CN115562675A

CN115562675A - Method, device, equipment and storage medium for analyzing binary file in firmware

Info

Publication number: CN115562675A
Application number: CN202211214280.7A
Authority: CN
Inventors: 魏凡; 马良; 李东宏; 陈杰; 赵亮; 李泽; 高剑
Original assignee: Nsfocus Technologies Inc; Nsfocus Technologies Group Co Ltd
Current assignee: Nsfocus Technologies Inc; Nsfocus Technologies Group Co Ltd
Priority date: 2022-09-30
Filing date: 2022-09-30
Publication date: 2023-01-03

Abstract

The application provides a method, a device, equipment and a storage medium for analyzing a binary file in firmware, which are used for solving the problems that IDA signature in the related art cannot perform function identification across platforms and the reverse analysis efficiency is low due to the high false alarm rate of a function identification method. In the method, a character string set to be identified of a function to be identified and a contrast character string set corresponding to a contrast function are extracted respectively, then any function to be identified and any contrast function form a function combination, the similarity between two functions in the function combination is compared, so that the function name of the function to be identified is identified, and finally, reverse analysis is carried out on a binary file in firmware according to the function name of the contrast function and the determined function name of the function to be identified. According to the method and the device, function identification is carried out by utilizing the character string set, cross-platform function identification can be achieved, the false alarm rate of a function identification algorithm is reduced, and the reverse analysis efficiency of the binary file in the firmware is improved.

Description

Method, device, equipment and storage medium for analyzing binary file in firmware

Technical Field

The application relates to the technical field of internet of things, in particular to a method, a device, equipment and a storage medium for analyzing a binary file in firmware.

Background

With the enhancement of the safety awareness of manufacturers of the internet of things, in order to prevent the firmware of own equipment of the internet of things from being researched reversely, the symbol table of the binary file in the firmware is usually removed, and the loss of the symbol table causes certain difficulty for safety researchers to analyze the firmware reversely. In practical situations, the models of manufacturer devices are more, firmware with symbol tables may exist in part of models (for example, a complete symbol table exists in a TP-Link Vxworks system), or some historical firmware which is not maintained any more exists, the symbol tables of part of binary files in the firmware are not removed, and the function of the binary files in the latest firmware of other models of devices can be automatically identified by using the binary files with the symbol tables.

In the related art, the automatic function identification technology is represented by an IDA signature, and a function signature for identifying a function can be made by using a binary file with a symbol table by using the IDA signature technology, but the binary files in the internet of things device firmware with different models generally have different architectures (such as ARM/X86/MIPS) and the IDA signature cannot identify the function across platforms.

The existing cross-platform function identification technology is generally based on function 'middle' instruction blocks, namely, one function generates a plurality of instruction blocks through a specific algorithm, the instruction blocks are used for generating 'middle' instruction blocks different from pseudo codes, and the instruction blocks have platform-independent characteristics and can be used for cross-platform function identification. However, in the firmware of the internet of things equipment, even in different binary files of the same function of the same manufacturer, the difference of the implementation processes of the functions with the same function name is very large, and the false alarm rate of function identification from the similarity of the 'middle' instruction block is high.

Disclosure of Invention

The application aims to provide a method, a device, equipment and a storage medium for analyzing a binary file in firmware, which are used for solving the problems that IDA (identity data association) signatures in the related art cannot perform cross-platform function identification and the efficiency of reverse analysis of the binary file in the firmware is low due to the high false alarm rate of the related cross-platform function identification method.

In a first aspect, an embodiment of the present application provides a method for parsing a binary file in firmware, where the method includes:

acquiring a binary file in firmware without a function name, and extracting character strings meeting preset conditions in the binary file in the firmware to obtain a character string set to be identified of at least one function to be identified;

acquiring a binary file in firmware labeled with a function name, and extracting character strings meeting preset conditions in the binary file in the firmware to obtain comparison character string sets corresponding to different comparison functions respectively;

combining any function to be identified and any comparison function into a function combination, and determining the similarity between the two functions in the function combination according to the character string set to be identified and the comparison character string set corresponding to the function combination;

when the similarity between two functions in the function combination is within a first threshold value range, judging that the function combination is a strong similarity function combination with the same function name, and obtaining the function name of the function to be identified;

and according to the function name of the comparison function, determining the function name of the function to be identified, and performing reverse analysis on the binary file in the firmware.

In one possible implementation, the method further includes:

when the similarity between two functions in the function combination is in a second threshold value range, determining that the function combination is a weak similarity function combination;

respectively determining a called function and a called function for two functions in the determined weak similarity function combination;

determining the function name of the function to be identified in the weak similarity function combination according to the relation between the called function and the called function;

the lower limit of the first threshold range is the upper limit of the second threshold range, and the number of the called functions is the same as that of the called functions.

In a possible implementation manner, determining a function name of a function to be identified in the weakly similar function combination according to a relationship between the called function and the called function includes:

combining any calling function of the comparison function and any calling function of the function to be identified into a calling function combination to obtain a calling function set;

combining any called function of the comparison function and any called function of the function to be identified into a called function combination to obtain a called function set;

if the calling function and the called function of the function to be identified in the weak similarity function combination are in a strong similarity function relationship, and the calling relation set formed by the calling function set and the called function set is a subset of the similarity function set, determining that the function names are consistent;

wherein, the similarity function set is a set formed by combining the strong similarity functions.

In a possible implementation manner, the extracting a character string meeting a preset condition in a binary file in the firmware to obtain a to-be-identified character string set of at least one to-be-identified function, or extracting a character string meeting a preset condition in a binary file in the firmware to obtain comparison character string sets corresponding to different comparison functions respectively includes:

acquiring all character strings contained in a binary file in the firmware;

cutting the character strings by using separators to obtain a first character string set corresponding to different functions;

deleting the character strings with the length smaller than the preset length in the first character string set to obtain a second character string set corresponding to different functions;

and extracting an ineffective English word character string from the second character string set to obtain a character string set to be recognized corresponding to at least one function to be recognized of different functions or a contrast character string set corresponding to different contrast functions respectively.

In a possible implementation manner, the determining, according to the set of strings to be identified and the set of comparison strings corresponding to the function combination, a similarity between two functions in the function combination includes:

determining the intersection of the character string set to be identified and the contrast character string set corresponding to the two functions in the function combination according to the character string set to be identified and the contrast character string set corresponding to the function combination;

respectively determining the total length of the character strings in the corresponding character string set to be identified and the corresponding character string set of the two functions in the function combination and the total length of the character strings in the intersection;

and determining the ratio of the total length of the character strings in the intersection to the character string set to be identified and the comparison character string set corresponding to the two functions in the function combination respectively, and taking the larger ratio as the similarity between the two functions in the function combination.

In one possible embodiment, the method further comprises:

when the similarity between the two functions is within a third threshold value range, determining that the two functions are dissimilar functions and determining that the function names of the two functions are not consistent;

the lower limit of the second threshold range is the upper limit of the third threshold range.

In a second aspect, an embodiment of the present application further provides an apparatus for parsing a binary file in firmware, where the apparatus includes:

the identification method comprises the steps that a character string to be identified acquiring module is configured to acquire a binary file in firmware without a function name, and extract character strings meeting preset conditions in the binary file in the firmware to obtain a character string set to be identified of at least one function to be identified;

the comparison character string acquisition module is configured to acquire a binary file in the firmware of the labeled function name, and extract character strings meeting preset conditions in the binary file in the firmware to obtain comparison character string sets corresponding to different comparison functions respectively;

the similarity determining module is configured to combine any function to be identified and any comparison function into a function combination, and determine the similarity between the two functions in the function combination according to the character string set to be identified and the comparison character string set corresponding to the function combination;

the strong similarity function determination module is configured to determine that the function combination is a strong similarity function combination with the same function name when the similarity between two functions in the function combination is within a first threshold range, and obtain the function name of the function to be identified;

and the binary file analysis module in the firmware is configured to reversely analyze the binary file in the firmware according to the function name of the function to be identified determined by comparing the function names of the functions.

In one possible implementation, the apparatus further comprises a weak similarity function determination module configured to:

respectively determining a called function and a called function for two functions in the weak similarity function combination;

In a possible implementation manner, determining a function name of a function to be identified in a weak similarity function combination according to a relationship between the called function and the called function is performed, and the weak similarity function determination module is configured to:

if the calling function and the called function of the function to be identified in the weak similar function combination are in a strong similar function relationship, and the calling relationship set formed by the calling function set and the called function set is a subset of the similar function set, determining that the function names are consistent;

In a possible implementation manner, the extraction processing of the character string meeting the preset condition in the binary file in the firmware is executed to obtain the to-be-identified character string set of at least one to-be-identified function, or the extraction processing of the character string meeting the preset condition in the binary file in the firmware is executed to obtain the comparison character string sets corresponding to different comparison functions, respectively, and the to-be-identified character string acquisition module or the comparison character string acquisition module is configured to:

acquiring all character strings contained in a binary file in the firmware;

and extracting an ineffective English word character string from the second character string set to obtain a character string set to be recognized of at least one function to be recognized corresponding to different functions or a contrast character string set respectively corresponding to different contrast functions.

In a possible implementation manner, the determining, according to the set of strings to be identified and the set of comparison strings corresponding to the function combination, the similarity between two functions in the function combination is performed, and the similarity determining module is configured to:

determining the intersection of the character string set to be identified and the control character string set corresponding to the two functions in the function combination according to the character string set to be identified and the control character string set corresponding to the function combination;

In one possible implementation, the apparatus further comprises a dissimilarity function determination module configured to:

the lower limit of the second threshold range is the upper limit of the third threshold range. In a third aspect, another embodiment of the present application further provides an electronic device, including at least one processor; and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any cross-regional message communication method provided by the embodiment of the application.

In a fourth aspect, another embodiment of the present application further provides a computer storage medium, where the computer storage medium stores a computer program, and the computer program is configured to cause a computer to execute any one of the cross-regional message communication methods in the embodiments of the present application.

In the embodiment of the application, firstly, a character string set to be recognized of a function to be recognized and a contrast character string set corresponding to different contrast functions are extracted respectively, then any function to be recognized and any contrast function form a function combination, the similarity between the two functions in the function combination is compared, so that the function name of the function to be recognized is recognized, and finally, the binary file in the firmware is reversely analyzed according to the function name of the contrast function and the determined function name of the function to be recognized. In summary, in the embodiment of the present application, the function identification is performed by using the character string set, and since the extracted character string set is unrelated to the platform, the cross-platform function identification can be implemented; the functions are identified through the similarity among different functions, the false alarm rate of the function identification algorithm is reduced, the accuracy rate of the function identification algorithm is improved, the difficulty of reverse analysis is reduced in the process of reversely analyzing the binary files in the firmware, and therefore the reverse analysis efficiency of the binary files in the firmware is improved.

Additional features and advantages of the application will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required to be used in the embodiments of the present application will be briefly described below, and it is obvious that the drawings described below are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on the drawings without creative efforts.

FIG. 1 is a schematic diagram of an application scenario according to one embodiment of the present application;

FIG. 2 is a flowchart illustrating a method for parsing a binary file in firmware according to an embodiment of the present application;

FIG. 3 is a flowchart illustrating step 202 according to one embodiment of the present application;

FIG. 4 is a schematic flow chart of step 203 according to one embodiment of the present application;

FIG. 5 is a flowchart illustrating identification of two functions in a weak similarity function combination according to an embodiment of the present application;

FIG. 6 is a flowchart illustrating a step 503 according to an embodiment of the present application;

FIG. 7 is a diagram illustrating an apparatus for parsing a binary file in firmware according to an embodiment of the present application;

FIG. 8 is a schematic view of an electronic device according to one embodiment of the present application.

Detailed Description

In order to make those skilled in the art better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

It should be noted that the terms "first," "second," and the like in the description and in the claims of the present application are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It should be understood that the data so used may be interchanged under appropriate circumstances such that embodiments of the application described herein may be implemented in sequences other than those illustrated or described herein. The implementations described in the following exemplary examples do not represent all implementations consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the application, as detailed in the appended claims.

In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.

Hereinafter, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

(1) Firmware: operating system of thing networking device.

(2) Symbol table: and mapping relation between function name and address.

(3) Library function: and the non-manufacturer self-realized general functions such as strcpy and the like.

The applicant summarizes that, during the analysis and research process of the binary file in the firmware in the related art, the following problems may exist:

in the process of analyzing and researching the binary file in the firmware, the functions included in the binary file in the firmware are mainly analyzed reversely. Currently, the automatic function identification technology is represented by an IDA signature, and the IDA signature technology can be used to make a function signature for identifying a function by using a binary file with a symbol table, but the binary files in internet of things device firmware of different models generally have different architectures (such as ARM/X86/MIPS), and the IDA signature cannot identify the function across platforms.

The existing cross-platform function identification technology is generally based on function 'middle' instruction blocks, namely, one function generates a plurality of instruction blocks through a specific algorithm, the instruction blocks are used for generating 'middle' instruction blocks different from pseudo codes, and the instruction blocks have platform-independent characteristics and can be used for cross-platform function identification. However, in the firmware of the internet of things device, even in binary files of the same function of the same manufacturer, the difference of the implementation processes of the functions with the same function name is very large, and the false alarm rate of function identification from the similarity of the 'middle' instruction block is high.

In view of this, embodiments of the present application provide a method, an apparatus, a device, and a storage medium for parsing a binary file in firmware. The method for analyzing the binary file in the firmware is relatively simple, convenient, efficient and high in accuracy.

Firstly, extracting a character string set to be identified of a function to be identified and a contrast character string set corresponding to different contrast functions respectively, then forming a function combination by any function to be identified and any contrast function, comparing the similarity between the two functions in the function combination so as to identify the function name of the function to be identified, and finally, reversely analyzing a binary file in firmware according to the function name of the contrast function and the determined function name of the function to be identified. In summary, in the embodiment of the present application, the character string set is used for function identification, and since the extracted character string set is irrelevant to the platform, cross-platform function identification can be implemented; the functions are identified through the similarity among different functions, the false alarm rate of the function identification algorithm is reduced, the accuracy rate of the function identification algorithm is improved, and the difficulty of reverse analysis is reduced in the process of reversely analyzing the binary files in the firmware, so that the reverse analysis efficiency is improved.

After introducing the design concept of the embodiment of the present application, some simple descriptions are provided below for application scenarios to which the technical solution of the embodiment of the present application can be applied, and it should be noted that the application scenarios described below are only used for describing the embodiment of the present application and are not limited. In specific implementation, the technical scheme provided by the embodiment of the application can be flexibly applied according to actual needs.

Fig. 1 is a schematic diagram of an application scenario according to an embodiment of the present application.

As shown in fig. 1, the application environment may include, for example, a storage system 10, a server 20, and a terminal device 30. Any suitable electronic device that terminal device 30 may use for network access includes, but is not limited to, a computer, a laptop, a smartphone, a tablet, a smartwatch, a smartband, or other type of terminal. The storage system 10 is capable of storing accessed media resources, such as web pages, electronic books, audio-video files, etc., for storing messages published by message publishers.

It should be noted that the terminal devices 30 shown in fig. 1 (e.g., 30_1 and 30 _2or 30 _N) can also communicate with each other via the network 40. Network 40 may be a network used for information transfer in a broad sense and may include one or more communication networks such as a wireless communication network, the internet, a private area network, a local area network, a metropolitan area network, a wide area network, or a cellular data network.

Only a single server or terminal device is detailed in the description of the present application, but it will be understood by those skilled in the art that the single server 20, terminal device 30 and storage system 10 or 11 shown are intended to represent that the technical aspects of the present application relate to the operation of the terminal device, server and storage system. The detailed description of a single terminal device and a single server and storage system is for convenience of description at least and does not imply limitations on the number, types, or locations of terminal devices and servers. It should be noted that the underlying concepts of the example embodiments of the present application may not be altered if additional modules are added or removed from the illustrated environments. In addition, although a bidirectional arrow from the storage system to the server is shown in fig. 1 for convenience of explanation, it will be understood by those skilled in the art that the above-described data transmission and reception may also be realized through the network 40.

The storage system 10 may be, for example, a cache system, a hard disk storage, a memory storage, or the like. Certainly, the method provided in the embodiment of the present application is not limited to the application scenario shown in fig. 1, and may also be used in other possible application scenarios, and the embodiment of the present application is not limited. The functions that can be implemented by each device in the application scenario shown in fig. 1 will be described in the following method embodiments, and will not be described in detail herein.

The server 20 may be a server, a server cluster composed of several servers, or a cloud computing center. The server 20 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or may provide cloud services, a cloud database, cloud computing, a cloud function, cloud storage, a network service, cloud communication, a middleware service, and a domain name service.

To further illustrate the technical solutions provided by the embodiments of the present application, the following detailed description is made with reference to the accompanying drawings and the detailed description. Although the embodiments of the present application provide method operation steps as shown in the following embodiments or figures, more or fewer operation steps may be included in the methods based on conventional or non-inventive efforts. In steps where no necessary causal relationship exists logically, the order of execution of these steps is not limited to the order of execution provided by the embodiments of the present application.

Referring to fig. 2, a schematic flowchart of a method for parsing a binary file in firmware according to an embodiment of the present application is provided, including the following steps:

in step 201, a binary file in the firmware without a function name is obtained, and a character string meeting a preset condition in the binary file in the firmware is extracted to obtain a to-be-identified character string set of at least one to-be-identified function.

In step 202, a binary file in the firmware labeled with the function name is obtained, and the character strings meeting the preset conditions in the binary file in the firmware are extracted to obtain comparison character string sets corresponding to different comparison functions respectively.

In a possible implementation manner, in step 201, a character string meeting a preset condition in a binary file in firmware is extracted to obtain a to-be-identified character string set of at least one to-be-identified function, or in step 202, a character string meeting a preset condition in a binary file in firmware is extracted to obtain comparison character string sets corresponding to different comparison functions, respectively, where a flow diagram of the method is shown in fig. 3, and the method includes the following steps:

in step 301, all strings contained in the binary file in the firmware are obtained.

The embodiment of the application uses a disassembling tool, such as IDA and the like, to open the binary file in the firmware to obtain all the character strings contained in the binary file. For example, all the strings contained in the binary file in the firmware are as follows:

[％s:％d]:ubus send_advertisement_frame error.％s\n

send_frame_handle

in step 302, the character strings are cut by using the delimiters to obtain a first character string set corresponding to different functions.

The embodiment of the present application cuts the character string by using a specific separator, the separator can exclude all characters except ("/", "_", "-",0-9, a-Z), delete the repeated character string, and cut all character strings included in the binary file in the firmware by using the separator to obtain the following first character string set:

ubus,send_advertisement_frame,error,send_frame_handle

in contrast to all the character strings contained in the binary file in the first character string set and the firmware, the character strings such as spaces, percentages and the like are deleted in the embodiment of the application, and for the character string send _ advertisement _ frame, the character string is regarded as a whole in the application. Therefore, the embodiment of the application deletes part of the character strings irrelevant to the function by using the specific separator, and avoids the interference of the character strings on the function identification.

In step 303, deleting the character strings with the length smaller than the preset length in the first character string set to obtain a second character string set corresponding to different functions.

Since the too short character strings such as "0x", "s", and the like are less associated with the semantics of the stop word "buf" and the function of the function itself, and a larger false alarm is caused, in the embodiment of the present application, the character string with the length smaller than the preset length is deleted, and the preset length is usually 5. For example, after performing step 303, the resulting second set of strings is as follows:

send_advertisement_frame,error,send_frame_handle

through the step 303, the embodiment of the application avoids the false alarm of the character string on the function identification, and improves the accuracy of the function identification.

In step 304, an invalid english word string is extracted from the second string set, and a string set to be recognized corresponding to at least one function to be recognized of different functions or a comparison string set corresponding to different comparison functions respectively is obtained.

By extracting the non-effective English word character strings, the function can be better reflected, and the misinformation of function identification caused by effective English word character strings is reduced. For example, in the second string set, the string error is a valid english word, and therefore, after step 304 is executed, the to-be-recognized string set or the comparison string set obtained in the embodiment of the present application is as follows:

send_advertisement_frame,send_frame_handle

therefore, according to the embodiment of the application, through the extraction processing of the character strings, the character string set which is closely associated with the function is obtained, the false alarm caused by function identification is avoided, and the accuracy of the function identification is improved.

After the to-be-identified string set of the at least one to-be-identified function and the comparison string sets respectively corresponding to different comparison functions are obtained, in step 203, any to-be-identified function and any comparison function form a function combination, and the similarity between the two functions in the function combination is determined according to the to-be-identified string set and the comparison string set corresponding to the function combination.

In a possible embodiment, in step 203, the similarity between two functions in the function combination is determined according to the corresponding character string set to be identified and the corresponding comparison character string set in the function combination, and the process is shown in fig. 4 and includes the following steps:

in step 401, an intersection of the string set to be identified and the comparison string set corresponding to the two functions in the function combination is determined according to the string set to be identified and the comparison string set corresponding to the function combination.

In step 402, the total length of the strings in the corresponding sets of strings to be identified and the control strings of the two functions in the function combination and the total length of the strings in the intersection are respectively determined.

In step 403, the ratio between the total length of the strings in the intersection and the corresponding string set to be recognized and the corresponding string set of the two functions in the function combination is determined, and the larger ratio is used as the similarity between the two functions in the function combination.

For example, the function a is a function to be recognized, the set of strings to be recognized is set a (a 1, a2, \8230;, an), the function B is a comparison function, and the set of comparison strings is set B (B1, B2, \8230;, bm).

1. According to the step 401, the intersection C of the set a and the set B is: c = a & B = (C1, C2, \8230;, ct);

2. according to the above step 402, the total lengths La, lb, and Lc of the character strings in the sets a, B, and C are respectively:

La＝len(a1)+len(a2)+…+len(an)

Lb＝len(b1)+len(b2)+…+len(bm)

Lc＝len(c1)+len(c2)+…+len(ct)

3. according to the step 403, the larger ratio of Lc/La and Lc/Lb is taken as the similarity S between the two functions in the function combination.

In step 204, when the similarity between the two functions in the function combination is within the first threshold range, the function combination is determined as a strong similarity function combination with the same function name, and the function name of the function to be identified is obtained.

For example, J and K are threshold values set by the present application, where 0-K-J-s are composed of 1. According to the magnitude relation of the similarity S between two functions in the function combination and the similarity J and the similarity K between the two functions in the function combination, the embodiment of the application divides the relation of the two functions in the function combination into the following three conditions:

case 1: if J < S = <1, the function combination is determined to be a strongly similar function combination with the same function name.

Case 2: if K < S = < J, the combination of functions is determined to be a weak similarity function combination.

Case 3: if 0= < S = < K, two functions in the combination of functions are determined to be dissimilar functions.

After determining that the function combination is a strong similar function combination with the same function name, in step 205, the binary file in the firmware is inversely analyzed according to the function name of the function to be identified, which is determined according to the function name of the comparison function.

In a possible implementation manner, for the above case 2, in a binary file in firmware, a function has a called and called relationship, and the called relationship and a function have a certain correlation, so that in the embodiment of the present application, the function-called relationship is introduced into a function identification process, and a schematic diagram of an identification flow of two functions in a weak similarity function combination is shown in fig. 5, and includes the following contents:

in step 501, when the similarity between two functions in the function combination is within a second threshold range, the function combination is determined to be a weak similarity function combination.

In step 502, for two functions determined to be in the weak similarity function combination, a called function and a called function are determined respectively.

In step 503, the function name of the function to be identified in the weak similarity function combination is determined according to the relationship between the called function and the called function.

It should be noted that, for the weak similarity function combination, the lower limit of the first threshold range is the upper limit of the second threshold range, and the number of the called functions is the same as that of the called functions.

In a possible embodiment, in step 503, the function name of the function to be identified in the weak similarity function combination is determined according to the relationship between the called function and the called function, and a flow diagram of the method is shown in fig. 6 and includes the following steps:

in step 601, any calling function of the comparison function and any calling function of the function to be identified are combined into a calling function combination to obtain a calling function set.

In step 602, any called function of the comparison function and any called function of the function to be identified are combined into a called function combination, so as to obtain a called function set.

In step 603, if the calling function and the called function of the function to be identified in the weak similar function combination are in a strong similar function relationship, and the calling relationship set composed of the calling function set and the called function set is a subset of the similar function set, it is determined that the function names are consistent.

For example, the function a and the function B are weak similar function combinations, and the function called by the function a and the function called by the function B include: the function A is called by a function D = { D1, D2, \8230;, dr } in the set D, and a function E = { E1, E2, \8230;, et } in the set E is called; the functions called by the function B and the called functions comprise: the function B is called by the function in the set F, F = { F1, F2, \8230;, fu } to call the function in the set G, G = { G1, G2, \8230;, gu }, so the set of calling functions obtained in step 601, the set of called functions obtained in step 602, and the set of calling relationships obtained in step 603 are as follows:

the set of calling functions H = (E & G) = { (ex, gx) }

The set of called functions I = (D & F) = { (dx, fx) }

Call relationship set J = (D & F, E & G) = { ex, gx), (dx, fx) }

If the calling function and the called function of the function to be identified in the weak similar function combination are in a strong similar function relationship, namely the functions in the calling function set G and the called function F of the function B are strong similar functions, and the calling relationship set consisting of the calling function set and the called function set is a subset of the similar function set, namely the calling relationship set J is contained in C (similar function set), the function names of the function A and the function B are determined to be consistent, namely the function A and the function B have the same function name, so that the function A and the function B have the same function characteristic.

It is added that the set of similarity functions is a set formed by combining strong similarity functions.

In one possible embodiment, for case 3 above, i.e., when the similarity between the two functions is within the third threshold, the two functions are determined to be dissimilar functions, and the function names of the two functions are determined to be dissimilar.

It should be noted that, for the dissimilar function, the lower limit of the second threshold range is the upper limit of the third threshold range.

To sum up, the embodiment of the application can identify the function to be identified in the binary file in the firmware with the symbol table, and perform function identification by using the character string set, because the extracted character string set is irrelevant to the platform, cross-platform function identification can be realized, the false alarm rate of the function identification algorithm is reduced, and the accuracy of the function identification algorithm is improved.

Based on the same inventive concept, the embodiment of the application further provides a device for analyzing the binary file in the firmware. Fig. 7 is a block diagram illustrating a binary file parsing apparatus in firmware according to an exemplary embodiment, and referring to fig. 7, the apparatus 700 includes:

the to-be-identified character string acquiring module 701 is configured to acquire a binary file in firmware without a function name, and extract a character string meeting a preset condition in the binary file in the firmware to obtain a to-be-identified character string set of at least one to-be-identified function;

a comparison character string obtaining module 702, configured to obtain a binary file in the firmware of the annotated function name, and extract a character string in the binary file in the firmware, where the character string meets a preset condition, to obtain comparison character string sets corresponding to different comparison functions respectively;

the similarity determining module 703 is configured to combine any function to be identified and any comparison function into a function combination, and determine the similarity between two functions in the function combination according to the character string set to be identified and the comparison character string set corresponding to the function combination;

a strong similarity function determining module 704 configured to determine that the function combination is a strong similarity function combination with the same function name when the similarity between two functions in the function combination is within a first threshold range, so as to obtain the function name of the function to be identified;

the firmware binary file analysis module 705 is configured to perform inverse analysis on the firmware binary file according to the function name of the function to be identified, which is determined by comparing the function names of the functions.

In a possible implementation, determining a function name of a function to be identified in a weak similarity function combination according to a relation between the called function and the called function is performed, and the weak similarity function determination module is configured to:

acquiring all character strings contained in a binary file in the firmware;

In a possible implementation manner, the similarity determination module is configured to perform the determining of the similarity between two functions in the function combination according to the set of strings to be identified and the set of comparison strings corresponding to the function combination, and is configured to:

respectively determining the total length of the character strings in the character string set to be identified and the comparison character string set corresponding to the two functions in the function combination and the total length of the character strings in the intersection;

when the similarity between the two functions is within a third threshold value range, determining that the two functions are dissimilar functions, and determining that the function names of the two functions are not consistent;

For implementation and beneficial effects of each operation in the parsing apparatus for binary files in firmware, reference is made to the description in the foregoing method, and details are not repeated here.

After introducing the method and apparatus for parsing a binary file in firmware according to an exemplary embodiment of the present application, an electronic device according to another exemplary embodiment of the present application is introduced next.

As will be appreciated by one skilled in the art, aspects of the present application may be embodied as a system, method or program product. Accordingly, various aspects of the present application may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.

In some possible embodiments, an electronic device according to the present application may include at least one processor, and at least one memory. The memory stores program codes, and when the program codes are executed by the processor, the processor is caused to execute the steps of the method for parsing the binary file in the firmware according to the various exemplary embodiments of the present application described above in the present specification. For example, the processor may perform steps in a method such as parsing a binary file in firmware.

The electronic device 130 according to this embodiment of the present application is described below with reference to fig. 8. The electronic device 130 shown in fig. 8 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.

As shown in fig. 8, the electronic device 130 is represented in the form of a general electronic device. The components of the electronic device 130 may include, but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 that couples various system components including the memory 132 and the processor 131.

Bus 133 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

The memory 132 may include readable media in the form of volatile memory, such as Random Access Memory (RAM) 1321 and/or cache memory 1322, and may further include Read Only Memory (ROM) 1323.

Memory 132 may also include a program/utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may comprise an implementation of a network environment.

The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), with one or more devices that enable a user to interact with the electronic device 130, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device 130 to communicate with one or more other electronic devices. Such communication may occur via input/output (I/O) interfaces 135. Also, the electronic device 130 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the internet) via the network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 over the bus 133. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

In some possible embodiments, the aspects of a method for parsing a binary file in firmware provided by the present application may also be implemented in the form of a program product, which includes program code for causing a computer device to perform the steps of a method for parsing a binary file in firmware according to various exemplary embodiments of the present application described above in this specification when the program product is run on the computer device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The program product for the parsing method of binary files in firmware according to the embodiment of the present application may employ a portable compact disc read only memory (CD-ROM) and include program codes, and may be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

A readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the consumer electronic device, partly on the consumer device, as a stand-alone software package, partly on the consumer electronic device and partly on a remote electronic device, or entirely on the remote electronic device or server. In the case of remote electronic devices, the remote electronic devices may be connected to the consumer electronic device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external electronic device (e.g., through the internet using an internet service provider).

It should be noted that although several units or sub-units of the apparatus are mentioned in the above detailed description, such division is merely exemplary and not mandatory. Indeed, the features and functions of two or more units described above may be embodied in one unit, according to embodiments of the application. Conversely, the features and functions of one unit described above may be further divided into embodiments by a plurality of units.

Further, while the operations of the methods of the present application are depicted in the drawings in a particular order, this does not require or imply that these operations must be performed in this particular order, or that all of the illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and so forth) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable image scaling apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable image scaling apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable image scaling apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable image scaling device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer implemented process such that the instructions which execute on the computer or other programmable device provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all alterations and modifications as fall within the scope of the application.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims

1. A method for parsing a binary file in firmware, the method comprising:

acquiring a binary file in firmware of a marked function name, and extracting character strings meeting preset conditions in the binary file in the firmware to obtain comparison character string sets corresponding to different comparison functions respectively;

2. The method of claim 1, further comprising:

3. The method according to claim 2, wherein determining the function name of the function to be identified in the weak similarity function combination according to the relation between the called function and the called function comprises:

4. The method according to claim 1, wherein the extracting a character string that meets a preset condition in a binary file in the firmware to obtain a character string set to be recognized of at least one function to be recognized, or extracting a character string that meets a preset condition in a binary file in the firmware to obtain comparison character string sets corresponding to different comparison functions respectively comprises:

acquiring all character strings contained in a binary file in the firmware;

5. The method according to claim 1, wherein determining the similarity between two functions in the function combination according to the corresponding character string set to be identified and the corresponding control character string set of the function combination comprises:

and determining the ratio of the total length of the character strings in the intersection to the character string set to be recognized and the comparison character string set corresponding to the two functions in the function combination respectively, and taking the larger ratio as the similarity between the two functions in the function combination.

6. The method of claim 1, further comprising:

7. An apparatus for parsing a binary file in firmware, the apparatus comprising:

the strong similarity function judging module is configured to judge that the function combination is a strong similarity function combination with the same function name when the similarity between two functions in the function combination is within a first threshold range, and the function name of the function to be identified is obtained;

8. An electronic device comprising at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to cause the at least one processor to perform the method of any one of claims 1-6.

9. A computer storage medium, characterized in that the computer storage medium stores a computer program for causing a computer to perform the method of any one of claims 1-6.

10. A computer program product, comprising a computer program to:

the computer program, when executed by a processor, implements the method of any one of claims 1-6.