High throughput disassembly system for executable code and applications
View Patent ↗The present invention performs high-throughput disassembly for executable code comprising a plurality of instructions. An input of the executable code is received. Exhaustive disassembly is performed on the executable code to produce a set of exhaustively disassembled instructions. An instruction flow graph is constructed from the exhaustively disassembled instructions. Instruction embedding is performed on the exhaustively disassembled instructions to construct embeddings.
1. A system for high-throughput disassembly for executable code comprising a plurality of instructions, comprising:
circuitry configured to
receive an input of the executable code;
perform exhaustive disassembly on the executable code to generate all possible disassembly results to produce a set of exhaustively disassembled instructions;
construct an instruction flow graph from the exhaustively disassembled instructions;
perform instruction embedding on the exhaustively disassembled instructions to construct embeddings; and
identify which of the exhaustively disassembled instructions are true instructions in accordance with the instruction flow graph and the instruction embedding, wherein the true instructions are instructions generated by a compiler.
2. The system of claim 1 , wherein the circuitry is further configured to apply the instruction flow graph to capture different relations among the plurality of instructions in the executable code.
3. The system of claim 1 , wherein the circuitry is further configured to implement translation of instruction metadata including REX prefix, opcode, ModR/M and SIB, into internal representations to predict a probability of the plurality of instructions in the executable code being the true instructions or not.
4. The system of claim 3 , wherein the circuitry is further configured to apply a GRU network to learn an internal representation of the plurality of instructions in the executable code.
5. The system of claim 1 , wherein the circuitry is further configured to apply graph inference on the instruction flow graph to propagate information of each of the plurality of instructions in the executable code to neighboring ones of the plurality of instructions in the executable code.
6. The system of claim 5 , wherein the circuitry is further configured to apply Relational-GCN to exploit structural information in the instruction flow graph.
7. The system of claim 1 , wherein the circuitry is further configured to implement an acceleration of code similarity detection solution using a code similarity detection tool.
8. A method for high-throughput disassembly for executable code comprising a plurality of instructions, comprising:
receiving an input of the executable code;
performing exhaustive disassembly on the executable code to generate all possible disassembly results to produce a set of exhaustively disassembled instructions;
constructing an instruction flow graph from the exhaustively disassembled instructions;
performing instruction embedding on the exhaustively disassembled instructions to construct embeddings; and
identifying which of the exhaustively disassembled instructions are true instructions in accordance with the instruction flow graph and the instruction embedding, wherein the true instructions are instructions generated by a compiler.
9. The method of claim 8 , further comprising applying the instruction flow graph to capture different relations among the plurality of instructions in the executable code.
10. The method of claim 8 , further comprising implementing translation of instruction metadata including REX prefix, opcode, ModR/M and SIB, into internal representations to predict a probability of the plurality of instructions in the executable code being the true instructions or not.
11. The method of claim 10 , further comprising applying a GRU network to learn an internal representation of the plurality of instructions in the executable code.
12. The method of claim 8 , further comprising applying graph inference on the instruction flow graph to propagate information of each of the plurality of instructions in the executable code to neighboring ones of the plurality of instructions in the executable code.
13. The method of claim 12 , further comprising applying Relational-GCN to exploit structural information in the instruction flow graph.
14. The method of claim 8 , further comprising implementing an acceleration of code similarity detection solution using a code similarity detection tool.
15. A non-transitory, computer readable medium storing instructions that, when executed on a computer, control the computer to perform a method for high-throughput disassembly for executable code comprising a plurality of instructions, the method comprising:
receiving an input of the executable code;
performing exhaustive disassembly on the executable code to generate all possible disassembly results to produce a set of exhaustively disassembled instructions;
constructing an instruction flow graph from the exhaustively disassembled instructions;
performing instruction embedding on the exhaustively disassembled instructions to construct embeddings; and
identifying which of the exhaustively disassembled instructions are true instructions in accordance with the instruction flow graph and the instruction embedding, wherein the true instructions are instructions generated by a compiler.
16. The non-transitory, computer-readable medium of claim 15 , wherein the method further comprises applying the instruction flow graph to capture different relations among the plurality of instructions in the executable code.
17. The non-transitory, computer-readable medium of claim 15 , wherein the method further comprises implementing translation of instruction metadata including REX prefix, opcode, ModR/M and SIB, into internal representations to predict a probability of the plurality of instructions in the executable code being the true instructions or not.
18. The non-transitory, computer-readable medium of claim 15 , wherein the method further comprises applying graph inference on the instruction flow graph to propagate information of each of the plurality of instructions in the executable code to neighboring ones of the plurality of instructions in the executable code.
19. The non-transitory, computer-readable medium of claim 18 , wherein the method further comprises applying Relational-GCN to exploit structural information in the instruction flow graph.
20. The non-transitory, computer-readable medium of claim 15 , wherein the method further comprises implementing an acceleration of code similarity detection solution using a code similarity detection tool.