Software analysis framework
View Patent ↗Presently described is a decompilation method of operation and system for parsing executable code, identifying and recursively modeling data flows, identifying and recursively modeling control flow, and iteratively refining these models to provide a complete model at the nanocode level. The nanocode decompiler may be used to determine if flaws, security vulnerabilities, or general quality issues exist in the code. The nanocode decompiler outputs in a standardized, human-readable intermediate representation (IR) designed for automated or scripted analysis and reporting. Reports may take the form of a computer annotated and/or partially human annotated nanocode listing in the above-described IR. Annotations may include plain English statements regarding flaws and pointers to badly constructed data structures, unchecked buffers, malicious embedded code or “trap doors,” and the like. Annotations may be generated through a scripted analysis process or by means of an expert-enhanced, quasi-autonomous system.
1. A method of analyzing executable software code by decompiling said executable code, comprising:
parsing said executable code to identify one or more data flows;
recursively, for at least one of the identified data flows:
discovering a fitting data flow model;
optimizing said fitting data flow model to form a refined data flow model;
propagating said refined data flow model until substantially all data variables are modeled; and
expressing said refined data flow model in an intermediate representation;
parsing said executable code to identify one or more control flows;
recursively, for at least one of the identified control flows:
discovering a fitting control flow model comprising one or more control branches;
optimizing said fitting control flow model to form a refined control flow model;
propagating said refined control flow model until substantially all said control branches are modeled; and
expressing said refined control flow model in an intermediate representation,
wherein said refined data flow model and said refined control flow model express a complete nanocode model of said executable software code in said intermediate representation; and
performing vulnerability analysis of the complete nanocode model to identify at least one of a flaw and a vulnerability in said executable code.
2. The method of claim 1 , wherein performing the vulnerability analysis of the complete nanocode model comprises:
translating said intermediate representation of the complete nanocode model into a high-level language representation; and
scanning, using a vulnerability scanner, the high level language representation.
3. The method of claim 1 , wherein:
the identified flaw comprises at least one of a software flaw, a programming practice that is designated unacceptable, and a pointer to a data structure designated unacceptable; and
the identified vulnerability comprises at least one of: a software vulnerability exploitable via an attack, a programming practice that is designated unacceptable, a pointer to a data structure designated unacceptable, an unchecked buffer, and an embedded malicious code.
4. The method of claim 1 , further comprising:
determining that none of the identified flaws or vulnerabilities is unacceptable; and
certifying the software as trusted or safe.
5. The method of claim 1 , wherein performing the vulnerability analysis of the complete nanocode model comprises at least one of:
using a pre-defined task script configured to identify at least one of: a set of known flaws and a set of known vulnerabilities; and
producing a report listing at least one of the identified flaw and the identified vulnerability.
6. The method of claim 5 , wherein said report comprises plain language statements and one or more optional nanocode model annotations.
7. The method of claim 1 , wherein said intermediate representation uses Dil Intermediate Language (DIL).
8. A system for analyzing executable software code by decompiling the executable code, the system comprising:
a first processor; and
a first memory in communication with the first processor, the first memory comprising instructions which, when executed by a processing unit comprising at least one of the first processor and a second processor, the processing unit being in communication with a memory module comprising at least one of the first memory and a second memory, program the processing unit to:
parse said executable code to identify one or more data flows;
recursively, for at least one identified data flow:
discover a fitting data flow model;
optimize said fitting data flow model to form a refined data flow model;
propagate said refined data flow model until substantially all data variables are modeled; and
express said refined data flow model in an intermediate representation;
parse said executable code to identify one or more control flows;
recursively, for at least one identified control flow:
discover a fitting control flow model comprising one or more control branches;
optimize said fitting control flow model to form a refined control flow model;
propagate said refined control flow model until substantially all said control branches are modeled; and
express said refined control flow model in an intermediate representation,
wherein said refined data flow model and said refined control flow model express a nanocode model of said executable software code in said intermediate representation; and
perform vulnerability analysis of the complete nanocode model to identify at least one of a flaw and a vulnerability in said executable code.
9. The system of claim 8 , wherein, to perform the vulnerability analysis of the complete nanocode model, the instructions program the processing unit to:
translate said intermediate representation into a high-level language representation; and
scan, using a vulnerability scanner, the high level language representation.
10. The system of claim 8 , wherein the instructions further program the processing unit to:
determine that none of the identified flaws or vulnerabilities is unacceptable; and
certify the software as trusted or safe.
11. The system of claim 8 , wherein:
the identified flaw comprises at least one of a software flaw, a programming practice that is designated unacceptable, and a pointer to a data structure designated unacceptable; and
the identified vulnerability comprises at least one of: a software vulnerability exploitable via an attack, a programming practice that is designated unacceptable, a pointer to a data structure designated unacceptable, an unchecked buffer, and an embedded malicious code.
12. The system of claim 8 , wherein, to perform the vulnerability analysis of the complete nanocode model, the instructions program the processing unit to:
apply a pre-defined task script configured to identify at least one of: a set of known flaws and a set of known vulnerabilities; and
produce a report listing at least one of the identified flaw and the identified vulnerability.
13. The system of claim 12 , wherein said report comprises plain language statements and one or more optional nanocode model annotations.
14. The system of claim 8 , wherein said intermediate representation uses Dil Intermediate Language (DIL).