一种精简二进制代码的程序理解方法  

A program understanding approach for stripped binary code

作　　者：李卷孺[1] 谷大武[1] 陆海宁[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240

出　　处：《计算机应用》2008年第10期2608-2612,共5页journal of Computer Applications

基　　金：国家863计划项目(2006AA01Z405);教育部新世纪优秀人才计划项目(NCET-05-0398)

摘　　要：精简二进制代码形式的软件是软件分析和程序理解需要处理的一类具有代表性的对象,基于高级语言源代码和调试符号信息的传统分析方法在处理此类软件时受到了极大限制。提出一种精简二进制形式软件的理解方法,首先将分析对象转变为运行期进程,引入实际运行中的进程信息;然后引入程序的行为特征,以程序表现出的外在行为和对外接口作为辅助信息,将此类外部特征映射到程序代码;最后基于切片思想和调试技术,获得程序切片并分析。这种方法为分析理解过程扩展了信息量,降低了复杂度,解决了分析此类软件时信息缺失和难以建立理解模型的问题。The stripped binary form software is a typical object that software analysis and program understanding activity often deal with. Traditional analysis and comprehension models based on source code or debug symbol information are often useless when handling this kind of software for lack of information. A comprehension approach for stripped binary code was proposed. The analysis object was transformed to runtime process and the process information was imported. Then the program＇s action feature was imported using the external behavior and interface as the supplementary information, the feature was mapped to binary code. Finally, program slicing and debugging techniques were used to analyze program. The approach has access to more information for software analysis and program understanding and reduces the complexity, thus solves the information shortage and model building problem when analyzing stripped binary code.

关 键 词：精简二进制代码 程序理解 二进制分析 代码反向工程 程序切片 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]