | 2020-06-08 | 2020-10-30 | 北京大学 | Software-defined key function positioning and extracting method of C + + system |
-
2022
- 2022-01-12 CN CN202210030173.2A patent/CN114519127A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102622558A (en) * | 2012-03-01 | 2012-08-01 | 北京邮电大学 | Excavating device and excavating method of binary system program loopholes |
| CN106529296A (en) * | 2016-11-16 | 2017-03-22 | 武汉工程大学 | Method for attacking software protection virtual machine based on fuzzy clustering |
| CN111857681A (en) * | 2020-06-08 | 2020-10-30 | 北京大学 | Software-defined key function positioning and extracting method of C + + system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108776595B (en) | Method, device, equipment and medium for identifying display card of GPU (graphics processing Unit) server | |
| CN107766130B (en) | Method and device for migrating virtual machine to container | |
| CN110908865A (en) | Memory leakage monitoring method and device and electronic equipment | |
| US10318479B2 (en) | Method and device for automatically identifying junk file | |
| CN104572387A (en) | Method and device for debugging terminal in engineering mode | |
| CN112099800A (en) | Code data processing method and device and server | |
| CN103198122A (en) | Method and device for restarting in-memory database | |
| CN109582332B (en) | System upgrading method and device for Internet camera | |
| CN112231403B (en) | Consistency verification method, device, equipment and storage medium for data synchronization | |
| CN110866258A (en) | Method for quickly positioning bug, electronic device and storage medium | |
| CN112256635B (en) | Method and device for identifying file type | |
| KR102260631B1 (en) | Duplication Image File Searching Method and Apparatus | |
| CN104317850A (en) | Data processing method and device | |
| CN110941516B (en) | Operating system restoration method, device, equipment and storage medium | |
| CN110245074B (en) | Log record generation method and device, storage medium and server | |
| CN114064216A (en) | Virtual machine initialization method, device, terminal equipment and storage medium | |
| CN114519127A (en) | Disassembling file processing method, device, equipment and storage medium | |
| CN102184115B (en) | Method for updating system software and terminal device | |
| CN110874387B (en) | Method and device for constructing sparse graph of co-occurrence relation of identifiers of mobile equipment | |
| CN112241141B (en) | Hardware configuration method, system, device and medium of PLC control system | |
| CN116149941A (en) | Monitoring method and device of server component, server and storage medium | |
| CN114140812A (en) | Primitive recognition method, device, equipment and medium | |
| CN113568581A (en) | Multi-application resource recovery method and system for embedded equipment | |
| CN108108133A (en) | A kind of method and apparatus for changing nvme SSD hard disk users and capacity can be used | |
| CN111158733A (en) | BMC upgrading method, device, equipment and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |