KR20230027890A - Ethereum virtual machine bytecode analysis method and evm bytecode analysis tool - Google Patents

Abstract

An ethereum virtual machine (EVM) bytecode analysis method and an EVM bytecode analysis tool are provided. The EVM bytecode analysis method includes the steps of: receiving an EVM bytecode; extracting an opcode corresponding to the EVM bytecode; and converting the opcode into an intermediate language, wherein converting into the intermediate language includes allocating a stack pointer capable of referring to a stack included in the opcode.

Description

EVM bytecode analysis method and EVM bytecode analysis tool {ETHEREUM VIRTUAL MACHINE BYTECODE ANALYSIS METHOD AND EVM BYTECODE ANALYSIS TOOL}

The present invention relates to an EVM (Ethereum Bytecode Machine) bytecode analysis method and analysis tool, and more particularly, to an EVM bytecode analysis method and analysis tool for efficiently analyzing bytecode used in an EVM of a stack-based machine. will be.

Blockchain originated from Satoshi Nakamoto's Bitcoin: A Peer-to-Peer Electronic Cash System in 2008, where blocks are connected to each other. Blockchain is a generic term for a distributed database that shares data bound by hash links on a distributed network composed of multiple network nodes.

Among blockchain platforms, Ethereum, which uses a cryptocurrency called Ether (ETH), is a programmable smart contract and decentralized application (dApp) using the script language Solidity. Ethereum Virtual Machine (EVM) is provided to support

The fact that the Ethereum platform supports the programmable EVM environment means that it can also contain security vulnerabilities, and the importance of analyzing the EVM bytecode running in the EVM environment is emphasized.

The technical problem to be solved by the present invention is to provide an EVM bytecode analysis method and analysis tool capable of converting a stack-based EVM into an intermediate language to support a stack pointer in order to increase the analysis efficiency of EVM bytecode for security vulnerability analysis. is to provide

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

An EVM bytecode analysis method according to some embodiments of the present invention for solving the above-described technical problem includes receiving EVM (Ethereum Virtual Machine) bytecode, and generating an opcode corresponding to the EVM bytecode. Extracting and converting the opcode into an intermediate language, wherein the converting into the intermediate language includes allocating a stack pointer that can refer to a stack included in the opcode.

In some embodiments of the present invention, allocating the stack pointer may include allocating a virtual register storing the stack pointer.

In some embodiments of the present invention, the converting to the intermediate language may include converting the PUSH included in the opcode to store data in the stack and increment the stack pointer.

In some embodiments of the present invention, the converting into the intermediate language may include converting the POP included in the opcode to fetch data from the stack and decrement the stack pointer.

An EVM bytecode analysis tool according to some embodiments of the present invention for solving the above technical problems includes a code input unit for receiving EVM bytecodes, a disassembler unit for extracting opcodes corresponding to the EVM bytecodes, and the opcodes. A code conversion unit for converting code into an intermediate language, wherein the code conversion unit allocates a stack pointer capable of referring to a stack included in an opcode to the intermediate language.

In some embodiments of the present invention, the code converter may allocate a virtual register for storing a stack pointer to the intermediate language.

In some embodiments of the present invention, the code conversion unit may store data in the stack and increment the stack pointer for PUSH included in the opcode.

In some embodiments of the present invention, the code conversion unit may read data from the stack for the POP included in the opcode and convert the data to decrease the stack pointer.

Details of other embodiments are included in the detailed description and drawings.

The EVM bytecode analysis method and analysis tool according to an embodiment of the present invention can increase the efficiency of an operation to insert (PUSH) or subtract (POP) a value from a stack by converting an opcode to generate an optimized intermediate language. In particular, the present invention can reduce the computation time and memory usage of control flow and data flow in the analysis process for analyzing EVM bytecode errors and security vulnerabilities.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description of the claims.

1 is a configuration diagram of an Ethereum Virtual Machine (EVM).
2 is a block diagram illustrating an EVM bytecode analysis tool according to some embodiments of the present invention.
3A and 3B are diagrams for explaining the operation of the EVM bytecode analysis tool of the present invention.
4A and 4B are diagrams for explaining the operation of the EVM bytecode analysis tool of the present invention.
5 is a flowchart illustrating an EVM bytecode analysis method according to some embodiments of the present invention.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

A component is said to be "connected to" or "coupled to" another component when it is directly connected or coupled to the other component or through another component in between. include all cases. On the other hand, when one component is referred to as “directly connected to” or “directly coupled to” another component, it indicates that another component is not intervened. “And/or” includes each and every combination of one or more of the recited items.

Terminology used herein is for describing the embodiments and is not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used herein, "comprises" and/or "comprising" means that a stated component, step, operation, and/or element is present in the presence of one or more other components, steps, operations, and/or elements. or do not rule out additions.

Although first, second, etc. are used to describe various constituent elements, these constituent elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may also be the second component within the technical spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

1 is a configuration diagram of an Ethereum Virtual Machine (EVM).

Referring to FIG. 1, the analysis of EVM bytecode according to some embodiments of the present invention is the EVM bytecode executed on the Ethereum Virtual Machine (EVM) for handling smart contract deployment and execution on the Ethereum platform. Use

The Ethereum virtual machine consists of a program counter (PC) that stores the execution location of instructions, gas to store the cost incurred each time an instruction is executed, and a stack and memory to read, write, and store data. can

A program written in Solidity, a programming language for writing smart contracts running on the Ethereum virtual machine, is compiled to generate EVM bytecode. Smart contracts can be deployed on the Ethereum network in the form of EVM bytecode.

The EVM bytecode analysis method and analysis tool according to an embodiment of the present invention increases the efficiency of analysis in the process of converting EVM bytecode into an intermediate language to help analyze whether there are security vulnerabilities or errors in the EVM bytecode. It is possible to provide an intermediate language transformation optimized for This will be described in more detail using the following drawings.

2 is a block diagram illustrating an EVM bytecode analysis tool according to some embodiments of the present invention.

Referring to FIG. 2 , the EVM bytecode analysis tool 100 according to some embodiments of the present invention may include a code input unit 110, a disassembler unit 120, and a code conversion unit 130.

The EVM bytecode analysis tool 100 may include a computing device capable of executing a series of operations of receiving EVM bytecode written in Solidity and converting it into an intermediate language. Such a computing device may be, for example, a module comprising at least one Central Processing Unit (CPU) and a set of memories to which they access to read and write data. The EVM bytecode analysis tool 100 may include, for example, various computer systems such as a personal computer (PC), a server computer, a workstation, and a laptop computer.

The code input unit 110 may receive EVM bytecode. As described above, the EVM bytecode is a binary expression code to be executed in the Ethereum virtual machine on the Ethereum platform, and can be obtained by compiling a program written in the Solidity language. In some embodiments, the code input unit 110 may obtain EVM bytecode by retaining a function of compiling a program written in Solidity.

The disassembler unit 120 may receive the EVM bytecode from the code input unit 110 and extract an opcode corresponding to the EVM bytecode. For example, if the EVM bytecode is '60 55', the code input unit 110 may extract 'push1 0x55' storing 0x55 in the stack.

The disassembler unit 120 disassembles the EVM bytecode to extract a plurality of opcodes that use the stack and memory shown in FIG. 1 and record gas usage.

The code conversion unit 130 may generate an intermediate language by converting the opcode extracted by the disassembler unit 120 . The process of transforming low-level opcodes into a language that can be explicitly expressed is intermediate language conversion or lifting.

When generating an intermediate language by converting the opcode, the code conversion unit 130 may generate an optimized intermediate language for efficient analysis of the intermediate language thereafter. Optimization of the intermediate language may include allocating a stack pointer that can refer to a stack included in the opcode.

The EVM virtual machine consists of a stack-based machine that uses a stack to store the results of executing opcodes. A stack-based machine can be implemented relatively simply compared to a register-based machine by operating in a manner of sequentially storing data in a stack and sequentially taking out and writing data.

3A and 3B are diagrams for explaining the operation of the EVM bytecode analysis tool of the present invention.

Referring first to FIG. 3A , a process for performing an operation of a+b in a stack-based machine is shown. In this process, a and b are sequentially stored on the stack through the PUSH command, then a and b are sequentially loaded through the POP command, summed through the ADD command, and the result is placed on the stack through the PUSH command. proceed to save. In this way, in a stack-based machine, it can be seen that 6 instruction cycles are required for the operation of a+b. The EVM bytecode compiled and generated from Solidity is configured to operate as a stack-based machine when the Ethereum virtual machine executes the EVM bytecode.

Referring to FIG. 3B , a process for performing an operation of a+b in the case of using a stack pointer pointing to a stack address is shown. This process proceeds to store a and b in the stack space pointed to by the stack pointer, add up a and b loaded using the stack pointer, and store them again in the stack. In this way, when using the stack pointer, it can be seen that 3 instruction cycles are required for the operation of a+b.

For efficiency of analysis of the EVM bytecode, the code conversion unit 130 may allocate a stack pointer when converting an opcode into an intermediate language to increase instruction execution efficiency.

That is, the code conversion unit 130 allocates a virtual register for storing the stack pointer, and increases the stack pointer when there is a PUSH command for storing data in the stack or a POP command for loading data from the stack among the opcodes to be converted. Transformation of the intermediate language can be performed to reduce

4A and 4B are diagrams for explaining the operation of the EVM bytecode analysis tool of the present invention.

Referring to FIGS. 4A and 4B, a series of opcodes extracted by disassembling EVM bytecodes are shown in FIG. 4A. The code conversion unit 130 may generate an intermediate language as shown in FIG. 4B by converting a series of opcodes.

FIG. 4B shows an example of converting the three push1 commands shown in FIG. 4A into an intermediate language. The code conversion unit 130 assigns a stack pointer (SP) and data ([SP]) stored in the stack referred to by the stack pointer to the 'push1 0x55' command that stores 0x55 in the stack, thereby converting the intermediate language can be created. After saving data to the stack via PUSH, the stack is incremented by 0x20 and set to point to the next storage space on the stack.

Subsequently, the code conversion unit 130 generates an intermediate language converted from 'push1 0x23' and 'push1 0xb', which sequentially stores 0x23 and 0xb in the stack. In the above process, the code conversion unit 130 stores the stack pointer in a virtual register, and stores data in the storage space of the stack indicated by the stack pointer when the opcode includes PUSH.

The code conversion unit 130 may generate an intermediate language converted to apply the stack pointer to commands other than the PUSH or POP commands. Referring to FIGS. 4C to 4E , an example of generating an intermediate language by converting dup3, add, and and by the code conversion unit 130 is shown.

In the case of dup3, it is a command for copying the value stored in the stack and writing it to the stack again. The code conversion unit 130 reads the data at the address reduced by 0x40 from the current stack pointer (SP), so that the current stack pointer is Converted intermediate language can be created by storing it in the pointed stack ([SP]).

In the case of add and and, these are commands for calling values stored in the stack in order, performing the operation, and then writing them back to the stack. It is possible to create an intermediate language that is converted in a way of loading it and storing the summed or bit-operated value on the stack.

5 is a flowchart illustrating an EVM bytecode analysis method according to some embodiments of the present invention.

Referring to FIG. 5 , the EVM bytecode analysis method according to an embodiment of the present invention comprises receiving an EVM bytecode (S110), extracting an opcode corresponding to the EVM bytecode (S120), and converting the opcode into an intermediate step. and converting into a language (S130).

The code input unit 110 may receive EVM bytecode (S110). The code input unit 110 may receive EVM bytecode generated by compiling Solidity code from an external component or generate EVM bytecode by receiving Solidity code and compiling it.

The disassembler unit 120 may extract an opcode corresponding to the EVM bytecode by disassembling the EVM bytecode (S120). The disassembler unit 120 may extract an opcode corresponding to a bytecode recorded in a binary format, such as '60 55'.

Subsequently, the code conversion unit 130 may generate an intermediate language by converting the opcode (S130). In the process of generating the intermediate language, the code conversion unit 130 may allocate a virtual register storing a stack pointer that can refer to a stack included in an opcode.

The code conversion unit 130 may convert the PUSH included in the opcode to store data in a stack and increase a stack pointer stored in a virtual register. Also, the code conversion unit 130 may read data from the stack for the POP included in the opcode and decrement the stack pointer stored in the virtual register. An example of an operation by the code conversion unit 130 has been described using FIGS. 4A and 4B.

Similarly, the code conversion unit 130 increases or decreases the stack pointer for various instructions included in the opcode to access the stack referenced by the stack pointer, and converts the opcode using FIGS. 4C to 4E. was explained.

The EVM bytecode analysis method and analysis tool according to an embodiment of the present invention can increase the efficiency of an operation to insert (PUSH) or subtract (POP) a value from a stack by generating an optimized intermediate language using the above-described method. . In particular, the present invention can reduce the computation time and memory usage of control flow and data flow in the analysis process for analyzing EVM bytecode errors and security vulnerabilities.

The present invention can also be implemented as computer readable codes on a computer readable recording medium. A computer-readable recording medium includes all types of recording devices in which data that can be read by a computer device is stored. Examples of computer-readable recording media include hard disks, ROMs, RAMs, CD-ROMs, hard disks, magnetic tapes, floppy disks, optical data storage devices, etc., and carrier waves (for example, transmission over the Internet). It also includes what is implemented in the form of.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art can realize that the present invention can be implemented in other specific forms without changing the technical spirit or essential features. you will be able to understand Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

100: EVM bytecode analysis tool 110: code input unit
120: disassembler unit 130: code conversion unit

Claims (9)

Receiving EVM (Ethereum Virtual Machine) bytecode;
extracting an opcode corresponding to the EVM bytecode;
converting the opcode into an intermediate language;
The step of converting to the intermediate language,
Including allocating a stack pointer that can refer to a stack included in the opcode.
EVM bytecode analysis method. According to claim 1,
Allocating the stack pointer,
Including allocating a virtual register for storing the stack pointer,
EVM bytecode analysis method. According to claim 1,
The step of converting to the intermediate language,
Converting to store data in the stack and increment the stack pointer for the PUSH included in the opcode.
EVM bytecode analysis method. According to claim 1,
The step of converting to the intermediate language,
Including fetching data from the stack for the POP included in the opcode and converting to decrement the stack pointer.
EVM bytecode analysis method. A computer program stored in the computer-readable recording medium in which a program for executing any one of the methods of claims 1 to 4 using a computer is recorded. a code input unit for receiving EVM bytecode;
a disassembler unit extracting an opcode corresponding to the EVM bytecode;
A code conversion unit for converting the opcode into an intermediate language;
The code conversion unit,
Allocating a stack pointer that can refer to a stack included in an opcode to the intermediate language,
EVM bytecode analysis tool. According to claim 6,
The code conversion unit,
Allocating a virtual register for storing a stack pointer in the intermediate language,
EVM bytecode analysis tool. According to claim 6,
The code conversion unit,
converting to store data in the stack and increment the stack pointer for a PUSH included in the opcode;
EVM bytecode analysis method. According to claim 6,
The code conversion unit,
converting to fetch data from the stack and decrement the stack pointer for the POP included in the opcode;
EVM bytecode analysis method.

Images