CN114816435A - A software development method based on reverse technology - Google Patents

Abstract

The present invention provides a software development method based on reverse technology, comprising: S1. Decompiling target software to obtain source code; S2. Performing function analysis on the target software to determine the corresponding relationship between each code block and function in the source code; S3. Deconstructing and analyzing the target software to obtain software information of the target software, including system deployment environment, architecture, scheduling mode, interface specification, communication protocol, reference method, and data storage method; S4. Reconstructing the system based on the described software information , and populate the refactoring system with code blocks that correspond to functions. This solution reverses the software part in a targeted manner according to the actual function of the software, and the remaining part can be expanded as needed, which can reduce the workload of reverse development, and at the same time can maximize the operability of software reverse engineering.

Description

A software development method based on reverse technology

technical field

The invention belongs to the technical field of software development, in particular to a software development method based on reverse technology.

Background technique

Reverse engineering, also known as software reverse engineering, refers to starting from a runnable program system and using various computer technologies such as disassembly, system analysis, and program understanding to reverse disassemble and disassemble the structure, process, algorithm, code, etc. of the software. Analyze and deduce the source code, design principle, structure, algorithm, processing process, operation method and related documents of the software product. It can be simply understood as constructing a new system outline by identifying and analyzing the source code of computer software. It conducts basic analysis on the original system of computer software, then identifies the components of the system software, and constructs a new and advanced software system by clarifying the relationship of each component of the software. Usually, the whole process of reverse analysis of software is collectively called software reverse engineering, and the techniques used in this process are collectively called software reverse engineering technology.

Through software reverse technology, we can explore the loopholes of current software protection, review the protection of existing software achievements in a targeted manner, or realize software debugging and function repair in the case of no source code in the production environment. Function expansion, develop new software based on existing software. The existing software reverse engineering is to reverse all the existing software, but the reverse engineering of all the details is a huge time-consuming project with low efficiency and low operability.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a software development method based on reverse technology in view of the above problems.

To achieve the above object, the present invention has adopted the following technical solutions:

A software development method based on reverse technology, comprising the following steps:

S1. Decompile the target software to obtain the source code;

S2. Perform functional analysis on the target software, and determine the corresponding relationship between each code block and function in the source code;

S3. Deconstructing and analyzing the target software to obtain software information of the target software including system deployment environment, architecture, scheduling mode, interface specification, communication protocol, reference method, and data storage method;

S4. Reconstructing the system based on the software information, and filling the code blocks with corresponding functions into the refactoring system.

In the above software development method based on reverse technology, step S1 specifically includes:

S11. Read the target code of the target software to the memory;

S12. Analyze the target code to separate out the instruction code and data;

S13. Disassemble the object code through a disassembly tool to obtain an assembly file;

S14. Decompile the assembly file through a decompilation tool to obtain the source code.

In the above software development method based on reverse technology, step S11 is specifically:

A1. Read several bytes from the target binary format file and store them in the Content object;

A2. Store the Content object in the Vector container;

A3. Repeat steps A1 and A2 until the end of the file.

In the above software development method based on reverse technology, step S12 is specifically:

B1. Track the instruction control flow, traverse and identify each instruction;

B2. Identify the part of the code that can be reached by the instruction stream as instruction code, and identify the rest as data.

In the above-mentioned software development method based on reverse technology, step S13 is specifically:

C1. Take out the objects in sequence from the Vector container, and judge whether the object is the instruction code or the data according to the separation result of the instruction code and the data;

C2. If the object is an instruction code, disassemble the instruction code into an assembly instruction form through a disassembly tool; if it is data, translate the data into the value of the data directly or through a disassembly tool.

In the above software development method based on reverse technology, between steps S13 and S14 further includes:

D1. Normalize the assembly instruction code into intermediate code;

D2. Extract library functions, and identify system library functions and user-defined functions;

D3. Restore key information of user-defined functions including name, number of parameters, return value and type;

In step S14, the decompilation tool decompiles the system library function and the user-defined function respectively.

In the above software development method based on reverse technology, in step S2, the function of the target software is determined according to the operation manual, the help document, and by dynamically running the target software.

In the above software development method based on reverse technology, in step S2, the key code is searched and extracted by dynamically debugging the source code, and the corresponding relationship between the key code and the function is marked according to the determined function.

In the above software development method based on reverse technology, in step S3, the target software is deconstructed and analyzed by static analysis and/or dynamic analysis.

In the above software development method based on reverse technology, the source code/code block is converted into the target development language before step S4;

In step S4, the reconstruction system is an open system with an open interface for users to develop, improve and check.

The advantages of the present invention are:

1. According to the actual function of the software, the software part is reversed in a targeted manner, and the remaining part can be expanded as needed, which can reduce the workload of reverse development and maximize the operability of software reverse engineering;

2. First separate the instruction code and data in the target code. When disassembling using the disassembly tool, the instruction code and data can be directly processed in a targeted manner, so as to avoid the interference of the data with the instruction code disassembly work, and improve the disassembly. efficiency;

3. Use the Vector container to store the Content object, which is convenient for content extraction and marking and for subsequent tracking of instruction control flow;

4. Tracking the instruction control flow by tracking the PC value can ensure that each instruction is traversed, thereby ensuring the complete separation of instruction code and data separation, and ensuring the separation effect;

5. Identify user-defined functions before processing assembly files, separate user-defined functions and system library functions, and restore key information of user-defined functions, which is convenient for subsequent source code level code restoration.

Description of drawings

Fig. 1 is the method flow chart of the software development method based on reverse technology of the present invention;

Fig. 2 is the method flow chart of obtaining source code in the software development method based on reverse technology of the present invention;

Fig. 3 is the method flow chart of reading target code to memory in the software development method based on reverse technology of the present invention;

Fig. 4 is the method flow chart of tracking instruction control flow in the software development method based on reverse technology of the present invention;

Fig. 5 is the working flow chart of disassembly process in the software development method based on reverse technology of the present invention;

Fig. 6 is the concrete processing flow chart of data and instruction code in the disassembly process in the software development method based on reverse technology of the present invention;

FIG. 7 is a schematic diagram of the location layout of functions in the memory.

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

As shown in FIG. 1, the present embodiment discloses a software development method based on reverse technology, which includes the following steps:

S1. Decompile the target software to obtain the source code;

S2. Perform functional analysis on the target software, and determine the corresponding relationship between each code block and function in the source code;

S3. Deconstructing and analyzing the target software to obtain software information of the target software including system deployment environment, architecture, scheduling mode, interface specification, communication protocol, reference method, and data storage method;

S4. Reconstructing the system based on the software information, and filling the code blocks with corresponding functions into the refactoring system.

Specifically, in step S2, the function of the target software is determined according to the operation manual, the help document and by dynamically running the target software, and the functions related to all functions or main functions or functions selected by the user are searched and extracted by dynamically debugging the source code. Corresponding key codes, and mark the correspondence between key codes and functions according to the determined functions.

Through step S2, the function is located in the code block, and then the corresponding relationship between the code block and the function is marked, the user can select the key function according to the needs, and the system extracts the code block corresponding to the key function selected by the user to realize the matching The key codes in the target software are refined and the details are hidden, thereby simplifying the software system and improving the operability of the software.

Further, in step S3, the target software is deconstructed and analyzed by static analysis and/or dynamic analysis. Specifically, tools such as c32asm can be used as tools for static analysis, and tools such as Ollydbg can be used as tools for dynamic analysis. The target software can be deconstructed and analyzed in the process of decompiling the target software.

Further, the source code obtained by decompiling the target software may be in languages such as C#, JAVA, etc. Some languages are easy to develop, and some languages are not easy to develop. Some engineers are accustomed to using one language, and some engineers are accustomed to using another language, so In this solution, after obtaining the source code according to the target code, the source code/code block is further converted into the target development language according to user requirements. And the reconstructed system in step S4 is an open system with an open interface for the user to develop, improve, check, etc., such as interface development, extension logic, and on-demand extension functions.

The specific method of converting source code/code block into target development language is as follows:

S1. Divide the source code/code block into a plain text replacement part and a function replacement part according to the characteristics of the string;

S2. Replace the strings in the plain text replacement part with strings corresponding to the target development language according to the data base; replace the strings in the function replacement part with strings with corresponding meanings in the target development language according to the data base and its meaning.

The data base here is a set of correspondence relationships between two language mechanisms constructed in advance for a specific code block language and a target conversion code language.

Specifically, as shown in Figure 2, step S1 specifically includes:

S11. Read the target code of the target software to the memory;

S12. Analyze the target code to separate out the instruction code and data;

S13. Disassemble the object code through a disassembly tool to obtain an assembly file;

S14. Decompile the assembly file through a decompilation tool to obtain the source code.

As shown in Figure 3, first define a Vector container of a Content object, and step S11 is specifically:

A1. First define a Content object, read several bytes from the target binary format file and store them in the Content object; the number of bytes read each time is determined by those skilled in the art according to the specific situation, such as the reverse for 32-bit instructions. Assembly, can read 4 bytes at a time;

A2. Store the Content object in the Vector container;

A3. Repeat steps A1 and A2 until the end of the file.

Step S12 is specifically:

B1. Track the instruction control flow, traverse and identify each instruction;

B2. Identify the part of the code that can be reached by the instruction stream as instruction code, and identify the rest as data.

Specifically, as shown in FIG. 4 , in step B1, the instruction control flow is tracked in the following manner:

B11. Set the PC value to 0;

B12. For example, when decompiling the instructions of a 32-bit operating system, since each instruction is stored as 4 bytes in a 32-bit operating system, at this time, the specific Content object refers to the subscript PC/4 The Content object indicates that the PC address is divided by 4 and then rounded up, which represents the ending address of each 4-byte instruction, that is, the starting address of the instruction;

B13. Identify the extracted Content object as an instruction, and mark the instruction as having been accessed;

B14. Determine whether the instruction identified in step B13 is the program end instruction, if so, execute step B15, otherwise execute step B16;

B15. Continue to judge whether the display table is empty, if so, end the tracking, otherwise, take an Elem element from the display table. If the display table is not empty, it means that there are Elem instructions on the stack in the call chain, and these instructions are still mapped to the Vector container Therefore, this solution repeats the process during the separation process until the display table has no Elem element to achieve a complete separation effect;

And judge whether the instruction at the addr address in the Elem element has been accessed, if not, restore the current field information including the PC value and return to step B12, that is, push the data at the addr address to the top of the stack, if so, then the next Elem Whether the instruction at the addr address in the element has been accessed is judged until the tracking is ended after traversing all Elem elements

B16. Further determine whether the instruction identified in B13 is a transfer instruction, and if so, update the PC value, display table, and return table according to the specific transfer instruction; otherwise, increment the PC automatically, and return to step B12. This step is a loop traversal process, and is used to push the identified instructions conforming to the instruction transfer representation into the return table and the display table. The return table is used to record the return address when the program is called; the display table, when a double branch instruction is encountered, the display address and the field (the value of each register of the program) are filled in the table.

Specifically, in step B16, the specific steps of updating the PC value, displaying the table, and returning the table are as follows:

If it is an unconditional transfer instruction (B instruction, etc., MOV PC, 0x16), fill in the segment table with the address of this instruction, fill in the segment table with its explicit address, and use the explicit address as the current PC address;

If it is an unconditional transfer instruction subroutine call instruction (BL instruction), fill in the segment table with the address of the instruction, fill in the return address table with the return address, fill in the segment table with the explicit address, and use the explicit address as the current PC address;

If it is the return instruction (MOV PC, LR) in the unconditional transfer instruction, the return address is found in the return address table according to the "last in first out" principle, the address of this instruction is filled in the segment table, and the return address is filled in the segment table, and Use the return address as the current PC address;

If it is a binary point instruction (BEQ, MOVEQ PC, 0x16, etc.), fill the explicit address into the explicit address table (and save the current register value), and then use the implicit address as the current PC address.

The segment table refers to filling in the branch address of all branch instructions except conditional branch into this table, including the address of this instruction and the redirection address. The code segment of several segments can be obtained through the segment table, which makes the code clearer and facilitates subsequent disassembly and other work.

Further, as shown in Figure 5 and Figure 6, step S13 is specifically:

C1. Take out the objects in sequence from the Vector container, and judge whether the object is the instruction code or the data according to the separation result of the instruction code and the data;

C2. If the object is an instruction code, disassemble the instruction code into an assembly instruction form; if it is data, translate the data into the value of the data. The code is separated first, so that the disassembler can disassemble the instruction code in a targeted manner, and directly translate the data, so as to improve the disassembly efficiency.

Further, between steps S13 and S14 also includes:

D1. Normalize assembly instruction code into intermediate code

(Low2levelIntermediateLanguage, LIL), and build various symbol tables during the conversion process, leaving it for later work;

D2. Extract library functions through dynamic debugging intermediate code and identify system library functions and user-defined functions;

D3. Restore the key information of the user-defined function including the name, the number of parameters, the return value and the type.

The intermediate code is an internal representation of the source program. It does not depend on the structure of the target machine. Normalizing the assembly instructions into the intermediate code and continuing the subsequent work is helpful for the development and porting (robustness) of the compiler program, and at the same time. Help users to optimize the code more conveniently. Dynamic debugging refers to making the program run, and dynamic debugging tools such as Ollydbg can be used.

The disassembly tool and the decompilation tool can use the same disassembly tool that can realize disassembly and decompilation at the same time, or can use a separate tool. When the same disassembly tool is used, the function recognition program in the above steps D1-D3 can be used. Embedded in the disassembly tool, it can also be paralleled with the disassembly tool. After the disassembly tool assembles the object code to obtain the assembly file, it outputs the assembly file to the function recognition program for function recognition, and the function recognition program returns the recognition result to the reverser. Assembly tool, and then the disassembly tool continues to perform control flow analysis and data type analysis on system library functions and user-defined functions respectively to complete the compilation work and obtain the disassembly result at the source code level. Here, the user-defined functions and system library functions are separately opened, and the information of the user-defined functions is recovered, and then the disassembly tool is used to perform disassembly work such as control flow analysis and data type analysis, which can avoid the disassembly of user-defined data. It can improve the efficiency of disassembly and reduce the error rate of disassembly.

Specifically, in step D2, the user-defined function is identified in the following manner:

E1. Prepare several calling programs that have only one library function calling statement and only differ in the parameters of the calling function;

E2. Execute several calling programs prepared in step E1, and determine a function whose valid operation instruction is fixed as a user-defined function. The effective operation instruction here refers to the opcode of the user-defined library function instruction. The opcode of the user-defined library function instruction is fixed, and the problem of address relocation will not occur during the compilation and linking process, and will not be affected by different version compiler and the impact of compilation optimizations. Therefore, in different calling programs, the effective operation instructions of the same library function are unchanged, so the user-defined library functions can be separated from the system library functions through the above steps.

Further, the addresses of the user-defined functions determined in step D2 are checked, the function with the highest address is selected, and the function and all functions with lower addresses are determined as user-defined functions. As shown in Figure 7, the code of user-defined library functions is stored continuously, and the storage order is consistent with their definition order in the source program, and the user-defined library function code is located at a low address, and the system library function code is located at a high address address, so through this method, the user-defined library functions can be effectively separated from the system library functions.

The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which the present invention pertains can make various modifications or additions to the described specific embodiments or substitute in similar manners, but will not deviate from the spirit of the present invention or go beyond the definitions of the appended claims range.

Although the terms such as target software, code block, and target code are used frequently in this article, the possibility of using other terms is not excluded. These terms are used only to more conveniently describe and explain the essence of the present invention; it is contrary to the spirit of the present invention to interpret them as any kind of additional limitation.

Claims (10)

1. A software development method based on reverse technology is characterized by comprising the following steps:

s1, decompiling target software to obtain a source code;

s2, performing function analysis on the target software, and determining the corresponding relation between each code block in the source code and the function;

s3, deconstruction analysis is carried out on the target software to obtain software information of the target software including a system deployment environment, a system architecture, a scheduling mode, an interface specification, a communication protocol, a reference mode and a data storage mode;

and S4, based on the software information reconstruction system, filling code blocks with corresponding relations with functions into the reconstruction system.

2. The software development method based on the reverse technology as claimed in claim 1, wherein step S1 specifically includes:

s11, reading a target code of the target software to a memory;

s12, analyzing the target code to separate an instruction code and data;

s13, disassembling the target code through a disassembling tool to obtain an assembly file;

s14, decompiling the assembly file through a decompiling tool to obtain a source code.

3. The software development method based on the reverse technology according to claim 2, wherein step S11 specifically includes:

A1. reading a plurality of bytes from the target binary format file and storing the bytes in the Content object;

A2. storing the Content object into a Vector container;

A3. steps A1 and A2 are repeated until the end of the file.

4. The software development method based on the reverse technology according to claim 3, wherein step S12 is specifically:

B1. tracing instruction control flow, traversing and identifying each instruction;

B2. the code portions reachable by the instruction stream are identified as instruction codes, and the remaining portions are identified as data.

5. The software development method based on the reverse technology as claimed in claim 4, wherein step S13 is specifically:

C1. sequentially taking out the objects from the Vector container, and judging whether the objects are instruction codes or data according to the separation result of the instruction codes and the data;

C2. if the object is an instruction code, disassembling the instruction code into an assembly instruction form through a disassembling tool; if so, the data is translated into values of the data, either directly or through a disassembly tool.

6. The reverse technology-based software development method according to claim 5, further comprising, between steps S13 and S14:

D1. normalizing the assembly instruction code into an intermediate code;

D2. extracting a library function, and identifying a system library function and a user-defined function;

D3. recovering key information of the user-defined function, including name, parameter number, return value and type;

in step S14, the decompilation tool decompilates the system library function and the user-defined function, respectively.

7. A method for software development based on reverse technology according to any of claims 1-6, characterized in that in step S2, the function of the target software is determined according to the operation manual, help document and by means of dynamic operation of the target software.

8. A method for developing software based on reverse technology according to claim 7, wherein in step S2, the key code is searched and extracted by dynamically debugging the source code, and the corresponding relationship between the key code and the function is marked according to the determined function.

9. A reverse-technology-based software development method according to claim 8, wherein in step S3, the target software is deconstructed and analyzed by static analysis and/or dynamic analysis.

10. The reverse technology-based software development method according to claim 9, wherein step S4 is preceded by converting the source code/code blocks into a target development language;

in step S4, the reconfiguration system is an open system with an open interface for user development, improvement and verification.

Images