某雷达DSP程序高级控制流的恢复

【作者】 李涛；

【导师】 史维峰；

【作者基本信息】 西北大学 ， 计算机技术（专业学位）， 2012， 硕士

【摘要】 在软件逆向分析中,对控制流的分析是一个很重要的步骤。后续分析很大程度上也依赖于前期对控制流的清楚掌握。控制流的恢复可以理清程序的跳转关系,进而可以清晰地总结出程序的整个流程和其中包含的各种控制结构。本文是对某雷达DSP程序高级控制流恢复的研究,分析如何从一个汇编指令序列构建控制流图,并在此基础上提取隐藏的高级控制结构,如顺序结构、分支结构和循环结构,最终恢复程序的控制流程。论文将整个过程分为前端处理、中间处理、后端处理三个阶段。前端处理负责汇编代码关键信息的提取。中间处理首先对汇编代码划分基本块,论文提出的方法是通过识别跳转关键字的方式来进行划分。然后将这些基本块看做控制流图的节点集,根据基本块的特点,将程序的跳转关系作为连接基本块的边,这样就建立起一张反映程序跳转关系的控制流图。论文通过对控制流图进行遍历,求出每个节点的必经节点集。在此基础上,论文给出了识别分支结构、循环结构的关键要素,针对分支结构的特点,在遍历过程中对分支结构做相应的标记。对于循环结构,采用查找回边和括号定理来识别的方法。后端处理主要负责控制流恢复的结果输出。实验证明,通过本文提出的这种方法,可以自动构建该型号DSP程序的控制流图,并识别其中潜在的分支结构和循环结构,大大提高了软件逆向分析的效率更多还原

【Abstract】 Control flow analysis is an essential step for Software Reverse Engineering. The later analysis is also based on it. It can sort out the relationship of the program’s jump, which can clearly reflect the program’s general process and control structure.This article is a study of a radar DSP program’s control flow recovery, in which describes how to extract high-level control structures from a linear sequence of instructions, such as sequential structure、loop structure、branch structure and finally recovery the program’s control flow. The whole process is divided into front-end processing、intermediate processing,、and back-end processing. The key information is extracted from the assembly code in front-end stage. In intermediate stage, by identify jump keywords, assembly code is divided into basic blocks. These basic blocks are seen as a set of control flow graph’s nodes. According to the characteristics of basic blocks, the program jump relationship is added to the control flow graph as edges. Thus a control flow graph which reflects the program jump relations is established. Each node’s must pass through set can be obtained by traverse the control flow graph. Based on it, key elements to identify the branched structure and loop structure are given in this paper. During traversal, the branch structure is marked, according to the characteristics of the branch structure. Back edge and parentheses theorem is used to identify loop structure. The results of control flow recovery are processed in back-end stage.In this way, control flow graph of this DSP program and potential branch structure、loop structure are reconstructed. The test results show that this method is greatly improved the efficiency of software reverse analysis.更多还原