Research On Slicing-Based Binary Executables Analysis Technology

With the advent of the information age, the demand for computer software are rapidly growing in our society. Various types and complex software growing everyday.But most of these software are written in high-level program language, due to the need of technological security, many software companies only provide executive program, which are the usual sense of binary code, without the provision of high-level language source code. Thus the analysis and understanding of the software had to stay in the machine language level. However, the binary program is less readable, hard to analysis and easy to make mistakes, So it need a lot of manpower and time, which is inefficient. The whole process most depend on the persion's intellectual work.Therefore, how to simplify the program comprehension and software analysis is an important subject in software engineering. In this paper, program slicing is introduced to binary program analysis and program comprehension, which can resolve the proglam present in program comprehension, program complexity measurement and program transformation. Program slicing have better reflect its role in large-scale program, because the operation can be achieved by slicing the purpose of decomposition process, thereby reducing the complexity of procedures to facilitate program understanding and further analysis. The main work of this paper is as follows.First, This article describes the structure of binary program. Including the essential parts of PE file. Its layout of disk and mapping to memory. And the operating system is how to load the binary program into the memory. In addition, describes the algorithm of binary program..Second, in this paper, using graph theory to aid the analysis of binary program. Through the use of disassemble engine, indentification the code which were user-defined functions. And then, constructor the control flow graph and data flow graph. With control flow graph, identification procedures in the if-else, while, do-while and other high-level language structure. And then used expression algorithm in data flow analisis. In the process of generating pseudo-high-level language, Which can elimination of redundant instruction register, redundant conditional branch codes to complete the procedure call parameters, return values and their type of recovery.Then, with the help of the technology of static slice, we can simplify the procedure specified for the procedure referred to a collection of statements and determined style, and capture the behavior as part of a subset of the original program. Through the control flow and data flow analysis, we can obtain the dependencies between statements, with can improve the analysis of binary program. Such as an indirect jump and indirect calls, ect, with is hard to identify in the process of control flow analysis.Finally, in the experiment, selected bubble sort of data struct and dialog base program of win32 to verificate the effectiveness of the system of slicing analysis program and the visual flow graph.